SCHEMA.sql

--
-- PostgreSQL database dump
--

\restrict Ima6egLcgrnJ79TnxwblysVaIC9DjWdCHPDn0FnJXFFtcuWvCqfvYirq9Tx4HXW

-- Dumped from database version 16.14 (Debian 16.14-1.pgdg12+1)
-- Dumped by pg_dump version 16.15 (Ubuntu 16.15-0ubuntu0.24.04.1)

SET statement_timeout = 0;
SET lock_timeout = 0;
SET idle_in_transaction_session_timeout = 0;
SET client_encoding = 'UTF8';
SET standard_conforming_strings = on;
SELECT pg_catalog.set_config('search_path', '', false);
SET check_function_bodies = false;
SET xmloption = content;
SET client_min_messages = warning;
SET row_security = off;

--
-- Name: public; Type: SCHEMA; Schema: -; Owner: -
--

CREATE SCHEMA public;


--
-- Name: SCHEMA public; Type: COMMENT; Schema: -; Owner: -
--

COMMENT ON SCHEMA public IS 'standard public schema';


--
-- Name: events_notify(); Type: FUNCTION; Schema: public; Owner: -
--

CREATE FUNCTION public.events_notify() RETURNS trigger
    LANGUAGE plpgsql
    AS $$
BEGIN
    PERFORM pg_notify('overslash_events', NEW.id::text);
    RETURN NULL;
END;
$$;


SET default_tablespace = '';

SET default_table_access_method = heap;

--
-- Name: api_keys; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.api_keys (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    name text NOT NULL,
    key_hash text NOT NULL,
    key_prefix text NOT NULL,
    scopes text[] DEFAULT '{}'::text[] NOT NULL,
    expires_at timestamp with time zone,
    last_used_at timestamp with time zone,
    revoked_at timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    revoked_reason text
);


--
-- Name: approvals; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.approvals (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    action_summary text NOT NULL,
    action_detail jsonb,
    permission_keys text[] DEFAULT '{}'::text[] NOT NULL,
    status text DEFAULT 'pending'::text NOT NULL,
    resolved_at timestamp with time zone,
    resolved_by text,
    remember boolean DEFAULT false NOT NULL,
    token text NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    current_resolver_identity_id uuid NOT NULL,
    resolver_assigned_at timestamp with time zone DEFAULT now() NOT NULL,
    disclosed_fields jsonb,
    replay_payload jsonb,
    tags text[] DEFAULT '{}'::text[] NOT NULL,
    execution_mode text DEFAULT 'sync'::text NOT NULL,
    CONSTRAINT approvals_execution_mode_check CHECK ((execution_mode = ANY (ARRAY['sync'::text, 'async'::text, 'hybrid'::text]))),
    CONSTRAINT approvals_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'allowed'::text, 'denied'::text, 'expired'::text])))
);


--
-- Name: COLUMN approvals.tags; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.approvals.tags IS 'System-derived `namespace:value` metadata tags describing the gated call (sql:*, table:*, service:*, host:*, risk:*). Never caller-supplied.';


--
-- Name: audit_log; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.audit_log (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid,
    action text NOT NULL,
    resource_type text,
    resource_id uuid,
    detail jsonb DEFAULT '{}'::jsonb NOT NULL,
    ip_address text,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    description text,
    impersonated_by_identity_id uuid,
    tags text[] DEFAULT '{}'::text[] NOT NULL,
    actor_name text,
    owner_user_name text
);


--
-- Name: COLUMN audit_log.tags; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.audit_log.tags IS 'System-derived `namespace:value` metadata tags. Searchable via GET /v1/audit?tag=. Populated on action/approval events; other events carry an empty array.';


--
-- Name: COLUMN audit_log.actor_name; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.audit_log.actor_name IS 'Name of identity_id as of write time. Historical by design (D59) — the row records the name the actor had when they acted, not their current one.';


--
-- Name: COLUMN audit_log.owner_user_name; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.audit_log.owner_user_name IS 'Name of the owning user (identities.owner_id, a flattened pointer to the root user) as of write time, or the actor''s own name when the actor is a user. Historical by design (D59).';


--
-- Name: billing_email_log; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.billing_email_log (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    stripe_event_id text NOT NULL,
    kind text NOT NULL,
    user_id uuid NOT NULL,
    attempted_at timestamp with time zone DEFAULT now() NOT NULL,
    sent_at timestamp with time zone,
    CONSTRAINT billing_email_log_kind_check CHECK ((kind = ANY (ARRAY['invoice_paid'::text, 'invoice_payment_failed'::text, 'subscription_canceled'::text])))
);


--
-- Name: byoc_credentials; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.byoc_credentials (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    provider_key text NOT NULL,
    encrypted_client_id bytea NOT NULL,
    encrypted_client_secret bytea NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    metadata jsonb DEFAULT '{}'::jsonb NOT NULL
);


--
-- Name: COLUMN byoc_credentials.metadata; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.byoc_credentials.metadata IS 'Opaque caller-supplied key/value claim (provenance tag). Echoed verbatim; cleared/rewritten whenever the encrypted client pair is replaced.';


--
-- Name: call_results; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.call_results (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    service_key text,
    action_key text,
    body_ciphertext bytea NOT NULL,
    status_code integer NOT NULL,
    content_type text,
    body_bytes bigint NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL
);


--
-- Name: TABLE call_results; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON TABLE public.call_results IS 'Full ActionResult of a call whose compact rendering was truncated, stored so the same bytes can be delivered again without re-running upstream. Written by POST /v1/actions/call when verbose=false truncated; read via GET /v1/downloads/{token}.';


--
-- Name: COLUMN call_results.body_ciphertext; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.call_results.body_ciphertext IS 'AES-256-GCM [version|nonce|ct+tag] over the serialized ActionResult. Response headers live inside the blob, which is why the whole thing is encrypted.';


--
-- Name: COLUMN call_results.body_bytes; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.call_results.body_bytes IS 'Plaintext size, for the download Descriptor. Bounded by call_result_max_bytes.';


--
-- Name: connections; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.connections (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    provider_key text NOT NULL,
    encrypted_access_token bytea NOT NULL,
    encrypted_refresh_token bytea,
    token_expires_at timestamp with time zone,
    scopes text[],
    account_email text,
    byoc_credential_id uuid,
    is_default boolean DEFAULT true NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    keep boolean DEFAULT false NOT NULL,
    reauth_required boolean DEFAULT false NOT NULL,
    account_picture text
);


--
-- Name: COLUMN connections.keep; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.connections.keep IS 'When true, this connection is never auto-deleted by service deletion, even when no service references it.';


--
-- Name: COLUMN connections.reauth_required; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.connections.reauth_required IS 'When true, the connection must be re-authorized before use (e.g. its pinned BYOC client was replaced). Cleared when fresh tokens are written.';


--
-- Name: directory_groups; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.directory_groups (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    idp_config_id uuid,
    source text DEFAULT 'oidc_claim'::text NOT NULL,
    external_id text NOT NULL,
    display_name text NOT NULL,
    first_seen_at timestamp with time zone DEFAULT now() NOT NULL,
    last_seen_at timestamp with time zone DEFAULT now() NOT NULL,
    google_directory_org_id uuid,
    CONSTRAINT directory_groups_google_directory_org_check CHECK (((source = 'google_directory'::text) = (google_directory_org_id IS NOT NULL))),
    CONSTRAINT directory_groups_source_check CHECK ((source = ANY (ARRAY['oidc_claim'::text, 'google_directory'::text])))
);


--
-- Name: download_tokens; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.download_tokens (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    token_hash bytea NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    service_instance_id uuid,
    service_key text,
    action_key text,
    request jsonb,
    credential_ref jsonb DEFAULT '{}'::jsonb NOT NULL,
    mime text,
    size_bytes bigint,
    filename text,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    last_used_at timestamp with time zone,
    use_count integer DEFAULT 0 NOT NULL,
    call_result_id uuid,
    CONSTRAINT download_tokens_one_byte_source CHECK ((num_nonnulls(request, call_result_id) = 1))
);


--
-- Name: TABLE download_tokens; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON TABLE public.download_tokens IS 'Capability tokens for deferred (out-of-band) byte delivery. Minted by POST /v1/actions/call with deliver:"url", redeemed by GET /v1/downloads/{token}.';


--
-- Name: COLUMN download_tokens.token_hash; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.download_tokens.token_hash IS 'sha256 of the raw token; the raw value exists only in the minted URL.';


--
-- Name: COLUMN download_tokens.request; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.download_tokens.request IS 'Replayable upstream request {method,url,headers,body}. Names secrets rather than carrying them; inline credential headers are rejected at mint time.';


--
-- Name: COLUMN download_tokens.credential_ref; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.download_tokens.credential_ref IS 'How to re-resolve the upstream credential at fetch time. Never the credential itself.';


--
-- Name: COLUMN download_tokens.call_result_id; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.download_tokens.call_result_id IS 'When set, redemption serves these stored bytes instead of replaying `request`. Mutually exclusive with `request` (download_tokens_one_byte_source).';


--
-- Name: group_directory_sources; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.group_directory_sources (
    group_id uuid NOT NULL,
    directory_group_id uuid NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: identity_directory_groups; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.identity_directory_groups (
    identity_id uuid NOT NULL,
    directory_group_id uuid NOT NULL,
    synced_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: identity_groups; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.identity_groups (
    identity_id uuid NOT NULL,
    group_id uuid NOT NULL,
    assigned_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: effective_identity_groups; Type: VIEW; Schema: public; Owner: -
--

CREATE VIEW public.effective_identity_groups AS
 SELECT ig.identity_id,
    ig.group_id
   FROM public.identity_groups ig
UNION
 SELECT idg.identity_id,
    gds.group_id
   FROM (public.identity_directory_groups idg
     JOIN public.group_directory_sources gds ON ((gds.directory_group_id = idg.directory_group_id)));


--
-- Name: email_unsubscribe_tokens; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.email_unsubscribe_tokens (
    token uuid DEFAULT gen_random_uuid() NOT NULL,
    user_id uuid NOT NULL,
    org_id uuid NOT NULL,
    purpose text DEFAULT 'welcome'::text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    redeemed_at timestamp with time zone,
    CONSTRAINT email_unsubscribe_tokens_purpose_check CHECK ((purpose = ANY (ARRAY['welcome'::text, 'webhook_digest'::text])))
);


--
-- Name: enabled_global_templates; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.enabled_global_templates (
    org_id uuid NOT NULL,
    template_key text NOT NULL,
    enabled_by uuid,
    created_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: events; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.events (
    id bigint NOT NULL,
    event_id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    type text NOT NULL,
    topic text NOT NULL,
    payload jsonb NOT NULL,
    audience uuid[] DEFAULT '{}'::uuid[] NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: TABLE events; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON TABLE public.events IS 'Durable event log for the SSE stream (GET /v1/events/stream). Also the fan-out substrate: inserts pg_notify the row id on the overslash_events channel and each replica fetches + forwards to its subscribers.';


--
-- Name: COLUMN events.id; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.events.id IS 'Resume cursor. Sent to clients as the SSE id: field and returned by them as Last-Event-ID.';


--
-- Name: COLUMN events.event_id; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.events.event_id IS 'Stable uuid for the wire envelope, mirroring the webhook envelope id.';


--
-- Name: COLUMN events.audience; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.events.audience IS 'Identity ids permitted to receive this event, frozen at emit time. Org admins bypass this check. Empty means admins-only.';


--
-- Name: events_id_seq; Type: SEQUENCE; Schema: public; Owner: -
--

CREATE SEQUENCE public.events_id_seq
    START WITH 1
    INCREMENT BY 1
    NO MINVALUE
    NO MAXVALUE
    CACHE 1;


--
-- Name: events_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: -
--

ALTER SEQUENCE public.events_id_seq OWNED BY public.events.id;


--
-- Name: executions; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.executions (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    approval_id uuid,
    org_id uuid NOT NULL,
    status text NOT NULL,
    remember boolean DEFAULT false NOT NULL,
    remember_keys text[],
    remember_rule_ttl timestamp with time zone,
    result jsonb,
    error text,
    triggered_by text,
    started_at timestamp with time zone,
    completed_at timestamp with time zone,
    expires_at timestamp with time zone NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    result_viewed_at timestamp with time zone,
    tags text[] DEFAULT '{}'::text[] NOT NULL,
    identity_id uuid NOT NULL,
    request jsonb,
    service_key text,
    service_instance_id uuid,
    lease_expires_at timestamp with time zone,
    worker_id text,
    attempts integer DEFAULT 0 NOT NULL,
    cancel_requested boolean DEFAULT false NOT NULL,
    render_verbose boolean,
    template_key text,
    description text,
    client_ip text,
    CONSTRAINT executions_attempts_nonneg CHECK ((attempts >= 0)),
    CONSTRAINT executions_has_origin CHECK (((approval_id IS NOT NULL) OR (request IS NOT NULL))),
    CONSTRAINT executions_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'executing'::text, 'executed'::text, 'failed'::text, 'cancelled'::text, 'expired'::text])))
);


--
-- Name: COLUMN executions.tags; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.executions.tags IS 'Copied verbatim from the originating approval at insert time — an execution can never disagree with what its approver saw.';


--
-- Name: COLUMN executions.request; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.executions.request IS 'Credential-free stored call payload, same shape as approvals.replay_payload. NOT NULL marks this row as worker-run (async).';


--
-- Name: COLUMN executions.lease_expires_at; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.executions.lease_expires_at IS 'While status=executing, the instant after which the claiming worker is presumed dead and the row may be reclaimed. Renewed by heartbeat.';


--
-- Name: COLUMN executions.attempts; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.executions.attempts IS 'Attempts that ended by losing their lease. Incremented only by the reclaim sweep, never by the claim.';


--
-- Name: COLUMN executions.cancel_requested; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.executions.cancel_requested IS 'Cooperative cancel. Stops Overslash waiting on the upstream; does not cancel the upstream operation itself.';


--
-- Name: google_directory_connect_flows; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.google_directory_connect_flows (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    pkce_verifier text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL
);


--
-- Name: group_grants; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.group_grants (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    group_id uuid NOT NULL,
    service_instance_id uuid NOT NULL,
    access_level text NOT NULL,
    auto_approve_reads boolean DEFAULT false NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    auto_approve_level text DEFAULT 'none'::text NOT NULL,
    CONSTRAINT group_grants_access_level_check CHECK ((access_level = ANY (ARRAY['read'::text, 'write'::text, 'admin'::text]))),
    CONSTRAINT group_grants_auto_approve_level_valid CHECK ((auto_approve_level = ANY (ARRAY['none'::text, 'read'::text, 'write'::text, 'admin'::text]))),
    CONSTRAINT group_grants_auto_approve_within_ceiling CHECK (((auto_approve_level = 'none'::text) OR (access_level = 'admin'::text) OR ((access_level = 'write'::text) AND (auto_approve_level = ANY (ARRAY['read'::text, 'write'::text]))) OR ((access_level = 'read'::text) AND (auto_approve_level = 'read'::text))))
);


--
-- Name: COLUMN group_grants.auto_approve_reads; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.group_grants.auto_approve_reads IS 'DEPRECATED — derived mirror of (auto_approve_level <> ''none''). Read auto_approve_level instead; this column is dropped once the API alias is removed.';


--
-- Name: COLUMN group_grants.auto_approve_level; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.group_grants.auto_approve_level IS 'How far up the read<write<admin ladder actions skip Layer 2 (no permission rule, no approval). ''none'' = always require approval. Bounded by access_level.';


--
-- Name: groups; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.groups (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    name text NOT NULL,
    description text DEFAULT ''::text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    is_system boolean DEFAULT false NOT NULL,
    system_kind text,
    owner_identity_id uuid,
    CONSTRAINT groups_owner_only_for_self CHECK (((system_kind = 'self'::text) = (owner_identity_id IS NOT NULL))),
    CONSTRAINT groups_system_kind_check CHECK ((system_kind = ANY (ARRAY['everyone'::text, 'admins'::text, 'self'::text])))
);


--
-- Name: identities; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.identities (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    name text NOT NULL,
    kind text NOT NULL,
    external_id text,
    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    email text,
    parent_id uuid,
    depth integer DEFAULT 0 NOT NULL,
    owner_id uuid,
    inherit_permissions boolean DEFAULT false NOT NULL,
    last_active_at timestamp with time zone DEFAULT now() NOT NULL,
    archived_at timestamp with time zone,
    archived_reason text,
    preferences jsonb DEFAULT '{}'::jsonb NOT NULL,
    is_org_admin boolean DEFAULT false NOT NULL,
    user_id uuid,
    auto_call_on_approve boolean DEFAULT true NOT NULL,
    CONSTRAINT identities_is_org_admin_only_user CHECK (((kind = 'user'::text) OR (is_org_admin = false))),
    CONSTRAINT identities_kind_check CHECK ((kind = ANY (ARRAY['user'::text, 'agent'::text, 'sub_agent'::text])))
);


--
-- Name: magic_link_tokens; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.magic_link_tokens (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    token_hash bytea NOT NULL,
    email text NOT NULL,
    next_path text,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    redeemed_at timestamp with time zone
);


--
-- Name: mcp_client_agent_bindings; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.mcp_client_agent_bindings (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    user_identity_id uuid NOT NULL,
    client_id text NOT NULL,
    agent_identity_id uuid NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    self_approve_enabled boolean DEFAULT false NOT NULL,
    elicitation_opted_out boolean DEFAULT false NOT NULL
);


--
-- Name: mcp_refresh_tokens; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.mcp_refresh_tokens (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    client_id text NOT NULL,
    identity_id uuid NOT NULL,
    org_id uuid NOT NULL,
    hash bytea NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    revoked_at timestamp with time zone,
    replaced_by_id uuid
);


--
-- Name: mcp_upstream_connections; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.mcp_upstream_connections (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    identity_id uuid NOT NULL,
    org_id uuid NOT NULL,
    upstream_resource text NOT NULL,
    upstream_client_id text NOT NULL,
    status text DEFAULT 'pending_auth'::text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    last_refreshed_at timestamp with time zone,
    CONSTRAINT mcp_upstream_connections_status_check CHECK ((status = ANY (ARRAY['pending_auth'::text, 'ready'::text, 'revoked'::text, 'error'::text])))
);


--
-- Name: mcp_upstream_flows; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.mcp_upstream_flows (
    id text NOT NULL,
    identity_id uuid NOT NULL,
    org_id uuid NOT NULL,
    upstream_resource text NOT NULL,
    upstream_client_id text NOT NULL,
    upstream_as_issuer text NOT NULL,
    upstream_token_endpoint text NOT NULL,
    upstream_authorize_url text NOT NULL,
    pkce_code_verifier text NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    consumed_at timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    created_ip text,
    created_user_agent text
);


--
-- Name: mcp_upstream_tokens; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.mcp_upstream_tokens (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    connection_id uuid NOT NULL,
    access_token_ciphertext bytea NOT NULL,
    refresh_token_ciphertext bytea,
    access_token_expires_at timestamp with time zone,
    scope text,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    superseded_at timestamp with time zone
);


--
-- Name: mcp_url_elicitations; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.mcp_url_elicitations (
    elicit_id text NOT NULL,
    agent_identity_id uuid NOT NULL,
    action text,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    answered_at timestamp with time zone,
    CONSTRAINT mcp_url_elicitations_action_check CHECK ((action = ANY (ARRAY['accept'::text, 'decline'::text, 'cancel'::text])))
);


--
-- Name: media_descriptors; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.media_descriptors (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    service_instance_id uuid,
    service_key text,
    media_path text NOT NULL,
    sha256 text,
    mime text,
    size_bytes bigint,
    filename text,
    source text NOT NULL,
    first_seen_at timestamp with time zone DEFAULT now() NOT NULL,
    last_seen_at timestamp with time zone DEFAULT now() NOT NULL,
    CONSTRAINT media_descriptors_source_check CHECK ((source = ANY (ARRAY['download'::text, 'upload'::text])))
);


--
-- Name: TABLE media_descriptors; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON TABLE public.media_descriptors IS 'What the gateway recorded about bytes it moved, so an approval that references them can describe them instead of showing a bare content hash. Best-effort: bytes that never passed through the gateway are simply absent.';


--
-- Name: oauth_connection_flows; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.oauth_connection_flows (
    id text NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    actor_identity_id uuid NOT NULL,
    provider_key text NOT NULL,
    byoc_credential_id uuid,
    scopes text[] DEFAULT '{}'::text[] NOT NULL,
    pkce_code_verifier text,
    upstream_authorize_url text NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    consumed_at timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    created_ip text,
    created_user_agent text,
    return_url text,
    upgrade_connection_id uuid,
    service_instance_id uuid,
    pin_service_instance_ids uuid[] DEFAULT '{}'::uuid[] NOT NULL,
    completed_at timestamp with time zone,
    failed_at timestamp with time zone,
    failure text,
    connection_id uuid
);


--
-- Name: COLUMN oauth_connection_flows.completed_at; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.oauth_connection_flows.completed_at IS 'Set by the OAuth callback when the flow produced a connection. Polled by URL-mode MCP elicitation.';


--
-- Name: COLUMN oauth_connection_flows.failed_at; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.oauth_connection_flows.failed_at IS 'Set by the OAuth callback when the flow ended in an error. Polled by URL-mode MCP elicitation.';


--
-- Name: COLUMN oauth_connection_flows.failure; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.oauth_connection_flows.failure IS 'Short reason the flow failed (provider OAuth error code, cancelled_by_user, or a coarse callback token). Set with failed_at.';


--
-- Name: COLUMN oauth_connection_flows.connection_id; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.oauth_connection_flows.connection_id IS 'The connection the OAuth callback created or upgraded. Set with completed_at.';


--
-- Name: oauth_handoff_codes; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.oauth_handoff_codes (
    code text NOT NULL,
    jwt text NOT NULL,
    origin text NOT NULL,
    next_path text,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    consumed_at timestamp with time zone
);


--
-- Name: oauth_mcp_clients; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.oauth_mcp_clients (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    client_id text NOT NULL,
    client_name text,
    redirect_uris text[] NOT NULL,
    software_id text,
    software_version text,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    last_seen_at timestamp with time zone,
    created_ip text,
    created_user_agent text,
    is_revoked boolean DEFAULT false NOT NULL,
    capabilities jsonb,
    client_info jsonb,
    protocol_version text,
    last_session_id uuid,
    org_id uuid
);


--
-- Name: COLUMN oauth_mcp_clients.org_id; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.oauth_mcp_clients.org_id IS 'Org this DCR client is locked to (stamped from the subdomain at registration). NULL = root/multi-org: usable on any subdomain, absent from any org''s admin MCP-Clients list.';


--
-- Name: oauth_preview_origins; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.oauth_preview_origins (
    preview_id uuid NOT NULL,
    origin text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    nonce text DEFAULT ''::text NOT NULL,
    pkce_verifier text,
    org_slug text,
    next_path text
);


--
-- Name: oauth_providers; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.oauth_providers (
    key text NOT NULL,
    display_name text NOT NULL,
    authorization_endpoint text NOT NULL,
    token_endpoint text NOT NULL,
    revocation_endpoint text,
    userinfo_endpoint text,
    client_id_pattern text,
    supports_pkce boolean DEFAULT false NOT NULL,
    supports_refresh boolean DEFAULT true NOT NULL,
    extra_auth_params jsonb DEFAULT '{}'::jsonb NOT NULL,
    is_builtin boolean DEFAULT true NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    token_auth_method text DEFAULT 'client_secret_post'::text NOT NULL,
    issuer_url text,
    jwks_uri text,
    default_identity_scopes text[] DEFAULT '{}'::text[] NOT NULL,
    login_hint_param text,
    refresh_endpoint text,
    email_identifies_account boolean DEFAULT false NOT NULL
);


--
-- Name: COLUMN oauth_providers.refresh_endpoint; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.oauth_providers.refresh_endpoint IS 'Where the refresh grant is posted, when the provider does not accept it at token_endpoint. NULL means refresh at token_endpoint.';


--
-- Name: org_google_directory_configs; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.org_google_directory_configs (
    org_id uuid NOT NULL,
    admin_subject text NOT NULL,
    customer_id text DEFAULT 'my_customer'::text NOT NULL,
    enabled boolean DEFAULT true NOT NULL,
    sync_interval_hours integer DEFAULT 8 NOT NULL,
    next_sync_at timestamp with time zone DEFAULT now() NOT NULL,
    sync_requested_at timestamp with time zone,
    lease_owner text,
    lease_expires_at timestamp with time zone,
    last_sync_started_at timestamp with time zone,
    last_sync_finished_at timestamp with time zone,
    last_sync_status text,
    last_sync_error text,
    last_sync_stats jsonb,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    domain text NOT NULL,
    connected_by_identity_id uuid,
    connected_at timestamp with time zone DEFAULT now() NOT NULL,
    CONSTRAINT org_google_directory_configs_last_sync_status_check CHECK ((last_sync_status = ANY (ARRAY['ok'::text, 'error'::text]))),
    CONSTRAINT org_google_directory_configs_sync_interval_hours_check CHECK (((sync_interval_hours >= 1) AND (sync_interval_hours <= 168)))
);


--
-- Name: org_idp_configs; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.org_idp_configs (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    provider_key text NOT NULL,
    encrypted_client_id bytea,
    encrypted_client_secret bytea,
    enabled boolean DEFAULT true NOT NULL,
    allowed_email_domains text[] DEFAULT '{}'::text[] NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    is_default boolean DEFAULT false NOT NULL,
    group_sync_enabled boolean DEFAULT false NOT NULL,
    group_claim text DEFAULT 'groups'::text NOT NULL,
    CONSTRAINT org_idp_configs_creds_both_or_neither CHECK ((((encrypted_client_id IS NULL) AND (encrypted_client_secret IS NULL)) OR ((encrypted_client_id IS NOT NULL) AND (encrypted_client_secret IS NOT NULL))))
);


--
-- Name: org_oauth_signin_overrides; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.org_oauth_signin_overrides (
    org_id uuid NOT NULL,
    provider_key text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: org_subscriptions; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.org_subscriptions (
    org_id uuid NOT NULL,
    stripe_subscription_id text NOT NULL,
    stripe_customer_id text NOT NULL,
    plan text DEFAULT 'team'::text NOT NULL,
    seats integer DEFAULT 2 NOT NULL,
    status text NOT NULL,
    currency text NOT NULL,
    current_period_start timestamp with time zone,
    current_period_end timestamp with time zone,
    cancel_at_period_end boolean DEFAULT false NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: orgs; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.orgs (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    name text NOT NULL,
    slug text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    subagent_idle_timeout_secs integer DEFAULT 14400 NOT NULL,
    subagent_archive_retention_days integer DEFAULT 30 NOT NULL,
    approval_auto_bubble_secs integer DEFAULT 300 NOT NULL,
    global_templates_enabled boolean DEFAULT true NOT NULL,
    allow_unsigned_secret_provide boolean DEFAULT true NOT NULL,
    is_personal boolean DEFAULT false NOT NULL,
    plan text DEFAULT 'standard'::text NOT NULL,
    default_deferred_execution boolean DEFAULT false NOT NULL,
    allow_overslash_managed_signin boolean DEFAULT false NOT NULL,
    creator_user_id uuid,
    audit_response_body_mode text DEFAULT 'off'::text NOT NULL,
    headless boolean DEFAULT false NOT NULL,
    require_invite_admission boolean DEFAULT true NOT NULL,
    managed_signin_allowed_domains text[] DEFAULT '{}'::text[] NOT NULL,
    trial_ends_at timestamp with time zone,
    allow_services_outside_catalog boolean DEFAULT false NOT NULL,
    user_template_policy text DEFAULT 'none'::text NOT NULL,
    call_timeout_ms integer,
    max_call_timeout_ms integer,
    default_agent_self_setup boolean DEFAULT true NOT NULL,
    default_remember_ttl_secs integer DEFAULT 604800,
    CONSTRAINT orgs_approval_auto_bubble_secs_check CHECK ((approval_auto_bubble_secs >= 0)),
    CONSTRAINT orgs_audit_response_body_mode_check CHECK ((audit_response_body_mode = ANY (ARRAY['off'::text, 'errors_only'::text, 'all'::text]))),
    CONSTRAINT orgs_call_timeout_bounds CHECK ((((call_timeout_ms IS NULL) OR ((call_timeout_ms >= 1000) AND (call_timeout_ms <= 600000))) AND ((max_call_timeout_ms IS NULL) OR ((max_call_timeout_ms >= 1000) AND (max_call_timeout_ms <= 600000))) AND ((call_timeout_ms IS NULL) OR (max_call_timeout_ms IS NULL) OR (call_timeout_ms <= max_call_timeout_ms)))),
    CONSTRAINT orgs_default_remember_ttl_bounds CHECK (((default_remember_ttl_secs IS NULL) OR ((default_remember_ttl_secs >= 60) AND (default_remember_ttl_secs <= 31536000)))),
    CONSTRAINT orgs_plan_check CHECK ((plan = ANY (ARRAY['standard'::text, 'free_unlimited'::text, 'trial'::text]))),
    CONSTRAINT orgs_user_template_policy_check CHECK ((user_template_policy = ANY (ARRAY['none'::text, 'restrictive'::text, 'full'::text])))
);


--
-- Name: COLUMN orgs.allow_services_outside_catalog; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.orgs.allow_services_outside_catalog IS 'When false (default), non-admins cannot instantiate global templates outside the curated catalog.';


--
-- Name: COLUMN orgs.user_template_policy; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.orgs.user_template_policy IS 'Whether org members may create user-namespace layers: none | restrictive (reserved) | full.';


--
-- Name: COLUMN orgs.call_timeout_ms; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.orgs.call_timeout_ms IS 'Default upstream timeout in ms for action calls in this org. NULL inherits the deployment default (CALL_TIMEOUT_MS). Overridden per template action and per call.';


--
-- Name: COLUMN orgs.max_call_timeout_ms; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.orgs.max_call_timeout_ms IS 'Ceiling on any resolved call timeout in this org, in ms. NULL inherits CALL_TIMEOUT_MAX_MS. A caller asking for more is rejected; a template or org default above it is clamped.';


--
-- Name: COLUMN orgs.default_agent_self_setup; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.orgs.default_agent_self_setup IS 'When true (default), a newly-created first-level agent (depth = 1) is seeded with the four overslash:*_own self-setup permission rules: manage_services_own, manage_templates_own, manage_connections_own, request_secrets_own. Existing agents are not touched when this flips.';


--
-- Name: COLUMN orgs.default_remember_ttl_secs; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.orgs.default_remember_ttl_secs IS 'Default expiry in seconds for rules written by Allow & Remember when the resolver does not pass a ttl. NULL = forever.';


--
-- Name: pending_checkouts; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.pending_checkouts (
    id text NOT NULL,
    user_id uuid NOT NULL,
    org_name text NOT NULL,
    org_slug text NOT NULL,
    seats integer NOT NULL,
    currency text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone DEFAULT (now() + '02:00:00'::interval) NOT NULL,
    fulfilled_org_id uuid
);


--
-- Name: pending_mcp_elicitations; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.pending_mcp_elicitations (
    elicit_id text NOT NULL,
    session_id uuid NOT NULL,
    agent_identity_id uuid NOT NULL,
    approval_id uuid NOT NULL,
    status text DEFAULT 'pending'::text NOT NULL,
    final_response jsonb,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    completed_at timestamp with time zone
);


--
-- Name: permission_rules; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.permission_rules (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    action_pattern text NOT NULL,
    effect text DEFAULT 'allow'::text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone,
    CONSTRAINT permission_rules_effect_check CHECK ((effect = ANY (ARRAY['allow'::text, 'deny'::text])))
);


--
-- Name: rate_limits; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.rate_limits (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid,
    group_id uuid,
    scope text NOT NULL,
    max_requests integer DEFAULT 1000 NOT NULL,
    window_seconds integer DEFAULT 60 NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    CONSTRAINT rate_limits_scope_check CHECK ((scope = ANY (ARRAY['org'::text, 'group'::text, 'user'::text, 'identity_cap'::text])))
);


--
-- Name: secret_requests; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.secret_requests (
    id text NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    secret_name text NOT NULL,
    requested_by uuid NOT NULL,
    reason text,
    token_hash bytea NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    fulfilled_at timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    require_user_session boolean DEFAULT false NOT NULL,
    service_instance_id uuid,
    credential_key text,
    declined_at timestamp with time zone,
    CONSTRAINT secret_requests_service_binding_complete CHECK (((service_instance_id IS NULL) = (credential_key IS NULL)))
);


--
-- Name: COLUMN secret_requests.service_instance_id; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.secret_requests.service_instance_id IS 'Service instance this request is provisioning a credential for. NULL for a plain secret request, which is the pre-118 shape. ON DELETE CASCADE: an outstanding setup link for a deleted instance has nothing left to bind.';


--
-- Name: COLUMN secret_requests.credential_key; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.secret_requests.credential_key IS 'Template securityScheme slot key to bind on fulfilment, validated against the template at mint time. NULL whenever service_instance_id is.';


--
-- Name: COLUMN secret_requests.declined_at; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.secret_requests.declined_at IS 'Set when the recipient pressed Deny on the provide page. Advisory; fulfilment still wins.';


--
-- Name: secret_versions; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.secret_versions (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    secret_id uuid NOT NULL,
    version integer NOT NULL,
    encrypted_value bytea NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    created_by uuid,
    provisioned_by_user_id uuid
);


--
-- Name: secrets; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.secrets (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    name text NOT NULL,
    current_version integer DEFAULT 1 NOT NULL,
    deleted_at timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    owner_identity_id uuid
);


--
-- Name: COLUMN secrets.owner_identity_id; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.secrets.owner_identity_id IS 'Namespace: the owning user identity, or NULL for the org-wide vault. Unique with (org_id, name).';


--
-- Name: service_action_embeddings; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.service_action_embeddings (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    tier text NOT NULL,
    org_id uuid,
    owner_identity_id uuid,
    template_key text NOT NULL,
    action_key text NOT NULL,
    source_text text NOT NULL,
    embedding public.vector(384) NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    CONSTRAINT service_action_embeddings_tier_check CHECK ((tier = ANY (ARRAY['global'::text, 'org'::text, 'user'::text])))
);


--
-- Name: service_instances; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.service_instances (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    owner_identity_id uuid,
    name text NOT NULL,
    template_source text NOT NULL,
    template_key text NOT NULL,
    template_id uuid,
    connection_id uuid,
    secret_name text,
    status text DEFAULT 'active'::text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    is_system boolean DEFAULT false NOT NULL,
    url text,
    use_default_connection boolean DEFAULT true NOT NULL,
    credentials jsonb DEFAULT '{}'::jsonb NOT NULL,
    discovered_tools jsonb,
    discovered_at timestamp with time zone,
    config jsonb DEFAULT '{}'::jsonb NOT NULL,
    auth_mode text,
    CONSTRAINT service_instances_status_check CHECK ((status = ANY (ARRAY['draft'::text, 'active'::text, 'archived'::text, 'pending_setup'::text]))),
    CONSTRAINT service_instances_template_source_check CHECK ((template_source = ANY (ARRAY['global'::text, 'org'::text, 'user'::text])))
);


--
-- Name: COLUMN service_instances.status; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.service_instances.status IS 'Lifecycle: active (callable), draft (deliberately parked), archived (retired), pending_setup (created by a setup flow, probe not yet green — swept after ~24h). Only active resolves by name or appears in search.';


--
-- Name: COLUMN service_instances.credentials; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.service_instances.credentials IS 'Per-scheme secret bindings: {securityScheme key -> secret path}. A path is org/<name> or <user identity uuid>/<name> (SecretPath). Names only, never values. Empty map falls back to legacy secret_name for the sole instance-source scheme.';


--
-- Name: COLUMN service_instances.discovered_tools; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.service_instances.discovered_tools IS 'MCP tools/list result for this instance (array of {name, description, input_schema, output_schema}). NULL = never resynced. Overlaid on the template''s authored tools at read time.';


--
-- Name: COLUMN service_instances.config; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.service_instances.config IS 'Per-instance non-secret param values: {param name -> scalar}. Only params the template marks x-overslash-instance-config may appear. Never secrets — those are vault references in credentials.';


--
-- Name: COLUMN service_instances.auth_mode; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.service_instances.auth_mode IS 'Which of the template''s x-overslash-auth-modes this instance authenticates with (e.g. oauth, token). NULL = the template''s default mode, and the only possibility for a template declaring no modes.';


--
-- Name: service_templates; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.service_templates (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    owner_identity_id uuid,
    key text NOT NULL,
    display_name text NOT NULL,
    description text DEFAULT ''::text NOT NULL,
    category text DEFAULT ''::text NOT NULL,
    hosts text[] DEFAULT '{}'::text[] NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    openapi jsonb,
    status text DEFAULT 'active'::text NOT NULL,
    extends text,
    delta jsonb,
    CONSTRAINT service_templates_layer_shape CHECK ((((extends IS NULL) AND (delta IS NULL) AND (openapi IS NOT NULL)) OR ((extends IS NOT NULL) AND (delta IS NOT NULL)))),
    CONSTRAINT service_templates_status_check CHECK ((status = ANY (ARRAY['draft'::text, 'active'::text])))
);


--
-- Name: COLUMN service_templates.extends; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.service_templates.extends IS 'Base template key for a derived layer (delta over a live base). NULL = standalone full-doc layer.';


--
-- Name: COLUMN service_templates.delta; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.service_templates.delta IS 'Derived-layer content: masks (allowlist/denylist/action_patch/hidden/relabel) + extensions (actions/hosts). NULL = standalone.';


--
-- Name: staged_uploads; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.staged_uploads (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    owner_user_id uuid NOT NULL,
    token_hash bytea,
    status text DEFAULT 'pending'::text NOT NULL,
    filename text NOT NULL,
    content_type text NOT NULL,
    declared_size_bytes bigint NOT NULL,
    declared_sha256 text,
    size_bytes bigint,
    sha256 text,
    body_ciphertext bytea,
    pinned_until timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    redeemed_at timestamp with time zone,
    CONSTRAINT staged_uploads_declared_size_bytes_check CHECK ((declared_size_bytes > 0)),
    CONSTRAINT staged_uploads_ready_has_bytes CHECK (((status = 'ready'::text) = ((body_ciphertext IS NOT NULL) AND (size_bytes IS NOT NULL) AND (sha256 IS NOT NULL)))),
    CONSTRAINT staged_uploads_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'uploading'::text, 'ready'::text])))
);


--
-- Name: TABLE staged_uploads; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON TABLE public.staged_uploads IS 'Bytes the gateway holds briefly so an HTTP action can carry them inline (x-overslash-staged-upload). Minted by overslash:upload_file, pushed to POST /v1/uploads/{token}, inlined at send time. Quota-bounded and TTL''d.';


--
-- Name: COLUMN staged_uploads.body_ciphertext; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.staged_uploads.body_ciphertext IS 'AES-256-GCM [version|nonce|ct+tag] over the raw bytes. NULL until redeemed.';


--
-- Name: COLUMN staged_uploads.pinned_until; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.staged_uploads.pinned_until IS 'Referenced by a pending approval or queued call until this time: not evictable, not swept.';


--
-- Name: upload_tokens; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.upload_tokens (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    token_hash bytea NOT NULL,
    org_id uuid NOT NULL,
    identity_id uuid NOT NULL,
    service_instance_id uuid,
    service_key text,
    action_key text,
    request jsonb NOT NULL,
    credential_ref jsonb DEFAULT '{}'::jsonb NOT NULL,
    declared_sha256 text,
    declared_size_bytes bigint,
    declared_mime text,
    declared_filename text,
    max_bytes bigint NOT NULL,
    filename_param text,
    result_spec jsonb,
    stored_media_path text,
    stored_sha256 text,
    stored_size_bytes bigint,
    stored_mime text,
    stored_filename text,
    completed_at timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    consumed_at timestamp with time zone
);


--
-- Name: TABLE upload_tokens; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON TABLE public.upload_tokens IS 'Single-use capability tokens for pushing bytes into a service. Minted by an action carrying x-overslash-upload, redeemed by POST /v1/uploads/{token}.';


--
-- Name: COLUMN upload_tokens.token_hash; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.upload_tokens.token_hash IS 'sha256 of the raw token; the raw value exists only in the minted URL.';


--
-- Name: COLUMN upload_tokens.declared_sha256; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.upload_tokens.declared_sha256 IS 'Content hash the caller declared at mint time. Verified against the stream during redemption; a mismatch refuses the descriptor so no later call can reference the bytes.';


--
-- Name: COLUMN upload_tokens.consumed_at; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.upload_tokens.consumed_at IS 'Set by the claim. A row with consumed_at but no completed_at is a push that started and did not land.';


--
-- Name: user_org_memberships; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.user_org_memberships (
    user_id uuid NOT NULL,
    org_id uuid NOT NULL,
    role text NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    CONSTRAINT user_org_memberships_role_check CHECK ((role = ANY (ARRAY['admin'::text, 'member'::text])))
);


--
-- Name: user_sessions; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.user_sessions (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    user_id uuid,
    identity_id uuid NOT NULL,
    org_id uuid NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    last_seen_at timestamp with time zone DEFAULT now() NOT NULL,
    expires_at timestamp with time zone NOT NULL,
    revoked_at timestamp with time zone,
    revoked_reason text,
    user_agent text,
    ip_address text,
    auth_method text,
    auth_provider text,
    authenticated_at timestamp with time zone,
    idp_amr text[],
    idp_acr text,
    CONSTRAINT user_sessions_auth_method_check CHECK ((auth_method = ANY (ARRAY['idp'::text, 'magic_link'::text, 'dev'::text]))),
    CONSTRAINT user_sessions_idp_has_provider CHECK (((auth_method IS DISTINCT FROM 'idp'::text) OR (auth_provider IS NOT NULL)))
);


--
-- Name: users; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.users (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    email text,
    display_name text,
    overslash_idp_provider text,
    overslash_idp_subject text,
    personal_org_id uuid,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    updated_at timestamp with time zone DEFAULT now() NOT NULL,
    stripe_customer_id text,
    is_instance_admin boolean DEFAULT false NOT NULL,
    welcome_email_sent_at timestamp with time zone,
    welcome_emails_unsubscribed_at timestamp with time zone,
    webhook_digest_unsubscribed_at timestamp with time zone,
    CONSTRAINT users_instance_admin_requires_overslash_idp CHECK (((NOT is_instance_admin) OR (overslash_idp_provider IS NOT NULL)))
);


--
-- Name: webhook_deliveries; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.webhook_deliveries (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    subscription_id uuid NOT NULL,
    event text NOT NULL,
    payload jsonb NOT NULL,
    status_code integer,
    response_body text,
    attempts integer DEFAULT 0 NOT NULL,
    next_retry_at timestamp with time zone,
    delivered_at timestamp with time zone,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    held_reason text
);


--
-- Name: COLUMN webhook_deliveries.held_reason; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.webhook_deliveries.held_reason IS 'Set while the delivery is held back and not dialed (pending_verification). NULL once released or for a normal delivery.';


--
-- Name: webhook_digest_runs; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.webhook_digest_runs (
    org_id uuid NOT NULL,
    run_date date NOT NULL,
    sent_at timestamp with time zone DEFAULT now() NOT NULL
);


--
-- Name: webhook_subscriptions; Type: TABLE; Schema: public; Owner: -
--

CREATE TABLE public.webhook_subscriptions (
    id uuid DEFAULT gen_random_uuid() NOT NULL,
    org_id uuid NOT NULL,
    url text NOT NULL,
    events text[] NOT NULL,
    secret text NOT NULL,
    active boolean DEFAULT true NOT NULL,
    created_at timestamp with time zone DEFAULT now() NOT NULL,
    disabled_reason text,
    verification_status text DEFAULT 'pending_verification'::text NOT NULL,
    verified_at timestamp with time zone,
    grandfathered boolean DEFAULT false NOT NULL,
    verification_attempted_at timestamp with time zone,
    verification_error text,
    CONSTRAINT webhook_subscriptions_verification_status_check CHECK ((verification_status = ANY (ARRAY['pending_verification'::text, 'verified'::text])))
);


--
-- Name: COLUMN webhook_subscriptions.disabled_reason; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.webhook_subscriptions.disabled_reason IS 'Why the platform disabled this subscription (needs_https). NULL for a subscription the platform has not disabled.';


--
-- Name: COLUMN webhook_subscriptions.verification_status; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.webhook_subscriptions.verification_status IS 'pending_verification until the endpoint echoes the ownership challenge; only verified subscriptions receive events.';


--
-- Name: COLUMN webhook_subscriptions.grandfathered; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.webhook_subscriptions.grandfathered IS 'Marked verified by migration 125 without a handshake (predates CASA 7.1.2). Cleared by a successful re-verification.';


--
-- Name: COLUMN webhook_subscriptions.verification_error; Type: COMMENT; Schema: public; Owner: -
--

COMMENT ON COLUMN public.webhook_subscriptions.verification_error IS 'Why the last handshake failed. NULL after a success.';


--
-- Name: events id; Type: DEFAULT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.events ALTER COLUMN id SET DEFAULT nextval('public.events_id_seq'::regclass);


--
-- Name: api_keys api_keys_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.api_keys
    ADD CONSTRAINT api_keys_pkey PRIMARY KEY (id);


--
-- Name: approvals approvals_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.approvals
    ADD CONSTRAINT approvals_pkey PRIMARY KEY (id);


--
-- Name: approvals approvals_token_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.approvals
    ADD CONSTRAINT approvals_token_key UNIQUE (token);


--
-- Name: audit_log audit_log_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.audit_log
    ADD CONSTRAINT audit_log_pkey PRIMARY KEY (id);


--
-- Name: billing_email_log billing_email_log_event_kind_unique; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.billing_email_log
    ADD CONSTRAINT billing_email_log_event_kind_unique UNIQUE (stripe_event_id, kind);


--
-- Name: billing_email_log billing_email_log_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.billing_email_log
    ADD CONSTRAINT billing_email_log_pkey PRIMARY KEY (id);


--
-- Name: byoc_credentials byoc_credentials_org_id_identity_id_provider_key_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.byoc_credentials
    ADD CONSTRAINT byoc_credentials_org_id_identity_id_provider_key_key UNIQUE (org_id, identity_id, provider_key);


--
-- Name: byoc_credentials byoc_credentials_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.byoc_credentials
    ADD CONSTRAINT byoc_credentials_pkey PRIMARY KEY (id);


--
-- Name: call_results call_results_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.call_results
    ADD CONSTRAINT call_results_pkey PRIMARY KEY (id);


--
-- Name: connections connections_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.connections
    ADD CONSTRAINT connections_pkey PRIMARY KEY (id);


--
-- Name: directory_groups directory_groups_org_id_source_idp_config_id_external_id_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.directory_groups
    ADD CONSTRAINT directory_groups_org_id_source_idp_config_id_external_id_key UNIQUE NULLS NOT DISTINCT (org_id, source, idp_config_id, external_id);


--
-- Name: directory_groups directory_groups_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.directory_groups
    ADD CONSTRAINT directory_groups_pkey PRIMARY KEY (id);


--
-- Name: download_tokens download_tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.download_tokens
    ADD CONSTRAINT download_tokens_pkey PRIMARY KEY (id);


--
-- Name: download_tokens download_tokens_token_hash_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.download_tokens
    ADD CONSTRAINT download_tokens_token_hash_key UNIQUE (token_hash);


--
-- Name: email_unsubscribe_tokens email_unsubscribe_tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.email_unsubscribe_tokens
    ADD CONSTRAINT email_unsubscribe_tokens_pkey PRIMARY KEY (token);


--
-- Name: enabled_global_templates enabled_global_templates_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.enabled_global_templates
    ADD CONSTRAINT enabled_global_templates_pkey PRIMARY KEY (org_id, template_key);


--
-- Name: events events_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.events
    ADD CONSTRAINT events_pkey PRIMARY KEY (id);


--
-- Name: executions executions_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.executions
    ADD CONSTRAINT executions_pkey PRIMARY KEY (id);


--
-- Name: google_directory_connect_flows google_directory_connect_flows_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.google_directory_connect_flows
    ADD CONSTRAINT google_directory_connect_flows_pkey PRIMARY KEY (id);


--
-- Name: group_directory_sources group_directory_sources_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.group_directory_sources
    ADD CONSTRAINT group_directory_sources_pkey PRIMARY KEY (group_id, directory_group_id);


--
-- Name: group_grants group_grants_group_id_service_instance_id_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.group_grants
    ADD CONSTRAINT group_grants_group_id_service_instance_id_key UNIQUE (group_id, service_instance_id);


--
-- Name: group_grants group_grants_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.group_grants
    ADD CONSTRAINT group_grants_pkey PRIMARY KEY (id);


--
-- Name: groups groups_org_id_name_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.groups
    ADD CONSTRAINT groups_org_id_name_key UNIQUE (org_id, name);


--
-- Name: groups groups_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.groups
    ADD CONSTRAINT groups_pkey PRIMARY KEY (id);


--
-- Name: identities identities_org_id_external_id_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identities
    ADD CONSTRAINT identities_org_id_external_id_key UNIQUE (org_id, external_id);


--
-- Name: identities identities_org_id_id_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identities
    ADD CONSTRAINT identities_org_id_id_key UNIQUE (org_id, id);


--
-- Name: identities identities_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identities
    ADD CONSTRAINT identities_pkey PRIMARY KEY (id);


--
-- Name: identity_directory_groups identity_directory_groups_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identity_directory_groups
    ADD CONSTRAINT identity_directory_groups_pkey PRIMARY KEY (identity_id, directory_group_id);


--
-- Name: identity_groups identity_groups_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identity_groups
    ADD CONSTRAINT identity_groups_pkey PRIMARY KEY (identity_id, group_id);


--
-- Name: magic_link_tokens magic_link_tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.magic_link_tokens
    ADD CONSTRAINT magic_link_tokens_pkey PRIMARY KEY (id);


--
-- Name: magic_link_tokens magic_link_tokens_token_hash_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.magic_link_tokens
    ADD CONSTRAINT magic_link_tokens_token_hash_key UNIQUE (token_hash);


--
-- Name: mcp_client_agent_bindings mcp_client_agent_bindings_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_client_agent_bindings
    ADD CONSTRAINT mcp_client_agent_bindings_pkey PRIMARY KEY (id);


--
-- Name: mcp_client_agent_bindings mcp_client_agent_bindings_user_client_org_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_client_agent_bindings
    ADD CONSTRAINT mcp_client_agent_bindings_user_client_org_key UNIQUE (user_identity_id, client_id, org_id);


--
-- Name: mcp_refresh_tokens mcp_refresh_tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_refresh_tokens
    ADD CONSTRAINT mcp_refresh_tokens_pkey PRIMARY KEY (id);


--
-- Name: mcp_upstream_connections mcp_upstream_connections_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_connections
    ADD CONSTRAINT mcp_upstream_connections_pkey PRIMARY KEY (id);


--
-- Name: mcp_upstream_connections mcp_upstream_connections_unique; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_connections
    ADD CONSTRAINT mcp_upstream_connections_unique UNIQUE (identity_id, upstream_resource);


--
-- Name: mcp_upstream_flows mcp_upstream_flows_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_flows
    ADD CONSTRAINT mcp_upstream_flows_pkey PRIMARY KEY (id);


--
-- Name: mcp_upstream_tokens mcp_upstream_tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_tokens
    ADD CONSTRAINT mcp_upstream_tokens_pkey PRIMARY KEY (id);


--
-- Name: mcp_url_elicitations mcp_url_elicitations_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_url_elicitations
    ADD CONSTRAINT mcp_url_elicitations_pkey PRIMARY KEY (elicit_id);


--
-- Name: media_descriptors media_descriptors_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.media_descriptors
    ADD CONSTRAINT media_descriptors_pkey PRIMARY KEY (id);


--
-- Name: oauth_connection_flows oauth_connection_flows_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_connection_flows
    ADD CONSTRAINT oauth_connection_flows_pkey PRIMARY KEY (id);


--
-- Name: oauth_handoff_codes oauth_handoff_codes_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_handoff_codes
    ADD CONSTRAINT oauth_handoff_codes_pkey PRIMARY KEY (code);


--
-- Name: oauth_mcp_clients oauth_mcp_clients_client_id_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_mcp_clients
    ADD CONSTRAINT oauth_mcp_clients_client_id_key UNIQUE (client_id);


--
-- Name: oauth_mcp_clients oauth_mcp_clients_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_mcp_clients
    ADD CONSTRAINT oauth_mcp_clients_pkey PRIMARY KEY (id);


--
-- Name: oauth_preview_origins oauth_preview_origins_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_preview_origins
    ADD CONSTRAINT oauth_preview_origins_pkey PRIMARY KEY (preview_id);


--
-- Name: oauth_providers oauth_providers_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_providers
    ADD CONSTRAINT oauth_providers_pkey PRIMARY KEY (key);


--
-- Name: org_google_directory_configs org_google_directory_configs_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_google_directory_configs
    ADD CONSTRAINT org_google_directory_configs_pkey PRIMARY KEY (org_id);


--
-- Name: org_idp_configs org_idp_configs_org_id_provider_key_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_idp_configs
    ADD CONSTRAINT org_idp_configs_org_id_provider_key_key UNIQUE (org_id, provider_key);


--
-- Name: org_idp_configs org_idp_configs_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_idp_configs
    ADD CONSTRAINT org_idp_configs_pkey PRIMARY KEY (id);


--
-- Name: org_oauth_signin_overrides org_oauth_signin_overrides_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_oauth_signin_overrides
    ADD CONSTRAINT org_oauth_signin_overrides_pkey PRIMARY KEY (org_id, provider_key);


--
-- Name: org_subscriptions org_subscriptions_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_subscriptions
    ADD CONSTRAINT org_subscriptions_pkey PRIMARY KEY (org_id);


--
-- Name: org_subscriptions org_subscriptions_stripe_subscription_id_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_subscriptions
    ADD CONSTRAINT org_subscriptions_stripe_subscription_id_key UNIQUE (stripe_subscription_id);


--
-- Name: orgs orgs_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.orgs
    ADD CONSTRAINT orgs_pkey PRIMARY KEY (id);


--
-- Name: orgs orgs_slug_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.orgs
    ADD CONSTRAINT orgs_slug_key UNIQUE (slug);


--
-- Name: pending_checkouts pending_checkouts_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.pending_checkouts
    ADD CONSTRAINT pending_checkouts_pkey PRIMARY KEY (id);


--
-- Name: pending_mcp_elicitations pending_mcp_elicitations_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.pending_mcp_elicitations
    ADD CONSTRAINT pending_mcp_elicitations_pkey PRIMARY KEY (elicit_id);


--
-- Name: permission_rules permission_rules_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.permission_rules
    ADD CONSTRAINT permission_rules_pkey PRIMARY KEY (id);


--
-- Name: rate_limits rate_limits_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.rate_limits
    ADD CONSTRAINT rate_limits_pkey PRIMARY KEY (id);


--
-- Name: secret_requests secret_requests_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_requests
    ADD CONSTRAINT secret_requests_pkey PRIMARY KEY (id);


--
-- Name: secret_versions secret_versions_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_versions
    ADD CONSTRAINT secret_versions_pkey PRIMARY KEY (id);


--
-- Name: secret_versions secret_versions_secret_id_version_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_versions
    ADD CONSTRAINT secret_versions_secret_id_version_key UNIQUE (secret_id, version);


--
-- Name: secrets secrets_org_owner_name_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secrets
    ADD CONSTRAINT secrets_org_owner_name_key UNIQUE NULLS NOT DISTINCT (org_id, owner_identity_id, name);


--
-- Name: secrets secrets_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secrets
    ADD CONSTRAINT secrets_pkey PRIMARY KEY (id);


--
-- Name: service_action_embeddings service_action_embeddings_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_action_embeddings
    ADD CONSTRAINT service_action_embeddings_pkey PRIMARY KEY (id);


--
-- Name: service_instances service_instances_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_instances
    ADD CONSTRAINT service_instances_pkey PRIMARY KEY (id);


--
-- Name: service_templates service_templates_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_templates
    ADD CONSTRAINT service_templates_pkey PRIMARY KEY (id);


--
-- Name: staged_uploads staged_uploads_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.staged_uploads
    ADD CONSTRAINT staged_uploads_pkey PRIMARY KEY (id);


--
-- Name: staged_uploads staged_uploads_token_hash_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.staged_uploads
    ADD CONSTRAINT staged_uploads_token_hash_key UNIQUE (token_hash);


--
-- Name: upload_tokens upload_tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.upload_tokens
    ADD CONSTRAINT upload_tokens_pkey PRIMARY KEY (id);


--
-- Name: upload_tokens upload_tokens_token_hash_key; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.upload_tokens
    ADD CONSTRAINT upload_tokens_token_hash_key UNIQUE (token_hash);


--
-- Name: user_org_memberships user_org_memberships_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.user_org_memberships
    ADD CONSTRAINT user_org_memberships_pkey PRIMARY KEY (user_id, org_id);


--
-- Name: user_sessions user_sessions_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.user_sessions
    ADD CONSTRAINT user_sessions_pkey PRIMARY KEY (id);


--
-- Name: users users_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.users
    ADD CONSTRAINT users_pkey PRIMARY KEY (id);


--
-- Name: webhook_deliveries webhook_deliveries_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.webhook_deliveries
    ADD CONSTRAINT webhook_deliveries_pkey PRIMARY KEY (id);


--
-- Name: webhook_digest_runs webhook_digest_runs_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.webhook_digest_runs
    ADD CONSTRAINT webhook_digest_runs_pkey PRIMARY KEY (org_id, run_date);


--
-- Name: webhook_subscriptions webhook_subscriptions_pkey; Type: CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.webhook_subscriptions
    ADD CONSTRAINT webhook_subscriptions_pkey PRIMARY KEY (id);


--
-- Name: billing_email_log_attempted_at; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX billing_email_log_attempted_at ON public.billing_email_log USING btree (attempted_at);


--
-- Name: billing_email_log_user_id; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX billing_email_log_user_id ON public.billing_email_log USING btree (user_id);


--
-- Name: call_results_expiry_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX call_results_expiry_idx ON public.call_results USING btree (expires_at);


--
-- Name: download_tokens_expiry_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX download_tokens_expiry_idx ON public.download_tokens USING btree (expires_at);


--
-- Name: email_unsubscribe_tokens_user_id; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX email_unsubscribe_tokens_user_id ON public.email_unsubscribe_tokens USING btree (user_id);


--
-- Name: events_org_replay_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX events_org_replay_idx ON public.events USING btree (org_id, id);


--
-- Name: events_prune_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX events_prune_idx ON public.events USING btree (created_at);


--
-- Name: identities_org_user_unique; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX identities_org_user_unique ON public.identities USING btree (org_id, user_id) WHERE ((user_id IS NOT NULL) AND (kind = 'user'::text));


--
-- Name: idx_api_keys_org_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_api_keys_org_identity ON public.api_keys USING btree (org_id, identity_id);


--
-- Name: idx_api_keys_prefix; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_api_keys_prefix ON public.api_keys USING btree (key_prefix);


--
-- Name: idx_approvals_expires; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_approvals_expires ON public.approvals USING btree (expires_at) WHERE (status = 'pending'::text);


--
-- Name: idx_approvals_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_approvals_identity ON public.approvals USING btree (identity_id);


--
-- Name: idx_approvals_org_status; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_approvals_org_status ON public.approvals USING btree (org_id, status);


--
-- Name: idx_approvals_resolver_pending; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_approvals_resolver_pending ON public.approvals USING btree (current_resolver_identity_id) WHERE (status = 'pending'::text);


--
-- Name: idx_audit_log_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_audit_log_identity ON public.audit_log USING btree (identity_id, created_at DESC);


--
-- Name: idx_audit_log_org_action; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_audit_log_org_action ON public.audit_log USING btree (org_id, action, created_at DESC);


--
-- Name: idx_audit_log_org_created_id; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_audit_log_org_created_id ON public.audit_log USING btree (org_id, created_at DESC, id DESC);


--
-- Name: idx_audit_log_org_resource_type; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_audit_log_org_resource_type ON public.audit_log USING btree (org_id, resource_type, created_at DESC);


--
-- Name: idx_audit_log_search_trgm; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_audit_log_search_trgm ON public.audit_log USING gin ((((((action || ' '::text) || COALESCE(description, ''::text)) || ' '::text) || COALESCE(actor_name, ''::text))) public.gin_trgm_ops);


--
-- Name: idx_connections_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_connections_identity ON public.connections USING btree (identity_id);


--
-- Name: idx_connections_one_default; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_connections_one_default ON public.connections USING btree (identity_id, provider_key) WHERE is_default;


--
-- Name: idx_connections_provider; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_connections_provider ON public.connections USING btree (org_id, provider_key);


--
-- Name: idx_directory_groups_google_directory_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_directory_groups_google_directory_org ON public.directory_groups USING btree (google_directory_org_id) WHERE (google_directory_org_id IS NOT NULL);


--
-- Name: idx_directory_groups_idp_config; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_directory_groups_idp_config ON public.directory_groups USING btree (idp_config_id);


--
-- Name: idx_directory_groups_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_directory_groups_org ON public.directory_groups USING btree (org_id);


--
-- Name: idx_executions_approval_id; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_executions_approval_id ON public.executions USING btree (approval_id) WHERE (approval_id IS NOT NULL);


--
-- Name: idx_executions_async_lease; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_executions_async_lease ON public.executions USING btree (lease_expires_at) WHERE ((status = 'executing'::text) AND (request IS NOT NULL));


--
-- Name: idx_executions_async_queue; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_executions_async_queue ON public.executions USING btree (created_at) WHERE ((status = 'pending'::text) AND (request IS NOT NULL));


--
-- Name: idx_executions_identity_recent; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_executions_identity_recent ON public.executions USING btree (org_id, identity_id, created_at DESC);


--
-- Name: idx_executions_org_status_expires; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_executions_org_status_expires ON public.executions USING btree (org_id, status, expires_at);


--
-- Name: idx_executions_pending_expiry; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_executions_pending_expiry ON public.executions USING btree (expires_at) WHERE (status = 'pending'::text);


--
-- Name: idx_executions_unread; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_executions_unread ON public.executions USING btree (org_id, completed_at) WHERE ((status = ANY (ARRAY['executed'::text, 'failed'::text])) AND (result_viewed_at IS NULL));


--
-- Name: idx_google_directory_connect_flows_expires; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_google_directory_connect_flows_expires ON public.google_directory_connect_flows USING btree (expires_at);


--
-- Name: idx_group_directory_sources_directory_group; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_group_directory_sources_directory_group ON public.group_directory_sources USING btree (directory_group_id);


--
-- Name: idx_group_grants_group; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_group_grants_group ON public.group_grants USING btree (group_id);


--
-- Name: idx_group_grants_service; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_group_grants_service ON public.group_grants USING btree (service_instance_id);


--
-- Name: idx_groups_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_groups_org ON public.groups USING btree (org_id);


--
-- Name: idx_groups_self_per_user; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_groups_self_per_user ON public.groups USING btree (org_id, owner_identity_id) WHERE (system_kind = 'self'::text);


--
-- Name: idx_identities_archived; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identities_archived ON public.identities USING btree (archived_at) WHERE (archived_at IS NOT NULL);


--
-- Name: idx_identities_email; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identities_email ON public.identities USING btree (email) WHERE (email IS NOT NULL);


--
-- Name: idx_identities_idle_subagents; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identities_idle_subagents ON public.identities USING btree (last_active_at) WHERE ((kind = 'sub_agent'::text) AND (archived_at IS NULL));


--
-- Name: idx_identities_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identities_org ON public.identities USING btree (org_id);


--
-- Name: idx_identities_owner; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identities_owner ON public.identities USING btree (owner_id) WHERE (owner_id IS NOT NULL);


--
-- Name: idx_identities_parent; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identities_parent ON public.identities USING btree (parent_id) WHERE (parent_id IS NOT NULL);


--
-- Name: idx_identities_user; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identities_user ON public.identities USING btree (user_id);


--
-- Name: idx_identity_directory_groups_group; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identity_directory_groups_group ON public.identity_directory_groups USING btree (directory_group_id);


--
-- Name: idx_identity_directory_groups_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identity_directory_groups_identity ON public.identity_directory_groups USING btree (identity_id);


--
-- Name: idx_identity_groups_group; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identity_groups_group ON public.identity_groups USING btree (group_id);


--
-- Name: idx_identity_groups_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_identity_groups_identity ON public.identity_groups USING btree (identity_id);


--
-- Name: idx_magic_link_tokens_expires; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_magic_link_tokens_expires ON public.magic_link_tokens USING btree (expires_at);


--
-- Name: idx_mcp_client_agent_bindings_agent; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_client_agent_bindings_agent ON public.mcp_client_agent_bindings USING btree (agent_identity_id);


--
-- Name: idx_mcp_client_agent_bindings_user; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_client_agent_bindings_user ON public.mcp_client_agent_bindings USING btree (user_identity_id);


--
-- Name: idx_mcp_refresh_tokens_active_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_refresh_tokens_active_identity ON public.mcp_refresh_tokens USING btree (identity_id) WHERE (revoked_at IS NULL);


--
-- Name: idx_mcp_refresh_tokens_client; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_refresh_tokens_client ON public.mcp_refresh_tokens USING btree (client_id);


--
-- Name: idx_mcp_refresh_tokens_hash; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_mcp_refresh_tokens_hash ON public.mcp_refresh_tokens USING btree (hash);


--
-- Name: idx_mcp_upstream_connections_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_upstream_connections_org ON public.mcp_upstream_connections USING btree (org_id);


--
-- Name: idx_mcp_upstream_flows_expires_at; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_upstream_flows_expires_at ON public.mcp_upstream_flows USING btree (expires_at) WHERE (consumed_at IS NULL);


--
-- Name: idx_mcp_upstream_flows_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_upstream_flows_identity ON public.mcp_upstream_flows USING btree (identity_id, created_at DESC);


--
-- Name: idx_mcp_upstream_tokens_current; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_mcp_upstream_tokens_current ON public.mcp_upstream_tokens USING btree (connection_id) WHERE (superseded_at IS NULL);


--
-- Name: idx_mcp_url_elicitations_created; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_mcp_url_elicitations_created ON public.mcp_url_elicitations USING btree (created_at);


--
-- Name: idx_memberships_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_memberships_org ON public.user_org_memberships USING btree (org_id);


--
-- Name: idx_oauth_connection_flows_expires_at; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_oauth_connection_flows_expires_at ON public.oauth_connection_flows USING btree (expires_at) WHERE (consumed_at IS NULL);


--
-- Name: idx_oauth_connection_flows_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_oauth_connection_flows_identity ON public.oauth_connection_flows USING btree (identity_id, created_at DESC);


--
-- Name: idx_oauth_handoff_codes_expires; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_oauth_handoff_codes_expires ON public.oauth_handoff_codes USING btree (expires_at);


--
-- Name: idx_oauth_mcp_clients_active; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_oauth_mcp_clients_active ON public.oauth_mcp_clients USING btree (created_at DESC) WHERE (is_revoked = false);


--
-- Name: idx_oauth_mcp_clients_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_oauth_mcp_clients_org ON public.oauth_mcp_clients USING btree (org_id);


--
-- Name: idx_oauth_preview_origins_expires; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_oauth_preview_origins_expires ON public.oauth_preview_origins USING btree (expires_at);


--
-- Name: idx_org_google_directory_configs_due; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_org_google_directory_configs_due ON public.org_google_directory_configs USING btree (next_sync_at) WHERE enabled;


--
-- Name: idx_org_idp_configs_domains; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_org_idp_configs_domains ON public.org_idp_configs USING gin (allowed_email_domains);


--
-- Name: idx_org_idp_configs_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_org_idp_configs_org ON public.org_idp_configs USING btree (org_id);


--
-- Name: idx_orgs_plan; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_orgs_plan ON public.orgs USING btree (plan) WHERE (plan <> 'standard'::text);


--
-- Name: idx_pending_checkouts_user; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_pending_checkouts_user ON public.pending_checkouts USING btree (user_id);


--
-- Name: idx_pending_mcp_elicit_agent_cancelled; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_pending_mcp_elicit_agent_cancelled ON public.pending_mcp_elicitations USING btree (agent_identity_id, completed_at) WHERE (status = 'cancelled'::text);


--
-- Name: idx_pending_mcp_elicit_session; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_pending_mcp_elicit_session ON public.pending_mcp_elicitations USING btree (session_id);


--
-- Name: idx_pending_mcp_elicit_status; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_pending_mcp_elicit_status ON public.pending_mcp_elicitations USING btree (status, created_at);


--
-- Name: idx_permission_rules_identity; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_permission_rules_identity ON public.permission_rules USING btree (identity_id);


--
-- Name: idx_rate_limits_group; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_rate_limits_group ON public.rate_limits USING btree (org_id, group_id) WHERE (scope = 'group'::text);


--
-- Name: idx_rate_limits_identity_cap; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_rate_limits_identity_cap ON public.rate_limits USING btree (org_id, identity_id) WHERE (scope = 'identity_cap'::text);


--
-- Name: idx_rate_limits_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_rate_limits_org ON public.rate_limits USING btree (org_id);


--
-- Name: idx_rate_limits_org_default; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_rate_limits_org_default ON public.rate_limits USING btree (org_id) WHERE (scope = 'org'::text);


--
-- Name: idx_rate_limits_user; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_rate_limits_user ON public.rate_limits USING btree (org_id, identity_id) WHERE (scope = 'user'::text);


--
-- Name: idx_secret_requests_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_secret_requests_org ON public.secret_requests USING btree (org_id);


--
-- Name: idx_secret_requests_pending; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_secret_requests_pending ON public.secret_requests USING btree (expires_at) WHERE (fulfilled_at IS NULL);


--
-- Name: idx_secret_requests_service; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_secret_requests_service ON public.secret_requests USING btree (service_instance_id) WHERE (service_instance_id IS NOT NULL);


--
-- Name: idx_secret_versions_provisioned_by; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_secret_versions_provisioned_by ON public.secret_versions USING btree (provisioned_by_user_id) WHERE (provisioned_by_user_id IS NOT NULL);


--
-- Name: idx_secret_versions_secret; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_secret_versions_secret ON public.secret_versions USING btree (secret_id);


--
-- Name: idx_secrets_org_name; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_secrets_org_name ON public.secrets USING btree (org_id, name);


--
-- Name: idx_secrets_owner; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_secrets_owner ON public.secrets USING btree (owner_identity_id) WHERE (owner_identity_id IS NOT NULL);


--
-- Name: idx_service_instances_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_service_instances_org ON public.service_instances USING btree (org_id);


--
-- Name: idx_service_instances_org_name; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_service_instances_org_name ON public.service_instances USING btree (org_id, name) WHERE (owner_identity_id IS NULL);


--
-- Name: idx_service_instances_owner; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_service_instances_owner ON public.service_instances USING btree (owner_identity_id);


--
-- Name: idx_service_instances_pending_setup; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_service_instances_pending_setup ON public.service_instances USING btree (created_at) WHERE (status = 'pending_setup'::text);


--
-- Name: idx_service_instances_user_name; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_service_instances_user_name ON public.service_instances USING btree (org_id, owner_identity_id, name) WHERE (owner_identity_id IS NOT NULL);


--
-- Name: idx_service_templates_extends; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_service_templates_extends ON public.service_templates USING btree (org_id, extends) WHERE (extends IS NOT NULL);


--
-- Name: idx_service_templates_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_service_templates_org ON public.service_templates USING btree (org_id);


--
-- Name: idx_service_templates_org_key; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_service_templates_org_key ON public.service_templates USING btree (org_id, key) WHERE ((owner_identity_id IS NULL) AND (status = 'active'::text));


--
-- Name: idx_service_templates_status; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_service_templates_status ON public.service_templates USING btree (status);


--
-- Name: idx_service_templates_user_key; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX idx_service_templates_user_key ON public.service_templates USING btree (org_id, owner_identity_id, key) WHERE ((owner_identity_id IS NOT NULL) AND (status = 'active'::text));


--
-- Name: idx_users_email; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_users_email ON public.users USING btree (email);


--
-- Name: idx_users_is_instance_admin; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_users_is_instance_admin ON public.users USING btree (is_instance_admin) WHERE is_instance_admin;


--
-- Name: idx_users_personal_org; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_users_personal_org ON public.users USING btree (personal_org_id);


--
-- Name: idx_webhook_deliveries_retry; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX idx_webhook_deliveries_retry ON public.webhook_deliveries USING btree (next_retry_at) WHERE ((delivered_at IS NULL) AND (attempts < 5));


--
-- Name: media_descriptors_ref_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX media_descriptors_ref_idx ON public.media_descriptors USING btree (org_id, service_instance_id, media_path) NULLS NOT DISTINCT;


--
-- Name: org_google_directory_configs_domain_key; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX org_google_directory_configs_domain_key ON public.org_google_directory_configs USING btree (lower(domain));


--
-- Name: org_idp_configs_one_default_per_org; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX org_idp_configs_one_default_per_org ON public.org_idp_configs USING btree (org_id) WHERE is_default;


--
-- Name: service_action_embeddings_global_unique; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX service_action_embeddings_global_unique ON public.service_action_embeddings USING btree (template_key, action_key) WHERE (tier = 'global'::text);


--
-- Name: service_action_embeddings_hnsw; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX service_action_embeddings_hnsw ON public.service_action_embeddings USING hnsw (embedding public.vector_cosine_ops);


--
-- Name: service_action_embeddings_org_unique; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX service_action_embeddings_org_unique ON public.service_action_embeddings USING btree (org_id, template_key, action_key) WHERE (tier = 'org'::text);


--
-- Name: service_action_embeddings_user_unique; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX service_action_embeddings_user_unique ON public.service_action_embeddings USING btree (org_id, owner_identity_id, template_key, action_key) WHERE (tier = 'user'::text);


--
-- Name: staged_uploads_expiry_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX staged_uploads_expiry_idx ON public.staged_uploads USING btree (expires_at);


--
-- Name: staged_uploads_identity_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX staged_uploads_identity_idx ON public.staged_uploads USING btree (identity_id, created_at);


--
-- Name: staged_uploads_org_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX staged_uploads_org_idx ON public.staged_uploads USING btree (org_id);


--
-- Name: upload_tokens_expiry_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX upload_tokens_expiry_idx ON public.upload_tokens USING btree (expires_at);


--
-- Name: user_sessions_expires_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX user_sessions_expires_idx ON public.user_sessions USING btree (expires_at);


--
-- Name: user_sessions_identity_live_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX user_sessions_identity_live_idx ON public.user_sessions USING btree (identity_id) WHERE (revoked_at IS NULL);


--
-- Name: user_sessions_user_live_idx; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX user_sessions_user_live_idx ON public.user_sessions USING btree (user_id) WHERE (revoked_at IS NULL);


--
-- Name: users_overslash_idp_unique; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX users_overslash_idp_unique ON public.users USING btree (overslash_idp_provider, overslash_idp_subject) WHERE ((overslash_idp_provider IS NOT NULL) AND (overslash_idp_subject IS NOT NULL));


--
-- Name: users_stripe_customer; Type: INDEX; Schema: public; Owner: -
--

CREATE UNIQUE INDEX users_stripe_customer ON public.users USING btree (stripe_customer_id) WHERE (stripe_customer_id IS NOT NULL);


--
-- Name: webhook_digest_runs_run_date; Type: INDEX; Schema: public; Owner: -
--

CREATE INDEX webhook_digest_runs_run_date ON public.webhook_digest_runs USING btree (run_date);


--
-- Name: events events_notify_trigger; Type: TRIGGER; Schema: public; Owner: -
--

CREATE TRIGGER events_notify_trigger AFTER INSERT ON public.events FOR EACH ROW EXECUTE FUNCTION public.events_notify();


--
-- Name: api_keys api_keys_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.api_keys
    ADD CONSTRAINT api_keys_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: api_keys api_keys_org_id_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.api_keys
    ADD CONSTRAINT api_keys_org_id_identity_id_fkey FOREIGN KEY (org_id, identity_id) REFERENCES public.identities(org_id, id) ON DELETE CASCADE;


--
-- Name: approvals approvals_current_resolver_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.approvals
    ADD CONSTRAINT approvals_current_resolver_identity_id_fkey FOREIGN KEY (current_resolver_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: approvals approvals_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.approvals
    ADD CONSTRAINT approvals_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: approvals approvals_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.approvals
    ADD CONSTRAINT approvals_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: audit_log audit_log_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.audit_log
    ADD CONSTRAINT audit_log_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE SET NULL;


--
-- Name: audit_log audit_log_impersonated_by_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.audit_log
    ADD CONSTRAINT audit_log_impersonated_by_identity_id_fkey FOREIGN KEY (impersonated_by_identity_id) REFERENCES public.identities(id) ON DELETE SET NULL;


--
-- Name: audit_log audit_log_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.audit_log
    ADD CONSTRAINT audit_log_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: billing_email_log billing_email_log_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.billing_email_log
    ADD CONSTRAINT billing_email_log_user_id_fkey FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE;


--
-- Name: byoc_credentials byoc_credentials_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.byoc_credentials
    ADD CONSTRAINT byoc_credentials_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: byoc_credentials byoc_credentials_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.byoc_credentials
    ADD CONSTRAINT byoc_credentials_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: byoc_credentials byoc_credentials_provider_key_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.byoc_credentials
    ADD CONSTRAINT byoc_credentials_provider_key_fkey FOREIGN KEY (provider_key) REFERENCES public.oauth_providers(key);


--
-- Name: call_results call_results_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.call_results
    ADD CONSTRAINT call_results_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: call_results call_results_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.call_results
    ADD CONSTRAINT call_results_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: connections connections_byoc_credential_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.connections
    ADD CONSTRAINT connections_byoc_credential_id_fkey FOREIGN KEY (byoc_credential_id) REFERENCES public.byoc_credentials(id) ON DELETE SET NULL;


--
-- Name: connections connections_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.connections
    ADD CONSTRAINT connections_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: connections connections_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.connections
    ADD CONSTRAINT connections_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: connections connections_provider_key_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.connections
    ADD CONSTRAINT connections_provider_key_fkey FOREIGN KEY (provider_key) REFERENCES public.oauth_providers(key);


--
-- Name: directory_groups directory_groups_google_directory_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.directory_groups
    ADD CONSTRAINT directory_groups_google_directory_org_id_fkey FOREIGN KEY (google_directory_org_id) REFERENCES public.org_google_directory_configs(org_id) ON DELETE CASCADE;


--
-- Name: directory_groups directory_groups_idp_config_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.directory_groups
    ADD CONSTRAINT directory_groups_idp_config_id_fkey FOREIGN KEY (idp_config_id) REFERENCES public.org_idp_configs(id) ON DELETE CASCADE;


--
-- Name: directory_groups directory_groups_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.directory_groups
    ADD CONSTRAINT directory_groups_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: download_tokens download_tokens_call_result_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.download_tokens
    ADD CONSTRAINT download_tokens_call_result_id_fkey FOREIGN KEY (call_result_id) REFERENCES public.call_results(id) ON DELETE CASCADE;


--
-- Name: download_tokens download_tokens_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.download_tokens
    ADD CONSTRAINT download_tokens_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: download_tokens download_tokens_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.download_tokens
    ADD CONSTRAINT download_tokens_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: download_tokens download_tokens_service_instance_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.download_tokens
    ADD CONSTRAINT download_tokens_service_instance_id_fkey FOREIGN KEY (service_instance_id) REFERENCES public.service_instances(id) ON DELETE CASCADE;


--
-- Name: email_unsubscribe_tokens email_unsubscribe_tokens_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.email_unsubscribe_tokens
    ADD CONSTRAINT email_unsubscribe_tokens_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: email_unsubscribe_tokens email_unsubscribe_tokens_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.email_unsubscribe_tokens
    ADD CONSTRAINT email_unsubscribe_tokens_user_id_fkey FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE;


--
-- Name: enabled_global_templates enabled_global_templates_enabled_by_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.enabled_global_templates
    ADD CONSTRAINT enabled_global_templates_enabled_by_fkey FOREIGN KEY (enabled_by) REFERENCES public.identities(id) ON DELETE SET NULL;


--
-- Name: enabled_global_templates enabled_global_templates_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.enabled_global_templates
    ADD CONSTRAINT enabled_global_templates_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: events events_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.events
    ADD CONSTRAINT events_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: executions executions_approval_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.executions
    ADD CONSTRAINT executions_approval_id_fkey FOREIGN KEY (approval_id) REFERENCES public.approvals(id) ON DELETE CASCADE;


--
-- Name: executions executions_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.executions
    ADD CONSTRAINT executions_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: executions executions_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.executions
    ADD CONSTRAINT executions_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: executions executions_service_instance_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.executions
    ADD CONSTRAINT executions_service_instance_id_fkey FOREIGN KEY (service_instance_id) REFERENCES public.service_instances(id) ON DELETE SET NULL;


--
-- Name: google_directory_connect_flows google_directory_connect_flows_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.google_directory_connect_flows
    ADD CONSTRAINT google_directory_connect_flows_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: google_directory_connect_flows google_directory_connect_flows_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.google_directory_connect_flows
    ADD CONSTRAINT google_directory_connect_flows_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: group_directory_sources group_directory_sources_directory_group_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.group_directory_sources
    ADD CONSTRAINT group_directory_sources_directory_group_id_fkey FOREIGN KEY (directory_group_id) REFERENCES public.directory_groups(id) ON DELETE CASCADE;


--
-- Name: group_directory_sources group_directory_sources_group_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.group_directory_sources
    ADD CONSTRAINT group_directory_sources_group_id_fkey FOREIGN KEY (group_id) REFERENCES public.groups(id) ON DELETE CASCADE;


--
-- Name: group_grants group_grants_group_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.group_grants
    ADD CONSTRAINT group_grants_group_id_fkey FOREIGN KEY (group_id) REFERENCES public.groups(id) ON DELETE CASCADE;


--
-- Name: group_grants group_grants_service_instance_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.group_grants
    ADD CONSTRAINT group_grants_service_instance_id_fkey FOREIGN KEY (service_instance_id) REFERENCES public.service_instances(id) ON DELETE CASCADE;


--
-- Name: groups groups_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.groups
    ADD CONSTRAINT groups_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: groups groups_owner_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.groups
    ADD CONSTRAINT groups_owner_identity_id_fkey FOREIGN KEY (owner_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: identities identities_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identities
    ADD CONSTRAINT identities_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: identities identities_owner_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identities
    ADD CONSTRAINT identities_owner_id_fkey FOREIGN KEY (owner_id) REFERENCES public.identities(id) ON DELETE SET NULL;


--
-- Name: identities identities_parent_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identities
    ADD CONSTRAINT identities_parent_id_fkey FOREIGN KEY (parent_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: identities identities_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identities
    ADD CONSTRAINT identities_user_id_fkey FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE SET NULL;


--
-- Name: identity_directory_groups identity_directory_groups_directory_group_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identity_directory_groups
    ADD CONSTRAINT identity_directory_groups_directory_group_id_fkey FOREIGN KEY (directory_group_id) REFERENCES public.directory_groups(id) ON DELETE CASCADE;


--
-- Name: identity_directory_groups identity_directory_groups_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identity_directory_groups
    ADD CONSTRAINT identity_directory_groups_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: identity_groups identity_groups_group_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identity_groups
    ADD CONSTRAINT identity_groups_group_id_fkey FOREIGN KEY (group_id) REFERENCES public.groups(id) ON DELETE CASCADE;


--
-- Name: identity_groups identity_groups_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.identity_groups
    ADD CONSTRAINT identity_groups_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: mcp_client_agent_bindings mcp_client_agent_bindings_agent_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_client_agent_bindings
    ADD CONSTRAINT mcp_client_agent_bindings_agent_identity_id_fkey FOREIGN KEY (agent_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: mcp_client_agent_bindings mcp_client_agent_bindings_client_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_client_agent_bindings
    ADD CONSTRAINT mcp_client_agent_bindings_client_id_fkey FOREIGN KEY (client_id) REFERENCES public.oauth_mcp_clients(client_id) ON DELETE CASCADE;


--
-- Name: mcp_client_agent_bindings mcp_client_agent_bindings_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_client_agent_bindings
    ADD CONSTRAINT mcp_client_agent_bindings_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: mcp_client_agent_bindings mcp_client_agent_bindings_user_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_client_agent_bindings
    ADD CONSTRAINT mcp_client_agent_bindings_user_identity_id_fkey FOREIGN KEY (user_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: mcp_refresh_tokens mcp_refresh_tokens_client_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_refresh_tokens
    ADD CONSTRAINT mcp_refresh_tokens_client_id_fkey FOREIGN KEY (client_id) REFERENCES public.oauth_mcp_clients(client_id) ON DELETE CASCADE;


--
-- Name: mcp_refresh_tokens mcp_refresh_tokens_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_refresh_tokens
    ADD CONSTRAINT mcp_refresh_tokens_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: mcp_refresh_tokens mcp_refresh_tokens_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_refresh_tokens
    ADD CONSTRAINT mcp_refresh_tokens_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: mcp_refresh_tokens mcp_refresh_tokens_replaced_by_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_refresh_tokens
    ADD CONSTRAINT mcp_refresh_tokens_replaced_by_id_fkey FOREIGN KEY (replaced_by_id) REFERENCES public.mcp_refresh_tokens(id);


--
-- Name: mcp_upstream_connections mcp_upstream_connections_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_connections
    ADD CONSTRAINT mcp_upstream_connections_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: mcp_upstream_connections mcp_upstream_connections_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_connections
    ADD CONSTRAINT mcp_upstream_connections_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: mcp_upstream_flows mcp_upstream_flows_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_flows
    ADD CONSTRAINT mcp_upstream_flows_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: mcp_upstream_flows mcp_upstream_flows_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_flows
    ADD CONSTRAINT mcp_upstream_flows_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: mcp_upstream_tokens mcp_upstream_tokens_connection_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_upstream_tokens
    ADD CONSTRAINT mcp_upstream_tokens_connection_id_fkey FOREIGN KEY (connection_id) REFERENCES public.mcp_upstream_connections(id) ON DELETE CASCADE;


--
-- Name: mcp_url_elicitations mcp_url_elicitations_agent_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.mcp_url_elicitations
    ADD CONSTRAINT mcp_url_elicitations_agent_identity_id_fkey FOREIGN KEY (agent_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: media_descriptors media_descriptors_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.media_descriptors
    ADD CONSTRAINT media_descriptors_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: media_descriptors media_descriptors_service_instance_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.media_descriptors
    ADD CONSTRAINT media_descriptors_service_instance_id_fkey FOREIGN KEY (service_instance_id) REFERENCES public.service_instances(id) ON DELETE CASCADE;


--
-- Name: oauth_connection_flows oauth_connection_flows_actor_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_connection_flows
    ADD CONSTRAINT oauth_connection_flows_actor_identity_id_fkey FOREIGN KEY (actor_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: oauth_connection_flows oauth_connection_flows_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_connection_flows
    ADD CONSTRAINT oauth_connection_flows_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: oauth_connection_flows oauth_connection_flows_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_connection_flows
    ADD CONSTRAINT oauth_connection_flows_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: oauth_connection_flows oauth_connection_flows_service_instance_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_connection_flows
    ADD CONSTRAINT oauth_connection_flows_service_instance_id_fkey FOREIGN KEY (service_instance_id) REFERENCES public.service_instances(id) ON DELETE SET NULL;


--
-- Name: oauth_mcp_clients oauth_mcp_clients_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.oauth_mcp_clients
    ADD CONSTRAINT oauth_mcp_clients_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: org_google_directory_configs org_google_directory_configs_connected_by_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_google_directory_configs
    ADD CONSTRAINT org_google_directory_configs_connected_by_identity_id_fkey FOREIGN KEY (connected_by_identity_id) REFERENCES public.identities(id) ON DELETE SET NULL;


--
-- Name: org_google_directory_configs org_google_directory_configs_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_google_directory_configs
    ADD CONSTRAINT org_google_directory_configs_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: org_idp_configs org_idp_configs_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_idp_configs
    ADD CONSTRAINT org_idp_configs_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: org_idp_configs org_idp_configs_provider_key_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_idp_configs
    ADD CONSTRAINT org_idp_configs_provider_key_fkey FOREIGN KEY (provider_key) REFERENCES public.oauth_providers(key);


--
-- Name: org_oauth_signin_overrides org_oauth_signin_overrides_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_oauth_signin_overrides
    ADD CONSTRAINT org_oauth_signin_overrides_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: org_oauth_signin_overrides org_oauth_signin_overrides_provider_key_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_oauth_signin_overrides
    ADD CONSTRAINT org_oauth_signin_overrides_provider_key_fkey FOREIGN KEY (provider_key) REFERENCES public.oauth_providers(key);


--
-- Name: org_subscriptions org_subscriptions_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.org_subscriptions
    ADD CONSTRAINT org_subscriptions_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: orgs orgs_creator_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.orgs
    ADD CONSTRAINT orgs_creator_user_id_fkey FOREIGN KEY (creator_user_id) REFERENCES public.users(id) ON DELETE SET NULL;


--
-- Name: pending_checkouts pending_checkouts_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.pending_checkouts
    ADD CONSTRAINT pending_checkouts_user_id_fkey FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE;


--
-- Name: pending_mcp_elicitations pending_mcp_elicitations_agent_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.pending_mcp_elicitations
    ADD CONSTRAINT pending_mcp_elicitations_agent_identity_id_fkey FOREIGN KEY (agent_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: pending_mcp_elicitations pending_mcp_elicitations_approval_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.pending_mcp_elicitations
    ADD CONSTRAINT pending_mcp_elicitations_approval_id_fkey FOREIGN KEY (approval_id) REFERENCES public.approvals(id) ON DELETE CASCADE;


--
-- Name: permission_rules permission_rules_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.permission_rules
    ADD CONSTRAINT permission_rules_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: permission_rules permission_rules_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.permission_rules
    ADD CONSTRAINT permission_rules_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: rate_limits rate_limits_group_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.rate_limits
    ADD CONSTRAINT rate_limits_group_id_fkey FOREIGN KEY (group_id) REFERENCES public.groups(id) ON DELETE CASCADE;


--
-- Name: rate_limits rate_limits_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.rate_limits
    ADD CONSTRAINT rate_limits_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: rate_limits rate_limits_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.rate_limits
    ADD CONSTRAINT rate_limits_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: secret_requests secret_requests_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_requests
    ADD CONSTRAINT secret_requests_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: secret_requests secret_requests_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_requests
    ADD CONSTRAINT secret_requests_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: secret_requests secret_requests_requested_by_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_requests
    ADD CONSTRAINT secret_requests_requested_by_fkey FOREIGN KEY (requested_by) REFERENCES public.identities(id);


--
-- Name: secret_requests secret_requests_service_instance_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_requests
    ADD CONSTRAINT secret_requests_service_instance_id_fkey FOREIGN KEY (service_instance_id) REFERENCES public.service_instances(id) ON DELETE CASCADE;


--
-- Name: secret_versions secret_versions_created_by_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_versions
    ADD CONSTRAINT secret_versions_created_by_fkey FOREIGN KEY (created_by) REFERENCES public.identities(id) ON DELETE SET NULL;


--
-- Name: secret_versions secret_versions_provisioned_by_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_versions
    ADD CONSTRAINT secret_versions_provisioned_by_user_id_fkey FOREIGN KEY (provisioned_by_user_id) REFERENCES public.identities(id) ON DELETE SET NULL;


--
-- Name: secret_versions secret_versions_secret_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secret_versions
    ADD CONSTRAINT secret_versions_secret_id_fkey FOREIGN KEY (secret_id) REFERENCES public.secrets(id) ON DELETE CASCADE;


--
-- Name: secrets secrets_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secrets
    ADD CONSTRAINT secrets_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: secrets secrets_owner_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.secrets
    ADD CONSTRAINT secrets_owner_identity_id_fkey FOREIGN KEY (owner_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: service_action_embeddings service_action_embeddings_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_action_embeddings
    ADD CONSTRAINT service_action_embeddings_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: service_action_embeddings service_action_embeddings_owner_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_action_embeddings
    ADD CONSTRAINT service_action_embeddings_owner_identity_id_fkey FOREIGN KEY (owner_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: service_instances service_instances_connection_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_instances
    ADD CONSTRAINT service_instances_connection_id_fkey FOREIGN KEY (connection_id) REFERENCES public.connections(id) ON DELETE SET NULL;


--
-- Name: service_instances service_instances_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_instances
    ADD CONSTRAINT service_instances_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: service_instances service_instances_owner_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_instances
    ADD CONSTRAINT service_instances_owner_identity_id_fkey FOREIGN KEY (owner_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: service_instances service_instances_template_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_instances
    ADD CONSTRAINT service_instances_template_id_fkey FOREIGN KEY (template_id) REFERENCES public.service_templates(id) ON DELETE SET NULL;


--
-- Name: service_templates service_templates_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_templates
    ADD CONSTRAINT service_templates_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: service_templates service_templates_owner_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.service_templates
    ADD CONSTRAINT service_templates_owner_identity_id_fkey FOREIGN KEY (owner_identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: staged_uploads staged_uploads_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.staged_uploads
    ADD CONSTRAINT staged_uploads_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: staged_uploads staged_uploads_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.staged_uploads
    ADD CONSTRAINT staged_uploads_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: staged_uploads staged_uploads_owner_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.staged_uploads
    ADD CONSTRAINT staged_uploads_owner_user_id_fkey FOREIGN KEY (owner_user_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: upload_tokens upload_tokens_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.upload_tokens
    ADD CONSTRAINT upload_tokens_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: upload_tokens upload_tokens_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.upload_tokens
    ADD CONSTRAINT upload_tokens_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: upload_tokens upload_tokens_service_instance_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.upload_tokens
    ADD CONSTRAINT upload_tokens_service_instance_id_fkey FOREIGN KEY (service_instance_id) REFERENCES public.service_instances(id) ON DELETE CASCADE;


--
-- Name: user_org_memberships user_org_memberships_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.user_org_memberships
    ADD CONSTRAINT user_org_memberships_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: user_org_memberships user_org_memberships_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.user_org_memberships
    ADD CONSTRAINT user_org_memberships_user_id_fkey FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE;


--
-- Name: user_sessions user_sessions_identity_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.user_sessions
    ADD CONSTRAINT user_sessions_identity_id_fkey FOREIGN KEY (identity_id) REFERENCES public.identities(id) ON DELETE CASCADE;


--
-- Name: user_sessions user_sessions_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.user_sessions
    ADD CONSTRAINT user_sessions_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: user_sessions user_sessions_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.user_sessions
    ADD CONSTRAINT user_sessions_user_id_fkey FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE;


--
-- Name: users users_personal_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.users
    ADD CONSTRAINT users_personal_org_id_fkey FOREIGN KEY (personal_org_id) REFERENCES public.orgs(id) ON DELETE SET NULL;


--
-- Name: webhook_deliveries webhook_deliveries_subscription_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.webhook_deliveries
    ADD CONSTRAINT webhook_deliveries_subscription_id_fkey FOREIGN KEY (subscription_id) REFERENCES public.webhook_subscriptions(id) ON DELETE CASCADE;


--
-- Name: webhook_digest_runs webhook_digest_runs_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.webhook_digest_runs
    ADD CONSTRAINT webhook_digest_runs_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- Name: webhook_subscriptions webhook_subscriptions_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
--

ALTER TABLE ONLY public.webhook_subscriptions
    ADD CONSTRAINT webhook_subscriptions_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE;


--
-- PostgreSQL database dump complete
--

\unrestrict Ima6egLcgrnJ79TnxwblysVaIC9DjWdCHPDn0FnJXFFtcuWvCqfvYirq9Tx4HXW