npm - @electric-ax/agents-server - Versions diffs - 0.4.14 → 0.4.16 - Mend

@electric-ax/agents-server 0.4.14 → 0.4.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (35) hide show

package/dist/entrypoint.js +1530 -256
package/dist/index.cjs +1517 -232
package/dist/index.d.cts +1359 -212
package/dist/index.d.ts +1359 -212
package/dist/index.js +1519 -234
package/drizzle/0010_sandbox_profiles.sql +5 -0
package/drizzle/0011_entity_permissions.sql +100 -0
package/drizzle/0012_horton_user_manage_permission.sql +25 -0
package/drizzle/0013_worker_user_manage_permission.sql +25 -0
package/drizzle/meta/_journal.json +28 -0
package/package.json +7 -7
package/src/db/schema.ts +200 -0
package/src/electric-agents-types.ts +147 -2
package/src/entity-bridge-manager.ts +57 -6
package/src/entity-manager.ts +411 -62
package/src/entity-projector.ts +79 -17
package/src/entity-registry.ts +681 -5
package/src/index.ts +11 -0
package/src/permissions.ts +239 -0
package/src/routing/context.ts +2 -0
package/src/routing/durable-streams-router.ts +125 -4
package/src/routing/electric-proxy-router.ts +4 -0
package/src/routing/entities-router.ts +362 -20
package/src/routing/entity-types-router.ts +244 -15
package/src/routing/hooks.ts +1 -0
package/src/routing/observations-router.ts +2 -1
package/src/routing/runners-router.ts +10 -0
package/src/routing/sandbox.ts +173 -0
package/src/runtime.ts +34 -0
package/src/sandbox-choice-schema.ts +28 -0
package/src/scheduler.ts +2 -0
package/src/server.ts +5 -0
package/src/stream-client.ts +17 -1
package/src/utils/server-utils.ts +192 -12
package/src/wake-registry.ts +30 -11

package/dist/index.d.cts CHANGED Viewed

@@ -185,9 +185,61 @@ import * as drizzle_orm_pg_core236 from "drizzle-orm/pg-core";
 import * as drizzle_orm_pg_core237 from "drizzle-orm/pg-core";
 import * as drizzle_orm_pg_core238 from "drizzle-orm/pg-core";
 import * as drizzle_orm_pg_core239 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core240 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core241 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core242 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core243 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core244 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core245 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core246 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core247 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core248 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core249 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core250 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core251 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core252 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core253 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core254 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core255 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core256 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core257 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core258 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core259 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core260 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core261 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core262 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core263 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core264 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core265 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core266 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core267 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core268 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core269 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core270 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core271 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core272 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core273 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core274 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core275 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core276 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core277 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core278 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core279 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core280 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core281 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core282 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core283 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core284 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core285 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core286 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core287 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core288 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core289 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core290 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core291 from "drizzle-orm/pg-core";
 import * as drizzle_orm73 from "drizzle-orm";
 import * as drizzle_orm74 from "drizzle-orm";
-import { EntityTags, EventSourceBucket, EventSourceContract, EventSourceContract as EventSourceContract$1, EventSourceFilter, EventSourceSubscription, EventSourceSubscription as EventSourceSubscription$1, EventSourceSubscriptionInput, SubscriptionLifetime, WebhookNotification, WebhookSignatureVerifierConfig } from "@electric-ax/agents-runtime";
+import { EntityTags, EventPointer, EventSourceBucket, EventSourceContract, EventSourceContract as EventSourceContract$1, EventSourceFilter, EventSourceSubscription, EventSourceSubscription as EventSourceSubscription$1, EventSourceSubscriptionInput, SubscriptionLifetime, WebhookNotification, WebhookSignatureVerifierConfig } from "@electric-ax/agents-runtime";
 import "@sinclair/typebox";
 import { MaybePromise } from "@durable-streams/client";
 import { AutoRouterType, IRequest } from "itty-router";
@@ -196,7 +248,7 @@ import { JsonWebKey, KeyObject } from "node:crypto";
 //#region rolldown:runtime
 declare namespace schema_d_exports {
-  export { consumerCallbacks, consumerClaims, entities, entityBridges, entityDispatchState, entityManifestSources, entityTypes, runnerRuntimeDiagnostics, runners, scheduledTasks, subscriptionWebhooks, tagStreamOutbox, users, wakeNotifications, wakeRegistrations };
+  export { consumerCallbacks, consumerClaims, entities, entityBridges, entityDispatchState, entityEffectivePermissions, entityLineage, entityManifestSources, entityPermissionGrants, entityTypePermissionGrants, entityTypes, runnerRuntimeDiagnostics, runners, scheduledTasks, sharedStateLinks, subscriptionWebhooks, tagStreamOutbox, users, wakeNotifications, wakeRegistrations };
 }
 declare const entityTypes: drizzle_orm_pg_core64.PgTableWithColumns<{
   name: "entity_types";
@@ -392,7 +444,7 @@ declare const entityTypes: drizzle_orm_pg_core64.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const entities: drizzle_orm_pg_core85.PgTableWithColumns<{
+declare const entities: drizzle_orm_pg_core86.PgTableWithColumns<{
   name: "entities";
   schema: undefined;
   columns: {
@@ -592,14 +644,722 @@ declare const entities: drizzle_orm_pg_core85.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    parent: drizzle_orm_pg_core78.PgColumn<{
+    sandbox: drizzle_orm_pg_core78.PgColumn<{
+      name: "sandbox";
+      tableName: "entities";
+      dataType: "json";
+      columnType: "PgJsonb";
+      data: unknown;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    parent: drizzle_orm_pg_core79.PgColumn<{
       name: "parent";
       tableName: "entities";
       dataType: "string";
       columnType: "PgText";
       data: string;
       driverParam: string;
-      notNull: false;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: drizzle_orm_pg_core80.PgColumn<{
+      name: "created_by";
+      tableName: "entities";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    typeRevision: drizzle_orm_pg_core81.PgColumn<{
+      name: "type_revision";
+      tableName: "entities";
+      dataType: "number";
+      columnType: "PgInteger";
+      data: number;
+      driverParam: string | number;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    inboxSchemas: drizzle_orm_pg_core82.PgColumn<{
+      name: "inbox_schemas";
+      tableName: "entities";
+      dataType: "json";
+      columnType: "PgJsonb";
+      data: unknown;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    stateSchemas: drizzle_orm_pg_core83.PgColumn<{
+      name: "state_schemas";
+      tableName: "entities";
+      dataType: "json";
+      columnType: "PgJsonb";
+      data: unknown;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: drizzle_orm_pg_core84.PgColumn<{
+      name: "created_at";
+      tableName: "entities";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    updatedAt: drizzle_orm_pg_core85.PgColumn<{
+      name: "updated_at";
+      tableName: "entities";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+declare const entityTypePermissionGrants: drizzle_orm_pg_core97.PgTableWithColumns<{
+  name: "entity_type_permission_grants";
+  schema: undefined;
+  columns: {
+    id: drizzle_orm_pg_core87.PgColumn<{
+      name: "id";
+      tableName: "entity_type_permission_grants";
+      dataType: "number";
+      columnType: "PgBigSerial53";
+      data: number;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    tenantId: drizzle_orm_pg_core88.PgColumn<{
+      name: "tenant_id";
+      tableName: "entity_type_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    entityType: drizzle_orm_pg_core89.PgColumn<{
+      name: "entity_type";
+      tableName: "entity_type_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    permission: drizzle_orm_pg_core90.PgColumn<{
+      name: "permission";
+      tableName: "entity_type_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    subjectKind: drizzle_orm_pg_core91.PgColumn<{
+      name: "subject_kind";
+      tableName: "entity_type_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    subjectValue: drizzle_orm_pg_core92.PgColumn<{
+      name: "subject_value";
+      tableName: "entity_type_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: drizzle_orm_pg_core93.PgColumn<{
+      name: "created_by";
+      tableName: "entity_type_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    expiresAt: drizzle_orm_pg_core94.PgColumn<{
+      name: "expires_at";
+      tableName: "entity_type_permission_grants";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: drizzle_orm_pg_core95.PgColumn<{
+      name: "created_at";
+      tableName: "entity_type_permission_grants";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    updatedAt: drizzle_orm_pg_core96.PgColumn<{
+      name: "updated_at";
+      tableName: "entity_type_permission_grants";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+declare const entityLineage: drizzle_orm_pg_core103.PgTableWithColumns<{
+  name: "entity_lineage";
+  schema: undefined;
+  columns: {
+    tenantId: drizzle_orm_pg_core98.PgColumn<{
+      name: "tenant_id";
+      tableName: "entity_lineage";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    ancestorUrl: drizzle_orm_pg_core99.PgColumn<{
+      name: "ancestor_url";
+      tableName: "entity_lineage";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    descendantUrl: drizzle_orm_pg_core100.PgColumn<{
+      name: "descendant_url";
+      tableName: "entity_lineage";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    depth: drizzle_orm_pg_core101.PgColumn<{
+      name: "depth";
+      tableName: "entity_lineage";
+      dataType: "number";
+      columnType: "PgInteger";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: drizzle_orm_pg_core102.PgColumn<{
+      name: "created_at";
+      tableName: "entity_lineage";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+declare const entityPermissionGrants: drizzle_orm_pg_core116.PgTableWithColumns<{
+  name: "entity_permission_grants";
+  schema: undefined;
+  columns: {
+    id: drizzle_orm_pg_core104.PgColumn<{
+      name: "id";
+      tableName: "entity_permission_grants";
+      dataType: "number";
+      columnType: "PgBigSerial53";
+      data: number;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    tenantId: drizzle_orm_pg_core105.PgColumn<{
+      name: "tenant_id";
+      tableName: "entity_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    entityUrl: drizzle_orm_pg_core106.PgColumn<{
+      name: "entity_url";
+      tableName: "entity_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    permission: drizzle_orm_pg_core107.PgColumn<{
+      name: "permission";
+      tableName: "entity_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    subjectKind: drizzle_orm_pg_core108.PgColumn<{
+      name: "subject_kind";
+      tableName: "entity_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    subjectValue: drizzle_orm_pg_core109.PgColumn<{
+      name: "subject_value";
+      tableName: "entity_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    propagation: drizzle_orm_pg_core110.PgColumn<{
+      name: "propagation";
+      tableName: "entity_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    copyToChildren: drizzle_orm_pg_core111.PgColumn<{
+      name: "copy_to_children";
+      tableName: "entity_permission_grants";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: drizzle_orm_pg_core112.PgColumn<{
+      name: "created_by";
+      tableName: "entity_permission_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    expiresAt: drizzle_orm_pg_core113.PgColumn<{
+      name: "expires_at";
+      tableName: "entity_permission_grants";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: drizzle_orm_pg_core114.PgColumn<{
+      name: "created_at";
+      tableName: "entity_permission_grants";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    updatedAt: drizzle_orm_pg_core115.PgColumn<{
+      name: "updated_at";
+      tableName: "entity_permission_grants";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+declare const entityEffectivePermissions: drizzle_orm_pg_core127.PgTableWithColumns<{
+  name: "entity_effective_permissions";
+  schema: undefined;
+  columns: {
+    id: drizzle_orm_pg_core117.PgColumn<{
+      name: "id";
+      tableName: "entity_effective_permissions";
+      dataType: "number";
+      columnType: "PgBigSerial53";
+      data: number;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    tenantId: drizzle_orm_pg_core118.PgColumn<{
+      name: "tenant_id";
+      tableName: "entity_effective_permissions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    entityUrl: drizzle_orm_pg_core119.PgColumn<{
+      name: "entity_url";
+      tableName: "entity_effective_permissions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    sourceEntityUrl: drizzle_orm_pg_core120.PgColumn<{
+      name: "source_entity_url";
+      tableName: "entity_effective_permissions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    sourceGrantId: drizzle_orm_pg_core121.PgColumn<{
+      name: "source_grant_id";
+      tableName: "entity_effective_permissions";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    permission: drizzle_orm_pg_core122.PgColumn<{
+      name: "permission";
+      tableName: "entity_effective_permissions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
       hasDefault: false;
       isPrimaryKey: false;
       isAutoincrement: false;
@@ -609,14 +1369,14 @@ declare const entities: drizzle_orm_pg_core85.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdBy: drizzle_orm_pg_core79.PgColumn<{
-      name: "created_by";
-      tableName: "entities";
+    subjectKind: drizzle_orm_pg_core123.PgColumn<{
+      name: "subject_kind";
+      tableName: "entity_effective_permissions";
       dataType: "string";
       columnType: "PgText";
       data: string;
       driverParam: string;
-      notNull: false;
+      notNull: true;
       hasDefault: false;
       isPrimaryKey: false;
       isAutoincrement: false;
@@ -626,30 +1386,30 @@ declare const entities: drizzle_orm_pg_core85.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    typeRevision: drizzle_orm_pg_core80.PgColumn<{
-      name: "type_revision";
-      tableName: "entities";
-      dataType: "number";
-      columnType: "PgInteger";
-      data: number;
-      driverParam: string | number;
-      notNull: false;
+    subjectValue: drizzle_orm_pg_core124.PgColumn<{
+      name: "subject_value";
+      tableName: "entity_effective_permissions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
       hasDefault: false;
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
-      enumValues: undefined;
+      enumValues: [string, ...string[]];
       baseColumn: never;
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    inboxSchemas: drizzle_orm_pg_core81.PgColumn<{
-      name: "inbox_schemas";
-      tableName: "entities";
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
+    expiresAt: drizzle_orm_pg_core125.PgColumn<{
+      name: "expires_at";
+      tableName: "entity_effective_permissions";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
       notNull: false;
       hasDefault: false;
       isPrimaryKey: false;
@@ -660,15 +1420,15 @@ declare const entities: drizzle_orm_pg_core85.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    stateSchemas: drizzle_orm_pg_core82.PgColumn<{
-      name: "state_schemas";
-      tableName: "entities";
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
-      notNull: false;
-      hasDefault: false;
+    createdAt: drizzle_orm_pg_core126.PgColumn<{
+      name: "created_at";
+      tableName: "entity_effective_permissions";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
@@ -677,32 +1437,107 @@ declare const entities: drizzle_orm_pg_core85.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core83.PgColumn<{
-      name: "created_at";
-      tableName: "entities";
-      dataType: "number";
-      columnType: "PgBigInt53";
-      data: number;
-      driverParam: string | number;
+  };
+  dialect: "pg";
+}>;
+declare const sharedStateLinks: drizzle_orm_pg_core134.PgTableWithColumns<{
+  name: "shared_state_links";
+  schema: undefined;
+  columns: {
+    tenantId: drizzle_orm_pg_core128.PgColumn<{
+      name: "tenant_id";
+      tableName: "shared_state_links";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    sharedStateId: drizzle_orm_pg_core129.PgColumn<{
+      name: "shared_state_id";
+      tableName: "shared_state_links";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    ownerEntityUrl: drizzle_orm_pg_core130.PgColumn<{
+      name: "owner_entity_url";
+      tableName: "shared_state_links";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    manifestKey: drizzle_orm_pg_core131.PgColumn<{
+      name: "manifest_key";
+      tableName: "shared_state_links";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
       notNull: true;
       hasDefault: false;
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: drizzle_orm_pg_core132.PgColumn<{
+      name: "created_at";
+      tableName: "shared_state_links";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
       enumValues: undefined;
       baseColumn: never;
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core84.PgColumn<{
+    updatedAt: drizzle_orm_pg_core133.PgColumn<{
       name: "updated_at";
-      tableName: "entities";
-      dataType: "number";
-      columnType: "PgBigInt53";
-      data: number;
-      driverParam: string | number;
+      tableName: "shared_state_links";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
       notNull: true;
-      hasDefault: false;
+      hasDefault: true;
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
@@ -714,11 +1549,11 @@ declare const entities: drizzle_orm_pg_core85.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
+declare const users: drizzle_orm_pg_core146.PgTableWithColumns<{
   name: "users";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core86.PgColumn<{
+    tenantId: drizzle_orm_pg_core135.PgColumn<{
       name: "tenant_id";
       tableName: "users";
       dataType: "string";
@@ -735,7 +1570,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    id: drizzle_orm_pg_core87.PgColumn<{
+    id: drizzle_orm_pg_core136.PgColumn<{
       name: "id";
       tableName: "users";
       dataType: "string";
@@ -752,7 +1587,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    displayName: drizzle_orm_pg_core88.PgColumn<{
+    displayName: drizzle_orm_pg_core137.PgColumn<{
       name: "display_name";
       tableName: "users";
       dataType: "string";
@@ -769,7 +1604,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    email: drizzle_orm_pg_core89.PgColumn<{
+    email: drizzle_orm_pg_core138.PgColumn<{
       name: "email";
       tableName: "users";
       dataType: "string";
@@ -786,7 +1621,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    avatarUrl: drizzle_orm_pg_core90.PgColumn<{
+    avatarUrl: drizzle_orm_pg_core139.PgColumn<{
       name: "avatar_url";
       tableName: "users";
       dataType: "string";
@@ -803,7 +1638,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    authProvider: drizzle_orm_pg_core91.PgColumn<{
+    authProvider: drizzle_orm_pg_core140.PgColumn<{
       name: "auth_provider";
       tableName: "users";
       dataType: "string";
@@ -820,7 +1655,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    authSubject: drizzle_orm_pg_core92.PgColumn<{
+    authSubject: drizzle_orm_pg_core141.PgColumn<{
       name: "auth_subject";
       tableName: "users";
       dataType: "string";
@@ -837,7 +1672,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    profile: drizzle_orm_pg_core93.PgColumn<{
+    profile: drizzle_orm_pg_core142.PgColumn<{
       name: "profile";
       tableName: "users";
       dataType: "json";
@@ -854,7 +1689,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    metadata: drizzle_orm_pg_core94.PgColumn<{
+    metadata: drizzle_orm_pg_core143.PgColumn<{
       name: "metadata";
       tableName: "users";
       dataType: "json";
@@ -871,7 +1706,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core95.PgColumn<{
+    createdAt: drizzle_orm_pg_core144.PgColumn<{
       name: "created_at";
       tableName: "users";
       dataType: "date";
@@ -888,7 +1723,7 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core96.PgColumn<{
+    updatedAt: drizzle_orm_pg_core145.PgColumn<{
       name: "updated_at";
       tableName: "users";
       dataType: "date";
@@ -908,11 +1743,11 @@ declare const users: drizzle_orm_pg_core97.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
+declare const runners: drizzle_orm_pg_core157.PgTableWithColumns<{
   name: "runners";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core98.PgColumn<{
+    tenantId: drizzle_orm_pg_core147.PgColumn<{
       name: "tenant_id";
       tableName: "runners";
       dataType: "string";
@@ -929,7 +1764,7 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    id: drizzle_orm_pg_core99.PgColumn<{
+    id: drizzle_orm_pg_core148.PgColumn<{
       name: "id";
       tableName: "runners";
       dataType: "string";
@@ -946,7 +1781,7 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    ownerPrincipal: drizzle_orm_pg_core100.PgColumn<{
+    ownerPrincipal: drizzle_orm_pg_core149.PgColumn<{
       name: "owner_principal";
       tableName: "runners";
       dataType: "string";
@@ -963,7 +1798,7 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    label: drizzle_orm_pg_core101.PgColumn<{
+    label: drizzle_orm_pg_core150.PgColumn<{
       name: "label";
       tableName: "runners";
       dataType: "string";
@@ -980,7 +1815,7 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    kind: drizzle_orm_pg_core102.PgColumn<{
+    kind: drizzle_orm_pg_core151.PgColumn<{
       name: "kind";
       tableName: "runners";
       dataType: "string";
@@ -997,7 +1832,7 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    adminStatus: drizzle_orm_pg_core103.PgColumn<{
+    adminStatus: drizzle_orm_pg_core152.PgColumn<{
       name: "admin_status";
       tableName: "runners";
       dataType: "string";
@@ -1014,7 +1849,7 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    wakeStream: drizzle_orm_pg_core104.PgColumn<{
+    wakeStream: drizzle_orm_pg_core153.PgColumn<{
       name: "wake_stream";
       tableName: "runners";
       dataType: "string";
@@ -1031,7 +1866,24 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core105.PgColumn<{
+    sandboxProfiles: drizzle_orm_pg_core154.PgColumn<{
+      name: "sandbox_profiles";
+      tableName: "runners";
+      dataType: "json";
+      columnType: "PgJsonb";
+      data: unknown;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: drizzle_orm_pg_core155.PgColumn<{
       name: "created_at";
       tableName: "runners";
       dataType: "date";
@@ -1048,7 +1900,7 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core106.PgColumn<{
+    updatedAt: drizzle_orm_pg_core156.PgColumn<{
       name: "updated_at";
       tableName: "runners";
       dataType: "date";
@@ -1068,11 +1920,11 @@ declare const runners: drizzle_orm_pg_core107.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumns<{
+declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core166.PgTableWithColumns<{
   name: "runner_runtime_diagnostics";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core108.PgColumn<{
+    tenantId: drizzle_orm_pg_core158.PgColumn<{
       name: "tenant_id";
       tableName: "runner_runtime_diagnostics";
       dataType: "string";
@@ -1089,7 +1941,7 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    runnerId: drizzle_orm_pg_core109.PgColumn<{
+    runnerId: drizzle_orm_pg_core159.PgColumn<{
       name: "runner_id";
       tableName: "runner_runtime_diagnostics";
       dataType: "string";
@@ -1106,7 +1958,7 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    ownerPrincipal: drizzle_orm_pg_core110.PgColumn<{
+    ownerPrincipal: drizzle_orm_pg_core160.PgColumn<{
       name: "owner_principal";
       tableName: "runner_runtime_diagnostics";
       dataType: "string";
@@ -1123,7 +1975,7 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    wakeStreamOffset: drizzle_orm_pg_core111.PgColumn<{
+    wakeStreamOffset: drizzle_orm_pg_core161.PgColumn<{
       name: "wake_stream_offset";
       tableName: "runner_runtime_diagnostics";
       dataType: "string";
@@ -1140,7 +1992,7 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastSeenAt: drizzle_orm_pg_core112.PgColumn<{
+    lastSeenAt: drizzle_orm_pg_core162.PgColumn<{
       name: "last_seen_at";
       tableName: "runner_runtime_diagnostics";
       dataType: "date";
@@ -1157,7 +2009,7 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    livenessLeaseExpiresAt: drizzle_orm_pg_core113.PgColumn<{
+    livenessLeaseExpiresAt: drizzle_orm_pg_core163.PgColumn<{
       name: "liveness_lease_expires_at";
       tableName: "runner_runtime_diagnostics";
       dataType: "date";
@@ -1174,7 +2026,7 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    diagnostics: drizzle_orm_pg_core114.PgColumn<{
+    diagnostics: drizzle_orm_pg_core164.PgColumn<{
       name: "diagnostics";
       tableName: "runner_runtime_diagnostics";
       dataType: "json";
@@ -1191,7 +2043,7 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core115.PgColumn<{
+    updatedAt: drizzle_orm_pg_core165.PgColumn<{
       name: "updated_at";
       tableName: "runner_runtime_diagnostics";
       dataType: "date";
@@ -1211,11 +2063,11 @@ declare const runnerRuntimeDiagnostics: drizzle_orm_pg_core116.PgTableWithColumn
   };
   dialect: "pg";
 }>;
-declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
+declare const entityDispatchState: drizzle_orm_pg_core186.PgTableWithColumns<{
   name: "entity_dispatch_state";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core117.PgColumn<{
+    tenantId: drizzle_orm_pg_core167.PgColumn<{
       name: "tenant_id";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1232,7 +2084,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    entityUrl: drizzle_orm_pg_core118.PgColumn<{
+    entityUrl: drizzle_orm_pg_core168.PgColumn<{
       name: "entity_url";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1249,7 +2101,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    pendingSourceStreams: drizzle_orm_pg_core119.PgColumn<{
+    pendingSourceStreams: drizzle_orm_pg_core169.PgColumn<{
       name: "pending_source_streams";
       tableName: "entity_dispatch_state";
       dataType: "json";
@@ -1266,7 +2118,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    pendingReason: drizzle_orm_pg_core120.PgColumn<{
+    pendingReason: drizzle_orm_pg_core170.PgColumn<{
       name: "pending_reason";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1283,7 +2135,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    pendingSince: drizzle_orm_pg_core121.PgColumn<{
+    pendingSince: drizzle_orm_pg_core171.PgColumn<{
       name: "pending_since";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1300,7 +2152,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    outstandingWakeId: drizzle_orm_pg_core122.PgColumn<{
+    outstandingWakeId: drizzle_orm_pg_core172.PgColumn<{
       name: "outstanding_wake_id";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1317,7 +2169,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    outstandingWakeTarget: drizzle_orm_pg_core123.PgColumn<{
+    outstandingWakeTarget: drizzle_orm_pg_core173.PgColumn<{
       name: "outstanding_wake_target";
       tableName: "entity_dispatch_state";
       dataType: "json";
@@ -1334,7 +2186,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    outstandingWakeCreatedAt: drizzle_orm_pg_core124.PgColumn<{
+    outstandingWakeCreatedAt: drizzle_orm_pg_core174.PgColumn<{
       name: "outstanding_wake_created_at";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1351,7 +2203,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    activeConsumerId: drizzle_orm_pg_core125.PgColumn<{
+    activeConsumerId: drizzle_orm_pg_core175.PgColumn<{
       name: "active_consumer_id";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1368,7 +2220,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    activeRunnerId: drizzle_orm_pg_core126.PgColumn<{
+    activeRunnerId: drizzle_orm_pg_core176.PgColumn<{
       name: "active_runner_id";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1385,7 +2237,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    activeEpoch: drizzle_orm_pg_core127.PgColumn<{
+    activeEpoch: drizzle_orm_pg_core177.PgColumn<{
       name: "active_epoch";
       tableName: "entity_dispatch_state";
       dataType: "number";
@@ -1402,7 +2254,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    activeClaimedAt: drizzle_orm_pg_core128.PgColumn<{
+    activeClaimedAt: drizzle_orm_pg_core178.PgColumn<{
       name: "active_claimed_at";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1419,7 +2271,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    activeLeaseExpiresAt: drizzle_orm_pg_core129.PgColumn<{
+    activeLeaseExpiresAt: drizzle_orm_pg_core179.PgColumn<{
       name: "active_lease_expires_at";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1436,7 +2288,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastWakeId: drizzle_orm_pg_core130.PgColumn<{
+    lastWakeId: drizzle_orm_pg_core180.PgColumn<{
       name: "last_wake_id";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1453,7 +2305,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastClaimedAt: drizzle_orm_pg_core131.PgColumn<{
+    lastClaimedAt: drizzle_orm_pg_core181.PgColumn<{
       name: "last_claimed_at";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1470,7 +2322,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastReleasedAt: drizzle_orm_pg_core132.PgColumn<{
+    lastReleasedAt: drizzle_orm_pg_core182.PgColumn<{
       name: "last_released_at";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1487,7 +2339,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastCompletedAt: drizzle_orm_pg_core133.PgColumn<{
+    lastCompletedAt: drizzle_orm_pg_core183.PgColumn<{
       name: "last_completed_at";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1504,7 +2356,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastError: drizzle_orm_pg_core134.PgColumn<{
+    lastError: drizzle_orm_pg_core184.PgColumn<{
       name: "last_error";
       tableName: "entity_dispatch_state";
       dataType: "string";
@@ -1521,7 +2373,7 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core135.PgColumn<{
+    updatedAt: drizzle_orm_pg_core185.PgColumn<{
       name: "updated_at";
       tableName: "entity_dispatch_state";
       dataType: "date";
@@ -1541,11 +2393,11 @@ declare const entityDispatchState: drizzle_orm_pg_core136.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
+declare const wakeNotifications: drizzle_orm_pg_core203.PgTableWithColumns<{
   name: "wake_notifications";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core137.PgColumn<{
+    tenantId: drizzle_orm_pg_core187.PgColumn<{
       name: "tenant_id";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1562,7 +2414,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    wakeId: drizzle_orm_pg_core138.PgColumn<{
+    wakeId: drizzle_orm_pg_core188.PgColumn<{
       name: "wake_id";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1579,7 +2431,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    entityUrl: drizzle_orm_pg_core139.PgColumn<{
+    entityUrl: drizzle_orm_pg_core189.PgColumn<{
       name: "entity_url";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1596,7 +2448,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    targetType: drizzle_orm_pg_core140.PgColumn<{
+    targetType: drizzle_orm_pg_core190.PgColumn<{
       name: "target_type";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1613,7 +2465,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    targetRunnerId: drizzle_orm_pg_core141.PgColumn<{
+    targetRunnerId: drizzle_orm_pg_core191.PgColumn<{
       name: "target_runner_id";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1630,7 +2482,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    targetWebhookUrl: drizzle_orm_pg_core142.PgColumn<{
+    targetWebhookUrl: drizzle_orm_pg_core192.PgColumn<{
       name: "target_webhook_url";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1647,7 +2499,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    targetWorkerPoolId: drizzle_orm_pg_core143.PgColumn<{
+    targetWorkerPoolId: drizzle_orm_pg_core193.PgColumn<{
       name: "target_worker_pool_id";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1664,7 +2516,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    runnerWakeStream: drizzle_orm_pg_core144.PgColumn<{
+    runnerWakeStream: drizzle_orm_pg_core194.PgColumn<{
       name: "runner_wake_stream";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1681,7 +2533,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    runnerWakeStreamOffset: drizzle_orm_pg_core145.PgColumn<{
+    runnerWakeStreamOffset: drizzle_orm_pg_core195.PgColumn<{
       name: "runner_wake_stream_offset";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1698,7 +2550,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    notificationPublic: drizzle_orm_pg_core146.PgColumn<{
+    notificationPublic: drizzle_orm_pg_core196.PgColumn<{
       name: "notification_public";
       tableName: "wake_notifications";
       dataType: "json";
@@ -1715,7 +2567,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    deliveryStatus: drizzle_orm_pg_core147.PgColumn<{
+    deliveryStatus: drizzle_orm_pg_core197.PgColumn<{
       name: "delivery_status";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1732,7 +2584,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    claimStatus: drizzle_orm_pg_core148.PgColumn<{
+    claimStatus: drizzle_orm_pg_core198.PgColumn<{
       name: "claim_status";
       tableName: "wake_notifications";
       dataType: "string";
@@ -1749,7 +2601,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core149.PgColumn<{
+    createdAt: drizzle_orm_pg_core199.PgColumn<{
       name: "created_at";
       tableName: "wake_notifications";
       dataType: "date";
@@ -1766,7 +2618,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    deliveredAt: drizzle_orm_pg_core150.PgColumn<{
+    deliveredAt: drizzle_orm_pg_core200.PgColumn<{
       name: "delivered_at";
       tableName: "wake_notifications";
       dataType: "date";
@@ -1783,7 +2635,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    claimedAt: drizzle_orm_pg_core151.PgColumn<{
+    claimedAt: drizzle_orm_pg_core201.PgColumn<{
       name: "claimed_at";
       tableName: "wake_notifications";
       dataType: "date";
@@ -1800,7 +2652,7 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    resolvedAt: drizzle_orm_pg_core152.PgColumn<{
+    resolvedAt: drizzle_orm_pg_core202.PgColumn<{
       name: "resolved_at";
       tableName: "wake_notifications";
       dataType: "date";
@@ -1820,11 +2672,11 @@ declare const wakeNotifications: drizzle_orm_pg_core153.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
+declare const consumerClaims: drizzle_orm_pg_core218.PgTableWithColumns<{
   name: "consumer_claims";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core154.PgColumn<{
+    tenantId: drizzle_orm_pg_core204.PgColumn<{
       name: "tenant_id";
       tableName: "consumer_claims";
       dataType: "string";
@@ -1841,7 +2693,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    consumerId: drizzle_orm_pg_core155.PgColumn<{
+    consumerId: drizzle_orm_pg_core205.PgColumn<{
       name: "consumer_id";
       tableName: "consumer_claims";
       dataType: "string";
@@ -1858,7 +2710,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    epoch: drizzle_orm_pg_core156.PgColumn<{
+    epoch: drizzle_orm_pg_core206.PgColumn<{
       name: "epoch";
       tableName: "consumer_claims";
       dataType: "number";
@@ -1875,7 +2727,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    wakeId: drizzle_orm_pg_core157.PgColumn<{
+    wakeId: drizzle_orm_pg_core207.PgColumn<{
       name: "wake_id";
       tableName: "consumer_claims";
       dataType: "string";
@@ -1892,7 +2744,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    entityUrl: drizzle_orm_pg_core158.PgColumn<{
+    entityUrl: drizzle_orm_pg_core208.PgColumn<{
       name: "entity_url";
       tableName: "consumer_claims";
       dataType: "string";
@@ -1909,7 +2761,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    streamPath: drizzle_orm_pg_core159.PgColumn<{
+    streamPath: drizzle_orm_pg_core209.PgColumn<{
       name: "stream_path";
       tableName: "consumer_claims";
       dataType: "string";
@@ -1926,7 +2778,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    runnerId: drizzle_orm_pg_core160.PgColumn<{
+    runnerId: drizzle_orm_pg_core210.PgColumn<{
       name: "runner_id";
       tableName: "consumer_claims";
       dataType: "string";
@@ -1943,7 +2795,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    status: drizzle_orm_pg_core161.PgColumn<{
+    status: drizzle_orm_pg_core211.PgColumn<{
       name: "status";
       tableName: "consumer_claims";
       dataType: "string";
@@ -1960,7 +2812,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    claimedAt: drizzle_orm_pg_core162.PgColumn<{
+    claimedAt: drizzle_orm_pg_core212.PgColumn<{
       name: "claimed_at";
       tableName: "consumer_claims";
       dataType: "date";
@@ -1977,7 +2829,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastHeartbeatAt: drizzle_orm_pg_core163.PgColumn<{
+    lastHeartbeatAt: drizzle_orm_pg_core213.PgColumn<{
       name: "last_heartbeat_at";
       tableName: "consumer_claims";
       dataType: "date";
@@ -1994,7 +2846,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    leaseExpiresAt: drizzle_orm_pg_core164.PgColumn<{
+    leaseExpiresAt: drizzle_orm_pg_core214.PgColumn<{
       name: "lease_expires_at";
       tableName: "consumer_claims";
       dataType: "date";
@@ -2011,7 +2863,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    releasedAt: drizzle_orm_pg_core165.PgColumn<{
+    releasedAt: drizzle_orm_pg_core215.PgColumn<{
       name: "released_at";
       tableName: "consumer_claims";
       dataType: "date";
@@ -2028,7 +2880,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    ackedStreams: drizzle_orm_pg_core166.PgColumn<{
+    ackedStreams: drizzle_orm_pg_core216.PgColumn<{
       name: "acked_streams";
       tableName: "consumer_claims";
       dataType: "json";
@@ -2045,7 +2897,7 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core167.PgColumn<{
+    updatedAt: drizzle_orm_pg_core217.PgColumn<{
       name: "updated_at";
       tableName: "consumer_claims";
       dataType: "date";
@@ -2065,11 +2917,11 @@ declare const consumerClaims: drizzle_orm_pg_core168.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
+declare const wakeRegistrations: drizzle_orm_pg_core231.PgTableWithColumns<{
   name: "wake_registrations";
   schema: undefined;
   columns: {
-    id: drizzle_orm_pg_core169.PgColumn<{
+    id: drizzle_orm_pg_core219.PgColumn<{
       name: "id";
       tableName: "wake_registrations";
       dataType: "number";
@@ -2086,7 +2938,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    tenantId: drizzle_orm_pg_core170.PgColumn<{
+    tenantId: drizzle_orm_pg_core220.PgColumn<{
       name: "tenant_id";
       tableName: "wake_registrations";
       dataType: "string";
@@ -2103,7 +2955,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    subscriberUrl: drizzle_orm_pg_core171.PgColumn<{
+    subscriberUrl: drizzle_orm_pg_core221.PgColumn<{
       name: "subscriber_url";
       tableName: "wake_registrations";
       dataType: "string";
@@ -2120,7 +2972,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    sourceUrl: drizzle_orm_pg_core172.PgColumn<{
+    sourceUrl: drizzle_orm_pg_core222.PgColumn<{
       name: "source_url";
       tableName: "wake_registrations";
       dataType: "string";
@@ -2137,7 +2989,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    condition: drizzle_orm_pg_core173.PgColumn<{
+    condition: drizzle_orm_pg_core223.PgColumn<{
       name: "condition";
       tableName: "wake_registrations";
       dataType: "json";
@@ -2154,7 +3006,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    debounceMs: drizzle_orm_pg_core174.PgColumn<{
+    debounceMs: drizzle_orm_pg_core224.PgColumn<{
       name: "debounce_ms";
       tableName: "wake_registrations";
       dataType: "number";
@@ -2171,7 +3023,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    timeoutMs: drizzle_orm_pg_core175.PgColumn<{
+    timeoutMs: drizzle_orm_pg_core225.PgColumn<{
       name: "timeout_ms";
       tableName: "wake_registrations";
       dataType: "number";
@@ -2188,7 +3040,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    oneShot: drizzle_orm_pg_core176.PgColumn<{
+    oneShot: drizzle_orm_pg_core226.PgColumn<{
       name: "one_shot";
       tableName: "wake_registrations";
       dataType: "boolean";
@@ -2205,7 +3057,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    timeoutConsumed: drizzle_orm_pg_core177.PgColumn<{
+    timeoutConsumed: drizzle_orm_pg_core227.PgColumn<{
       name: "timeout_consumed";
       tableName: "wake_registrations";
       dataType: "boolean";
@@ -2222,7 +3074,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    includeResponse: drizzle_orm_pg_core178.PgColumn<{
+    includeResponse: drizzle_orm_pg_core228.PgColumn<{
       name: "include_response";
       tableName: "wake_registrations";
       dataType: "boolean";
@@ -2239,7 +3091,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    manifestKey: drizzle_orm_pg_core179.PgColumn<{
+    manifestKey: drizzle_orm_pg_core229.PgColumn<{
       name: "manifest_key";
       tableName: "wake_registrations";
       dataType: "string";
@@ -2256,7 +3108,7 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core180.PgColumn<{
+    createdAt: drizzle_orm_pg_core230.PgColumn<{
       name: "created_at";
       tableName: "wake_registrations";
       dataType: "date";
@@ -2276,11 +3128,11 @@ declare const wakeRegistrations: drizzle_orm_pg_core181.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const subscriptionWebhooks: drizzle_orm_pg_core186.PgTableWithColumns<{
+declare const subscriptionWebhooks: drizzle_orm_pg_core236.PgTableWithColumns<{
   name: "subscription_webhooks";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core182.PgColumn<{
+    tenantId: drizzle_orm_pg_core232.PgColumn<{
       name: "tenant_id";
       tableName: "subscription_webhooks";
       dataType: "string";
@@ -2297,7 +3149,7 @@ declare const subscriptionWebhooks: drizzle_orm_pg_core186.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    subscriptionId: drizzle_orm_pg_core183.PgColumn<{
+    subscriptionId: drizzle_orm_pg_core233.PgColumn<{
       name: "subscription_id";
       tableName: "subscription_webhooks";
       dataType: "string";
@@ -2314,7 +3166,7 @@ declare const subscriptionWebhooks: drizzle_orm_pg_core186.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    webhookUrl: drizzle_orm_pg_core184.PgColumn<{
+    webhookUrl: drizzle_orm_pg_core234.PgColumn<{
       name: "webhook_url";
       tableName: "subscription_webhooks";
       dataType: "string";
@@ -2331,7 +3183,7 @@ declare const subscriptionWebhooks: drizzle_orm_pg_core186.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core185.PgColumn<{
+    createdAt: drizzle_orm_pg_core235.PgColumn<{
       name: "created_at";
       tableName: "subscription_webhooks";
       dataType: "date";
@@ -2351,11 +3203,11 @@ declare const subscriptionWebhooks: drizzle_orm_pg_core186.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const consumerCallbacks: drizzle_orm_pg_core192.PgTableWithColumns<{
+declare const consumerCallbacks: drizzle_orm_pg_core242.PgTableWithColumns<{
   name: "consumer_callbacks";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core187.PgColumn<{
+    tenantId: drizzle_orm_pg_core237.PgColumn<{
       name: "tenant_id";
       tableName: "consumer_callbacks";
       dataType: "string";
@@ -2372,7 +3224,7 @@ declare const consumerCallbacks: drizzle_orm_pg_core192.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    consumerId: drizzle_orm_pg_core188.PgColumn<{
+    consumerId: drizzle_orm_pg_core238.PgColumn<{
       name: "consumer_id";
       tableName: "consumer_callbacks";
       dataType: "string";
@@ -2389,7 +3241,7 @@ declare const consumerCallbacks: drizzle_orm_pg_core192.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    callbackUrl: drizzle_orm_pg_core189.PgColumn<{
+    callbackUrl: drizzle_orm_pg_core239.PgColumn<{
       name: "callback_url";
       tableName: "consumer_callbacks";
       dataType: "string";
@@ -2406,7 +3258,7 @@ declare const consumerCallbacks: drizzle_orm_pg_core192.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    primaryStream: drizzle_orm_pg_core190.PgColumn<{
+    primaryStream: drizzle_orm_pg_core240.PgColumn<{
       name: "primary_stream";
       tableName: "consumer_callbacks";
       dataType: "string";
@@ -2423,7 +3275,7 @@ declare const consumerCallbacks: drizzle_orm_pg_core192.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core191.PgColumn<{
+    createdAt: drizzle_orm_pg_core241.PgColumn<{
       name: "created_at";
       tableName: "consumer_callbacks";
       dataType: "date";
@@ -2443,11 +3295,11 @@ declare const consumerCallbacks: drizzle_orm_pg_core192.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
+declare const scheduledTasks: drizzle_orm_pg_core258.PgTableWithColumns<{
   name: "scheduled_tasks";
   schema: undefined;
   columns: {
-    id: drizzle_orm_pg_core193.PgColumn<{
+    id: drizzle_orm_pg_core243.PgColumn<{
       name: "id";
       tableName: "scheduled_tasks";
       dataType: "number";
@@ -2464,7 +3316,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    tenantId: drizzle_orm_pg_core194.PgColumn<{
+    tenantId: drizzle_orm_pg_core244.PgColumn<{
       name: "tenant_id";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2481,7 +3333,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    kind: drizzle_orm_pg_core195.PgColumn<{
+    kind: drizzle_orm_pg_core245.PgColumn<{
       name: "kind";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2498,7 +3350,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    payload: drizzle_orm_pg_core196.PgColumn<{
+    payload: drizzle_orm_pg_core246.PgColumn<{
       name: "payload";
       tableName: "scheduled_tasks";
       dataType: "json";
@@ -2515,7 +3367,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    fireAt: drizzle_orm_pg_core197.PgColumn<{
+    fireAt: drizzle_orm_pg_core247.PgColumn<{
       name: "fire_at";
       tableName: "scheduled_tasks";
       dataType: "date";
@@ -2532,7 +3384,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    cronExpression: drizzle_orm_pg_core198.PgColumn<{
+    cronExpression: drizzle_orm_pg_core248.PgColumn<{
       name: "cron_expression";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2549,7 +3401,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    cronTimezone: drizzle_orm_pg_core199.PgColumn<{
+    cronTimezone: drizzle_orm_pg_core249.PgColumn<{
       name: "cron_timezone";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2566,7 +3418,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    cronTickNumber: drizzle_orm_pg_core200.PgColumn<{
+    cronTickNumber: drizzle_orm_pg_core250.PgColumn<{
       name: "cron_tick_number";
       tableName: "scheduled_tasks";
       dataType: "number";
@@ -2583,7 +3435,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    ownerEntityUrl: drizzle_orm_pg_core201.PgColumn<{
+    ownerEntityUrl: drizzle_orm_pg_core251.PgColumn<{
       name: "owner_entity_url";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2600,7 +3452,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    manifestKey: drizzle_orm_pg_core202.PgColumn<{
+    manifestKey: drizzle_orm_pg_core252.PgColumn<{
       name: "manifest_key";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2617,7 +3469,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    claimedBy: drizzle_orm_pg_core203.PgColumn<{
+    claimedBy: drizzle_orm_pg_core253.PgColumn<{
       name: "claimed_by";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2634,7 +3486,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    claimedAt: drizzle_orm_pg_core204.PgColumn<{
+    claimedAt: drizzle_orm_pg_core254.PgColumn<{
       name: "claimed_at";
       tableName: "scheduled_tasks";
       dataType: "date";
@@ -2651,7 +3503,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    completedAt: drizzle_orm_pg_core205.PgColumn<{
+    completedAt: drizzle_orm_pg_core255.PgColumn<{
       name: "completed_at";
       tableName: "scheduled_tasks";
       dataType: "date";
@@ -2668,7 +3520,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastError: drizzle_orm_pg_core206.PgColumn<{
+    lastError: drizzle_orm_pg_core256.PgColumn<{
       name: "last_error";
       tableName: "scheduled_tasks";
       dataType: "string";
@@ -2685,7 +3537,7 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core207.PgColumn<{
+    createdAt: drizzle_orm_pg_core257.PgColumn<{
       name: "created_at";
       tableName: "scheduled_tasks";
       dataType: "date";
@@ -2705,11 +3557,11 @@ declare const scheduledTasks: drizzle_orm_pg_core208.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
+declare const entityBridges: drizzle_orm_pg_core270.PgTableWithColumns<{
   name: "entity_bridges";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core209.PgColumn<{
+    tenantId: drizzle_orm_pg_core259.PgColumn<{
       name: "tenant_id";
       tableName: "entity_bridges";
       dataType: "string";
@@ -2726,7 +3578,7 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    sourceRef: drizzle_orm_pg_core210.PgColumn<{
+    sourceRef: drizzle_orm_pg_core260.PgColumn<{
       name: "source_ref";
       tableName: "entity_bridges";
       dataType: "string";
@@ -2743,7 +3595,7 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    tags: drizzle_orm_pg_core211.PgColumn<{
+    tags: drizzle_orm_pg_core261.PgColumn<{
       name: "tags";
       tableName: "entity_bridges";
       dataType: "json";
@@ -2760,7 +3612,7 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    streamUrl: drizzle_orm_pg_core212.PgColumn<{
+    streamUrl: drizzle_orm_pg_core262.PgColumn<{
       name: "stream_url";
       tableName: "entity_bridges";
       dataType: "string";
@@ -2777,7 +3629,41 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    shapeHandle: drizzle_orm_pg_core213.PgColumn<{
+    principalUrl: drizzle_orm_pg_core263.PgColumn<{
+      name: "principal_url";
+      tableName: "entity_bridges";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    principalKind: drizzle_orm_pg_core264.PgColumn<{
+      name: "principal_kind";
+      tableName: "entity_bridges";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    shapeHandle: drizzle_orm_pg_core265.PgColumn<{
       name: "shape_handle";
       tableName: "entity_bridges";
       dataType: "string";
@@ -2794,7 +3680,7 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    shapeOffset: drizzle_orm_pg_core214.PgColumn<{
+    shapeOffset: drizzle_orm_pg_core266.PgColumn<{
       name: "shape_offset";
       tableName: "entity_bridges";
       dataType: "string";
@@ -2811,7 +3697,7 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastObserverActivityAt: drizzle_orm_pg_core215.PgColumn<{
+    lastObserverActivityAt: drizzle_orm_pg_core267.PgColumn<{
       name: "last_observer_activity_at";
       tableName: "entity_bridges";
       dataType: "date";
@@ -2828,7 +3714,7 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core216.PgColumn<{
+    createdAt: drizzle_orm_pg_core268.PgColumn<{
       name: "created_at";
       tableName: "entity_bridges";
       dataType: "date";
@@ -2845,7 +3731,7 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core217.PgColumn<{
+    updatedAt: drizzle_orm_pg_core269.PgColumn<{
       name: "updated_at";
       tableName: "entity_bridges";
       dataType: "date";
@@ -2865,11 +3751,11 @@ declare const entityBridges: drizzle_orm_pg_core218.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const entityManifestSources: drizzle_orm_pg_core225.PgTableWithColumns<{
+declare const entityManifestSources: drizzle_orm_pg_core277.PgTableWithColumns<{
   name: "entity_manifest_sources";
   schema: undefined;
   columns: {
-    tenantId: drizzle_orm_pg_core219.PgColumn<{
+    tenantId: drizzle_orm_pg_core271.PgColumn<{
       name: "tenant_id";
       tableName: "entity_manifest_sources";
       dataType: "string";
@@ -2886,7 +3772,7 @@ declare const entityManifestSources: drizzle_orm_pg_core225.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    ownerEntityUrl: drizzle_orm_pg_core220.PgColumn<{
+    ownerEntityUrl: drizzle_orm_pg_core272.PgColumn<{
       name: "owner_entity_url";
       tableName: "entity_manifest_sources";
       dataType: "string";
@@ -2903,7 +3789,7 @@ declare const entityManifestSources: drizzle_orm_pg_core225.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    manifestKey: drizzle_orm_pg_core221.PgColumn<{
+    manifestKey: drizzle_orm_pg_core273.PgColumn<{
       name: "manifest_key";
       tableName: "entity_manifest_sources";
       dataType: "string";
@@ -2920,7 +3806,7 @@ declare const entityManifestSources: drizzle_orm_pg_core225.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    sourceRef: drizzle_orm_pg_core222.PgColumn<{
+    sourceRef: drizzle_orm_pg_core274.PgColumn<{
       name: "source_ref";
       tableName: "entity_manifest_sources";
       dataType: "string";
@@ -2937,7 +3823,7 @@ declare const entityManifestSources: drizzle_orm_pg_core225.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core223.PgColumn<{
+    createdAt: drizzle_orm_pg_core275.PgColumn<{
       name: "created_at";
       tableName: "entity_manifest_sources";
       dataType: "date";
@@ -2954,7 +3840,7 @@ declare const entityManifestSources: drizzle_orm_pg_core225.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    updatedAt: drizzle_orm_pg_core224.PgColumn<{
+    updatedAt: drizzle_orm_pg_core276.PgColumn<{
       name: "updated_at";
       tableName: "entity_manifest_sources";
       dataType: "date";
@@ -2974,11 +3860,11 @@ declare const entityManifestSources: drizzle_orm_pg_core225.PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
+declare const tagStreamOutbox: drizzle_orm_pg_core291.PgTableWithColumns<{
   name: "tag_stream_outbox";
   schema: undefined;
   columns: {
-    id: drizzle_orm_pg_core226.PgColumn<{
+    id: drizzle_orm_pg_core278.PgColumn<{
       name: "id";
       tableName: "tag_stream_outbox";
       dataType: "number";
@@ -2995,7 +3881,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    tenantId: drizzle_orm_pg_core227.PgColumn<{
+    tenantId: drizzle_orm_pg_core279.PgColumn<{
       name: "tenant_id";
       tableName: "tag_stream_outbox";
       dataType: "string";
@@ -3012,7 +3898,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    entityUrl: drizzle_orm_pg_core228.PgColumn<{
+    entityUrl: drizzle_orm_pg_core280.PgColumn<{
       name: "entity_url";
       tableName: "tag_stream_outbox";
       dataType: "string";
@@ -3029,7 +3915,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    collection: drizzle_orm_pg_core229.PgColumn<{
+    collection: drizzle_orm_pg_core281.PgColumn<{
       name: "collection";
       tableName: "tag_stream_outbox";
       dataType: "string";
@@ -3046,7 +3932,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    op: drizzle_orm_pg_core230.PgColumn<{
+    op: drizzle_orm_pg_core282.PgColumn<{
       name: "op";
       tableName: "tag_stream_outbox";
       dataType: "string";
@@ -3063,7 +3949,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    key: drizzle_orm_pg_core231.PgColumn<{
+    key: drizzle_orm_pg_core283.PgColumn<{
       name: "key";
       tableName: "tag_stream_outbox";
       dataType: "string";
@@ -3080,7 +3966,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    rowData: drizzle_orm_pg_core232.PgColumn<{
+    rowData: drizzle_orm_pg_core284.PgColumn<{
       name: "row_data";
       tableName: "tag_stream_outbox";
       dataType: "json";
@@ -3097,7 +3983,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    attemptCount: drizzle_orm_pg_core233.PgColumn<{
+    attemptCount: drizzle_orm_pg_core285.PgColumn<{
       name: "attempt_count";
       tableName: "tag_stream_outbox";
       dataType: "number";
@@ -3114,7 +4000,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    lastError: drizzle_orm_pg_core234.PgColumn<{
+    lastError: drizzle_orm_pg_core286.PgColumn<{
       name: "last_error";
       tableName: "tag_stream_outbox";
       dataType: "string";
@@ -3131,7 +4017,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    claimedBy: drizzle_orm_pg_core235.PgColumn<{
+    claimedBy: drizzle_orm_pg_core287.PgColumn<{
       name: "claimed_by";
       tableName: "tag_stream_outbox";
       dataType: "string";
@@ -3148,7 +4034,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    claimedAt: drizzle_orm_pg_core236.PgColumn<{
+    claimedAt: drizzle_orm_pg_core288.PgColumn<{
       name: "claimed_at";
       tableName: "tag_stream_outbox";
       dataType: "date";
@@ -3165,7 +4051,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    deadLetteredAt: drizzle_orm_pg_core237.PgColumn<{
+    deadLetteredAt: drizzle_orm_pg_core289.PgColumn<{
       name: "dead_lettered_at";
       tableName: "tag_stream_outbox";
       dataType: "date";
@@ -3182,7 +4068,7 @@ declare const tagStreamOutbox: drizzle_orm_pg_core239.PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    createdAt: drizzle_orm_pg_core238.PgColumn<{
+    createdAt: drizzle_orm_pg_core290.PgColumn<{
       name: "created_at";
       tableName: "tag_stream_outbox";
       dataType: "date";
@@ -3245,6 +4131,68 @@ interface DispatchPolicy {
 type RunnerKind = `local` | `cloud-worker` | `sandbox` | `ci` | `server`;
 type RunnerAdminStatus = `enabled` | `disabled`;
 type RunnerLiveness = `online` | `offline`;
+type PermissionSubjectKind = `principal` | `principal_kind`;
+type PermissionSubject = {
+  subject_kind: PermissionSubjectKind;
+  subject_value: string;
+};
+type EntityPermission = `read` | `write` | `delete` | `signal` | `fork` | `schedule` | `spawn` | `manage`;
+type EntityTypePermission = `spawn` | `manage`;
+type EntityPermissionPropagation = `self` | `descendants`;
+interface EntityPermissionGrant extends PermissionSubject {
+  id: number;
+  entity_url: string;
+  permission: EntityPermission;
+  propagation: EntityPermissionPropagation;
+  copy_to_children: boolean;
+  created_by?: string;
+  expires_at?: string;
+  created_at: string;
+  updated_at: string;
+}
+interface EntityTypePermissionGrant extends PermissionSubject {
+  id: number;
+  entity_type: string;
+  permission: EntityTypePermission;
+  created_by?: string;
+  expires_at?: string;
+  created_at: string;
+  updated_at: string;
+}
+interface EntityTypePermissionGrantInput extends PermissionSubject {
+  permission: EntityTypePermission;
+  expires_at?: string;
+}
+type AuthorizationResource = {
+  kind: `entity`;
+  entity: ElectricAgentsEntity;
+} | {
+  kind: `entity_type`;
+  entityType: ElectricAgentsEntityType;
+} | {
+  kind: `entity_type_registration`;
+  entityTypeName: string;
+} | {
+  kind: `shared_state`;
+  sharedStateId: string;
+  linkedEntityUrls: Array<string>;
+};
+type AuthorizationDecision = {
+  decision: `allow` | `deny`;
+  expires_at?: string;
+};
+type AuthorizeRequest = (input: {
+  tenant: string;
+  principal: Principal;
+  verb: EntityPermission | EntityTypePermission;
+  resource: AuthorizationResource;
+  request?: {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+  };
+  builtInAllowed: boolean;
+}) => Promise<AuthorizationDecision> | AuthorizationDecision;
 type WakeDeliveryStatus = `queued` | `delivered` | `failed` | `superseded`;
 type WakeClaimStatus = `unclaimed` | `claimed` | `completed` | `expired`;
 type ConsumerClaimStatus = `active` | `released` | `expired` | `failed`;
@@ -3273,6 +4221,18 @@ interface RunnerActiveClaim {
   claimedAt: string;
   leaseExpiresAt?: string;
 }
+interface SandboxProfileAdvertisement {
+  name: string;
+  label: string;
+  description?: string;
+  /**
+   * True for off-host (remote-provider) profiles, reachable from any runner.
+   * Absent/false means the sandbox is host-local, so a shared sandbox on this
+   * profile requires its collaborators to be pinned to a single runner. Set
+   * by the runtime per profile (see SandboxProfile.remote).
+   */
+  remote?: boolean;
+}
 interface ElectricAgentsRunner {
   id: string;
   owner_principal: string;
@@ -3286,6 +4246,7 @@ interface ElectricAgentsRunner {
   wake_stream: string;
   wake_stream_offset?: string;
   diagnostics?: Record<string, unknown>;
+  sandbox_profiles: Array<SandboxProfileAdvertisement>;
   created_at: string;
   updated_at: string;
 }
@@ -3360,19 +4321,65 @@ declare function assertEntitySignal(s: string): EntitySignal;
 declare function isTerminalEntityStatus(status: EntityStatus): boolean;
 declare function rejectsNormalWrites(status: EntityStatus): boolean;
 declare function expectedSignalStatus(status: EntityStatus, signal: EntitySignal): EntityStatus;
+/**
+ * Resolved sandbox selection stored on an entity and replayed to the runtime at
+ * wake. Only an explicit / inherited cross-entity `key` is persisted here;
+ * `scope`-derived keys are computed at wake time (and so left unstored, keeping
+ * the co-location guard keyed on genuine cross-entity sharing). `persistent`
+ * defaults by scope at wake time when unset.
+ */
+interface EntitySandboxSelection {
+  profile: string;
+  key?: string;
+  scope?: `entity` | `wake`;
+  persistent?: boolean;
+  /**
+   * Whether the entity owns the sandbox (create + govern teardown) or only
+   * attaches to an owner's. Stored as `false` for an attacher (e.g. an
+   * `inherit` spawn); omitted ⇒ owner (the default).
+   */
+  owner?: boolean;
+}
+/**
+ * Spawn-time sandbox CHOICE — the request input, before resolution. Resolved
+ * into an {@link EntitySandboxSelection} by the spawn path. The wire schema for
+ * this shape lives in `sandbox-choice-schema.ts` (mirrors how `DispatchPolicy`
+ * pairs with `dispatch-policy-schema.ts`).
+ */
+interface SandboxChoice {
+  /** Profile name advertised by the target runner. */
+  profile?: string;
+  /** Explicit cross-entity key to join (or start) a shared sandbox. */
+  key?: string;
+  /** Identity scope when no explicit `key`: per-entity (default) or per-wake. */
+  scope?: `entity` | `wake`;
+  /** Idle-teardown durability; defaults by scope when unset. */
+  persistent?: boolean;
+  /** Whether this entity owns the sandbox (default) or only attaches to one. */
+  owner?: boolean;
+  /** Reuse the parent entity's resolved sandbox (attach-only). */
+  inherit?: boolean;
+}
 interface ElectricAgentsEntity {
   url: string;
   type: string;
   status: EntityStatus;
   streams: {
     main: string;
-    error: string;
   };
   subscription_id: string;
   dispatch_policy?: DispatchPolicy;
   write_token: string;
   tags: Record<string, string>;
   spawn_args?: Record<string, unknown>;
+  /**
+   * Resolved sandbox selection. An explicit `key` lets entities collaborate on
+   * one workspace and is the only key form persisted (it's cross-entity, so the
+   * co-location guard applies); a `scope` ('entity' default / 'wake') instead
+   * derives the key at wake time, so it's left unstored. `persistent` chooses
+   * idle durability.
+   */
+  sandbox?: EntitySandboxSelection;
   parent?: string;
   type_revision?: number;
   inbox_schemas?: Record<string, Record<string, unknown>>;
@@ -3388,11 +4395,11 @@ interface PublicElectricAgentsEntity {
   status: EntityStatus;
   streams: {
     main: string;
-    error: string;
   };
   dispatch_policy?: DispatchPolicy;
   tags: Record<string, string>;
   spawn_args?: Record<string, unknown>;
+  sandbox?: EntitySandboxSelection;
   parent?: string;
   created_by?: string;
   created_at: number;
@@ -3422,6 +4429,7 @@ interface RegisterEntityTypeRequest {
   state_schemas?: Record<string, Record<string, unknown>>;
   serve_endpoint?: string;
   default_dispatch_policy?: DispatchPolicy;
+  permission_grants?: Array<EntityTypePermissionGrantInput>;
 }
 interface TypedSpawnRequest {
   instance_id: string;
@@ -3429,6 +4437,12 @@ interface TypedSpawnRequest {
   tags?: Record<string, string>;
   parent?: string;
   dispatch_policy?: DispatchPolicy;
+  /**
+   * Sandbox selection: `profile` for a sandbox (optionally with `scope` /
+   * `persistent`), `key` to join (or start) an explicit shared one, or
+   * `inherit: true` to reuse the parent's resolved sandbox.
+   */
+  sandbox?: SandboxChoice;
   initialMessage?: unknown;
   created_by?: string;
   wake?: {
@@ -3446,6 +4460,8 @@ interface TypedSpawnRequest {
 }
 interface SendRequest {
   from?: string;
+  from_principal?: string;
+  from_agent?: string;
   payload?: unknown;
   key?: string;
   type?: string;
@@ -3481,6 +4497,8 @@ interface EntityBridgeRow {
   sourceRef: string;
   tags: EntityTags;
   streamUrl: string;
+  principalUrl?: string;
+  principalKind?: string;
   shapeHandle?: string;
   shapeOffset?: string;
   lastObserverActivityAt: Date;
@@ -3512,6 +4530,13 @@ interface RegisterRunnerInput {
   kind?: RunnerKind;
   adminStatus?: RunnerAdminStatus;
   wakeStream?: string;
+  /**
+   * Full-set replacement: provide the complete list of profiles the
+   * runner currently exposes. Existing rows for the runner are
+   * removed and the supplied set is inserted in one transaction.
+   * Omit (or pass undefined) to leave the existing set untouched.
+   */
+  sandboxProfiles?: ReadonlyArray<SandboxProfileAdvertisement>;
 }
 interface HeartbeatRunnerInput {
   runnerId: string;
@@ -3553,13 +4578,41 @@ interface MaterializeReleasedClaimInput {
   ackedStreams?: Array<SourceStreamOffset>;
   releasedAt?: Date;
 }
+interface CreateEntityTypePermissionGrantInput {
+  entityType: string;
+  permission: EntityTypePermission;
+  subjectKind: PermissionSubjectKind;
+  subjectValue: string;
+  createdBy?: string;
+  expiresAt?: Date;
+}
+interface CreateEntityPermissionGrantInput {
+  entityUrl: string;
+  permission: EntityPermission;
+  subjectKind: PermissionSubjectKind;
+  subjectValue: string;
+  propagation?: EntityPermissionPropagation;
+  copyToChildren?: boolean;
+  createdBy?: string;
+  expiresAt?: Date;
+}
 declare class PostgresRegistry {
   private db;
   readonly tenantId: string;
+  private lastPermissionPruneStartedAt;
+  private permissionPrunePromise;
   constructor(db: DrizzleDB, tenantId?: string);
   initialize(): Promise<void>;
   close(): void;
+  ensureUserForPrincipal(principal: Principal): Promise<void>;
   createRunner(input: RegisterRunnerInput): Promise<ElectricAgentsRunner>;
+  /**
+   * Every sandbox profile advertised by a runner in this tenant (one entry
+   * per runner that advertises it — names may repeat across runners). Used by
+   * spawn validation for unpinned dispatch to learn whether a chosen profile
+   * is remote (so a shared sandbox can skip the single-runner guard).
+   */
+  listSandboxProfiles(): Promise<Array<SandboxProfileAdvertisement>>;
   getRunner(id: string): Promise<ElectricAgentsRunner | null>;
   listRunners(filter?: {
     ownerPrincipal?: string;
@@ -3599,10 +4652,38 @@ declare class PostgresRegistry {
     limit?: number;
     offset?: number;
     created_by?: string;
+    readableBy?: {
+      principalUrl: string;
+      principalKind: string;
+      bypass?: boolean;
+    };
   }): Promise<{
     entities: Array<ElectricAgentsEntity>;
     total: number;
   }>;
+  createEntityTypePermissionGrant(input: CreateEntityTypePermissionGrantInput): Promise<EntityTypePermissionGrant>;
+  ensureEntityTypePermissionGrant(input: CreateEntityTypePermissionGrantInput): Promise<EntityTypePermissionGrant>;
+  listEntityTypePermissionGrants(entityType: string): Promise<Array<EntityTypePermissionGrant>>;
+  deleteEntityTypePermissionGrant(entityType: string, grantId: number): Promise<boolean>;
+  hasEntityTypePermission(entityType: string, permission: EntityTypePermission, subject: {
+    principalUrl: string;
+    principalKind: string;
+  }): Promise<boolean>;
+  createEntityPermissionGrant(input: CreateEntityPermissionGrantInput): Promise<EntityPermissionGrant>;
+  listEntityPermissionGrants(entityUrl: string): Promise<Array<EntityPermissionGrant>>;
+  deleteEntityPermissionGrant(entityUrl: string, grantId: number): Promise<boolean>;
+  copyEntityPermissionGrantsForSpawn(parentEntityUrl: string, childEntityUrl: string, createdBy?: string): Promise<Array<EntityPermissionGrant>>;
+  hasEntityPermission(entityUrl: string, permission: EntityPermission, subject: {
+    principalUrl: string;
+    principalKind: string;
+  }): Promise<boolean>;
+  replaceSharedStateLink(ownerEntityUrl: string, manifestKey: string, sharedStateId?: string): Promise<void>;
+  listSharedStateLinkedEntityUrls(sharedStateId: string): Promise<Array<string>>;
+  pruneExpiredPermissionGrants(now?: Date, options?: {
+    force?: boolean;
+  }): Promise<void>;
+  private pruneExpiredPermissionGrantsNow;
+  private materializeEntityPermissionGrant;
   updateStatus(entityUrl: string, status: EntityStatus): Promise<void>;
   updateStatusWithTxid(entityUrl: string, status: EntityStatus): Promise<number | null>;
   touchEntityWithTxid(entityUrl: string): Promise<number | null>;
@@ -3620,6 +4701,8 @@ declare class PostgresRegistry {
     sourceRef: string;
     tags: EntityTags;
     streamUrl: string;
+    principalUrl: string;
+    principalKind: string;
   }): Promise<EntityBridgeRow>;
   getEntityBridge(sourceRef: string): Promise<EntityBridgeRow | null>;
   listEntityBridges(tenantId?: string | null): Promise<Array<EntityBridgeRow>>;
@@ -3640,6 +4723,8 @@ declare class PostgresRegistry {
   releaseTagOutboxClaims(workerId: string, tenantId?: string | null): Promise<void>;
   deleteEntity(url: string): Promise<void>;
   private rowToEntityType;
+  private rowToEntityTypePermissionGrant;
+  private rowToEntityPermissionGrant;
   private rowToEntity;
   private rowToEntityBridge;
   private rowToTagStreamOutbox;
@@ -3725,7 +4810,9 @@ declare class StreamClient {
     body?: Uint8Array | string;
     closed?: boolean;
   }): Promise<void>;
-  fork(path: string, sourcePath: string): Promise<void>;
+  fork(path: string, sourcePath: string, opts?: {
+    forkPointer?: EventPointer;
+  }): Promise<void>;
   append(path: string, data: Uint8Array | string, opts?: {
     close?: boolean;
   }): Promise<StreamAppendResult>;
@@ -3765,7 +4852,7 @@ declare class StreamClient {
 interface EntityBridgeCoordinator {
   start(): Promise<void>;
   stop(): Promise<void>;
-  register(tagsInput: unknown): Promise<{
+  register(tagsInput: unknown, principalUrl: string, principalKind: string): Promise<{
     sourceRef: string;
     streamUrl: string;
   }>;
@@ -3808,13 +4895,13 @@ declare class EntityProjector {
   forTenant(tenantId: string, registry?: PostgresRegistry): EntityProjectorTenantFacade;
   start(): Promise<void>;
   stop(): Promise<void>;
-  register(tenantId: string, registry: PostgresRegistry, tagsInput: unknown): Promise<{
+  register(tenantId: string, registry: PostgresRegistry, tagsInput: unknown, principalUrl: string, principalKind: string): Promise<{
     sourceRef: string;
     streamUrl: string;
   }>;
   touchByStreamPath(tenantId: string, registry: PostgresRegistry, streamPath: string): Promise<void>;
   beginClientRead(tenantId: string, registry: PostgresRegistry, streamPath: string): Promise<(() => Promise<void>) | null>;
-  onEntityChanged(_tenantId: string, _entityUrl: string): Promise<void>;
+  onEntityChanged(tenantId: string, entityUrl: string): Promise<void>;
   loadTenantBridges(tenantId: string, registry?: PostgresRegistry): Promise<void>;
   private resetReady;
   private waitUntilReady;
@@ -3841,7 +4928,7 @@ declare class EntityProjectorTenantFacade implements EntityBridgeCoordinator {
   constructor(projector: EntityProjector, tenantId: string, registry: PostgresRegistry);
   start(): Promise<void>;
   stop(): Promise<void>;
-  register(tagsInput: unknown): Promise<{
+  register(tagsInput: unknown, principalUrl: string, principalKind: string): Promise<{
     sourceRef: string;
     streamUrl: string;
   }>;
@@ -3869,6 +4956,8 @@ declare class ClaimWriteTokenStore {
 interface DelayedSendPayload {
   entityUrl: string;
   from?: string;
+  from_principal?: string;
+  from_agent?: string;
   payload: unknown;
   key?: string;
   type?: string;
@@ -3978,6 +5067,12 @@ interface WakeEvalResult {
       collection: string;
       kind: `insert` | `update` | `delete`;
       key: string;
+      from?: string;
+      from_principal?: string;
+      from_agent?: string;
+      payload?: unknown;
+      timestamp?: string;
+      message_type?: string;
     }>;
   };
   runFinishedStatus?: `completed` | `failed`;
@@ -4119,6 +5214,16 @@ type ForkSubtreeOptions = {
   rootInstanceId?: string;
   waitTimeoutMs?: number;
   waitPollMs?: number;
+  createdBy?: string;
+  /**
+   * Optional anchor pointing at an event on the source root's `main` stream.
+   * When set: only events at or before the pointer are kept on the root's
+   * forked `main`, and the root's manifest is filtered so that descendants
+   * spawned after the pointer are dropped from the fork (their now-orphan
+   * subtrees are not forked). The pointer applies only to the root's
+   * `main` stream; shared-state streams clone at HEAD regardless.
+   */
+  forkPointer?: EventPointer;
 };
 type ForkResult = {
   root: ElectricAgentsEntity;
@@ -4164,6 +5269,7 @@ declare class EntityManager {
   deleteEntityType(name: string): Promise<void>;
   ensurePrincipalEntityType(): Promise<ElectricAgentsEntityType>;
   ensurePrincipal(principal: Principal): Promise<ElectricAgentsEntity>;
+  private ensureUserPrincipal;
   /**
    * Spawn a new entity of the given type with durable streams.
    */
@@ -4179,7 +5285,42 @@ declare class EntityManager {
   private assertEntityNotForkWorkLocked;
   private addForkLocks;
   private releaseForkLocks;
+  /**
+   * Variant of {@link waitForIdleSubtree} that takes an explicit entity
+   * list instead of walking the registry from `rootUrl`. Used by the
+   * pointer-fork path to wait+lock only the kept descendants, since
+   * the root is being forked from history and doesn't need to be idle.
+   */
+  private waitForGivenEntitiesIdle;
   private waitForIdleSubtree;
+  /**
+   * Translate `forkPointer` into a 1-indexed CUMULATIVE position in the
+   * source's flattened history. Throws a 400 if the pointer doesn't
+   * address a real event.
+   *
+   * Semantics (mirroring the durable-streams server interpretation):
+   * `{ offset: X, subOffset: N }` means "from anchor X, take N flattened
+   * messages forward." Concretely, the target event is the N-th event
+   * after the last event whose `headers.offset` is ≤ X. (When `X` is
+   * `null`, the anchor is the stream start and the target is the N-th
+   * event from the very beginning.) The returned position is the count
+   * of events to KEEP — events 1..position survive the filter.
+   *
+   * A pointer is valid when:
+   *   - `pointer.offset` is `null` (stream start) OR matches some
+   *     event's `headers.offset` value, AND
+   *   - `pointer.subOffset` is in `[1, total events past the anchor]`.
+   */
+  private resolveForkPointerTarget;
+  /**
+   * Compute the subset of `sourceTree` that survives the manifest filter
+   * applied at the root. After filtering the root's manifest at the fork
+   * pointer, only children whose manifest entries landed at or before the
+   * pointer remain; those kept children carry their CURRENT (HEAD) subtree
+   * along with them. Children dropped from the root's manifest, and any
+   * of their descendants, are excluded.
+   */
+  private computeEffectiveSubtree;
   private listEntitySubtree;
   private readForkStateSnapshot;
   private reduceStateRows;
@@ -4223,7 +5364,10 @@ declare class EntityManager {
   }>;
   setTag(entityUrl: string, key: string, req: SetTagRequest, token: string): Promise<ElectricAgentsEntity>;
   deleteTag(entityUrl: string, key: string, token: string): Promise<ElectricAgentsEntity>;
-  ensureEntitiesMembershipStream(tags: Record<string, string>): Promise<{
+  ensureEntitiesMembershipStream(tags: Record<string, string>, principal: {
+    url: string;
+    kind: string;
+  }): Promise<{
     sourceRef: string;
     streamUrl: string;
   }>;
@@ -4293,8 +5437,9 @@ declare class EntityManager {
    * trigger webhook notification.
    */
   private deliverWakeResult;
-  private syncEntitiesManifestSource;
+  private syncManifestLinks;
   private extractEntitiesSourceRef;
+  private extractSharedStateId;
   /**
    * Read a child entity's stream and extract concatenated text deltas
    * for a specific run, plus any error messages for that run.
@@ -4381,6 +5526,7 @@ declare class ElectricAgentsTenantRuntime {
   private applyManifestFutureSendSchedule;
   private applyManifestEntitySource;
   private extractEntitiesSourceRef;
+  private extractSharedStateId;
   private maybeMarkEntityIdleAfterRunFinished;
 }
@@ -4549,6 +5695,7 @@ interface TenantContext {
   entityBridgeManager: EntityBridgeCoordinator;
   eventSources?: EventSourceCatalog;
   ensureEventSourceWakeSource?: (sourceUrl: string) => Promise<void> | void;
+  authorizeRequest?: AuthorizeRequest;
   isShuttingDown: () => boolean;
 }
@@ -4568,4 +5715,4 @@ declare class UnregisteredTenantError extends Error {
 declare function isUnregisteredTenantError(error: unknown): error is UnregisteredTenantError;
 //#endregion
-export { AgentsHost, AgentsHostOptions, AgentsHostTenantConfig, AgentsHostTenantRuntime, AuthenticateRequest, ConsumerClaim, DEFAULT_TENANT_ID, DispatchPolicy, DispatchTarget, DrizzleDB, DurableStreamsBearerProvider, DurableStreamsRoutingAdapter, DurableStreamsRoutingInput, Ed25519WebhookSignerOptions, ElectricAgentsEntity, ElectricAgentsEntityRow, ElectricAgentsEntityType, ElectricAgentsRunner, ElectricAgentsUser, EntityBridgeCoordinator, EntityDispatchState, EntityListFilter, EntitySignal, EntityStatus, EventSourceBucket, EventSourceCatalog, EventSourceContract, EventSourceFilter, EventSourceSubscription, EventSourceSubscriptionInput, GlobalRoutes, PgClient, Principal, PrincipalKind, PublicElectricAgentsEntity, PublicWakeNotification, RegisterEntityTypeRequest, RegisterRunnerRequest, RequestPrincipal, RunnerAdminStatus, RunnerHeartbeatRequest, RunnerKind, RunnerLiveness, SendRequest, SignalRequest, SignalResponse, SourceStreamOffset, StreamClient, StreamClientOptions, SubscriptionClaimResponse, SubscriptionCreateInput, SubscriptionLifetime, SubscriptionResponse, SubscriptionStreamInfo, TenantContext, TypedSpawnRequest, UnregisteredTenantError, WakeNotificationRow, WebhookJwks, WebhookPublicJwk, WebhookSigner, WebhookSigningKeyInput, WebhookSigningMetadata, assertEntitySignal, assertEntityStatus, createDb, createEd25519WebhookSigner, expectedSignalStatus, getDefaultWebhookSigner, globalRouter, isTerminalEntityStatus, isUnregisteredTenantError, pathPrefixedSingleTenantDurableStreamsRoutingAdapter, rejectsNormalWrites, runMigrations, streamRootDurableStreamsRoutingAdapter, tenantRootDurableStreamsRoutingAdapter, toPublicEntity, webhookSigningMetadata };
+export { AgentsHost, AgentsHostOptions, AgentsHostTenantConfig, AgentsHostTenantRuntime, AuthenticateRequest, AuthorizationDecision, AuthorizationResource, AuthorizeRequest, ConsumerClaim, DEFAULT_TENANT_ID, DispatchPolicy, DispatchTarget, DrizzleDB, DurableStreamsBearerProvider, DurableStreamsRoutingAdapter, DurableStreamsRoutingInput, Ed25519WebhookSignerOptions, ElectricAgentsEntity, ElectricAgentsEntityRow, ElectricAgentsEntityType, ElectricAgentsRunner, ElectricAgentsUser, EntityBridgeCoordinator, EntityDispatchState, EntityListFilter, EntityPermission, EntityPermissionGrant, EntityPermissionPropagation, EntitySignal, EntityStatus, EntityTypePermission, EntityTypePermissionGrant, EntityTypePermissionGrantInput, EventSourceBucket, EventSourceCatalog, EventSourceContract, EventSourceFilter, EventSourceSubscription, EventSourceSubscriptionInput, GlobalRoutes, PermissionSubject, PermissionSubjectKind, PgClient, Principal, PrincipalKind, PublicElectricAgentsEntity, PublicWakeNotification, RegisterEntityTypeRequest, RegisterRunnerRequest, RequestPrincipal, RunnerAdminStatus, RunnerHeartbeatRequest, RunnerKind, RunnerLiveness, SendRequest, SignalRequest, SignalResponse, SourceStreamOffset, StreamClient, StreamClientOptions, SubscriptionClaimResponse, SubscriptionCreateInput, SubscriptionLifetime, SubscriptionResponse, SubscriptionStreamInfo, TenantContext, TypedSpawnRequest, UnregisteredTenantError, WakeNotificationRow, WebhookJwks, WebhookPublicJwk, WebhookSigner, WebhookSigningKeyInput, WebhookSigningMetadata, assertEntitySignal, assertEntityStatus, createDb, createEd25519WebhookSigner, expectedSignalStatus, getDefaultWebhookSigner, globalRouter, isTerminalEntityStatus, isUnregisteredTenantError, pathPrefixedSingleTenantDurableStreamsRoutingAdapter, rejectsNormalWrites, runMigrations, streamRootDurableStreamsRoutingAdapter, tenantRootDurableStreamsRoutingAdapter, toPublicEntity, webhookSigningMetadata };