@opengeni/db 0.28.1 → 0.31.1

package/drizzle/0216_pack_component_ownership.sql

@@ -0,0 +1,235 @@
+-- deployment-mode: rolling
+-- Additive Pack installation evidence and component ownership. Old API/worker
+-- binaries continue to use the original columns; new binaries freeze the
+-- reviewed manifest and populate the normalized component ledger.
+
+ALTER TABLE "pack_installations"
+  ADD COLUMN "version" integer NOT NULL DEFAULT 1,
+  ADD COLUMN "manifest_snapshot" jsonb,
+  ADD COLUMN "manifest_digest" text,
+  ADD COLUMN "selected_rig_id" uuid REFERENCES "rigs"("id") ON DELETE SET NULL,
+  ADD COLUMN "installed_by_subject_id" text;
+
+ALTER TABLE "pack_installations"
+  ADD CONSTRAINT "pack_installations_version_chk" CHECK ("version" > 0) NOT VALID,
+  ADD CONSTRAINT "pack_installations_manifest_chk" CHECK (
+    ("manifest_snapshot" IS NULL AND "manifest_digest" IS NULL)
+    OR (
+      jsonb_typeof("manifest_snapshot") = 'object'
+      AND octet_length(convert_to("manifest_snapshot"::text, 'UTF8')) <= 1048576
+      AND "manifest_digest" ~ '^[0-9a-f]{64}$'
+    )
+  ) NOT VALID,
+  ADD CONSTRAINT "pack_installations_actor_chk" CHECK (
+    "installed_by_subject_id" IS NULL
+    OR length(btrim("installed_by_subject_id")) BETWEEN 1 AND 1024
+  ) NOT VALID,
+  ADD CONSTRAINT "pack_installations_status_chk" CHECK (
+    "status" IN ('installing', 'active', 'needs_attention', 'disabled')
+  ) NOT VALID;
+
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_version_chk";
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_manifest_chk";
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_actor_chk";
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_status_chk";
+
+CREATE INDEX "pack_installations_workspace_rig_idx"
+  ON "pack_installations" ("workspace_id", "selected_rig_id")
+  WHERE "selected_rig_id" IS NOT NULL;
+
+CREATE TABLE "pack_installation_components" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "pack_installation_id" uuid NOT NULL REFERENCES "pack_installations"("id") ON DELETE CASCADE,
+  "component_key" text NOT NULL,
+  "kind" text NOT NULL,
+  "capability_id" text NOT NULL,
+  "resolved_id" text NOT NULL,
+  "digest" text NOT NULL,
+  "metadata" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "pack_installation_components_key_chk" CHECK (
+    length("component_key") BETWEEN 1 AND 128
+    AND "component_key" ~ '^[a-z0-9]([a-z0-9._/-]*[a-z0-9])?$'
+  ),
+  CONSTRAINT "pack_installation_components_kind_chk" CHECK (
+    "kind" IN ('plugin', 'skill', 'integration', 'feature', 'inline_skill')
+  ),
+  CONSTRAINT "pack_installation_components_identity_chk" CHECK (
+    length("capability_id") BETWEEN 1 AND 512
+    AND length("resolved_id") BETWEEN 1 AND 512
+    AND "capability_id" !~ '[[:cntrl:]]'
+    AND "resolved_id" !~ '[[:cntrl:]]'
+    AND "digest" ~ '^[0-9a-f]{64}$'
+  ),
+  CONSTRAINT "pack_installation_components_metadata_chk" CHECK (
+    jsonb_typeof("metadata") = 'object'
+    AND octet_length(convert_to("metadata"::text, 'UTF8')) <= 131072
+  ),
+  CONSTRAINT "pack_installation_components_pack_key_uq"
+    UNIQUE ("pack_installation_id", "component_key")
+);
+
+CREATE INDEX "pack_installation_components_workspace_capability_idx"
+  ON "pack_installation_components" ("workspace_id", "kind", "capability_id");
+
+CREATE OR REPLACE FUNCTION pack_v2_validate_installation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW."manifest_snapshot" IS NOT NULL
+    AND NEW."manifest_snapshot" ->> 'id' IS DISTINCT FROM NEW."pack_id"
+  THEN
+    RAISE EXCEPTION 'pack installation snapshot id does not match pack_id'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW."selected_rig_id" IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM "rigs" r
+    WHERE r."id" = NEW."selected_rig_id"
+      AND r."account_id" = NEW."account_id"
+      AND r."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'pack installation Rig belongs to another tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER pack_installations_v2_validate
+  BEFORE INSERT OR UPDATE ON "pack_installations"
+  FOR EACH ROW EXECUTE FUNCTION pack_v2_validate_installation();
+
+CREATE OR REPLACE FUNCTION pack_v2_validate_component()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM "pack_installations" i
+    WHERE i."id" = NEW."pack_installation_id"
+      AND i."account_id" = NEW."account_id"
+      AND i."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'Pack component does not match its installation tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER pack_installation_components_validate
+  BEFORE INSERT OR UPDATE ON "pack_installation_components"
+  FOR EACH ROW EXECUTE FUNCTION pack_v2_validate_component();
+
+-- Harden the polymorphic owner identity added by 0202 now that first-class
+-- Pack installation ids exist. Direct/migration owners remain textual, and
+-- rolling legacy Pack owners remain valid when they are not UUID-shaped.
+CREATE OR REPLACE FUNCTION capability_v2_validate_component_owner()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM "capability_facet_installations" i
+    WHERE i."id" = NEW."facet_installation_id"
+      AND i."account_id" = NEW."account_id"
+      AND i."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'component owner does not match its facet installation tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW."owner_kind" = 'plugin' THEN
+    IF NEW."owner_id" !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
+      RAISE EXCEPTION 'plugin component owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    ELSIF NOT EXISTS (
+        SELECT 1 FROM "capability_plugin_installations" p
+        WHERE p."id" = NEW."owner_id"::uuid
+          AND p."account_id" = NEW."account_id"
+          AND p."workspace_id" = NEW."workspace_id"
+      ) THEN
+      RAISE EXCEPTION 'plugin component owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  ELSIF NEW."owner_kind" = 'pack'
+    AND NEW."owner_id" ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+  THEN
+    IF NOT EXISTS (
+      SELECT 1 FROM "pack_installations" p
+      WHERE p."id" = NEW."owner_id"::uuid
+        AND p."account_id" = NEW."account_id"
+        AND p."workspace_id" = NEW."workspace_id"
+    ) THEN
+      RAISE EXCEPTION 'Pack component owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION capability_v2_validate_feature_binding_owner()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM "integration_feature_bindings" b
+    WHERE b."id" = NEW."binding_id"
+      AND b."account_id" = NEW."account_id"
+      AND b."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'feature binding owner does not match its binding tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW."owner_kind" = 'plugin' THEN
+    IF NEW."owner_id" !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
+      RAISE EXCEPTION 'plugin feature binding owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    ELSIF NOT EXISTS (
+        SELECT 1 FROM "capability_plugin_installations" p
+        WHERE p."id" = NEW."owner_id"::uuid
+          AND p."account_id" = NEW."account_id"
+          AND p."workspace_id" = NEW."workspace_id"
+      ) THEN
+      RAISE EXCEPTION 'plugin feature binding owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  ELSIF NEW."owner_kind" = 'pack'
+    AND NEW."owner_id" ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+  THEN
+    IF NOT EXISTS (
+      SELECT 1 FROM "pack_installations" p
+      WHERE p."id" = NEW."owner_id"::uuid
+        AND p."account_id" = NEW."account_id"
+        AND p."workspace_id" = NEW."workspace_id"
+    ) THEN
+      RAISE EXCEPTION 'Pack feature binding owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+ALTER TABLE "pack_installation_components" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "pack_installation_components" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY workspace_isolation ON "pack_installation_components"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON "pack_installation_components" TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0217_capability_definition_delete_authority.sql

@@ -0,0 +1,32 @@
+-- deployment-mode: rolling
+-- Shared capability and Integration definitions are globally readable catalog
+-- data, not tenant lifecycle rows. Revoke ordinary runtime deletion authority
+-- without narrowing the installation, binding, owner, or operation lifecycle.
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    REVOKE DELETE ON
+      "capability_plugins",
+      "capability_plugin_versions",
+      "capability_facets",
+      "capability_integration_facets",
+      "capability_mcp_facets",
+      "capability_api_facets",
+      "capability_skill_facets",
+      "capability_skill_files",
+      "integration_spec_revisions",
+      "integration_tools",
+      "integration_feature_facets"
+    FROM opengeni_app;
+
+    GRANT SELECT, INSERT, UPDATE, DELETE ON
+      "capability_plugin_installations",
+      "capability_facet_installations",
+      "capability_component_owners",
+      "integration_feature_bindings",
+      "integration_feature_binding_owners",
+      "capability_operations"
+    TO opengeni_app;
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.28.1",
+  "version": "0.31.1",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -34,6 +34,18 @@
     "./provision-roles": {
       "types": "./dist/provision-roles.d.ts",
       "import": "./dist/provision-roles.js"
+    },
+    "./editable-artifacts": {
+      "types": "./dist/editable-artifacts.d.ts",
+      "import": "./dist/editable-artifacts.js"
+    },
+    "./editable-artifact-durable-export": {
+      "types": "./dist/editable-artifact-durable-export.d.ts",
+      "import": "./dist/editable-artifact-durable-export.js"
+    },
+    "./video-generation": {
+      "types": "./dist/video-generation.d.ts",
+      "import": "./dist/video-generation.js"
     }
   },
   "publishConfig": {
@@ -50,10 +62,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codex": "^0.2.11",
-    "@opengeni/config": "^0.11.0",
-    "@opengeni/contracts": "^0.39.0",
-    "@opengeni/network": "^0.2.0",
+    "@opengeni/codemode": "^0.2.2",
+    "@opengeni/codex": "^0.2.15",
+    "@opengeni/config": "^0.13.2",
+    "@opengeni/contracts": "^0.44.1",
+    "@opengeni/network": "^0.2.2",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/attached-browser-devices.ts

@@ -0,0 +1,371 @@
+import {
+  AttachedBrowserDevice,
+  AttachedBrowserDeviceCapabilities,
+  AttachedBrowserDeviceListResponse,
+  AttachedBrowserInventorySnapshot,
+  type AttachedBrowserDevice as AttachedBrowserDeviceValue,
+  type AttachedBrowserDeviceAnnouncement,
+  type AttachedBrowserDeviceListResponse as AttachedBrowserDeviceListResponseValue,
+  type AttachedBrowserInventorySnapshot as AttachedBrowserInventorySnapshotValue,
+} from "@opengeni/contracts";
+import { and, asc, desc, eq, inArray, isNull } from "drizzle-orm";
+import { type Database, withRlsContext } from "./database";
+import {
+  advanceWorkspaceInteractionRevision,
+  readWorkspaceInteractionRevision,
+} from "./interaction-revisions";
+import * as schema from "./schema";
+
+type DeviceRow = typeof schema.attachedBrowserDevices.$inferSelect;
+
+const CONSISTENT_READ = {
+  isolationLevel: "repeatable read",
+  accessMode: "read only",
+} as const;
+
+export class AttachedBrowserDeviceNotFoundError extends Error {
+  readonly name = "AttachedBrowserDeviceNotFoundError";
+}
+
+export class AttachedBrowserInventoryConflictError extends Error {
+  readonly name = "AttachedBrowserInventoryConflictError";
+}
+
+export type ReconcileAttachedBrowserInventoryResult = {
+  accepted: boolean;
+  changed: boolean;
+  revision: number;
+};
+
+function safeInteger(value: number, label: string): number {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} is outside safe range`);
+  return value;
+}
+
+function deviceFromRow(row: DeviceRow): AttachedBrowserDeviceValue {
+  return AttachedBrowserDevice.parse({
+    id: row.id,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    enrollmentId: row.enrollmentId,
+    name: row.name,
+    profileLabel: row.profileLabel,
+    browserName: row.browserName,
+    browserVersion: row.browserVersion,
+    extensionVersion: row.extensionVersion,
+    platform: row.platform,
+    architecture: row.architecture,
+    state: row.disconnectedAt ? "disconnected" : "connected",
+    connectionGeneration: row.connectionGeneration,
+    inventoryRevision: safeInteger(row.inventoryRevision, "attached browser inventory revision"),
+    tabCount: safeInteger(row.tabCount, "attached browser tab count"),
+    capabilities: row.capabilities,
+    lastSeenAt: row.lastSeenAt.toISOString(),
+    disconnectedAt: row.disconnectedAt?.toISOString() ?? null,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  });
+}
+
+function sameAnnouncement(row: DeviceRow, value: AttachedBrowserDeviceAnnouncement): boolean {
+  return (
+    row.name === value.name &&
+    row.profileLabel === value.profileLabel &&
+    row.browserName === value.browserName &&
+    row.browserVersion === value.browserVersion &&
+    row.extensionVersion === value.extensionVersion &&
+    row.platform === value.platform &&
+    row.architecture === value.architecture &&
+    row.connectionGeneration === value.connectionGeneration &&
+    row.inventoryRevision === value.inventoryRevision &&
+    row.tabCount === value.tabCount &&
+    JSON.stringify(AttachedBrowserDeviceCapabilities.parse(row.capabilities)) ===
+      JSON.stringify(value.capabilities) &&
+    row.disconnectedAt === null
+  );
+}
+
+/** Reconcile one full browser-bridge snapshot. The enrollment row serializes
+ *  concurrent heartbeats; a lower revision from the same bridge generation is
+ *  ignored, and a replay only refreshes liveness. */
+export async function reconcileAttachedBrowserInventory(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    snapshot: AttachedBrowserInventorySnapshotValue;
+  },
+): Promise<ReconcileAttachedBrowserInventoryResult> {
+  const snapshot = AttachedBrowserInventorySnapshot.parse(input.snapshot);
+  return await withRlsContext(
+    db,
+    input,
+    async (scopedDb) =>
+      await scopedDb.transaction(async (rawTx) => {
+        const tx = rawTx as unknown as Database;
+        const [enrollment] = await tx
+          .select({
+            id: schema.enrollments.id,
+            accountId: schema.enrollments.accountId,
+            workspaceId: schema.enrollments.workspaceId,
+            status: schema.enrollments.status,
+          })
+          .from(schema.enrollments)
+          .where(
+            and(
+              eq(schema.enrollments.id, input.enrollmentId),
+              eq(schema.enrollments.accountId, input.accountId),
+              eq(schema.enrollments.workspaceId, input.workspaceId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (!enrollment || enrollment.status !== "active") {
+          throw new AttachedBrowserInventoryConflictError(
+            "attached browser inventory belongs to an unavailable enrollment",
+          );
+        }
+
+        const [cursor] = await tx
+          .select()
+          .from(schema.attachedBrowserInventories)
+          .where(
+            and(
+              eq(schema.attachedBrowserInventories.workspaceId, input.workspaceId),
+              eq(schema.attachedBrowserInventories.enrollmentId, input.enrollmentId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (
+          cursor?.bridgeGeneration === snapshot.bridgeGeneration &&
+          snapshot.revision < cursor.revision
+        ) {
+          return {
+            accepted: false,
+            changed: false,
+            revision: await readWorkspaceInteractionRevision(tx, input.workspaceId),
+          };
+        }
+
+        const now = new Date();
+        const rows = await tx
+          .select()
+          .from(schema.attachedBrowserDevices)
+          .where(eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId))
+          .for("update");
+        const byId = new Map(rows.map((row) => [row.id, row]));
+        let changed = false;
+        for (const device of snapshot.devices) {
+          const existing = byId.get(device.id);
+          if (existing && existing.enrollmentId !== input.enrollmentId) {
+            throw new AttachedBrowserInventoryConflictError(
+              "attached browser device id is already owned by another enrollment",
+            );
+          }
+          if (!existing) {
+            await tx.insert(schema.attachedBrowserDevices).values({
+              id: device.id,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              enrollmentId: input.enrollmentId,
+              name: device.name,
+              profileLabel: device.profileLabel,
+              browserName: device.browserName,
+              browserVersion: device.browserVersion,
+              extensionVersion: device.extensionVersion,
+              platform: device.platform,
+              architecture: device.architecture,
+              connectionGeneration: device.connectionGeneration,
+              inventoryRevision: device.inventoryRevision,
+              tabCount: device.tabCount,
+              capabilities: device.capabilities,
+              lastSeenAt: now,
+              disconnectedAt: null,
+              createdAt: now,
+              updatedAt: now,
+            });
+            changed = true;
+            continue;
+          }
+          const materialChanged = !sameAnnouncement(existing, device);
+          await tx
+            .update(schema.attachedBrowserDevices)
+            .set({
+              name: device.name,
+              profileLabel: device.profileLabel,
+              browserName: device.browserName,
+              browserVersion: device.browserVersion,
+              extensionVersion: device.extensionVersion,
+              platform: device.platform,
+              architecture: device.architecture,
+              connectionGeneration: device.connectionGeneration,
+              inventoryRevision: device.inventoryRevision,
+              tabCount: device.tabCount,
+              capabilities: device.capabilities,
+              lastSeenAt: now,
+              disconnectedAt: null,
+              updatedAt: materialChanged ? now : existing.updatedAt,
+            })
+            .where(
+              and(
+                eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId),
+                eq(schema.attachedBrowserDevices.id, device.id),
+              ),
+            );
+          changed ||= materialChanged;
+        }
+
+        const announced = new Set(snapshot.devices.map((device) => device.id));
+        const disconnectedIds = rows
+          .filter(
+            (row) =>
+              row.enrollmentId === input.enrollmentId &&
+              row.disconnectedAt === null &&
+              !announced.has(row.id),
+          )
+          .map((row) => row.id);
+        if (disconnectedIds.length > 0) {
+          await tx
+            .update(schema.attachedBrowserDevices)
+            .set({ disconnectedAt: now, updatedAt: now })
+            .where(
+              and(
+                eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId),
+                eq(schema.attachedBrowserDevices.enrollmentId, input.enrollmentId),
+                inArray(schema.attachedBrowserDevices.id, disconnectedIds),
+                isNull(schema.attachedBrowserDevices.disconnectedAt),
+              ),
+            );
+          changed = true;
+        }
+
+        if (cursor) {
+          await tx
+            .update(schema.attachedBrowserInventories)
+            .set({
+              bridgeGeneration: snapshot.bridgeGeneration,
+              revision: snapshot.revision,
+              observedAt: now,
+              updatedAt: now,
+            })
+            .where(
+              and(
+                eq(schema.attachedBrowserInventories.workspaceId, input.workspaceId),
+                eq(schema.attachedBrowserInventories.enrollmentId, input.enrollmentId),
+              ),
+            );
+        } else {
+          await tx.insert(schema.attachedBrowserInventories).values({
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            enrollmentId: input.enrollmentId,
+            bridgeGeneration: snapshot.bridgeGeneration,
+            revision: snapshot.revision,
+            observedAt: now,
+            updatedAt: now,
+          });
+        }
+        const revision = changed
+          ? await advanceWorkspaceInteractionRevision(tx, input.accountId, input.workspaceId)
+          : await readWorkspaceInteractionRevision(tx, input.workspaceId);
+        return { accepted: true, changed, revision };
+      }),
+  );
+}
+
+/** Immediately mark every live Chrome profile on a cleanly disconnected agent
+ *  offline. Historical endpoint rows remain discoverable and reconnect in place. */
+export async function disconnectAttachedBrowserDevices(
+  db: Database,
+  input: { accountId: string; workspaceId: string; enrollmentId: string },
+): Promise<{ changed: boolean; revision: number }> {
+  return await withRlsContext(
+    db,
+    input,
+    async (scopedDb) =>
+      await scopedDb.transaction(async (rawTx) => {
+        const tx = rawTx as unknown as Database;
+        const now = new Date();
+        const rows = await tx
+          .update(schema.attachedBrowserDevices)
+          .set({ disconnectedAt: now, updatedAt: now })
+          .where(
+            and(
+              eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId),
+              eq(schema.attachedBrowserDevices.enrollmentId, input.enrollmentId),
+              isNull(schema.attachedBrowserDevices.disconnectedAt),
+            ),
+          )
+          .returning({ id: schema.attachedBrowserDevices.id });
+        const revision = rows.length
+          ? await advanceWorkspaceInteractionRevision(tx, input.accountId, input.workspaceId)
+          : await readWorkspaceInteractionRevision(tx, input.workspaceId);
+        return { changed: rows.length > 0, revision };
+      }),
+  );
+}
+
+export async function listAttachedBrowserDevices(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    includeDisconnected?: boolean;
+  },
+): Promise<AttachedBrowserDeviceListResponseValue> {
+  return await withRlsContext(
+    db,
+    input,
+    async (scopedDb) => {
+      const rows = await scopedDb
+        .select()
+        .from(schema.attachedBrowserDevices)
+        .where(
+          input.includeDisconnected
+            ? eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId)
+            : and(
+                eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId),
+                isNull(schema.attachedBrowserDevices.disconnectedAt),
+              ),
+        )
+        .orderBy(
+          desc(schema.attachedBrowserDevices.disconnectedAt),
+          desc(schema.attachedBrowserDevices.updatedAt),
+          asc(schema.attachedBrowserDevices.name),
+          asc(schema.attachedBrowserDevices.id),
+        );
+      return AttachedBrowserDeviceListResponse.parse({
+        revision: await readWorkspaceInteractionRevision(scopedDb, input.workspaceId),
+        devices: rows.map(deviceFromRow),
+      });
+    },
+    CONSISTENT_READ,
+  );
+}
+
+export async function getAttachedBrowserDevice(
+  db: Database,
+  input: { accountId: string; workspaceId: string; deviceId: string },
+): Promise<AttachedBrowserDeviceValue> {
+  return await withRlsContext(
+    db,
+    input,
+    async (scopedDb) => {
+      const [row] = await scopedDb
+        .select()
+        .from(schema.attachedBrowserDevices)
+        .where(
+          and(
+            eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId),
+            eq(schema.attachedBrowserDevices.id, input.deviceId),
+          ),
+        )
+        .limit(1);
+      if (!row) throw new AttachedBrowserDeviceNotFoundError("Attached browser not found");
+      return deviceFromRow(row);
+    },
+    CONSISTENT_READ,
+  );
+}