[{"data":1,"prerenderedAt":3982},["ShallowReactive",2],{"navigation":3,"/app-enablement/scoped-sql":1197,"/app-enablement/scoped-sql-surround":3977},[4,45,67,118,136,209,230],{"title":5,"path":6,"stem":7,"children":8,"icon":10},"Use it","/use","00.use/1.index",[9,11,16,21,26,30,35,40],{"title":5,"path":6,"stem":7,"icon":10},"i-lucide-list-checks",{"title":12,"path":13,"stem":14,"icon":15},"Run a workflow from an assistant","/use/run-from-an-assistant","00.use/2.run-from-an-assistant","i-lucide-bot",{"title":17,"path":18,"stem":19,"icon":20},"Connect a cloud and use it","/use/connect-a-cloud","00.use/3.connect-a-cloud","i-lucide-cloud",{"title":22,"path":23,"stem":24,"icon":25},"Put Orkestia in your app","/use/in-your-app","00.use/4.in-your-app","i-lucide-key-round",{"title":27,"path":28,"stem":29,"icon":15},"Stand up an actor","/use/stand-up-an-actor","00.use/5.stand-up-an-actor",{"title":31,"path":32,"stem":33,"icon":34},"Operate a run","/use/operate-a-run","00.use/6.operate-a-run","i-lucide-activity",{"title":36,"path":37,"stem":38,"icon":39},"Work from the desktop app","/use/work-from-the-desktop-app","00.use/7.work-from-the-desktop-app","i-lucide-app-window",{"title":41,"path":42,"stem":43,"icon":44},"Let an agent use your browser","/use/let-an-agent-use-your-browser","00.use/8.let-an-agent-use-your-browser","i-lucide-globe",{"title":46,"path":47,"stem":48,"children":49,"icon":52},"Getting Started","/getting-started","02.getting-started/1.index",[50,53,58,63],{"title":51,"path":47,"stem":48,"icon":52},"Quick Start","i-lucide-rocket",{"title":54,"path":55,"stem":56,"icon":57},"Architecture Overview","/getting-started/architecture-overview","02.getting-started/2.architecture-overview","i-lucide-layout-dashboard",{"title":59,"path":60,"stem":61,"icon":62},"Concepts at a Glance","/getting-started/concepts","02.getting-started/3.concepts","i-lucide-list",{"title":64,"path":65,"stem":66,"icon":15},"Connect an AI Assistant","/getting-started/connect-an-ai-assistant","02.getting-started/4.connect-an-ai-assistant",{"title":68,"path":69,"stem":70,"children":71,"icon":73},"Guides","/guides","04.guides/1.index",[72,74,79,84,89,94,99,104,109,113],{"title":68,"path":69,"stem":70,"icon":73},"i-lucide-compass",{"title":75,"path":76,"stem":77,"icon":78},"Receive webhooks with a re-query","/guides/webhooks-with-requery","04.guides/10.webhooks-with-requery","i-lucide-webhook",{"title":80,"path":81,"stem":82,"icon":83},"Keep scheduled compositions cheap","/guides/composition-runtime-cost","04.guides/11.composition-runtime-cost","i-lucide-gauge",{"title":85,"path":86,"stem":87,"icon":88},"Building with DGI","/guides/building-with-dgi","04.guides/2.building-with-dgi","i-lucide-brain-circuit",{"title":90,"path":91,"stem":92,"icon":93},"Creating & Exposing Virtual Workflows","/guides/virtual-workflows","04.guides/4.virtual-workflows","i-lucide-blocks",{"title":95,"path":96,"stem":97,"icon":98},"Runner Management & Provisioning","/guides/runner-management","04.guides/5.runner-management","i-lucide-server",{"title":100,"path":101,"stem":102,"icon":103},"Security & Compliance","/guides/security-and-compliance","04.guides/7.security-and-compliance","i-lucide-shield",{"title":105,"path":106,"stem":107,"icon":108},"Tickets & Software Delivery","/guides/tickets-and-software-delivery","04.guides/8.tickets-and-software-delivery","i-lucide-ticket",{"title":110,"path":111,"stem":112},"Orkestia for AI-driven cloud infrastructure automation","/guides/cloud-automation-alternatives","04.guides/9.cloud-automation-alternatives",{"title":114,"path":115,"stem":116,"icon":117},"Typed decisions with TypeSafe","/guides/typed-decisions-with-typesafe","04.guides/9.typed-decisions-with-typesafe","i-lucide-git-branch",{"title":119,"path":120,"stem":121,"children":122,"icon":125},"Introduction","/introduction","01.introduction/1.index",[123,126,131],{"title":124,"path":120,"stem":121,"icon":125},"What is Orkestia?","i-lucide-sparkles",{"title":127,"path":128,"stem":129,"icon":130},"Core Philosophy","/introduction/core-philosophy","01.introduction/2.core-philosophy","i-lucide-shield-check",{"title":132,"path":133,"stem":134,"icon":135},"Key Benefits","/introduction/key-benefits","01.introduction/3.key-benefits","i-lucide-trophy",{"title":137,"path":138,"stem":139,"children":140,"icon":142},"Core Concepts","/concepts","03.concepts/01.index",[141,143,148,153,158,163,167,172,176,181,186,191,195,200,204],{"title":137,"path":138,"stem":139,"icon":142},"i-lucide-book-open",{"title":144,"path":145,"stem":146,"icon":147},"Workflows","/concepts/workflows","03.concepts/02.workflows","i-lucide-workflow",{"title":149,"path":150,"stem":151,"icon":152},"DGI — Dialog Generative Interface","/concepts/dgi","03.concepts/03.dgi","i-lucide-brain",{"title":154,"path":155,"stem":156,"icon":157},"How DGI works","/concepts/dgi-how-it-works","03.concepts/03.dgi-how-it-works","i-lucide-cpu",{"title":159,"path":160,"stem":161,"icon":162},"Staff & AI Workforce Governance","/concepts/staff-governance","03.concepts/04.staff-governance","i-lucide-users-round",{"title":164,"path":165,"stem":166,"icon":15},"Agents — the execution substrate","/concepts/agents-platform","03.concepts/05.agents-platform",{"title":168,"path":169,"stem":170,"icon":171},"Runners & Execution Environments","/concepts/runners","03.concepts/06.runners","i-lucide-server-cog",{"title":173,"path":174,"stem":175,"icon":34},"Lumen Observability","/concepts/lumen","03.concepts/07.lumen",{"title":177,"path":178,"stem":179,"icon":180},"Identity & Multi-Tenancy","/concepts/identity-multi-tenancy","03.concepts/08.identity-multi-tenancy","i-lucide-users",{"title":182,"path":183,"stem":184,"icon":185},"Billing, Pricing & Seats","/concepts/billing-and-seats","03.concepts/09.billing-and-seats","i-lucide-credit-card",{"title":187,"path":188,"stem":189,"icon":190},"App Data","/concepts/appdata","03.concepts/10.appdata","i-lucide-database",{"title":192,"path":193,"stem":194,"icon":152},"Engram","/concepts/engram","03.concepts/11.engram",{"title":196,"path":197,"stem":198,"icon":199},"DevKit","/concepts/devkit","03.concepts/12.devkit","i-lucide-terminal",{"title":201,"path":202,"stem":203,"icon":44},"App Host","/concepts/app-host","03.concepts/13.app-host",{"title":205,"path":206,"stem":207,"icon":208},"Agent Exchange","/concepts/agent-exchange","03.concepts/14.agent-exchange","i-lucide-landmark",{"title":210,"path":211,"stem":212,"children":213,"icon":215},"Reference","/reference","05.reference/1.index",[214,216,221,225],{"title":210,"path":211,"stem":212,"icon":215},"i-lucide-library",{"title":217,"path":218,"stem":219,"icon":220},"MCP Integration","/reference/mcp-integration","05.reference/3.mcp-integration","i-lucide-plug-zap",{"title":222,"path":223,"stem":224,"icon":199},"API & Tooling","/reference/api-tooling","05.reference/4.api-tooling",{"title":226,"path":227,"stem":228,"icon":229},"Platform Services","/reference/platform-services","05.reference/7.platform-services","i-lucide-boxes",{"title":231,"path":232,"icon":215,"children":233},"Product pages","/product-pages",[234,261,282,311,346,369,412,439,472,495,565,590,636,650,672,742,785,808,820,910,938,986,1013,1049,1135,1153,1165,1184,1191],{"title":235,"path":236,"stem":237,"children":238,"icon":240},"Advanced Topics","/advanced","06.advanced/1.index",[239,241,246,251,256],{"title":235,"path":236,"stem":237,"icon":240},"i-lucide-flask-conical",{"title":242,"path":243,"stem":244,"icon":245},"Hybrid AI + Deterministic Execution","/advanced/hybrid-execution-model","06.advanced/2.hybrid-execution-model","i-lucide-git-merge",{"title":247,"path":248,"stem":249,"icon":250},"Drift Detection & Self-Healing","/advanced/drift-detection-self-healing","06.advanced/3.drift-detection-self-healing","i-lucide-heart-pulse",{"title":252,"path":253,"stem":254,"icon":255},"Governance & Approvals","/advanced/governance-and-approvals","06.advanced/4.governance-and-approvals","i-lucide-scale",{"title":257,"path":258,"stem":259,"icon":260},"Cost & Performance Optimization","/advanced/cost-and-performance","06.advanced/5.cost-and-performance","i-lucide-zap",{"title":262,"path":263,"stem":264,"children":265,"icon":267},"Operations","/operations","07.operations/1.index",[266,268,272,277],{"title":262,"path":263,"stem":264,"icon":267},"i-lucide-settings-2",{"title":269,"path":270,"stem":271,"icon":229},"Deployment Models","/operations/deployment-models","07.operations/2.deployment-models",{"title":273,"path":274,"stem":275,"icon":276},"Monitoring & Debugging","/operations/monitoring-and-debugging","07.operations/3.monitoring-and-debugging","i-lucide-bug",{"title":278,"path":279,"stem":280,"icon":281},"Best Practices","/operations/best-practices","07.operations/4.best-practices","i-lucide-check-check",{"title":283,"path":284,"stem":285,"children":286,"icon":288},"AWS Connections","/aws-connections","08.aws-connections/1.index",[287,289,292,297,302,307],{"title":283,"path":284,"stem":285,"icon":288},"i-simple-icons-amazonaws",{"title":46,"path":290,"stem":291,"icon":52},"/aws-connections/getting-started","08.aws-connections/2.getting-started",{"title":293,"path":294,"stem":295,"icon":296},"Setup Methods","/aws-connections/setup-methods","08.aws-connections/3.setup-methods","i-lucide-wrench",{"title":298,"path":299,"stem":300,"icon":301},"Managing Connections","/aws-connections/managing-connections","08.aws-connections/4.managing-connections","i-lucide-settings",{"title":303,"path":304,"stem":305,"icon":306},"Security Best Practices","/aws-connections/security-best-practices","08.aws-connections/5.security-best-practices","i-lucide-lock",{"title":308,"path":309,"stem":310,"icon":276},"Troubleshooting","/aws-connections/troubleshooting","08.aws-connections/6.troubleshooting",{"title":312,"path":313,"stem":314,"children":315,"icon":317},"Cloud Connections","/cloud-connections","09.cloud-connections/1.index",[316,318,323,328,332,337,341],{"title":312,"path":313,"stem":314,"icon":317},"i-lucide-cable",{"title":319,"path":320,"stem":321,"icon":322},"Google Cloud (GCP)","/cloud-connections/gcp","09.cloud-connections/2.gcp","i-simple-icons-googlecloud",{"title":324,"path":325,"stem":326,"icon":327},"Microsoft Azure","/cloud-connections/azure","09.cloud-connections/3.azure","i-simple-icons-microsoftazure",{"title":329,"path":330,"stem":331,"icon":20},"Magalu Cloud","/cloud-connections/magalu","09.cloud-connections/4.magalu",{"title":333,"path":334,"stem":335,"icon":336},"Kubernetes","/cloud-connections/kubernetes","09.cloud-connections/5.kubernetes","i-simple-icons-kubernetes",{"title":338,"path":339,"stem":340,"icon":255},"TypeSafe","/cloud-connections/typesafe","09.cloud-connections/6.typesafe",{"title":342,"path":343,"stem":344,"icon":345},"Email mailboxes","/cloud-connections/email","09.cloud-connections/7.email","i-lucide-mail",{"title":347,"path":348,"stem":349,"children":350,"icon":98},"DNS Providers","/dns-providers","10.dns-providers/1.index",[351,353,356,359,362,366],{"title":352,"path":348,"stem":349,"icon":98},"DNS Provider Connections",{"title":46,"path":354,"stem":355,"icon":52},"/dns-providers/getting-started","10.dns-providers/2.getting-started",{"title":293,"path":357,"stem":358,"icon":296},"/dns-providers/setup-methods","10.dns-providers/3.setup-methods",{"title":298,"path":360,"stem":361,"icon":301},"/dns-providers/managing-connections","10.dns-providers/4.managing-connections",{"title":363,"path":364,"stem":365,"icon":62},"Zones and Records","/dns-providers/zones-and-records","10.dns-providers/5.zones-and-records",{"title":308,"path":367,"stem":368,"icon":276},"/dns-providers/troubleshooting","10.dns-providers/6.troubleshooting",{"title":370,"path":371,"stem":372,"children":373,"icon":52},"Cloud Deploy","/cloud-deploy","11.cloud-deploy/01.index",[374,375,378,383,387,392,396,400,405,409],{"title":370,"path":371,"stem":372,"icon":52},{"title":46,"path":376,"stem":377,"icon":52},"/cloud-deploy/getting-started","11.cloud-deploy/02.getting-started",{"title":379,"path":380,"stem":381,"icon":382},"Creating a Site","/cloud-deploy/creating-a-site","11.cloud-deploy/03.creating-a-site","i-lucide-plus-circle",{"title":384,"path":385,"stem":386,"icon":57},"Site Overview and Deployments","/cloud-deploy/site-overview","11.cloud-deploy/04.site-overview",{"title":388,"path":389,"stem":390,"icon":391},"Deployment Progress and Success","/cloud-deploy/deployment-progress","11.cloud-deploy/05.deployment-progress","i-lucide-loader",{"title":393,"path":394,"stem":395,"icon":301},"Settings","/cloud-deploy/settings","11.cloud-deploy/06.settings",{"title":397,"path":398,"stem":399,"icon":44},"Custom Domains","/cloud-deploy/custom-domains","11.cloud-deploy/07.custom-domains",{"title":401,"path":402,"stem":403,"icon":404},"Resources, Releases, and Danger Zone","/cloud-deploy/resources-releases","11.cloud-deploy/08.resources-releases","i-lucide-package",{"title":406,"path":407,"stem":408,"icon":103},"Admin Dashboard","/cloud-deploy/admin-dashboard","11.cloud-deploy/09.admin-dashboard",{"title":308,"path":410,"stem":411,"icon":276},"/cloud-deploy/troubleshooting","11.cloud-deploy/10.troubleshooting",{"title":413,"path":414,"stem":415,"children":416,"icon":419},"User Onboarding","/user-onboarding","12.user-onboarding/1.index",[417,420,423,428,432,436],{"title":418,"path":414,"stem":415,"icon":419},"User Creation and Onboarding","i-lucide-user-plus",{"title":46,"path":421,"stem":422,"icon":52},"/user-onboarding/getting-started","12.user-onboarding/2.getting-started",{"title":424,"path":425,"stem":426,"icon":427},"Creating Your Organization","/user-onboarding/onboarding","12.user-onboarding/3.onboarding","i-lucide-building-2",{"title":429,"path":430,"stem":431,"icon":345},"Invitations","/user-onboarding/invitations","12.user-onboarding/4.invitations",{"title":433,"path":434,"stem":435,"icon":301},"Managing Your Account","/user-onboarding/managing-account","12.user-onboarding/5.managing-account",{"title":308,"path":437,"stem":438,"icon":276},"/user-onboarding/troubleshooting","12.user-onboarding/6.troubleshooting",{"title":393,"path":440,"stem":441,"children":442,"icon":444},"/settings","13.settings/1.index",[443,445,450,454,459,463,467],{"title":393,"path":440,"stem":441,"icon":444},"i-lucide-sliders-horizontal",{"title":446,"path":447,"stem":448,"icon":449},"General Settings","/settings/general","13.settings/2.general","i-lucide-user",{"title":451,"path":452,"stem":453,"icon":180},"Members Settings","/settings/members","13.settings/3.members",{"title":455,"path":456,"stem":457,"icon":458},"Notifications Settings","/settings/notifications","13.settings/4.notifications","i-lucide-bell",{"title":460,"path":461,"stem":462,"icon":103},"Security Settings","/settings/security","13.settings/5.security",{"title":464,"path":465,"stem":466,"icon":25},"Signing Keys","/settings/keys","13.settings/6.keys",{"title":468,"path":469,"stem":470,"icon":471},"API Tokens","/settings/api-tokens","13.settings/7.api-tokens","i-lucide-key",{"title":473,"path":474,"stem":475,"children":476,"icon":52},"App Enablement","/app-enablement","14.app-enablement/1.index",[477,478,482,486,490],{"title":473,"path":474,"stem":475,"icon":52},{"title":479,"path":480,"stem":481,"icon":25},"Sign in with Orkestia","/app-enablement/sign-in-with-orkestia","14.app-enablement/2.sign-in-with-orkestia",{"title":483,"path":484,"stem":485,"icon":190},"End-user data","/app-enablement/end-user-data","14.app-enablement/3.end-user-data",{"title":487,"path":488,"stem":489,"icon":93},"Compositions — use, invoke, share","/app-enablement/compositions","14.app-enablement/4.compositions",{"title":491,"path":492,"stem":493,"icon":494},"Scoped SQL on your own database","/app-enablement/scoped-sql","14.app-enablement/5.scoped-sql","i-lucide-database-zap",{"title":496,"path":497,"stem":498,"children":499,"icon":34},"Lumen","/lumen","15.lumen/1.index",[500,501,506,510,515,519,523,527,532,537,542,546,550,555,560],{"title":496,"path":497,"stem":498,"icon":34},{"title":502,"path":503,"stem":504,"icon":505},"Explore and correlate","/lumen/explore-and-correlate","15.lumen/10.explore-and-correlate","i-lucide-link-2",{"title":507,"path":508,"stem":509,"icon":125},"AI analytics in the Cockpit app","/lumen/ai-analytics-in-cockpit","15.lumen/11.ai-analytics-in-cockpit",{"title":511,"path":512,"stem":513,"icon":514},"Pulse in the Cockpit app","/lumen/pulse-in-cockpit","15.lumen/12.pulse-in-cockpit","i-lucide-bar-chart-3",{"title":516,"path":517,"stem":518,"icon":444},"Rules in the Cockpit app","/lumen/rules-in-cockpit","15.lumen/13.rules-in-cockpit",{"title":520,"path":521,"stem":522,"icon":185},"Plans, usage and API keys in the Cockpit app","/lumen/plans-usage-and-keys","15.lumen/14.plans-usage-and-keys",{"title":524,"path":525,"stem":526,"icon":267},"Settings and bulk actions","/lumen/settings-and-bulk-actions","15.lumen/15.settings-and-bulk-actions",{"title":528,"path":529,"stem":530,"icon":531},"Enable Lumen","/lumen/enable","15.lumen/2.enable","i-lucide-power",{"title":533,"path":534,"stem":535,"icon":536},"Send data","/lumen/send-data","15.lumen/3.send-data","i-lucide-upload",{"title":538,"path":539,"stem":540,"icon":541},"Collector","/lumen/collector","15.lumen/4.collector","i-lucide-container",{"title":543,"path":544,"stem":545,"icon":57},"Use Lumen","/lumen/observe","15.lumen/5.observe",{"title":547,"path":548,"stem":549,"icon":15},"Lumen MCP","/lumen/mcp","15.lumen/6.mcp",{"title":551,"path":552,"stem":553,"icon":554},"Query API","/lumen/query-api","15.lumen/7.query-api","i-lucide-search",{"title":556,"path":557,"stem":558,"icon":559},"Lumen in the Cockpit app","/lumen/cockpit-mode","15.lumen/8.cockpit-mode","i-lucide-monitor-smartphone",{"title":561,"path":562,"stem":563,"icon":564},"Dashboards in the Cockpit app","/lumen/dashboards-in-cockpit","15.lumen/9.dashboards-in-cockpit","i-lucide-layout-grid",{"title":566,"path":567,"stem":568,"children":569,"icon":571},"SDKs","/sdks","16.sdks/1.index",[570,572,577,582,586],{"title":566,"path":567,"stem":568,"icon":571},"i-lucide-code",{"title":573,"path":574,"stem":575,"icon":576},"Workflows SDK — Node / TypeScript","/sdks/workflows-nodejs","16.sdks/2.workflows-nodejs","i-lucide-file-ts",{"title":578,"path":579,"stem":580,"icon":581},"Workflows SDK — Python","/sdks/workflows-python","16.sdks/3.workflows-python","i-simple-icons-python",{"title":583,"path":584,"stem":585,"icon":25},"Auth SDK — Sign in with Orkestia","/sdks/auth","16.sdks/4.auth",{"title":587,"path":588,"stem":589,"icon":514},"Pulse SDK — product analytics for your app","/sdks/lumen-pulse","16.sdks/5.lumen-pulse",{"title":187,"path":591,"stem":592,"children":593,"icon":190},"/appdata","17.appdata/1.index",[594,595,599,604,609,613,617,622,627,632],{"title":187,"path":591,"stem":592,"icon":190},{"title":596,"path":597,"stem":598,"icon":15},"Agents over App Data","/appdata/end-user-agents","17.appdata/10.end-user-agents",{"title":600,"path":601,"stem":602,"icon":603},"Declare structures","/appdata/declare","17.appdata/2.declare","i-lucide-table",{"title":605,"path":606,"stem":607,"icon":608},"Records & Data API","/appdata/data-api","17.appdata/3.data-api","i-lucide-rows-3",{"title":610,"path":611,"stem":612,"icon":427},"Ownership & workspaces","/appdata/ownership","17.appdata/4.ownership",{"title":614,"path":615,"stem":616,"icon":39},"Expose App Data to end-users","/appdata/expose","17.appdata/5.expose",{"title":618,"path":619,"stem":620,"icon":621},"PostgREST HTTP","/appdata/postgrest","17.appdata/6.postgrest","i-lucide-unplug",{"title":623,"path":624,"stem":625,"icon":626},"Ordered append","/appdata/append","17.appdata/7.append","i-lucide-list-ordered",{"title":628,"path":629,"stem":630,"icon":631},"Databases and instances","/appdata/instances","17.appdata/8.instances","i-lucide-hard-drive",{"title":633,"path":634,"stem":635,"icon":199},"Query console and SQL","/appdata/query","17.appdata/9.query",{"title":192,"path":637,"stem":638,"children":639,"icon":152},"/engram","18.engram/1.index",[640,641,645],{"title":192,"path":637,"stem":638,"icon":152},{"title":642,"path":643,"stem":644,"icon":117},"Write & recall","/engram/write-recall","18.engram/2.write-recall",{"title":646,"path":647,"stem":648,"icon":649},"Field & feed","/engram/agent-memory","18.engram/3.agent-memory","i-lucide-radio",{"title":196,"path":651,"stem":652,"children":653,"icon":199},"/devkit","19.devkit/1.index",[654,655,660,664,668],{"title":196,"path":651,"stem":652,"icon":199},{"title":656,"path":657,"stem":658,"icon":659},"Install DevKit","/devkit/install","19.devkit/2.install","i-lucide-download",{"title":661,"path":662,"stem":663,"icon":621},"Hook redirect","/devkit/hooks","19.devkit/3.hooks",{"title":665,"path":666,"stem":667,"icon":157},"Local coding runner","/devkit/local-runner","19.devkit/4.local-runner",{"title":669,"path":670,"stem":671,"icon":93},"Compositions from DevKit","/devkit/compositions","19.devkit/5.compositions",{"title":673,"path":674,"stem":675,"children":676,"icon":15},"Staff & Agents","/staff-and-agents","20.staff-and-agents/01.index",[677,678,682,686,690,694,698,702,706,711,715,720,725,729,732,737],{"title":673,"path":674,"stem":675,"icon":15},{"title":679,"path":680,"stem":681,"icon":10},"Prerequisites","/staff-and-agents/prerequisites","20.staff-and-agents/02.prerequisites",{"title":683,"path":684,"stem":685,"icon":419},"Hire an actor","/staff-and-agents/hire-an-actor","20.staff-and-agents/03.hire-an-actor",{"title":687,"path":688,"stem":689,"icon":57},"Console","/staff-and-agents/console","20.staff-and-agents/04.console",{"title":691,"path":692,"stem":693,"icon":125},"Configs, skills, and MCP","/staff-and-agents/configs-skills-mcp","20.staff-and-agents/05.configs-skills-mcp",{"title":695,"path":696,"stem":697,"icon":98},"Agent runner groups","/staff-and-agents/runner-groups","20.staff-and-agents/06.runner-groups",{"title":699,"path":700,"stem":701,"icon":130},"Governance","/staff-and-agents/governance","20.staff-and-agents/07.governance",{"title":703,"path":704,"stem":705,"icon":25},"Identity and tokens","/staff-and-agents/identity","20.staff-and-agents/08.identity",{"title":707,"path":708,"stem":709,"icon":710},"Memory and cost","/staff-and-agents/memory-and-cost","20.staff-and-agents/09.memory-and-cost","i-lucide-wallet",{"title":712,"path":713,"stem":714,"icon":117},"Coding agents","/staff-and-agents/coding-agents","20.staff-and-agents/10.coding-agents",{"title":716,"path":717,"stem":718,"icon":719},"Wire a repository for coding agents","/staff-and-agents/wire-a-repository","20.staff-and-agents/11.wire-a-repository","i-lucide-link",{"title":721,"path":722,"stem":723,"icon":724},"Run a ticket end to end","/staff-and-agents/run-a-ticket","20.staff-and-agents/12.run-a-ticket","i-lucide-play",{"title":726,"path":727,"stem":728,"icon":162},"Build a product team of actors","/staff-and-agents/build-a-product-team","20.staff-and-agents/13.build-a-product-team",{"title":308,"path":730,"stem":731,"icon":296},"/staff-and-agents/troubleshooting","20.staff-and-agents/14.troubleshooting",{"title":733,"path":734,"stem":735,"icon":736},"Media actors","/staff-and-agents/media-actors","20.staff-and-agents/15.media-actors","i-lucide-clapperboard",{"title":738,"path":739,"stem":740,"icon":741},"Agents that serve people","/staff-and-agents/agents-that-serve-people","20.staff-and-agents/16.agents-that-serve-people","i-lucide-hand-helping",{"title":201,"path":743,"stem":744,"children":745,"icon":44},"/app-host","21.app-host/1.index",[746,747,752,756,759,764,768,773,777,781],{"title":201,"path":743,"stem":744,"icon":44},{"title":748,"path":749,"stem":750,"icon":751},"Static egress IP","/app-host/static-egress-ip","21.app-host/10.static-egress-ip","i-lucide-network",{"title":753,"path":754,"stem":755,"icon":39},"Your app and site","/app-host/your-app","21.app-host/2.your-app",{"title":187,"path":757,"stem":758,"icon":190},"/app-host/app-data","21.app-host/3.app-data",{"title":760,"path":761,"stem":762,"icon":763},"Website and process","/app-host/hosting","21.app-host/4.hosting","i-lucide-cloud-upload",{"title":765,"path":766,"stem":767,"icon":649},"Buzz","/app-host/buzz","21.app-host/5.buzz",{"title":769,"path":770,"stem":771,"icon":772},"Files","/app-host/files","21.app-host/6.files","i-lucide-folder",{"title":774,"path":775,"stem":776,"icon":44},"Your own domain","/app-host/your-domain","21.app-host/7.your-domain",{"title":778,"path":779,"stem":780,"icon":276},"Troubleshooting App Host","/app-host/troubleshooting","21.app-host/8.troubleshooting",{"title":782,"path":783,"stem":784,"icon":25},"Signing keys","/app-host/signing-keys","21.app-host/9.signing-keys",{"title":205,"path":786,"stem":787,"children":788,"icon":208},"/agent-exchange","22.agent-exchange/01.index",[789,790,793,797,801,805],{"title":205,"path":786,"stem":787,"icon":208},{"title":683,"path":791,"stem":792,"icon":419},"/agent-exchange/hire","22.agent-exchange/02.hire",{"title":794,"path":795,"stem":796,"icon":255},"List an actor","/agent-exchange/list","22.agent-exchange/03.list",{"title":798,"path":799,"stem":800,"icon":199},"Invoke & leases","/agent-exchange/invoke","22.agent-exchange/04.invoke",{"title":802,"path":803,"stem":804,"icon":103},"Settlement & trust","/agent-exchange/settlement","22.agent-exchange/05.settlement",{"title":144,"path":806,"stem":807,"icon":147},"/agent-exchange/workflows","22.agent-exchange/06.workflows",{"title":809,"path":810,"stem":811,"children":812,"icon":171},"Runners","/runners","23.runners/1.index",[813,815],{"title":814,"path":810,"stem":811,"icon":171},"Runner groups",{"title":816,"path":817,"stem":818,"icon":819},"Purposes & integrations","/runners/purposes","23.runners/16.purposes","i-lucide-layers",{"title":821,"path":822,"stem":823,"children":824,"icon":826},"Chat","/chat","24.chat/01.index",[825,827,831,836,840,845,850,854,859,863,868,873,877,882,887,891,895,900,905],{"title":821,"path":822,"stem":823,"icon":826},"i-lucide-messages-square",{"title":828,"path":829,"stem":830,"icon":531},"Enable and publish","/chat/enable-and-publish","24.chat/02.enable-and-publish",{"title":832,"path":833,"stem":834,"icon":835},"Theme and customization","/chat/theme-and-customization","24.chat/03.theme-and-customization","i-lucide-palette",{"title":837,"path":838,"stem":839,"icon":180},"Members and moderation","/chat/members-and-moderation","24.chat/04.members-and-moderation",{"title":841,"path":842,"stem":843,"icon":844},"Channels","/chat/channels","24.chat/05.channels","i-lucide-hash",{"title":846,"path":847,"stem":848,"icon":849},"Using the chat","/chat/using-the-chat","24.chat/06.using-the-chat","i-lucide-message-circle",{"title":851,"path":852,"stem":853,"icon":15},"Actors in chat","/chat/actors-in-chat","24.chat/07.actors-in-chat",{"title":855,"path":856,"stem":857,"icon":858},"Internal support actor","/chat/internal-support-actor","24.chat/08.internal-support-actor","i-lucide-life-buoy",{"title":860,"path":861,"stem":862,"icon":199},"API and console","/chat/api-and-console","24.chat/09.api-and-console",{"title":864,"path":865,"stem":866,"icon":867},"Limits","/chat/limits","24.chat/10.limits","i-lucide-triangle-alert",{"title":869,"path":870,"stem":871,"icon":872},"Structured chat with DGI","/chat/structured-chat","24.chat/11.structured-chat","i-lucide-layout-list",{"title":874,"path":875,"stem":876,"icon":44},"Option A: hosted chat with DGI","/chat/option-a-hosted-chat","24.chat/12.option-a-hosted-chat",{"title":878,"path":879,"stem":880,"icon":881},"Option B: embed the chat component","/chat/option-b-embed-component","24.chat/13.option-b-embed-component","i-lucide-component",{"title":883,"path":884,"stem":885,"icon":886},"Option C: custom client (wire contract)","/chat/option-c-custom-client","24.chat/14.option-c-custom-client","i-lucide-braces",{"title":888,"path":889,"stem":890,"icon":649},"Cards, live updates and proactive posts","/chat/cards-live-and-proactive","24.chat/16.cards-live-and-proactive",{"title":892,"path":893,"stem":894,"icon":130},"Structured chat security model","/chat/structured-chat-security","24.chat/17.structured-chat-security",{"title":896,"path":897,"stem":898,"icon":899},"Option D: any app or API (dgi.chat)","/chat/option-d-chat-api","24.chat/18.option-d-chat-api","i-lucide-plug",{"title":901,"path":902,"stem":903,"icon":904},"Living Surfaces","/chat/living-surfaces","24.chat/20.living-surfaces","i-lucide-sprout",{"title":906,"path":907,"stem":908,"icon":909},"Connect your WhatsApp number","/chat/whatsapp","24.chat/21.whatsapp","i-lucide-phone",{"title":911,"path":912,"stem":913,"children":914,"icon":152},"DGI","/dgi","25.dgi/1.index",[915,917,921,925,929,933],{"title":916,"path":912,"stem":913,"icon":152},"What is DGI",{"title":154,"path":918,"stem":919,"icon":920},"/dgi/how-it-works","25.dgi/2.how-it-works","i-lucide-cog",{"title":922,"path":923,"stem":924,"icon":564},"Interfaces","/dgi/interfaces","25.dgi/3.interfaces",{"title":926,"path":927,"stem":928,"icon":52},"Quickstart","/dgi/quickstart","25.dgi/4.quickstart",{"title":930,"path":931,"stem":932,"icon":130},"Trust and safety","/dgi/trust-and-safety","25.dgi/5.trust-and-safety",{"title":934,"path":935,"stem":936,"icon":937},"FAQ","/dgi/faq","25.dgi/6.faq","i-lucide-circle-help",{"title":939,"path":940,"stem":941,"children":942,"icon":736},"Media","/media","26.media/01.index",[943,944,948,953,957,962,967,971,975,979,982],{"title":939,"path":940,"stem":941,"icon":736},{"title":945,"path":946,"stem":947,"icon":899},"Set up the studio","/media/set-up","26.media/02.set-up",{"title":949,"path":950,"stem":951,"icon":952},"Files, covers and looks","/media/files-covers-and-looks","26.media/03.files-covers-and-looks","i-lucide-images",{"title":841,"path":954,"stem":955,"icon":956},"/media/channels","26.media/04.channels","i-lucide-tv",{"title":958,"path":959,"stem":960,"icon":961},"Posts and review","/media/posts-and-review","26.media/05.posts-and-review","i-lucide-send",{"title":963,"path":964,"stem":965,"icon":966},"Video templates","/media/video-templates","26.media/06.video-templates","i-lucide-film",{"title":968,"path":969,"stem":970,"icon":736},"Render videos","/media/render-videos","26.media/07.render-videos",{"title":972,"path":973,"stem":974,"icon":571},"Templates as code","/media/templates-as-code","26.media/08.templates-as-code",{"title":976,"path":977,"stem":978,"icon":15},"Agents and media","/media/agents-and-media","26.media/09.agents-and-media",{"title":210,"path":980,"stem":981,"icon":142},"/media/reference","26.media/10.reference",{"title":983,"path":984,"stem":985,"icon":858},"Limits and troubleshooting","/media/limits-and-troubleshooting","26.media/11.limits-and-troubleshooting",{"title":987,"path":988,"stem":989,"children":990,"icon":992},"Vault","/vault","27.vault/01.index",[991,993,997,1001,1005,1010],{"title":987,"path":988,"stem":989,"icon":992},"i-lucide-vault",{"title":994,"path":995,"stem":996,"icon":25},"Secrets","/vault/secrets","27.vault/02.secrets",{"title":998,"path":999,"stem":1000,"icon":130},"Access policies","/vault/access-policies","27.vault/03.access-policies",{"title":1002,"path":1003,"stem":1004,"icon":961},"API access","/vault/api-access","27.vault/04.api-access",{"title":1006,"path":1007,"stem":1008,"icon":1009},"Audit log and keys","/vault/audit-and-keys","27.vault/05.audit-and-keys","i-lucide-scroll-text",{"title":210,"path":1011,"stem":1012,"icon":142},"/vault/reference","27.vault/06.reference",{"title":1014,"path":1015,"stem":1016,"children":1017,"icon":39},"Build apps","/build-apps","28.build-apps/01.index",[1018,1019,1023,1028,1032,1036,1040,1045],{"title":1014,"path":1015,"stem":1016,"icon":39},{"title":1020,"path":1021,"stem":1022,"icon":147},"Backend","/build-apps/backend","28.build-apps/02.backend",{"title":1024,"path":1025,"stem":1026,"icon":1027},"Modules and feature flags","/build-apps/modules-and-feature-flags","28.build-apps/03.modules-and-feature-flags","i-lucide-toggle-right",{"title":1029,"path":1030,"stem":1031,"icon":117},"Environments","/build-apps/environments","28.build-apps/04.environments",{"title":1033,"path":1034,"stem":1035,"icon":83},"Pricing and limits","/build-apps/pricing-and-limits","28.build-apps/05.pricing-and-limits",{"title":1037,"path":1038,"stem":1039,"icon":162},"Workspaces","/build-apps/workspaces","28.build-apps/06.workspaces",{"title":1041,"path":1042,"stem":1043,"icon":1044},"End-user authoring","/build-apps/end-user-authoring","28.build-apps/07.end-user-authoring","i-lucide-pencil-ruler",{"title":1046,"path":1047,"stem":1048,"icon":34},"Operate","/build-apps/operate","28.build-apps/08.operate",{"title":1050,"path":1051,"stem":1052,"children":1053,"icon":39},"Cockpit app","/cockpit","28.cockpit/1.index",[1054,1055,1060,1064,1068,1072,1076,1080,1084,1088,1092,1096,1100,1105,1110,1114,1118,1122,1127,1132],{"title":1050,"path":1051,"stem":1052,"icon":39},{"title":1056,"path":1057,"stem":1058,"icon":1059},"Overview, Decisions and Activity","/cockpit/overview-decisions-activity","28.cockpit/10.overview-decisions-activity","i-lucide-inbox",{"title":1061,"path":1062,"stem":1063,"icon":108},"Tickets","/cockpit/tickets","28.cockpit/11.tickets",{"title":1065,"path":1066,"stem":1067,"icon":147},"Workflows builder","/cockpit/workflows-builder","28.cockpit/12.workflows-builder",{"title":1069,"path":1070,"stem":1071,"icon":15},"Agents and Coding","/cockpit/agents-and-coding","28.cockpit/13.agents-and-coding",{"title":1073,"path":1074,"stem":1075,"icon":39},"Runners and Connections","/cockpit/apps-runners-connections","28.cockpit/14.apps-runners-connections",{"title":1077,"path":1078,"stem":1079,"icon":427},"Organization — people, access and cost","/cockpit/organization-people-access-cost","28.cockpit/15.organization-people-access-cost",{"title":1081,"path":1082,"stem":1083,"icon":899},"AI tools and MCP","/cockpit/ai-tools-and-mcp","28.cockpit/16.ai-tools-and-mcp",{"title":1085,"path":1086,"stem":1087,"icon":826},"App chats and shared chats","/cockpit/app-chats","28.cockpit/17.app-chats",{"title":1089,"path":1090,"stem":1091,"icon":564},"Apps mode","/cockpit/apps-mode","28.cockpit/18.apps-mode",{"title":1093,"path":1094,"stem":1095,"icon":83},"App infrastructure","/cockpit/app-infrastructure","28.cockpit/19.app-infrastructure",{"title":1097,"path":1098,"stem":1099,"icon":659},"Install and sign in","/cockpit/install-and-sign-in","28.cockpit/2.install-and-sign-in",{"title":1101,"path":1102,"stem":1103,"icon":1104},"App files, settings and flags","/cockpit/app-files-settings-flags","28.cockpit/20.app-files-settings-flags","i-lucide-folder-cog",{"title":1106,"path":1107,"stem":1108,"icon":1109},"Cards in the chat","/cockpit/chat-cards","28.cockpit/21.chat-cards","i-lucide-layout-panel-left",{"title":1111,"path":1112,"stem":1113,"icon":229},"App modules","/cockpit/app-modules","28.cockpit/22.app-modules",{"title":1115,"path":1116,"stem":1117,"icon":117},"App environments","/cockpit/app-environments","28.cockpit/23.app-environments",{"title":1119,"path":1120,"stem":1121,"icon":125},"First run and onboarding","/cockpit/first-run-onboarding","28.cockpit/3.first-run-onboarding",{"title":1123,"path":1124,"stem":1125,"icon":1126},"Navigation and shortcuts","/cockpit/navigation-and-shortcuts","28.cockpit/4.navigation-and-shortcuts","i-lucide-keyboard",{"title":1128,"path":1129,"stem":1130,"icon":1131},"About, settings and updates","/cockpit/about-settings-and-updates","28.cockpit/5.about-settings-and-updates","i-lucide-info",{"title":308,"path":1133,"stem":1134,"icon":858},"/cockpit/troubleshooting","28.cockpit/6.troubleshooting",{"title":1136,"path":1137,"stem":1138,"children":1139,"icon":1141},"CRM","/crm","29.crm/01.index",[1140,1142,1146,1150],{"title":1136,"path":1137,"stem":1138,"icon":1141},"i-lucide-contact",{"title":1143,"path":1144,"stem":1145,"icon":180},"Contacts and leads","/crm/contacts-and-leads","29.crm/02.contacts-and-leads",{"title":1147,"path":1148,"stem":1149,"icon":130},"Privacy and erasure","/crm/privacy-and-erasure","29.crm/03.privacy-and-erasure",{"title":210,"path":1151,"stem":1152,"icon":142},"/crm/reference","29.crm/04.reference",{"title":1154,"path":1155,"stem":1156,"children":1157,"icon":631},"Storage","/storage","29.storage/1.index",[1158,1160],{"title":1159,"path":1155,"stem":1156,"icon":631},"Orkestia storage",{"title":1161,"path":1162,"stem":1163,"icon":1164},"Where to use it","/storage/where-to-use","29.storage/2.where-to-use","i-lucide-map",{"title":1166,"path":1167,"stem":1168,"children":1169,"icon":44},"Browser","/browser","30.browser/01.index",[1170,1172,1176,1180],{"title":1171,"path":1167,"stem":1168,"icon":44},"Orkestia Browser",{"title":1173,"path":1174,"stem":1175,"icon":899},"Connect your Chrome","/browser/connect","30.browser/02.connect",{"title":1177,"path":1178,"stem":1179,"icon":130},"Sessions and approvals","/browser/sessions-and-approvals","30.browser/03.sessions-and-approvals",{"title":1181,"path":1182,"stem":1183,"icon":296},"Agent tools","/browser/agent-tools","30.browser/04.agent-tools",{"title":1185,"path":1186,"stem":1187,"children":1188,"icon":541},"Registry","/registry","31.registry/1.index",[1189],{"title":1190,"path":1186,"stem":1187,"icon":541},"Orkestia Registry",{"title":1192,"path":1193,"stem":1194,"children":1195,"icon":404},"Packages and Git","/packages-and-git","32.packages-and-git/1.index",[1196],{"title":1192,"path":1193,"stem":1194,"icon":404},{"id":1198,"title":491,"body":1199,"description":3970,"extension":3971,"links":3972,"meta":3973,"navigation":3974,"path":492,"seo":3975,"stem":493,"__hash__":3976},"docs/14.app-enablement/5.scoped-sql.md",{"type":1200,"value":1201,"toc":3948},"minimark",[1202,1211,1226,1232,1237,1328,1331,1335,1345,1375,1381,1386,1463,1470,1474,1478,1485,1503,1506,1512,1634,1645,1655,1680,1696,1700,1714,1810,1821,1825,1836,1965,1976,1987,1991,1996,2076,2079,2083,2094,2954,2967,2970,2974,3052,3063,3067,3354,3363,3371,3374,3467,3511,3551,3555,3562,3637,3647,3650,3692,3699,3710,3714,3717,3861,3865,3886,3897,3901,3915,3919,3944],[1203,1204,1205,1206,1210],"p",{},"Your data already lives in a Postgres database you run: an ERP replica, a reporting database, a warehouse. You want the people who sign in to your app to read ",[1207,1208,1209],"strong",{},"their"," rows from it, without giving the browser a connection string and without letting one customer see another's data.",[1203,1212,1213,1216,1217,1221,1222,1225],{},[1207,1214,1215],{},"Scoped SQL"," does this with one workflow, ",[1218,1219,1220],"code",{},"sql.query.run-scoped",". You write the query. Your users can only supply filter values. Orkestia picks the database login from the user's ",[1207,1223,1224],{},"active workspace",", and your database decides what that login can see.",[1227,1228,1229],"note",{},[1203,1230,1231],{},"End users still never send SQL. The query is fixed when you save the composition; the only thing a user can change is the value of a filter you declared.",[1233,1234,1236],"h2",{"id":1235},"appdata-or-your-own-database","AppData or your own database?",[1238,1239,1240,1256],"table",{},[1241,1242,1243],"thead",{},[1244,1245,1246,1250,1253],"tr",{},[1247,1248,1249],"th",{},"Your data is…",[1247,1251,1252],{},"Use",[1247,1254,1255],{},"Who enforces isolation",[1257,1258,1259,1290,1315],"tbody",{},[1244,1260,1261,1269,1287],{},[1262,1263,1264,1265,1268],"td",{},"In ",[1266,1267,187],"a",{"href":591},", Orkestia's Postgres for the app",[1262,1270,1271,1274,1275,1278,1279,1282,1283,1286],{},[1266,1272,1273],{"href":611},"Ownership"," and ",[1266,1276,1277],{"href":615},"Expose"," (",[1218,1280,1281],{},"owner"," or ",[1218,1284,1285],{},"organization"," tables)",[1262,1288,1289],{},"Orkestia, row by row, from the user's token",[1244,1291,1292,1299,1304],{},[1262,1293,1294,1295,1298],{},"In a Postgres database ",[1207,1296,1297],{},"you"," operate",[1262,1300,1301,1303],{},[1207,1302,1215],{}," (this page)",[1262,1305,1306,1307,1310,1311,1314],{},"Orkestia picks ",[1207,1308,1309],{},"which login"," runs the query; ",[1207,1312,1313],{},"your database"," decides what that login can read",[1244,1316,1317,1320,1325],{},[1262,1318,1319],{},"Something your team wants to browse",[1262,1321,1322],{},[1266,1323,1324],{"href":634},"Query console",[1262,1326,1327],{},"Org members only; not for end users",[1203,1329,1330],{},"If you can move the data into App Data, do: the platform then enforces the boundary on its own. Scoped SQL is for data that has to stay in your database.",[1233,1332,1334],{"id":1333},"how-the-scope-works","How the scope works",[1336,1337,1342],"pre",{"className":1338,"code":1340,"language":1341},[1339],"language-text","end user signs in ──► starts your exposed composition\n │\n Orkestia reads the user's active workspace (from the token, never from the request)\n │\n workspace + slot ──► the SQL connection you bound to that workspace\n │\n your database login ──► only the rows that login may see\n │\n your static SELECT, narrowed by the user's filter values\n","text",[1218,1343,1340],{"__ignoreMap":1344},"",[1346,1347,1348,1359,1369],"ul",{},[1349,1350,1351,1352,1355,1356,1358],"li",{},"A ",[1207,1353,1354],{},"workspace"," is a tenant inside your app: a company, a farm, an office. See ",[1266,1357,1037],{"href":1038},".",[1349,1360,1351,1361,1364,1365,1368],{},[1207,1362,1363],{},"slot"," is a name your composition uses for \"the database connection\", such as ",[1218,1366,1367],{},"reporting",". The composition names the slot, never a connection.",[1349,1370,1351,1371,1374],{},[1207,1372,1373],{},"binding"," maps one workspace and one slot to one SQL connection. Each workspace gets its own connection, and each connection uses its own database login.",[1203,1376,1377,1378,1380],{},"The scope is the ",[1207,1379,1354],{},", not the individual person. Everyone in the same workspace reads through the same login and sees the same rows. If each person must see only their own rows, give each person their own workspace and login.",[1382,1383,1385],"h3",{"id":1384},"what-orkestia-guarantees-and-what-your-database-must-do","What Orkestia guarantees, and what your database must do",[1238,1387,1388,1398],{},[1241,1389,1390],{},[1244,1391,1392,1395],{},[1247,1393,1394],{},"Orkestia guarantees",[1247,1396,1397],{},"Your database is responsible for",[1257,1399,1400,1412,1424,1436,1444,1456],{},[1244,1401,1402,1409],{},[1262,1403,1404,1405,1408],{},"A run uses only the connection bound to the user's ",[1207,1406,1407],{},"own active workspace",", in your own organization",[1262,1410,1411],{},"That each login can read only its workspace's rows (grants, row-level security, or one schema per workspace)",[1244,1413,1414,1417],{},[1262,1415,1416],{},"The user cannot choose or override the connection, the slot, the SQL, or a filter's column, operator or type",[1262,1418,1419,1420,1423],{},"Views, ",[1218,1421,1422],{},"SECURITY DEFINER"," functions and anything else that could let a login read more than its grants allow",[1244,1425,1426,1433],{},[1262,1427,1428,1429,1432],{},"User input reaches only filter ",[1207,1430,1431],{},"values",", which are type-checked and can only narrow the result",[1262,1434,1435],{},"That your SQL returns the right data",[1244,1437,1438,1441],{},[1262,1439,1440],{},"A read-only transaction that is always rolled back, a statement timeout and a row cap",[1262,1442,1443],{},"Creating, rotating and revoking the database logins",[1244,1445,1446,1453],{},[1262,1447,1448,1449,1452],{},"A superuser or ",[1218,1450,1451],{},"BYPASSRLS"," login is refused before your query runs",[1262,1454,1455],{},"Network access from Orkestia to your database",[1244,1457,1458,1461],{},[1262,1459,1460],{},"Two workspaces in the same slot never share a connection or a database login",[1262,1462],{},[1203,1464,1465,1466,1469],{},"Every check on the left runs again on ",[1207,1467,1468],{},"every run",", from a fresh lookup: the user and the app are active, the workspace is still the user's active one and their membership is active, the binding exists and points at a live SQL connection of your organization. Nothing is cached from bind time or from when the run started.",[1233,1471,1473],{"id":1472},"set-it-up","Set it up",[1382,1475,1477],{"id":1476},"_1-create-one-database-login-per-workspace-dba","1. Create one database login per workspace (DBA)",[1203,1479,1480,1481,1484],{},"Each workspace needs its own Postgres login that can read ",[1207,1482,1483],{},"only"," that workspace's data. Rules:",[1346,1486,1487,1493,1496],{},[1349,1488,1489,1490,1492],{},"not a superuser, and not ",[1218,1491,1451],{}," (the run is refused);",[1349,1494,1495],{},"never shared by two workspaces (the run is refused if two workspaces in a slot use the same host, port, database and username);",[1349,1497,1498,1499,1502],{},"never the login your sync or ETL job writes with: grant ",[1218,1500,1501],{},"SELECT"," only.",[1203,1504,1505],{},"Two common ways to do it.",[1203,1507,1508,1511],{},[1207,1509,1510],{},"Option A: row-level security."," One table maps each login to the rows it may see:",[1336,1513,1517],{"className":1514,"code":1515,"language":1516,"meta":1344,"style":1344},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","-- once\nCREATE ROLE orkestia_readers NOLOGIN;\nGRANT USAGE ON SCHEMA sales TO orkestia_readers;\n\nCREATE TABLE sales.reader_scope (login name PRIMARY KEY, customer_id bigint NOT NULL);\nALTER TABLE sales.reader_scope ENABLE ROW LEVEL SECURITY;\nCREATE POLICY own_row ON sales.reader_scope\n FOR SELECT TO orkestia_readers USING (login = current_user);\nGRANT SELECT ON sales.reader_scope TO orkestia_readers;\n\nALTER TABLE sales.orders ENABLE ROW LEVEL SECURITY;\nCREATE POLICY by_customer ON sales.orders\n FOR SELECT TO orkestia_readers\n USING (customer_id IN (SELECT customer_id FROM sales.reader_scope));\nGRANT SELECT ON sales.orders TO orkestia_readers;\n\n-- per workspace\nCREATE ROLE orkestia_ws_acme LOGIN PASSWORD '…' IN ROLE orkestia_readers;\nINSERT INTO sales.reader_scope VALUES ('orkestia_ws_acme', 42);\n","sql",[1218,1518,1519,1527,1533,1539,1546,1552,1558,1564,1570,1576,1581,1587,1593,1599,1605,1611,1616,1622,1628],{"__ignoreMap":1344},[1520,1521,1524],"span",{"class":1522,"line":1523},"line",1,[1520,1525,1526],{},"-- once\n",[1520,1528,1530],{"class":1522,"line":1529},2,[1520,1531,1532],{},"CREATE ROLE orkestia_readers NOLOGIN;\n",[1520,1534,1536],{"class":1522,"line":1535},3,[1520,1537,1538],{},"GRANT USAGE ON SCHEMA sales TO orkestia_readers;\n",[1520,1540,1542],{"class":1522,"line":1541},4,[1520,1543,1545],{"emptyLinePlaceholder":1544},true,"\n",[1520,1547,1549],{"class":1522,"line":1548},5,[1520,1550,1551],{},"CREATE TABLE sales.reader_scope (login name PRIMARY KEY, customer_id bigint NOT NULL);\n",[1520,1553,1555],{"class":1522,"line":1554},6,[1520,1556,1557],{},"ALTER TABLE sales.reader_scope ENABLE ROW LEVEL SECURITY;\n",[1520,1559,1561],{"class":1522,"line":1560},7,[1520,1562,1563],{},"CREATE POLICY own_row ON sales.reader_scope\n",[1520,1565,1567],{"class":1522,"line":1566},8,[1520,1568,1569],{}," FOR SELECT TO orkestia_readers USING (login = current_user);\n",[1520,1571,1573],{"class":1522,"line":1572},9,[1520,1574,1575],{},"GRANT SELECT ON sales.reader_scope TO orkestia_readers;\n",[1520,1577,1579],{"class":1522,"line":1578},10,[1520,1580,1545],{"emptyLinePlaceholder":1544},[1520,1582,1584],{"class":1522,"line":1583},11,[1520,1585,1586],{},"ALTER TABLE sales.orders ENABLE ROW LEVEL SECURITY;\n",[1520,1588,1590],{"class":1522,"line":1589},12,[1520,1591,1592],{},"CREATE POLICY by_customer ON sales.orders\n",[1520,1594,1596],{"class":1522,"line":1595},13,[1520,1597,1598],{}," FOR SELECT TO orkestia_readers\n",[1520,1600,1602],{"class":1522,"line":1601},14,[1520,1603,1604],{}," USING (customer_id IN (SELECT customer_id FROM sales.reader_scope));\n",[1520,1606,1608],{"class":1522,"line":1607},15,[1520,1609,1610],{},"GRANT SELECT ON sales.orders TO orkestia_readers;\n",[1520,1612,1614],{"class":1522,"line":1613},16,[1520,1615,1545],{"emptyLinePlaceholder":1544},[1520,1617,1619],{"class":1522,"line":1618},17,[1520,1620,1621],{},"-- per workspace\n",[1520,1623,1625],{"class":1522,"line":1624},18,[1520,1626,1627],{},"CREATE ROLE orkestia_ws_acme LOGIN PASSWORD '…' IN ROLE orkestia_readers;\n",[1520,1629,1631],{"class":1522,"line":1630},19,[1520,1632,1633],{},"INSERT INTO sales.reader_scope VALUES ('orkestia_ws_acme', 42);\n",[1203,1635,1636,1637,1640,1641,1644],{},"Each login sees only its own row of ",[1218,1638,1639],{},"reader_scope",", so the policy on ",[1218,1642,1643],{},"orders"," resolves to that customer's rows.",[1203,1646,1647,1650,1651,1654],{},[1207,1648,1649],{},"Option B: one schema per workspace."," Put each workspace's tables in its own schema, grant the login only that schema, and set its ",[1218,1652,1653],{},"search_path"," so the same unqualified SQL works for every workspace:",[1336,1656,1658],{"className":1514,"code":1657,"language":1516,"meta":1344,"style":1344},"CREATE ROLE orkestia_ws_acme LOGIN PASSWORD '…';\nGRANT USAGE ON SCHEMA acme TO orkestia_ws_acme;\nGRANT SELECT ON ALL TABLES IN SCHEMA acme TO orkestia_ws_acme;\nALTER ROLE orkestia_ws_acme SET search_path = acme;\n",[1218,1659,1660,1665,1670,1675],{"__ignoreMap":1344},[1520,1661,1662],{"class":1522,"line":1523},[1520,1663,1664],{},"CREATE ROLE orkestia_ws_acme LOGIN PASSWORD '…';\n",[1520,1666,1667],{"class":1522,"line":1529},[1520,1668,1669],{},"GRANT USAGE ON SCHEMA acme TO orkestia_ws_acme;\n",[1520,1671,1672],{"class":1522,"line":1535},[1520,1673,1674],{},"GRANT SELECT ON ALL TABLES IN SCHEMA acme TO orkestia_ws_acme;\n",[1520,1676,1677],{"class":1522,"line":1541},[1520,1678,1679],{},"ALTER ROLE orkestia_ws_acme SET search_path = acme;\n",[1681,1682,1683],"warning",{},[1203,1684,1685,1688,1689,1692,1693,1695],{},[1207,1686,1687],{},"Views and functions can bypass row-level security."," A view runs with its owner's rights unless it is created ",[1218,1690,1691],{},"WITH (security_invoker = true)"," (Postgres 15+), and a ",[1218,1694,1422],{}," function always runs as its owner. A login that reads such a view or function can see every row the owner sees. Orkestia guarantees which login runs the query; it cannot inspect what your views and functions expose.",[1382,1697,1699],{"id":1698},"_2-add-one-sql-connection-per-login","2. Add one SQL connection per login",[1203,1701,1702,1703,1705,1706,1709,1710,1713],{},"Create an Orkestia connection of type ",[1218,1704,1516],{}," for each login with ",[1218,1707,1708],{},"connection.setup"," (console or ",[1266,1711,1712],{"href":218},"MCP","):",[1238,1715,1716,1726],{},[1241,1717,1718],{},[1244,1719,1720,1723],{},[1247,1721,1722],{},"Field",[1247,1724,1725],{},"Value",[1257,1727,1728,1739,1760,1770,1780,1797],{},[1244,1729,1730,1735],{},[1262,1731,1732],{},[1218,1733,1734],{},"provider_type",[1262,1736,1737],{},[1218,1738,1516],{},[1244,1740,1741,1753],{},[1262,1742,1743,1746,1747,1746,1750],{},[1218,1744,1745],{},"host",", ",[1218,1748,1749],{},"port",[1218,1751,1752],{},"database",[1262,1754,1755,1756,1759],{},"Your database (port defaults to ",[1218,1757,1758],{},"5432",")",[1244,1761,1762,1767],{},[1262,1763,1764],{},[1218,1765,1766],{},"username",[1262,1768,1769],{},"The workspace's login",[1244,1771,1772,1777],{},[1262,1773,1774],{},[1218,1775,1776],{},"api_token",[1262,1778,1779],{},"That login's password (stored encrypted)",[1244,1781,1782,1787],{},[1262,1783,1784],{},[1218,1785,1786],{},"ssl_mode",[1262,1788,1789,1790,1793,1794],{},"Postgres ",[1218,1791,1792],{},"sslmode","; default ",[1218,1795,1796],{},"prefer",[1244,1798,1799,1804],{},[1262,1800,1801],{},[1218,1802,1803],{},"connection_name",[1262,1805,1806,1807],{},"A label, for example ",[1218,1808,1809],{},"orders-acme",[1203,1811,1812,1813,1816,1817,1820],{},"Postgres is the only supported database. Orkestia must be able to reach ",[1218,1814,1815],{},"host:port"," over the network. ",[1218,1818,1819],{},"sql.connection.validate"," checks the connection.",[1382,1822,1824],{"id":1823},"_3-bind-each-connection-to-its-workspace","3. Bind each connection to its workspace",[1203,1826,1827,1828,1831,1832,1835],{},"Pick a slot name: lowercase letters, digits and ",[1218,1829,1830],{},"_",", starting with a letter, up to 41 characters (",[1218,1833,1834],{},"^[a-z][a-z0-9_]{0,40}$","). Bind every workspace's connection under that slot:",[1336,1837,1841],{"className":1838,"code":1839,"language":1840,"meta":1344,"style":1344},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","identity.app-organization.bind-connection({\n identity_app_uuid: \"…\",\n app_organization_uuid: \"…\", // the workspace\n slot: \"reporting\",\n cloud_connection_uuid: \"…\", // that workspace's connection\n})\n// → { app_organization_uuid, slot, cloud_connection_uuid, bound: true }\n","ts",[1218,1842,1843,1877,1899,1919,1934,1952,1960],{"__ignoreMap":1344},[1520,1844,1845,1849,1852,1855,1858,1860,1862,1865,1867,1871,1874],{"class":1522,"line":1523},[1520,1846,1848],{"class":1847},"sTEyZ","identity",[1520,1850,1358],{"class":1851},"sMK4o",[1520,1853,1854],{"class":1847},"app",[1520,1856,1857],{"class":1851},"-",[1520,1859,1285],{"class":1847},[1520,1861,1358],{"class":1851},[1520,1863,1864],{"class":1847},"bind",[1520,1866,1857],{"class":1851},[1520,1868,1870],{"class":1869},"s2Zo4","connection",[1520,1872,1873],{"class":1847},"(",[1520,1875,1876],{"class":1851},"{\n",[1520,1878,1879,1883,1886,1889,1893,1896],{"class":1522,"line":1529},[1520,1880,1882],{"class":1881},"swJcz"," identity_app_uuid",[1520,1884,1885],{"class":1851},":",[1520,1887,1888],{"class":1851}," \"",[1520,1890,1892],{"class":1891},"sfazB","…",[1520,1894,1895],{"class":1851},"\"",[1520,1897,1898],{"class":1851},",\n",[1520,1900,1901,1904,1906,1908,1910,1912,1915],{"class":1522,"line":1535},[1520,1902,1903],{"class":1881}," app_organization_uuid",[1520,1905,1885],{"class":1851},[1520,1907,1888],{"class":1851},[1520,1909,1892],{"class":1891},[1520,1911,1895],{"class":1851},[1520,1913,1914],{"class":1851},",",[1520,1916,1918],{"class":1917},"sHwdD"," // the workspace\n",[1520,1920,1921,1924,1926,1928,1930,1932],{"class":1522,"line":1541},[1520,1922,1923],{"class":1881}," slot",[1520,1925,1885],{"class":1851},[1520,1927,1888],{"class":1851},[1520,1929,1367],{"class":1891},[1520,1931,1895],{"class":1851},[1520,1933,1898],{"class":1851},[1520,1935,1936,1939,1941,1943,1945,1947,1949],{"class":1522,"line":1548},[1520,1937,1938],{"class":1881}," cloud_connection_uuid",[1520,1940,1885],{"class":1851},[1520,1942,1888],{"class":1851},[1520,1944,1892],{"class":1891},[1520,1946,1895],{"class":1851},[1520,1948,1914],{"class":1851},[1520,1950,1951],{"class":1917}," // that workspace's connection\n",[1520,1953,1954,1957],{"class":1522,"line":1554},[1520,1955,1956],{"class":1851},"}",[1520,1958,1959],{"class":1847},")\n",[1520,1961,1962],{"class":1522,"line":1560},[1520,1963,1964],{"class":1917},"// → { app_organization_uuid, slot, cloud_connection_uuid, bound: true }\n",[1346,1966,1967,1970,1973],{},[1349,1968,1969],{},"The connection must be a live SQL connection of your organization.",[1349,1971,1972],{},"Binding a connection that already serves another workspace in the same slot is refused.",[1349,1974,1975],{},"Binding a slot again replaces the previous connection.",[1203,1977,1978,1979,1982,1983,1986],{},"List what is bound with ",[1218,1980,1981],{},"identity.app-organization.connection-bindings"," (no credentials are returned). A workspace you add later has no binding until you bind one; its users get ",[1218,1984,1985],{},"SCOPE_UNRESOLVED"," until then.",[1382,1988,1990],{"id":1989},"_4-allow-the-step-for-your-app","4. Allow the step for your app",[1203,1992,1993,1995],{},[1218,1994,1220],{}," is not open to end users by default. Turn it on for your app only:",[1336,1997,1999],{"className":1838,"code":1998,"language":1840,"meta":1344,"style":1344},"identity.app.set-workflow-eligibility({\n identity_app_uuid: \"…\",\n workflow_type: \"sql.query.run-scoped\",\n enabled: true,\n})\n",[1218,2000,2001,2028,2042,2057,2070],{"__ignoreMap":1344},[1520,2002,2003,2005,2007,2009,2011,2014,2016,2019,2021,2024,2026],{"class":1522,"line":1523},[1520,2004,1848],{"class":1847},[1520,2006,1358],{"class":1851},[1520,2008,1854],{"class":1847},[1520,2010,1358],{"class":1851},[1520,2012,2013],{"class":1847},"set",[1520,2015,1857],{"class":1851},[1520,2017,2018],{"class":1847},"workflow",[1520,2020,1857],{"class":1851},[1520,2022,2023],{"class":1869},"eligibility",[1520,2025,1873],{"class":1847},[1520,2027,1876],{"class":1851},[1520,2029,2030,2032,2034,2036,2038,2040],{"class":1522,"line":1529},[1520,2031,1882],{"class":1881},[1520,2033,1885],{"class":1851},[1520,2035,1888],{"class":1851},[1520,2037,1892],{"class":1891},[1520,2039,1895],{"class":1851},[1520,2041,1898],{"class":1851},[1520,2043,2044,2047,2049,2051,2053,2055],{"class":1522,"line":1535},[1520,2045,2046],{"class":1881}," workflow_type",[1520,2048,1885],{"class":1851},[1520,2050,1888],{"class":1851},[1520,2052,1220],{"class":1891},[1520,2054,1895],{"class":1851},[1520,2056,1898],{"class":1851},[1520,2058,2059,2062,2064,2068],{"class":1522,"line":1541},[1520,2060,2061],{"class":1881}," enabled",[1520,2063,1885],{"class":1851},[1520,2065,2067],{"class":2066},"sfNiH"," true",[1520,2069,1898],{"class":1851},[1520,2071,2072,2074],{"class":1522,"line":1548},[1520,2073,1956],{"class":1851},[1520,2075,1959],{"class":1847},[1203,2077,2078],{},"Bind, unbind and this switch must be run by a person on your team (in the console, over MCP, or with an API token they created). AI agent actors are refused, so an agent cannot widen what your users can read.",[1382,2080,2082],{"id":2081},"_5-write-the-composition","5. Write the composition",[1203,2084,2085,2086,2089,2090,2093],{},"Everything is ",[1218,2087,2088],{},"static"," except filter values. Each filter declares a column of your query's output, an operator and a type; only ",[1218,2091,2092],{},"value"," may come from the caller.",[1336,2095,2099],{"className":2096,"code":2097,"language":2098,"meta":1344,"style":1344},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n \"name\": \"my-orders\",\n \"layers\": [\n {\n \"name\": \"read\",\n \"steps\": [\n {\n \"name\": \"orders\",\n \"workflow_type\": \"sql.query.run-scoped\",\n \"input_mapping\": {\n \"slot\": { \"source\": \"static\", \"value\": \"reporting\" },\n \"sql\": { \"source\": \"static\", \"value\": \"SELECT id, status, placed_on, total FROM sales.orders\" },\n \"filters\": {\n \"source\": \"object\",\n \"fields\": {\n \"status\": {\n \"source\": \"object\",\n \"fields\": {\n \"column\": { \"source\": \"static\", \"value\": \"status\" },\n \"op\": { \"source\": \"static\", \"value\": \"in\" },\n \"type\": { \"source\": \"static\", \"value\": \"text\" },\n \"value\": { \"source\": \"input\", \"field\": \"statuses\" }\n }\n },\n \"period\": {\n \"source\": \"object\",\n \"fields\": {\n \"column\": { \"source\": \"static\", \"value\": \"placed_on\" },\n \"op\": { \"source\": \"static\", \"value\": \"between\" },\n \"type\": { \"source\": \"static\", \"value\": \"date\" },\n \"value\": { \"source\": \"input\", \"field\": \"period\" }\n }\n }\n }\n },\n \"max_rows\": { \"source\": \"static\", \"value\": 500 }\n }\n }\n ]\n }\n ]\n}\n","json",[1218,2100,2101,2105,2127,2141,2146,2167,2180,2185,2205,2224,2238,2287,2332,2345,2365,2378,2392,2411,2423,2469,2516,2562,2611,2617,2623,2637,2656,2669,2715,2761,2807,2852,2857,2863,2869,2875,2918,2924,2930,2936,2942,2948],{"__ignoreMap":1344},[1520,2102,2103],{"class":1522,"line":1523},[1520,2104,1876],{"class":1851},[1520,2106,2107,2110,2114,2116,2118,2120,2123,2125],{"class":1522,"line":1529},[1520,2108,2109],{"class":1851}," \"",[1520,2111,2113],{"class":2112},"spNyl","name",[1520,2115,1895],{"class":1851},[1520,2117,1885],{"class":1851},[1520,2119,1888],{"class":1851},[1520,2121,2122],{"class":1891},"my-orders",[1520,2124,1895],{"class":1851},[1520,2126,1898],{"class":1851},[1520,2128,2129,2131,2134,2136,2138],{"class":1522,"line":1535},[1520,2130,2109],{"class":1851},[1520,2132,2133],{"class":2112},"layers",[1520,2135,1895],{"class":1851},[1520,2137,1885],{"class":1851},[1520,2139,2140],{"class":1851}," [\n",[1520,2142,2143],{"class":1522,"line":1541},[1520,2144,2145],{"class":1851}," {\n",[1520,2147,2148,2151,2154,2156,2158,2160,2163,2165],{"class":1522,"line":1548},[1520,2149,2150],{"class":1851}," \"",[1520,2152,2113],{"class":2153},"sBMFI",[1520,2155,1895],{"class":1851},[1520,2157,1885],{"class":1851},[1520,2159,1888],{"class":1851},[1520,2161,2162],{"class":1891},"read",[1520,2164,1895],{"class":1851},[1520,2166,1898],{"class":1851},[1520,2168,2169,2171,2174,2176,2178],{"class":1522,"line":1554},[1520,2170,2150],{"class":1851},[1520,2172,2173],{"class":2153},"steps",[1520,2175,1895],{"class":1851},[1520,2177,1885],{"class":1851},[1520,2179,2140],{"class":1851},[1520,2181,2182],{"class":1522,"line":1560},[1520,2183,2184],{"class":1851}," {\n",[1520,2186,2187,2190,2193,2195,2197,2199,2201,2203],{"class":1522,"line":1566},[1520,2188,2189],{"class":1851}," \"",[1520,2191,2113],{"class":2192},"sbssI",[1520,2194,1895],{"class":1851},[1520,2196,1885],{"class":1851},[1520,2198,1888],{"class":1851},[1520,2200,1643],{"class":1891},[1520,2202,1895],{"class":1851},[1520,2204,1898],{"class":1851},[1520,2206,2207,2209,2212,2214,2216,2218,2220,2222],{"class":1522,"line":1572},[1520,2208,2189],{"class":1851},[1520,2210,2211],{"class":2192},"workflow_type",[1520,2213,1895],{"class":1851},[1520,2215,1885],{"class":1851},[1520,2217,1888],{"class":1851},[1520,2219,1220],{"class":1891},[1520,2221,1895],{"class":1851},[1520,2223,1898],{"class":1851},[1520,2225,2226,2228,2231,2233,2235],{"class":1522,"line":1578},[1520,2227,2189],{"class":1851},[1520,2229,2230],{"class":2192},"input_mapping",[1520,2232,1895],{"class":1851},[1520,2234,1885],{"class":1851},[1520,2236,2237],{"class":1851}," {\n",[1520,2239,2240,2243,2245,2247,2249,2252,2254,2258,2260,2262,2264,2266,2268,2270,2272,2274,2276,2278,2280,2282,2284],{"class":1522,"line":1583},[1520,2241,2242],{"class":1851}," \"",[1520,2244,1363],{"class":1881},[1520,2246,1895],{"class":1851},[1520,2248,1885],{"class":1851},[1520,2250,2251],{"class":1851}," {",[1520,2253,1888],{"class":1851},[1520,2255,2257],{"class":2256},"su27w","source",[1520,2259,1895],{"class":1851},[1520,2261,1885],{"class":1851},[1520,2263,1888],{"class":1851},[1520,2265,2088],{"class":1891},[1520,2267,1895],{"class":1851},[1520,2269,1914],{"class":1851},[1520,2271,1888],{"class":1851},[1520,2273,2092],{"class":2256},[1520,2275,1895],{"class":1851},[1520,2277,1885],{"class":1851},[1520,2279,1888],{"class":1851},[1520,2281,1367],{"class":1891},[1520,2283,1895],{"class":1851},[1520,2285,2286],{"class":1851}," },\n",[1520,2288,2289,2291,2293,2295,2297,2299,2301,2303,2305,2307,2309,2311,2313,2315,2317,2319,2321,2323,2325,2328,2330],{"class":1522,"line":1589},[1520,2290,2242],{"class":1851},[1520,2292,1516],{"class":1881},[1520,2294,1895],{"class":1851},[1520,2296,1885],{"class":1851},[1520,2298,2251],{"class":1851},[1520,2300,1888],{"class":1851},[1520,2302,2257],{"class":2256},[1520,2304,1895],{"class":1851},[1520,2306,1885],{"class":1851},[1520,2308,1888],{"class":1851},[1520,2310,2088],{"class":1891},[1520,2312,1895],{"class":1851},[1520,2314,1914],{"class":1851},[1520,2316,1888],{"class":1851},[1520,2318,2092],{"class":2256},[1520,2320,1895],{"class":1851},[1520,2322,1885],{"class":1851},[1520,2324,1888],{"class":1851},[1520,2326,2327],{"class":1891},"SELECT id, status, placed_on, total FROM sales.orders",[1520,2329,1895],{"class":1851},[1520,2331,2286],{"class":1851},[1520,2333,2334,2336,2339,2341,2343],{"class":1522,"line":1595},[1520,2335,2242],{"class":1851},[1520,2337,2338],{"class":1881},"filters",[1520,2340,1895],{"class":1851},[1520,2342,1885],{"class":1851},[1520,2344,2237],{"class":1851},[1520,2346,2347,2350,2352,2354,2356,2358,2361,2363],{"class":1522,"line":1601},[1520,2348,2349],{"class":1851}," \"",[1520,2351,2257],{"class":2256},[1520,2353,1895],{"class":1851},[1520,2355,1885],{"class":1851},[1520,2357,1888],{"class":1851},[1520,2359,2360],{"class":1891},"object",[1520,2362,1895],{"class":1851},[1520,2364,1898],{"class":1851},[1520,2366,2367,2369,2372,2374,2376],{"class":1522,"line":1607},[1520,2368,2349],{"class":1851},[1520,2370,2371],{"class":2256},"fields",[1520,2373,1895],{"class":1851},[1520,2375,1885],{"class":1851},[1520,2377,2237],{"class":1851},[1520,2379,2380,2383,2386,2388,2390],{"class":1522,"line":1613},[1520,2381,2382],{"class":1851}," \"",[1520,2384,2385],{"class":1869},"status",[1520,2387,1895],{"class":1851},[1520,2389,1885],{"class":1851},[1520,2391,2237],{"class":1851},[1520,2393,2394,2397,2399,2401,2403,2405,2407,2409],{"class":1522,"line":1618},[1520,2395,2396],{"class":1851}," \"",[1520,2398,2257],{"class":2066},[1520,2400,1895],{"class":1851},[1520,2402,1885],{"class":1851},[1520,2404,1888],{"class":1851},[1520,2406,2360],{"class":1891},[1520,2408,1895],{"class":1851},[1520,2410,1898],{"class":1851},[1520,2412,2413,2415,2417,2419,2421],{"class":1522,"line":1624},[1520,2414,2396],{"class":1851},[1520,2416,2371],{"class":2066},[1520,2418,1895],{"class":1851},[1520,2420,1885],{"class":1851},[1520,2422,2237],{"class":1851},[1520,2424,2425,2428,2431,2433,2435,2437,2439,2441,2443,2445,2447,2449,2451,2453,2455,2457,2459,2461,2463,2465,2467],{"class":1522,"line":1630},[1520,2426,2427],{"class":1851}," \"",[1520,2429,2430],{"class":2112},"column",[1520,2432,1895],{"class":1851},[1520,2434,1885],{"class":1851},[1520,2436,2251],{"class":1851},[1520,2438,1888],{"class":1851},[1520,2440,2257],{"class":1891},[1520,2442,1895],{"class":1851},[1520,2444,1885],{"class":1851},[1520,2446,1888],{"class":1851},[1520,2448,2088],{"class":1891},[1520,2450,1895],{"class":1851},[1520,2452,1914],{"class":1851},[1520,2454,1888],{"class":1851},[1520,2456,2092],{"class":1891},[1520,2458,1895],{"class":1851},[1520,2460,1885],{"class":1851},[1520,2462,1888],{"class":1851},[1520,2464,2385],{"class":1891},[1520,2466,1895],{"class":1851},[1520,2468,2286],{"class":1851},[1520,2470,2472,2474,2477,2479,2481,2483,2485,2487,2489,2491,2493,2495,2497,2499,2501,2503,2505,2507,2509,2512,2514],{"class":1522,"line":2471},20,[1520,2473,2427],{"class":1851},[1520,2475,2476],{"class":2112},"op",[1520,2478,1895],{"class":1851},[1520,2480,1885],{"class":1851},[1520,2482,2251],{"class":1851},[1520,2484,1888],{"class":1851},[1520,2486,2257],{"class":1891},[1520,2488,1895],{"class":1851},[1520,2490,1885],{"class":1851},[1520,2492,1888],{"class":1851},[1520,2494,2088],{"class":1891},[1520,2496,1895],{"class":1851},[1520,2498,1914],{"class":1851},[1520,2500,1888],{"class":1851},[1520,2502,2092],{"class":1891},[1520,2504,1895],{"class":1851},[1520,2506,1885],{"class":1851},[1520,2508,1888],{"class":1851},[1520,2510,2511],{"class":1891},"in",[1520,2513,1895],{"class":1851},[1520,2515,2286],{"class":1851},[1520,2517,2519,2521,2524,2526,2528,2530,2532,2534,2536,2538,2540,2542,2544,2546,2548,2550,2552,2554,2556,2558,2560],{"class":1522,"line":2518},21,[1520,2520,2427],{"class":1851},[1520,2522,2523],{"class":2112},"type",[1520,2525,1895],{"class":1851},[1520,2527,1885],{"class":1851},[1520,2529,2251],{"class":1851},[1520,2531,1888],{"class":1851},[1520,2533,2257],{"class":1891},[1520,2535,1895],{"class":1851},[1520,2537,1885],{"class":1851},[1520,2539,1888],{"class":1851},[1520,2541,2088],{"class":1891},[1520,2543,1895],{"class":1851},[1520,2545,1914],{"class":1851},[1520,2547,1888],{"class":1851},[1520,2549,2092],{"class":1891},[1520,2551,1895],{"class":1851},[1520,2553,1885],{"class":1851},[1520,2555,1888],{"class":1851},[1520,2557,1341],{"class":1891},[1520,2559,1895],{"class":1851},[1520,2561,2286],{"class":1851},[1520,2563,2565,2567,2569,2571,2573,2575,2577,2579,2581,2583,2585,2588,2590,2592,2594,2597,2599,2601,2603,2606,2608],{"class":1522,"line":2564},22,[1520,2566,2427],{"class":1851},[1520,2568,2092],{"class":2112},[1520,2570,1895],{"class":1851},[1520,2572,1885],{"class":1851},[1520,2574,2251],{"class":1851},[1520,2576,1888],{"class":1851},[1520,2578,2257],{"class":1891},[1520,2580,1895],{"class":1851},[1520,2582,1885],{"class":1851},[1520,2584,1888],{"class":1851},[1520,2586,2587],{"class":1891},"input",[1520,2589,1895],{"class":1851},[1520,2591,1914],{"class":1851},[1520,2593,1888],{"class":1851},[1520,2595,2596],{"class":1891},"field",[1520,2598,1895],{"class":1851},[1520,2600,1885],{"class":1851},[1520,2602,1888],{"class":1851},[1520,2604,2605],{"class":1891},"statuses",[1520,2607,1895],{"class":1851},[1520,2609,2610],{"class":1851}," }\n",[1520,2612,2614],{"class":1522,"line":2613},23,[1520,2615,2616],{"class":1851}," }\n",[1520,2618,2620],{"class":1522,"line":2619},24,[1520,2621,2622],{"class":1851}," },\n",[1520,2624,2626,2628,2631,2633,2635],{"class":1522,"line":2625},25,[1520,2627,2382],{"class":1851},[1520,2629,2630],{"class":1869},"period",[1520,2632,1895],{"class":1851},[1520,2634,1885],{"class":1851},[1520,2636,2237],{"class":1851},[1520,2638,2640,2642,2644,2646,2648,2650,2652,2654],{"class":1522,"line":2639},26,[1520,2641,2396],{"class":1851},[1520,2643,2257],{"class":2066},[1520,2645,1895],{"class":1851},[1520,2647,1885],{"class":1851},[1520,2649,1888],{"class":1851},[1520,2651,2360],{"class":1891},[1520,2653,1895],{"class":1851},[1520,2655,1898],{"class":1851},[1520,2657,2659,2661,2663,2665,2667],{"class":1522,"line":2658},27,[1520,2660,2396],{"class":1851},[1520,2662,2371],{"class":2066},[1520,2664,1895],{"class":1851},[1520,2666,1885],{"class":1851},[1520,2668,2237],{"class":1851},[1520,2670,2672,2674,2676,2678,2680,2682,2684,2686,2688,2690,2692,2694,2696,2698,2700,2702,2704,2706,2708,2711,2713],{"class":1522,"line":2671},28,[1520,2673,2427],{"class":1851},[1520,2675,2430],{"class":2112},[1520,2677,1895],{"class":1851},[1520,2679,1885],{"class":1851},[1520,2681,2251],{"class":1851},[1520,2683,1888],{"class":1851},[1520,2685,2257],{"class":1891},[1520,2687,1895],{"class":1851},[1520,2689,1885],{"class":1851},[1520,2691,1888],{"class":1851},[1520,2693,2088],{"class":1891},[1520,2695,1895],{"class":1851},[1520,2697,1914],{"class":1851},[1520,2699,1888],{"class":1851},[1520,2701,2092],{"class":1891},[1520,2703,1895],{"class":1851},[1520,2705,1885],{"class":1851},[1520,2707,1888],{"class":1851},[1520,2709,2710],{"class":1891},"placed_on",[1520,2712,1895],{"class":1851},[1520,2714,2286],{"class":1851},[1520,2716,2718,2720,2722,2724,2726,2728,2730,2732,2734,2736,2738,2740,2742,2744,2746,2748,2750,2752,2754,2757,2759],{"class":1522,"line":2717},29,[1520,2719,2427],{"class":1851},[1520,2721,2476],{"class":2112},[1520,2723,1895],{"class":1851},[1520,2725,1885],{"class":1851},[1520,2727,2251],{"class":1851},[1520,2729,1888],{"class":1851},[1520,2731,2257],{"class":1891},[1520,2733,1895],{"class":1851},[1520,2735,1885],{"class":1851},[1520,2737,1888],{"class":1851},[1520,2739,2088],{"class":1891},[1520,2741,1895],{"class":1851},[1520,2743,1914],{"class":1851},[1520,2745,1888],{"class":1851},[1520,2747,2092],{"class":1891},[1520,2749,1895],{"class":1851},[1520,2751,1885],{"class":1851},[1520,2753,1888],{"class":1851},[1520,2755,2756],{"class":1891},"between",[1520,2758,1895],{"class":1851},[1520,2760,2286],{"class":1851},[1520,2762,2764,2766,2768,2770,2772,2774,2776,2778,2780,2782,2784,2786,2788,2790,2792,2794,2796,2798,2800,2803,2805],{"class":1522,"line":2763},30,[1520,2765,2427],{"class":1851},[1520,2767,2523],{"class":2112},[1520,2769,1895],{"class":1851},[1520,2771,1885],{"class":1851},[1520,2773,2251],{"class":1851},[1520,2775,1888],{"class":1851},[1520,2777,2257],{"class":1891},[1520,2779,1895],{"class":1851},[1520,2781,1885],{"class":1851},[1520,2783,1888],{"class":1851},[1520,2785,2088],{"class":1891},[1520,2787,1895],{"class":1851},[1520,2789,1914],{"class":1851},[1520,2791,1888],{"class":1851},[1520,2793,2092],{"class":1891},[1520,2795,1895],{"class":1851},[1520,2797,1885],{"class":1851},[1520,2799,1888],{"class":1851},[1520,2801,2802],{"class":1891},"date",[1520,2804,1895],{"class":1851},[1520,2806,2286],{"class":1851},[1520,2808,2810,2812,2814,2816,2818,2820,2822,2824,2826,2828,2830,2832,2834,2836,2838,2840,2842,2844,2846,2848,2850],{"class":1522,"line":2809},31,[1520,2811,2427],{"class":1851},[1520,2813,2092],{"class":2112},[1520,2815,1895],{"class":1851},[1520,2817,1885],{"class":1851},[1520,2819,2251],{"class":1851},[1520,2821,1888],{"class":1851},[1520,2823,2257],{"class":1891},[1520,2825,1895],{"class":1851},[1520,2827,1885],{"class":1851},[1520,2829,1888],{"class":1851},[1520,2831,2587],{"class":1891},[1520,2833,1895],{"class":1851},[1520,2835,1914],{"class":1851},[1520,2837,1888],{"class":1851},[1520,2839,2596],{"class":1891},[1520,2841,1895],{"class":1851},[1520,2843,1885],{"class":1851},[1520,2845,1888],{"class":1851},[1520,2847,2630],{"class":1891},[1520,2849,1895],{"class":1851},[1520,2851,2610],{"class":1851},[1520,2853,2855],{"class":1522,"line":2854},32,[1520,2856,2616],{"class":1851},[1520,2858,2860],{"class":1522,"line":2859},33,[1520,2861,2862],{"class":1851}," }\n",[1520,2864,2866],{"class":1522,"line":2865},34,[1520,2867,2868],{"class":1851}," }\n",[1520,2870,2872],{"class":1522,"line":2871},35,[1520,2873,2874],{"class":1851}," },\n",[1520,2876,2878,2880,2883,2885,2887,2889,2891,2893,2895,2897,2899,2901,2903,2905,2907,2909,2911,2913,2916],{"class":1522,"line":2877},36,[1520,2879,2242],{"class":1851},[1520,2881,2882],{"class":1881},"max_rows",[1520,2884,1895],{"class":1851},[1520,2886,1885],{"class":1851},[1520,2888,2251],{"class":1851},[1520,2890,1888],{"class":1851},[1520,2892,2257],{"class":2256},[1520,2894,1895],{"class":1851},[1520,2896,1885],{"class":1851},[1520,2898,1888],{"class":1851},[1520,2900,2088],{"class":1891},[1520,2902,1895],{"class":1851},[1520,2904,1914],{"class":1851},[1520,2906,1888],{"class":1851},[1520,2908,2092],{"class":2256},[1520,2910,1895],{"class":1851},[1520,2912,1885],{"class":1851},[1520,2914,2915],{"class":2192}," 500",[1520,2917,2610],{"class":1851},[1520,2919,2921],{"class":1522,"line":2920},37,[1520,2922,2923],{"class":1851}," }\n",[1520,2925,2927],{"class":1522,"line":2926},38,[1520,2928,2929],{"class":1851}," }\n",[1520,2931,2933],{"class":1522,"line":2932},39,[1520,2934,2935],{"class":1851}," ]\n",[1520,2937,2939],{"class":1522,"line":2938},40,[1520,2940,2941],{"class":1851}," }\n",[1520,2943,2945],{"class":1522,"line":2944},41,[1520,2946,2947],{"class":1851}," ]\n",[1520,2949,2951],{"class":1522,"line":2950},42,[1520,2952,2953],{"class":1851},"}\n",[1203,2955,2956,2957,1274,2960,1278,2963,2966],{},"Save it with ",[1218,2958,2959],{},"composition.validate",[1218,2961,2962],{},"composition.save",[1266,2964,2965],{"href":488},"Compositions",").",[1203,2968,2969],{},"If a user leaves a filter out, that filter is skipped: they get every row of their own scope, never more.",[1382,2971,2973],{"id":2972},"_6-expose-it-to-your-app","6. Expose it to your app",[1336,2975,2977],{"className":1838,"code":2976,"language":1840,"meta":1344,"style":1344},"identity.app.expose-virtual-workflow({\n identity_app_uuid: \"…\",\n composition_uuid: \"…\",\n version: 1,\n})\n",[1218,2978,2979,3005,3019,3034,3046],{"__ignoreMap":1344},[1520,2980,2981,2983,2985,2987,2989,2992,2994,2997,2999,3001,3003],{"class":1522,"line":1523},[1520,2982,1848],{"class":1847},[1520,2984,1358],{"class":1851},[1520,2986,1854],{"class":1847},[1520,2988,1358],{"class":1851},[1520,2990,2991],{"class":1847},"expose",[1520,2993,1857],{"class":1851},[1520,2995,2996],{"class":1847},"virtual",[1520,2998,1857],{"class":1851},[1520,3000,2018],{"class":1869},[1520,3002,1873],{"class":1847},[1520,3004,1876],{"class":1851},[1520,3006,3007,3009,3011,3013,3015,3017],{"class":1522,"line":1529},[1520,3008,1882],{"class":1881},[1520,3010,1885],{"class":1851},[1520,3012,1888],{"class":1851},[1520,3014,1892],{"class":1891},[1520,3016,1895],{"class":1851},[1520,3018,1898],{"class":1851},[1520,3020,3021,3024,3026,3028,3030,3032],{"class":1522,"line":1535},[1520,3022,3023],{"class":1881}," composition_uuid",[1520,3025,1885],{"class":1851},[1520,3027,1888],{"class":1851},[1520,3029,1892],{"class":1891},[1520,3031,1895],{"class":1851},[1520,3033,1898],{"class":1851},[1520,3035,3036,3039,3041,3044],{"class":1522,"line":1541},[1520,3037,3038],{"class":1881}," version",[1520,3040,1885],{"class":1851},[1520,3042,3043],{"class":2192}," 1",[1520,3045,1898],{"class":1851},[1520,3047,3048,3050],{"class":1522,"line":1548},[1520,3049,1956],{"class":1851},[1520,3051,1959],{"class":1847},[1203,3053,3054,3055,3058,3059,3062],{},"Expose refuses the composition, and lists the offending paths under ",[1218,3056,3057],{},"unsealed_steps",", if caller input reaches anything other than ",[1218,3060,3061],{},"filters.\u003Cname>.value",". That includes input passed through another step first. Turning the switch from step 4 off again un-exposes every composition that depended on it.",[1382,3064,3066],{"id":3065},"_7-call-it-as-the-signed-in-user","7. Call it as the signed-in user",[1336,3068,3070],{"className":1838,"code":3069,"language":1840,"meta":1344,"style":1344},"import { createOrkestiaAuth } from \"@orkestia/auth\"\nimport { LtIntegWorkflowsClient } from \"@ltinteg/workflows-sdk\"\n\nconst session = createOrkestiaAuth({ clientKey: \"orkestia_…\" }).getSession()\nconst client = new LtIntegWorkflowsClient({\n baseUrl: \"https://workflow-api.orkestia.dev\",\n token: session.token,\n})\n\nconst run = await client.start(\"virtual.\u003Ccomposition_uuid>@1\", {\n statuses: [\"open\", \"paid\"],\n period: [\"2026-10-01\", \"2026-10-31\"],\n})\nconst { state_data } = await run.wait()\n// state_data.orders → { rows: [...], row_count, truncated, slot, app_organization_uuid, ... }\n",[1218,3071,3072,3097,3117,3121,3163,3181,3197,3214,3220,3224,3257,3288,3317,3323,3349],{"__ignoreMap":1344},[1520,3073,3074,3078,3080,3083,3086,3089,3091,3094],{"class":1522,"line":1523},[1520,3075,3077],{"class":3076},"s7zQu","import",[1520,3079,2251],{"class":1851},[1520,3081,3082],{"class":1847}," createOrkestiaAuth",[1520,3084,3085],{"class":1851}," }",[1520,3087,3088],{"class":3076}," from",[1520,3090,1888],{"class":1851},[1520,3092,3093],{"class":1891},"@orkestia/auth",[1520,3095,3096],{"class":1851},"\"\n",[1520,3098,3099,3101,3103,3106,3108,3110,3112,3115],{"class":1522,"line":1529},[1520,3100,3077],{"class":3076},[1520,3102,2251],{"class":1851},[1520,3104,3105],{"class":1847}," LtIntegWorkflowsClient",[1520,3107,3085],{"class":1851},[1520,3109,3088],{"class":3076},[1520,3111,1888],{"class":1851},[1520,3113,3114],{"class":1891},"@ltinteg/workflows-sdk",[1520,3116,3096],{"class":1851},[1520,3118,3119],{"class":1522,"line":1535},[1520,3120,1545],{"emptyLinePlaceholder":1544},[1520,3122,3123,3126,3129,3132,3134,3136,3139,3142,3144,3146,3149,3151,3153,3155,3157,3160],{"class":1522,"line":1541},[1520,3124,3125],{"class":2112},"const",[1520,3127,3128],{"class":1847}," session ",[1520,3130,3131],{"class":1851},"=",[1520,3133,3082],{"class":1869},[1520,3135,1873],{"class":1847},[1520,3137,3138],{"class":1851},"{",[1520,3140,3141],{"class":1881}," clientKey",[1520,3143,1885],{"class":1851},[1520,3145,1888],{"class":1851},[1520,3147,3148],{"class":1891},"orkestia_…",[1520,3150,1895],{"class":1851},[1520,3152,3085],{"class":1851},[1520,3154,1759],{"class":1847},[1520,3156,1358],{"class":1851},[1520,3158,3159],{"class":1869},"getSession",[1520,3161,3162],{"class":1847},"()\n",[1520,3164,3165,3167,3170,3172,3175,3177,3179],{"class":1522,"line":1548},[1520,3166,3125],{"class":2112},[1520,3168,3169],{"class":1847}," client ",[1520,3171,3131],{"class":1851},[1520,3173,3174],{"class":1851}," new",[1520,3176,3105],{"class":1869},[1520,3178,1873],{"class":1847},[1520,3180,1876],{"class":1851},[1520,3182,3183,3186,3188,3190,3193,3195],{"class":1522,"line":1554},[1520,3184,3185],{"class":1881}," baseUrl",[1520,3187,1885],{"class":1851},[1520,3189,1888],{"class":1851},[1520,3191,3192],{"class":1891},"https://workflow-api.orkestia.dev",[1520,3194,1895],{"class":1851},[1520,3196,1898],{"class":1851},[1520,3198,3199,3202,3204,3207,3209,3212],{"class":1522,"line":1560},[1520,3200,3201],{"class":1881}," token",[1520,3203,1885],{"class":1851},[1520,3205,3206],{"class":1847}," session",[1520,3208,1358],{"class":1851},[1520,3210,3211],{"class":1847},"token",[1520,3213,1898],{"class":1851},[1520,3215,3216,3218],{"class":1522,"line":1566},[1520,3217,1956],{"class":1851},[1520,3219,1959],{"class":1847},[1520,3221,3222],{"class":1522,"line":1572},[1520,3223,1545],{"emptyLinePlaceholder":1544},[1520,3225,3226,3228,3231,3233,3236,3239,3241,3244,3246,3248,3251,3253,3255],{"class":1522,"line":1578},[1520,3227,3125],{"class":2112},[1520,3229,3230],{"class":1847}," run ",[1520,3232,3131],{"class":1851},[1520,3234,3235],{"class":3076}," await",[1520,3237,3238],{"class":1847}," client",[1520,3240,1358],{"class":1851},[1520,3242,3243],{"class":1869},"start",[1520,3245,1873],{"class":1847},[1520,3247,1895],{"class":1851},[1520,3249,3250],{"class":1891},"virtual.\u003Ccomposition_uuid>@1",[1520,3252,1895],{"class":1851},[1520,3254,1914],{"class":1851},[1520,3256,2237],{"class":1851},[1520,3258,3259,3262,3264,3267,3269,3272,3274,3276,3278,3281,3283,3286],{"class":1522,"line":1583},[1520,3260,3261],{"class":1881}," statuses",[1520,3263,1885],{"class":1851},[1520,3265,3266],{"class":1847}," [",[1520,3268,1895],{"class":1851},[1520,3270,3271],{"class":1891},"open",[1520,3273,1895],{"class":1851},[1520,3275,1914],{"class":1851},[1520,3277,1888],{"class":1851},[1520,3279,3280],{"class":1891},"paid",[1520,3282,1895],{"class":1851},[1520,3284,3285],{"class":1847},"]",[1520,3287,1898],{"class":1851},[1520,3289,3290,3293,3295,3297,3299,3302,3304,3306,3308,3311,3313,3315],{"class":1522,"line":1589},[1520,3291,3292],{"class":1881}," period",[1520,3294,1885],{"class":1851},[1520,3296,3266],{"class":1847},[1520,3298,1895],{"class":1851},[1520,3300,3301],{"class":1891},"2026-10-01",[1520,3303,1895],{"class":1851},[1520,3305,1914],{"class":1851},[1520,3307,1888],{"class":1851},[1520,3309,3310],{"class":1891},"2026-10-31",[1520,3312,1895],{"class":1851},[1520,3314,3285],{"class":1847},[1520,3316,1898],{"class":1851},[1520,3318,3319,3321],{"class":1522,"line":1595},[1520,3320,1956],{"class":1851},[1520,3322,1959],{"class":1847},[1520,3324,3325,3327,3329,3332,3334,3337,3339,3342,3344,3347],{"class":1522,"line":1601},[1520,3326,3125],{"class":2112},[1520,3328,2251],{"class":1851},[1520,3330,3331],{"class":1847}," state_data ",[1520,3333,1956],{"class":1851},[1520,3335,3336],{"class":1851}," =",[1520,3338,3235],{"class":3076},[1520,3340,3341],{"class":1847}," run",[1520,3343,1358],{"class":1851},[1520,3345,3346],{"class":1869},"wait",[1520,3348,3162],{"class":1847},[1520,3350,3351],{"class":1522,"line":1607},[1520,3352,3353],{"class":1917},"// state_data.orders → { rows: [...], row_count, truncated, slot, app_organization_uuid, ... }\n",[1203,3355,3356,3357,3360,3361,1358],{},"The step's result sits under the step's name. ",[1218,3358,3359],{},"truncated: true"," means there were more rows than ",[1218,3362,2882],{},[3364,3365,3366],"tip",{},[1203,3367,3368,3369,1358],{},"Test with a real end-user token. The step needs a signed-in user with an active workspace, so starting the composition as yourself (an org member) fails with ",[1218,3370,1985],{},[1233,3372,3373],{"id":2338},"Filters",[1238,3375,3376,3388],{},[1241,3377,3378],{},[1244,3379,3380,3382,3385],{},[1247,3381,1722],{},[1247,3383,3384],{},"Set by",[1247,3386,3387],{},"Allowed",[1257,3389,3390,3412,3435,3455],{},[1244,3391,3392,3396,3399],{},[1262,3393,3394],{},[1218,3395,2430],{},[1262,3397,3398],{},"You (static)",[1262,3400,3401,3402,3405,3406,3409,3410],{},"A column of your query's ",[1207,3403,3404],{},"output",", lowercase: ",[1218,3407,3408],{},"^[a-z_][a-z0-9_]{0,62}$",". Alias other names in your ",[1218,3411,1501],{},[1244,3413,3414,3418,3420],{},[1262,3415,3416],{},[1218,3417,2476],{},[1262,3419,3398],{},[1262,3421,3422,1746,3425,1746,3427,1746,3429,1746,3432],{},[1218,3423,3424],{},"eq",[1218,3426,2511],{},[1218,3428,2756],{},[1218,3430,3431],{},"gte",[1218,3433,3434],{},"lte",[1244,3436,3437,3441,3443],{},[1262,3438,3439],{},[1218,3440,2523],{},[1262,3442,3398],{},[1262,3444,3445,1746,3448,1746,3451,1746,3453],{},[1218,3446,3447],{},"integer",[1218,3449,3450],{},"uuid",[1218,3452,2802],{},[1218,3454,1341],{},[1244,3456,3457,3461,3464],{},[1262,3458,3459],{},[1218,3460,2092],{},[1262,3462,3463],{},"The user",[1262,3465,3466],{},"See below",[1238,3468,3469,3478],{},[1241,3470,3471],{},[1244,3472,3473,3476],{},[1247,3474,3475],{},"Operator",[1247,3477,1725],{},[1257,3479,3480,3493,3502],{},[1244,3481,3482,3490],{},[1262,3483,3484,1746,3486,1746,3488],{},[1218,3485,3424],{},[1218,3487,3431],{},[1218,3489,3434],{},[1262,3491,3492],{},"One value",[1244,3494,3495,3499],{},[1262,3496,3497],{},[1218,3498,2511],{},[1262,3500,3501],{},"A list of 1 to 50 values",[1244,3503,3504,3508],{},[1262,3505,3506],{},[1218,3507,2756],{},[1262,3509,3510],{},"Exactly two values, low then high (inclusive)",[1346,3512,3513,3535,3544],{},[1349,3514,3515,3517,3518,3520,3521,3523,3524,3526,3527,3529,3530,1282,3532,3534],{},[1218,3516,3447],{},": a whole number (or a string of digits). ",[1218,3519,3450],{},": a UUID. ",[1218,3522,2802],{},": an ISO date such as ",[1218,3525,3310],{},". ",[1218,3528,1341],{},": a non-empty string of at most 200 characters, with ",[1218,3531,3424],{},[1218,3533,2511],{}," only, compared exactly (no wildcards).",[1349,3536,1351,3537,3540,3541,1358],{},[1218,3538,3539],{},"null",", empty, wrongly typed or out-of-range value fails with ",[1218,3542,3543],{},"FILTER_INVALID",[1349,3545,3546,3547,3550],{},"At most 16 filters per step. All supplied filters are combined with ",[1218,3548,3549],{},"AND"," around your query, so they can only remove rows.",[1233,3552,3554],{"id":3553},"rules-for-your-sql","Rules for your SQL",[1203,3556,3557,3558,3561],{},"Orkestia wraps your query as ",[1218,3559,3560],{},"SELECT * FROM (\u003Cyour SQL>) AS q WHERE \u003Cfilters> LIMIT \u003Cmax_rows + 1>",". Your SQL must be:",[1346,3563,3564,3574,3589,3614],{},[1349,3565,3566,3567,3570,3571,3573],{},"exactly ",[1207,3568,3569],{},"one"," ",[1218,3572,1501],{}," statement (CTEs are fine);",[1349,3575,3576,3577,3580,3581,3584,3585,3588],{},"free of placeholders: values only arrive through filters. Write ",[1218,3578,3579],{},"%%"," for a literal ",[1218,3582,3583],{},"%",", for example ",[1218,3586,3587],{},"LIKE 'INV-%%'",";",[1349,3590,3591,3592,1746,3595,1746,3598,1746,3601,1746,3604,1746,3607,1282,3610,3613],{},"read-only: no ",[1218,3593,3594],{},"INSERT",[1218,3596,3597],{},"UPDATE",[1218,3599,3600],{},"DELETE",[1218,3602,3603],{},"MERGE",[1218,3605,3606],{},"SELECT INTO",[1218,3608,3609],{},"FOR UPDATE",[1218,3611,3612],{},"FOR SHARE",", even inside a CTE;",[1349,3615,3616,3617,1746,3620,1746,3623,1746,3626,3629,3630,1746,3633,3636],{},"free of session, file, sleep and cross-database functions: ",[1218,3618,3619],{},"set_config",[1218,3621,3622],{},"current_setting",[1218,3624,3625],{},"pg_sleep*",[1218,3627,3628],{},"pg_read_file"," and similar, ",[1218,3631,3632],{},"dblink*",[1218,3634,3635],{},"lo_*",", advisory locks, backend termination.",[1203,3638,3639,3640,3643,3644,1358],{},"A query that breaks a rule fails with ",[1218,3641,3642],{},"SQL_REJECTED",". A filter on a column that is not in your query's output fails with ",[1218,3645,3646],{},"QUERY_FAILED",[1233,3648,864],{"id":3649},"limits",[1238,3651,3652,3665],{},[1241,3653,3654],{},[1244,3655,3656,3659,3662],{},[1247,3657,3658],{},"Setting",[1247,3660,3661],{},"Default",[1247,3663,3664],{},"Maximum",[1257,3666,3667,3679],{},[1244,3668,3669,3673,3676],{},[1262,3670,3671],{},[1218,3672,2882],{},[1262,3674,3675],{},"500",[1262,3677,3678],{},"10,000",[1244,3680,3681,3686,3689],{},[1262,3682,3683],{},[1218,3684,3685],{},"timeout_seconds",[1262,3687,3688],{},"10",[1262,3690,3691],{},"30",[1203,3693,3694,3695,3698],{},"Both are static. The timeout is applied as the transaction's ",[1218,3696,3697],{},"statement_timeout"," on your server, so make sure your database can answer within it: index the columns you filter on. Every run opens a new connection with the workspace's login and closes it at the end.",[1203,3700,3701,3702,3705,3706,3709],{},"Values come back JSON-safe: dates and timestamps as ISO strings, ",[1218,3703,3704],{},"numeric"," as strings (precision kept), UUIDs as strings, ",[1218,3707,3708],{},"bytea"," as hex.",[1233,3711,3713],{"id":3712},"errors","Errors",[1203,3715,3716],{},"The user's run fails with a code only. Database error text is never returned to the end user.",[1238,3718,3719,3732],{},[1241,3720,3721],{},[1244,3722,3723,3726,3729],{},[1247,3724,3725],{},"Code",[1247,3727,3728],{},"Meaning",[1247,3730,3731],{},"Fix",[1257,3733,3734,3746,3759,3772,3785,3800,3815,3829,3845],{},[1244,3735,3736,3740,3743],{},[1262,3737,3738],{},[1218,3739,1985],{},[1262,3741,3742],{},"No signed-in end user, a scheduled run, no active workspace, the user switched workspace or lost membership, the workspace is inactive, nothing is bound to the slot, or the bound connection is gone or not SQL",[1262,3744,3745],{},"Bind the workspace; check the user's membership and active workspace",[1244,3747,3748,3753,3756],{},[1262,3749,3750],{},[1218,3751,3752],{},"TENANT_MISMATCH",[1262,3754,3755],{},"The user's app does not belong to the organization running the composition",[1262,3757,3758],{},"Expose the composition from the app's own organization",[1244,3760,3761,3766,3769],{},[1262,3762,3763],{},[1218,3764,3765],{},"PRINCIPAL_INACTIVE",[1262,3767,3768],{},"The app is suspended or the end user is disabled",[1262,3770,3771],{},"Reactivate them",[1244,3773,3774,3779,3782],{},[1262,3775,3776],{},[1218,3777,3778],{},"SHARED_CREDENTIAL",[1262,3780,3781],{},"Another workspace in the same slot uses the same connection or the same database login",[1262,3783,3784],{},"Give every workspace its own login",[1244,3786,3787,3792,3797],{},[1262,3788,3789],{},[1218,3790,3791],{},"PRIVILEGED_ROLE",[1262,3793,3794,3795],{},"The bound login is a superuser or has ",[1218,3796,1451],{},[1262,3798,3799],{},"Use a plain login",[1244,3801,3802,3806,3809],{},[1262,3803,3804],{},[1218,3805,3543],{},[1262,3807,3808],{},"A filter value or filter definition is invalid",[1262,3810,3811,3812],{},"See ",[1266,3813,3373],{"href":3814},"#filters",[1244,3816,3817,3821,3824],{},[1262,3818,3819],{},[1218,3820,3642],{},[1262,3822,3823],{},"Your SQL breaks a rule",[1262,3825,3811,3826],{},[1266,3827,3554],{"href":3828},"#rules-for-your-sql",[1244,3830,3831,3835,3838],{},[1262,3832,3833],{},[1218,3834,3646],{},[1262,3836,3837],{},"The database returned an error (permission, unknown column, connection)",[1262,3839,3840,3841,3844],{},"Run the same SQL in ",[1218,3842,3843],{},"psql"," as that workspace's login",[1244,3846,3847,3852,3855],{},[1262,3848,3849],{},[1218,3850,3851],{},"QUERY_TIMEOUT",[1262,3853,3854],{},"The query hit the statement timeout",[1262,3856,3857,3858,3860],{},"Index, narrow, or raise ",[1218,3859,3685],{}," (max 30)",[1233,3862,3864],{"id":3863},"check-and-roll-back","Check and roll back",[1346,3866,3867,3870,3877],{},[1349,3868,3869],{},"Sign in as a user of workspace A and run the composition: only A's rows come back.",[1349,3871,3872,3873,3876],{},"Switch that user to workspace B (",[1218,3874,3875],{},"identity.end-user.organization.switch",") and run again: only B's rows.",[1349,3878,3879,3880,3883,3884,1358],{},"Unbind A (",[1218,3881,3882],{},"identity.app-organization.unbind-connection","): A's next run fails with ",[1218,3885,1985],{},[1203,3887,3888,3889,3892,3893,3896],{},"To stop everything at once, run ",[1218,3890,3891],{},"identity.app.set-workflow-eligibility"," with ",[1218,3894,3895],{},"enabled: false",". Every composition that uses the step is un-exposed.",[1233,3898,3900],{"id":3899},"not-supported","Not supported",[1346,3902,3903,3906,3909,3912],{},[1349,3904,3905],{},"Databases other than Postgres.",[1349,3907,3908],{},"Scheduled runs: a schedule carries no workspace, so it is refused.",[1349,3910,3911],{},"Writes: the step only reads.",[1349,3913,3914],{},"Choosing a connection, SQL or column at run time.",[1233,3916,3918],{"id":3917},"related","Related",[3920,3921,3922,3928,3933,3939],"card-group",{},[3923,3924,3925],"card",{"icon":162,"title":1037,"to":1038},[1203,3926,3927],{},"Create workspaces, add members, switch the active one.",[3923,3929,3930],{"icon":93,"title":2965,"to":488},[1203,3931,3932],{},"Save, expose and invoke a composition with the user's token.",[3923,3934,3936],{"icon":3935,"title":483,"to":484},"i-lucide-user-check",[1203,3937,3938],{},"Why an end-user token can start only what you exposed.",[3923,3940,3941],{"icon":190,"title":187,"to":591},[1203,3942,3943],{},"When the data can live in Orkestia, isolation is enforced row by row.",[3945,3946,3947],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .su27w, html code.shiki .su27w{--shiki-light:#916B53;--shiki-default:#916B53;--shiki-dark:#916B53}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":1344,"searchDepth":1523,"depth":1529,"links":3949},[3950,3951,3954,3963,3964,3965,3966,3967,3968,3969],{"id":1235,"depth":1529,"text":1236},{"id":1333,"depth":1529,"text":1334,"children":3952},[3953],{"id":1384,"depth":1535,"text":1385},{"id":1472,"depth":1529,"text":1473,"children":3955},[3956,3957,3958,3959,3960,3961,3962],{"id":1476,"depth":1535,"text":1477},{"id":1698,"depth":1535,"text":1699},{"id":1823,"depth":1535,"text":1824},{"id":1989,"depth":1535,"text":1990},{"id":2081,"depth":1535,"text":2082},{"id":2972,"depth":1535,"text":2973},{"id":3065,"depth":1535,"text":3066},{"id":2338,"depth":1529,"text":3373},{"id":3553,"depth":1529,"text":3554},{"id":3649,"depth":1529,"text":864},{"id":3712,"depth":1529,"text":3713},{"id":3863,"depth":1529,"text":3864},{"id":3899,"depth":1529,"text":3900},{"id":3917,"depth":1529,"text":3918},"Let your app's signed-in users read rows from a Postgres database you operate, through a login bound to their workspace, with filters that can only narrow.","md",null,{},{"icon":494},{"title":491,"description":3970},"2WQbvzhgN2rNIId3sJ5aJEeBoClHOnf5HknyAh_Whos",[3978,3980],{"title":487,"path":488,"stem":489,"description":3979,"icon":93,"children":-1},"Save a virtual workflow, invoke it, expose it to your app's users, and let them run it with their Sign in with Orkestia JWT.",{"title":496,"path":497,"stem":498,"description":3981,"icon":34,"children":-1},"Observability control plane — structured logs, SHA-256 error groups, traces/spans, metrics, Pulse, and a query/MCP API",1794361943432]