// Package roles owns persistence for the resource runtime Role catalog, // immutable versions, package manifests, grants, agent assignments, // realizations, and operation receipts. These persistence projections are not // interchangeable with AgentTeam organization roles, API DTOs, or the Approval-driven // rolemanagement execution projection. package roles import "time" // Role is the persisted resource runtime catalog entry for a reusable agent setup. // Preset Roles are copied into this table before a user may edit them. type Role struct { ID string `gorm:"primaryKey;size:64"` WorkspaceID string `gorm:"size:64;not null;index:idx_roles_workspace_updated;uniqueIndex:uk_roles_workspace_slug"` OwnerType string `gorm:"size:32;not null;default:'user';index"` OwnerID string `gorm:"size:64;not null;default:'';index"` Slug string `gorm:"size:255;not null;default:'';index;uniqueIndex:uk_roles_workspace_slug"` Name string `gorm:"size:255;not null"` Description string `gorm:"type:text;not null"` Locale string `gorm:"size:32;not null;default:'';index"` Scenario string `gorm:"size:64;not null;default:'';index"` Icon string `gorm:"size:128;not null;default:''"` TagsJSON string `gorm:"column:tags_json;type:text;not null"` Definition string `gorm:"type:text;not null"` RuntimeHintsJSON string `gorm:"column:runtime_hints_json;type:text;not null"` AttachmentsJSON string `gorm:"column:attachments_json;type:text;not null"` SourceKind string `gorm:"size:32;not null;default:'manual';index"` SourceRef string `gorm:"size:128;not null;default:'';index"` SourceVersion int `gorm:"not null;default:0"` Visibility string `gorm:"size:32;not null;default:'private';index"` ActiveVersionID string `gorm:"size:64;not null;default:'';index"` SourcePresetID string `gorm:"size:128;not null;default:'';index"` SourcePresetVersion int `gorm:"not null;default:0"` SourceAgentID string `gorm:"size:64;not null;default:'';index"` IsActive bool `gorm:"not null;default:true;index"` CreatedBy string `gorm:"size:64;not null"` UpdatedBy string `gorm:"size:64;not null"` CreatedAt time.Time `gorm:"not null"` UpdatedAt time.Time `gorm:"not null;index:idx_roles_workspace_updated"` DeletedAt *time.Time `gorm:"index"` Role string `gorm:"-"` CanManage bool `gorm:"-"` } // TableName preserves the resource Role catalog table. func (Role) TableName() string { return "roles" } // RoleGrant records an authorization grant on a resource runtime Role. // Authorization policy remains owned by the resource Role service. type RoleGrant struct { ID string `gorm:"primaryKey;size:64"` WorkspaceID string `gorm:"size:64;not null;index:idx_role_grants_subject;uniqueIndex:uk_role_grants_subject"` RoleID string `gorm:"size:64;not null;index:idx_role_grants_role;uniqueIndex:uk_role_grants_subject"` SubjectType string `gorm:"size:32;not null;index:idx_role_grants_subject;uniqueIndex:uk_role_grants_subject"` SubjectID string `gorm:"size:64;not null;index:idx_role_grants_subject;uniqueIndex:uk_role_grants_subject"` Role string `gorm:"size:32;not null;default:'view'"` CreatedBy string `gorm:"size:64;not null"` UpdatedBy string `gorm:"size:64;not null"` CreatedAt time.Time `gorm:"not null"` UpdatedAt time.Time `gorm:"not null;index"` } // TableName preserves the resource Role grant table. func (RoleGrant) TableName() string { return "role_grants" } // RoleVersion is an immutable published resource Role definition projection. type RoleVersion struct { ID string `gorm:"primaryKey;size:64;index:idx_role_versions_history,priority:5"` RoleID string `gorm:"size:64;not null;index:idx_role_versions_role_version;uniqueIndex:uk_role_versions_role_version;index:idx_role_versions_exact_content,priority:2;index:idx_role_versions_history,priority:2"` WorkspaceID string `gorm:"size:64;not null;index;index:idx_role_versions_exact_content,priority:1;index:idx_role_versions_history,priority:1"` Version int `gorm:"not null;uniqueIndex:uk_role_versions_role_version"` Status string `gorm:"size:32;not null;default:'draft';index"` Definition string `gorm:"type:text;not null"` RuntimeHintsJSON string `gorm:"column:runtime_hints_json;type:text;not null"` ProvenanceJSON string `gorm:"column:provenance_json;type:text;not null"` NonPortableSummaryJSON string `gorm:"column:non_portable_summary_json;type:text;not null"` ContentID string `gorm:"size:64;not null;default:'';index:idx_role_versions_content;index:idx_role_versions_exact_content,priority:3;index:idx_role_versions_history,priority:3"` ContentVersionID string `gorm:"size:64;not null;default:'';index:idx_role_versions_content;index:idx_role_versions_exact_content,priority:4"` CreatedBy string `gorm:"size:64;not null"` CreatedAt time.Time `gorm:"not null;index:idx_role_versions_history,priority:4"` } // TableName preserves the immutable resource Role version table. func (RoleVersion) TableName() string { return "role_versions" } // RoleVersionSummary is the narrow immutable history projection returned by // bounded list queries. Package payload summaries remain on RoleVersion and // are loaded only for an explicit version read. type RoleVersionSummary struct { ID string Version int ContentID string ContentVersionID string CreatedBy string CreatedAt time.Time } // RolePackageManifestItem persists one resource dependency or portable content // item attached to an immutable Role version. type RolePackageManifestItem struct { ID string `gorm:"primaryKey;size:64"` RoleVersionID string `gorm:"size:64;not null;index:idx_role_pkg_manifest_role_version_sort;index:idx_role_pkg_manifest_scope_content,priority:3"` RoleID string `gorm:"size:64;not null;index;index:idx_role_pkg_manifest_scope_content,priority:2"` WorkspaceID string `gorm:"size:64;not null;index;index:idx_role_pkg_manifest_scope_content,priority:1"` ItemType string `gorm:"column:item_type;size:64;not null;index"` Name string `gorm:"size:255;not null;default:''"` Description string `gorm:"type:text;not null"` Required bool `gorm:"not null;default:false"` RealizationAction string `gorm:"column:realization_action;size:32;not null;default:''"` SourceKind string `gorm:"column:source_kind;size:32;not null;default:''"` SourceResourceID string `gorm:"column:source_resource_id;size:128;not null;default:''"` SourceRef string `gorm:"column:source_ref;type:text;not null"` ContentRef string `gorm:"column:content_ref;type:text;not null"` ContentID string `gorm:"column:content_id;size:64;not null;default:'';index:idx_role_pkg_manifest_content,priority:1;index:idx_role_pkg_manifest_scope_content,priority:4"` ContentVersionID string `gorm:"column:content_version_id;size:64;not null;default:'';index:idx_role_pkg_manifest_content,priority:2;index:idx_role_pkg_manifest_scope_content,priority:5"` ContentPath string `gorm:"column:content_path;size:1024;not null;default:''"` ContentHash string `gorm:"column:content_hash;size:128;not null;default:''"` AccessLevel string `gorm:"column:access_level;size:32;not null;default:''"` Branch string `gorm:"size:255;not null;default:''"` Content string `gorm:"type:text;not null"` SortOrder int `gorm:"column:sort_order;not null;default:0;index:idx_role_pkg_manifest_role_version_sort"` MetadataJSON string `gorm:"column:metadata_json;type:text;not null"` } // TableName preserves the resource Role package manifest table. func (RolePackageManifestItem) TableName() string { return "role_package_manifest_items" } // AgentRoleBinding persists the selected resource Role version and realization // assigned to one agent. Assignment policy remains in the resource Role service. type AgentRoleBinding struct { ID string `gorm:"primaryKey;size:64"` WorkspaceID string `gorm:"size:64;not null;index:idx_agent_role_bindings_agent;uniqueIndex:uk_agent_role_bindings_agent"` AgentID string `gorm:"size:64;not null;index:idx_agent_role_bindings_agent;uniqueIndex:uk_agent_role_bindings_agent"` BindingKind string `gorm:"column:binding_kind;size:32;not null;default:'blank';index"` RoleID string `gorm:"size:64;not null;default:'';index"` RoleVersionID string `gorm:"column:role_version_id;size:64;not null;default:'';index"` SourcePresetRoleID string `gorm:"column:source_preset_role_id;size:128;not null;default:''"` SourcePresetVersionID string `gorm:"column:source_preset_version_id;size:64;not null;default:''"` ActiveDefinitionPath string `gorm:"column:active_definition_path;size:255;not null;default:''"` RealizationID string `gorm:"column:realization_id;size:64;not null;default:'';index"` CreatedBy string `gorm:"size:64;not null"` UpdatedBy string `gorm:"size:64;not null"` CreatedAt time.Time `gorm:"not null"` UpdatedAt time.Time `gorm:"not null"` } // TableName preserves the agent resource Role binding table. func (AgentRoleBinding) TableName() string { return "agent_role_bindings" } // RoleRealization records one plan or application of a resource Role to an agent. type RoleRealization struct { ID string `gorm:"primaryKey;size:64"` WorkspaceID string `gorm:"size:64;not null;index"` AgentID string `gorm:"size:64;not null;index:idx_role_realizations_agent_created"` RoleID string `gorm:"size:64;not null;default:'';index"` RoleVersionID string `gorm:"column:role_version_id;size:64;not null;default:'';index"` Status string `gorm:"size:32;not null;default:'planned';index"` DryRun bool `gorm:"column:dry_run;not null;default:false"` CreatedBy string `gorm:"size:64;not null"` CreatedAt time.Time `gorm:"not null;index:idx_role_realizations_agent_created"` } // TableName preserves the resource Role realization table. func (RoleRealization) TableName() string { return "role_realizations" } // RoleRealizationItem records one resource action produced by a Role realization. type RoleRealizationItem struct { ID string `gorm:"primaryKey;size:64"` RealizationID string `gorm:"column:realization_id;size:64;not null;index:idx_role_realization_items_realization_sort"` ManifestItemID string `gorm:"column:manifest_item_id;size:64;not null;default:'';index"` ManifestItemType string `gorm:"column:manifest_item_type;size:64;not null;default:''"` ManifestItemName string `gorm:"column:manifest_item_name;size:255;not null;default:''"` Action string `gorm:"size:32;not null;default:''"` Status string `gorm:"size:32;not null;default:''"` ResourceID string `gorm:"column:resource_id;size:128;not null;default:''"` Branch string `gorm:"size:255;not null;default:''"` AccessLevel string `gorm:"column:access_level;size:32;not null;default:''"` Message string `gorm:"type:text;not null"` Required bool `gorm:"not null;default:false"` SortOrder int `gorm:"column:sort_order;not null;default:0;index:idx_role_realization_items_realization_sort"` } // TableName preserves the resource Role realization item table. func (RoleRealizationItem) TableName() string { return "role_realization_items" } // RoleOperationReceipt records the stable result of a workspace-scoped resource // Role command. The operation key is shared by every action so callers cannot // reuse one request identity for a different mutation. type RoleOperationReceipt struct { WorkspaceID string `gorm:"size:64;not null;uniqueIndex:uk_role_operation_receipts_workspace_key"` OperationKey string `gorm:"size:255;not null;uniqueIndex:uk_role_operation_receipts_workspace_key"` Action string `gorm:"size:32;not null"` RequestDigest string `gorm:"size:128;not null"` ResultJSON string `gorm:"column:result_json;type:text;not null"` CreatedAt time.Time `gorm:"not null"` } // TableName preserves the resource Role operation receipt table. func (RoleOperationReceipt) TableName() string { return "role_operation_receipts" }