@opengeni/db 0.31.1 → 0.36.0

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-YHZXQ7HP.js";
+} from "./chunk-VKLB2ZGI.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/runtime-posture.d.ts

@@ -1,11 +1,12 @@
 import type { Database, RlsStrategy } from "./database.js";
-export declare const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES: readonly ["knowledge_source_sync_lock_authority(uuid, uuid, uuid)"];
+export declare const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES: readonly ["fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text)", "xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint)", "create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamp with time zone)", "disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb)", "knowledge_source_sync_lock_authority(uuid, uuid, uuid)", "ensure_managed_human_personal_workspace(uuid, text, uuid)", "ensure_canonical_human_identity(text, text)", "validate_canonical_human_session(text, text, boolean)", "get_canonical_human_identity_projection(text)", "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)", "session_private_actor_visible(uuid, uuid, uuid, text)", "session_reference_visible(uuid, uuid, uuid)", "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text)", "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)", "resolve_xai_authority_pool(uuid, uuid, text, jsonb)", "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)", "xai_provider_account_authority_snapshot_v1_valid(jsonb)"];
+export declare const RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES: readonly ["session_reference_visible(uuid, uuid, uuid)", "xai_provider_account_authority_snapshot_v1_valid(jsonb)"];
 /**
  * The complete standalone tenant-table contract. Adding or removing a
  * FORCE-RLS table is an architectural change: update this list in the same
  * commit as the migration so startup cannot silently accept an unreviewed gap.
  */
-export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "attached_browser_devices", "attached_browser_inventories", "audit_events", "auth_runs", "billing_customers", "browser_identities", "browser_revision_components", "browser_revisions", "browser_session_associations", "browser_sessions", "browser_state_artifacts", "capability_api_facets", "capability_catalog_items", "capability_component_owners", "capability_facet_installations", "capability_facets", "capability_installations", "capability_integration_facets", "capability_mcp_facets", "capability_operations", "capability_plugin_installations", "capability_plugin_versions", "capability_plugins", "capability_skill_facets", "capability_skill_files", "codex_apps_settings", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "company_profile_activation_events", "company_profile_heads", "company_profile_revisions", "company_profile_snapshots", "composer_drafts", "computer_session_associations", "computer_sessions", "connection_disconnect_operations", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "editable_artifact_blob_refs", "editable_artifact_idempotency_receipts", "editable_artifact_live_outbox", "editable_artifact_live_tickets", "editable_artifact_materialization_jobs", "editable_artifact_materialization_results", "editable_artifact_operations", "editable_artifact_replica_leases", "editable_artifact_scope_authorization_heads", "editable_artifact_sequence_checkpoints", "editable_artifact_session_links", "editable_artifact_snapshots", "editable_artifact_transactions", "editable_artifact_undo_claims", "editable_artifact_versions", "editable_artifacts", "enrollments", "file_uploads", "files", "generated_image_artifacts", "generated_video_artifacts", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "image_generation_operations", "import_batches", "integration_feature_binding_owners", "integration_feature_bindings", "integration_feature_facets", "integration_oauth_state_nonces", "integration_spec_revisions", "integration_tools", "interaction_interventions", "interaction_operations", "interaction_resource_operations", "knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_lifecycle_events", "knowledge_memories", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_source_sync_index_obligations", "knowledge_source_sync_item_outcomes", "knowledge_source_sync_object_observations", "knowledge_source_sync_states", "knowledge_source_sync_wakes", "knowledge_sources", "knowledge_sync_runs", "machine_metrics_latest", "machine_metrics_series", "machine_removal_operations", "memory_slack_publication_configurations", "memory_slack_publication_receipts", "memory_slack_publications", "model_call_facts", "network_routes", "new_session_drafts", "pack_installation_components", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "retained_screenshot_artifacts", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_codemode_calls", "session_attempt_interruptions", "session_attempt_tool_catalogs", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "site_auth_connections", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_installation_bindings", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "slack_user_link_access_request_operations", "slack_user_link_access_requests", "social_connections", "social_posts", "temporal_schedule_cleanup_outbox", "transcription_recording_chunks", "transcription_recording_objects", "transcription_recording_segments", "transcription_recordings", "usage_events", "video_generation_operations", "video_generation_references", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_onboarding_proposals", "workspace_instruction_policy_revisions", "workspace_instruction_policy_snapshots", "workspace_interaction_revisions", "workspace_learning_policy_activation_events", "workspace_learning_policy_heads", "workspace_learning_policy_revisions", "workspace_learning_policy_snapshots", "workspace_model_policies", "workspace_packs", "workspace_screenshot_quotas", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets", "workspace_video_generation_policies", "workspace_video_generation_quotas"];
+export declare const FORCE_RLS_TABLES: readonly ["agent_run_states", "api_keys", "attached_browser_devices", "attached_browser_inventories", "audit_events", "auth_runs", "billing_customers", "browser_identities", "browser_revision_components", "browser_revisions", "browser_session_associations", "browser_sessions", "browser_state_artifacts", "browser_state_uploads", "canonical_human_identities", "canonical_human_identity_operations", "canonical_human_identity_subjects", "canonical_human_login_bindings", "capability_api_facets", "capability_catalog_items", "capability_component_owners", "capability_facet_installations", "capability_facets", "capability_installations", "capability_integration_facets", "capability_mcp_facets", "capability_operations", "capability_plugin_installations", "capability_plugin_versions", "capability_plugins", "capability_skill_facets", "capability_skill_files", "channels", "codex_apps_settings", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "company_profile_activation_events", "company_profile_heads", "company_profile_revisions", "company_profile_snapshots", "composer_drafts", "computer_session_associations", "computer_sessions", "connection_disconnect_operations", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "editable_artifact_blob_refs", "editable_artifact_idempotency_receipts", "editable_artifact_live_outbox", "editable_artifact_live_tickets", "editable_artifact_materialization_jobs", "editable_artifact_materialization_results", "editable_artifact_operations", "editable_artifact_replica_leases", "editable_artifact_scope_authorization_heads", "editable_artifact_sequence_checkpoints", "editable_artifact_session_links", "editable_artifact_snapshots", "editable_artifact_transactions", "editable_artifact_undo_claims", "editable_artifact_versions", "editable_artifacts", "enrollments", "file_uploads", "files", "generated_image_artifacts", "generated_video_artifacts", "github_installation_repositories", "github_installations", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "image_generation_operations", "import_batches", "integration_facet_binding_owners", "integration_facet_bindings", "integration_facet_definitions", "integration_oauth_state_nonces", "integration_spec_revisions", "integration_tools", "interaction_interventions", "interaction_operations", "interaction_resource_operations", "knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_lifecycle_events", "knowledge_memories", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_source_sync_index_obligations", "knowledge_source_sync_item_outcomes", "knowledge_source_sync_object_observations", "knowledge_source_sync_states", "knowledge_source_sync_wakes", "knowledge_sources", "knowledge_sync_runs", "machine_metrics_latest", "machine_metrics_series", "machine_removal_operations", "memory_slack_publication_configurations", "memory_slack_publication_receipts", "memory_slack_publications", "model_call_facts", "network_routes", "new_session_drafts", "organization_memberships", "organization_user_resource_authorities", "organization_user_resource_grants", "organization_user_retention_policies", "pack_installation_components", "pack_installations", "preference_registry_events", "preference_registry_preferences", "preference_registry_revisions", "preference_registry_snapshots", "retained_screenshot_artifacts", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_codemode_calls", "session_attempt_interruptions", "session_attempt_tool_catalogs", "session_command_receipts", "session_events", "session_goal_revisions", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_spawn_denials", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_visibility_write_capabilities", "session_workflow_wake_outbox", "sessions", "site_auth_connections", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_update_operations", "slack_bot_user_links", "slack_installation_bindings", "slack_interaction_action_handles", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "slack_shared_task_origins", "slack_task_policy_activation_events", "slack_task_policy_heads", "slack_task_policy_revisions", "slack_user_link_access_request_operations", "slack_user_link_access_requests", "social_connections", "social_posts", "task_note_events", "task_note_write_capabilities", "task_notes", "temporal_schedule_cleanup_outbox", "transcription_recording_chunks", "transcription_recording_objects", "transcription_recording_segments", "transcription_recordings", "usage_events", "video_generation_operations", "video_generation_references", "workspace_artifact_events", "workspace_artifact_versions", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_heads", "workspace_instruction_policy_onboarding_proposals", "workspace_instruction_policy_revisions", "workspace_instruction_policy_snapshots", "workspace_interaction_revisions", "workspace_learning_policy_activation_events", "workspace_learning_policy_heads", "workspace_learning_policy_revisions", "workspace_learning_policy_snapshots", "workspace_model_policies", "workspace_packs", "workspace_screenshot_quotas", "workspace_session_activity_revisions", "workspace_variable_set_variables", "workspace_variable_sets", "workspace_video_generation_policies", "workspace_video_generation_quotas", "xai_capacity_waiters", "xai_credential_leases", "xai_rotation_settings", "xai_session_account_pins", "xai_subscription_credentials"];
 /**
  * Deployment-global and authentication tables used by ordinary API/worker
  * traffic. They intentionally do not carry workspace RLS: their access model
@@ -17,20 +18,20 @@ export declare const NON_RLS_RUNTIME_TABLES: readonly ["auth_identities", "auth_
  * explicit instead of being derived from FORCE_RLS_TABLES: adding a protected
  * table must not silently grant it broader DML than its migration intended.
  */
-export declare const RUNTIME_FULL_DML_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "auth_identities", "auth_rate_limits", "auth_sessions", "auth_users", "auth_verifications", "billing_customers", "browser_session_associations", "capability_catalog_items", "capability_component_owners", "capability_facet_installations", "capability_installations", "capability_operations", "capability_plugin_installations", "codex_apps_settings", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "computer_session_associations", "connection_disconnect_operations", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "editable_artifact_replica_leases", "enrollments", "file_uploads", "files", "generated_image_artifacts", "generated_video_artifacts", "github_installation_repositories", "github_installations", "image_generation_operations", "import_batches", "integration_feature_binding_owners", "integration_feature_bindings", "integration_oauth_clients", "integration_oauth_state_nonces", "knowledge_memories", "knowledge_source_sync_index_obligations", "knowledge_source_sync_item_outcomes", "knowledge_source_sync_object_observations", "knowledge_source_sync_states", "knowledge_source_sync_wakes", "machine_metrics_latest", "machine_metrics_series", "machine_removal_operations", "managed_accounts", "memory_slack_publication_configurations", "memory_slack_publication_receipts", "memory_slack_publications", "model_call_facts", "new_session_drafts", "pack_installation_components", "pack_installations", "retained_screenshot_artifacts", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_user_links", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "stripe_webhook_events", "transcription_recording_chunks", "transcription_recording_objects", "transcription_recording_segments", "transcription_recordings", "usage_events", "video_generation_operations", "video_generation_references", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_heads", "workspace_memberships", "workspace_model_policies", "workspace_packs", "workspace_screenshot_quotas", "workspace_variable_set_variables", "workspace_variable_sets", "workspace_video_generation_policies", "workspace_video_generation_quotas", "workspaces"];
+export declare const RUNTIME_FULL_DML_TABLES: readonly ["agent_run_states", "api_keys", "audit_events", "auth_identities", "auth_rate_limits", "auth_sessions", "auth_users", "auth_verifications", "billing_customers", "browser_session_associations", "capability_catalog_items", "capability_component_owners", "capability_facet_installations", "capability_installations", "capability_operations", "capability_plugin_installations", "channels", "codex_apps_settings", "codex_capacity_waiters", "codex_credential_leases", "codex_reset_redemption_attempts", "codex_rotation_settings", "codex_subscription_credentials", "composer_drafts", "computer_session_associations", "connection_disconnect_operations", "connections", "connector_action_policies", "connector_action_requests", "credit_ledger_entries", "device_enrollment_requests", "document_bases", "document_chunks", "documents", "editable_artifact_replica_leases", "enrollments", "file_uploads", "files", "generated_image_artifacts", "generated_video_artifacts", "github_installation_repositories", "github_installations", "image_generation_operations", "import_batches", "integration_facet_binding_owners", "integration_facet_bindings", "integration_oauth_clients", "integration_oauth_state_nonces", "knowledge_memories", "knowledge_source_sync_index_obligations", "knowledge_source_sync_item_outcomes", "knowledge_source_sync_object_observations", "knowledge_source_sync_states", "knowledge_source_sync_wakes", "machine_metrics_latest", "machine_metrics_series", "machine_removal_operations", "managed_accounts", "memory_slack_publication_configurations", "memory_slack_publication_receipts", "memory_slack_publications", "model_call_facts", "new_session_drafts", "pack_installation_components", "pack_installations", "retained_screenshot_artifacts", "rig_changes", "rig_versions", "rigs", "sandbox_checkpoint_artifacts", "sandbox_lease_holders", "sandbox_leases", "sandbox_pty_sessions", "sandbox_retained_processes", "sandbox_session_envelopes", "sandbox_workspace_mutation_admissions", "sandboxes", "scheduled_task_runs", "scheduled_tasks", "session_attempt_interruptions", "session_command_receipts", "session_events", "session_goals", "session_history_items", "session_human_input_requests", "session_list_snapshots", "session_mcp_servers", "session_pending_tool_calls", "session_pins", "session_realtime_connections", "session_realtime_context_projections", "session_realtime_entries", "session_realtime_modes", "session_recordings", "session_stream_acknowledgments", "session_system_update_outbox", "session_system_updates", "session_turn_attempts", "session_turns", "session_workflow_wake_outbox", "sessions", "slack_bot_delete_operations", "slack_bot_post_operations", "slack_bot_update_operations", "slack_bot_user_links", "slack_interaction_action_handles", "slack_interaction_inbox", "slack_interaction_progress_deliveries", "slack_interactions", "social_connections", "social_posts", "stripe_webhook_events", "transcription_recording_chunks", "transcription_recording_objects", "transcription_recording_segments", "transcription_recordings", "usage_events", "video_generation_operations", "video_generation_references", "workspace_artifacts", "workspace_captures", "workspace_control_events", "workspace_inference_controls", "workspace_instruction_policy_heads", "workspace_memberships", "workspace_model_policies", "workspace_packs", "workspace_screenshot_quotas", "workspace_variable_set_variables", "workspace_variable_sets", "workspace_video_generation_policies", "workspace_video_generation_quotas", "workspaces", "xai_capacity_waiters", "xai_credential_leases", "xai_rotation_settings", "xai_session_account_pins", "xai_subscription_credentials"];
 /** Configuration and lifecycle-owned audit rows are read-only at runtime. */
-export declare const RUNTIME_READ_ONLY_TABLES: readonly ["company_profile_activation_events", "company_profile_heads", "company_profile_snapshots", "knowledge_lifecycle_events", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "nested_agent_depth_configuration", "preference_registry_events", "preference_registry_snapshots", "slack_installation_bindings", "workspace_instruction_policy_snapshots", "workspace_learning_policy_activation_events", "workspace_learning_policy_heads", "workspace_learning_policy_snapshots"];
+export declare const RUNTIME_READ_ONLY_TABLES: readonly ["company_profile_activation_events", "company_profile_heads", "company_profile_snapshots", "knowledge_lifecycle_events", "knowledge_memory_lifecycle_events", "knowledge_memory_relationships", "nested_agent_depth_configuration", "preference_registry_events", "preference_registry_snapshots", "slack_installation_bindings", "slack_task_policy_activation_events", "slack_task_policy_heads", "slack_task_policy_revisions", "workspace_instruction_policy_snapshots", "workspace_learning_policy_activation_events", "workspace_learning_policy_heads", "workspace_learning_policy_snapshots"];
 /** Existing runtime authorities that may be observed and advanced, never created or deleted. */
 export declare const RUNTIME_READ_UPDATE_TABLES: readonly ["workspace_session_activity_revisions"];
 /** Append-only evidence/revision tables are insertable and queryable, never mutable. */
-export declare const RUNTIME_READ_INSERT_TABLES: readonly ["browser_revision_components", "browser_revisions", "company_profile_revisions", "editable_artifact_blob_refs", "editable_artifact_idempotency_receipts", "editable_artifact_live_outbox", "editable_artifact_materialization_jobs", "editable_artifact_materialization_results", "editable_artifact_operations", "editable_artifact_sequence_checkpoints", "editable_artifact_snapshots", "editable_artifact_transactions", "editable_artifact_undo_claims", "editable_artifact_versions", "knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_sources", "knowledge_sync_runs", "preference_registry_preferences", "preference_registry_revisions", "session_attempt_tool_catalogs", "session_spawn_denials", "slack_user_link_access_request_operations", "temporal_schedule_cleanup_outbox", "workspace_artifact_events", "workspace_artifact_versions", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_onboarding_proposals", "workspace_instruction_policy_revisions", "workspace_learning_policy_revisions"];
+export declare const RUNTIME_READ_INSERT_TABLES: readonly ["browser_revision_components", "browser_revisions", "company_profile_revisions", "editable_artifact_blob_refs", "editable_artifact_idempotency_receipts", "editable_artifact_live_outbox", "editable_artifact_materialization_jobs", "editable_artifact_materialization_results", "editable_artifact_operations", "editable_artifact_sequence_checkpoints", "editable_artifact_snapshots", "editable_artifact_transactions", "editable_artifact_undo_claims", "editable_artifact_versions", "knowledge_change_proposals", "knowledge_claim_evidence", "knowledge_claim_relations", "knowledge_claim_reviews", "knowledge_claims", "knowledge_document_versions", "knowledge_entities", "knowledge_entity_aliases", "knowledge_facts", "knowledge_operation_receipts", "knowledge_providers", "knowledge_source_acl_versions", "knowledge_source_objects", "knowledge_sources", "knowledge_sync_runs", "preference_registry_preferences", "preference_registry_revisions", "session_attempt_tool_catalogs", "session_goal_revisions", "session_spawn_denials", "slack_shared_task_origins", "slack_user_link_access_request_operations", "temporal_schedule_cleanup_outbox", "workspace_artifact_events", "workspace_artifact_versions", "workspace_instruction_policy_activation_events", "workspace_instruction_policy_onboarding_proposals", "workspace_instruction_policy_revisions", "workspace_learning_policy_revisions"];
 /** Durable operation journals are append/read plus claim/settle updates, never deletes. */
-export declare const RUNTIME_READ_INSERT_UPDATE_TABLES: readonly ["attached_browser_devices", "attached_browser_inventories", "auth_runs", "browser_identities", "browser_sessions", "browser_state_artifacts", "capability_api_facets", "capability_facets", "capability_integration_facets", "capability_mcp_facets", "capability_plugin_versions", "capability_plugins", "capability_skill_facets", "capability_skill_files", "computer_sessions", "editable_artifact_session_links", "editable_artifacts", "integration_feature_facets", "integration_spec_revisions", "integration_tools", "interaction_interventions", "interaction_operations", "interaction_resource_operations", "network_routes", "session_attempt_codemode_calls", "site_auth_connections", "slack_user_link_access_requests", "workspace_interaction_revisions"];
+export declare const RUNTIME_READ_INSERT_UPDATE_TABLES: readonly ["attached_browser_devices", "attached_browser_inventories", "auth_runs", "browser_identities", "browser_sessions", "browser_state_artifacts", "browser_state_uploads", "capability_api_facets", "capability_facets", "capability_integration_facets", "capability_mcp_facets", "capability_plugin_versions", "capability_plugins", "capability_skill_facets", "capability_skill_files", "computer_sessions", "editable_artifact_session_links", "editable_artifacts", "integration_facet_definitions", "integration_spec_revisions", "integration_tools", "interaction_interventions", "interaction_operations", "interaction_resource_operations", "network_routes", "session_attempt_codemode_calls", "site_auth_connections", "slack_user_link_access_requests", "workspace_interaction_revisions"];
 /**
  * These FORCE-RLS tables are owned by security-definer host-export routines.
  * The ordinary application role must have no direct table privileges on them.
  */
-export declare const PROTECTED_NO_DIRECT_DML_TABLES: readonly ["editable_artifact_live_tickets", "editable_artifact_scope_authorization_heads", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox"];
+export declare const PROTECTED_NO_DIRECT_DML_TABLES: readonly ["canonical_human_identities", "canonical_human_identity_operations", "canonical_human_identity_subjects", "canonical_human_login_bindings", "editable_artifact_live_tickets", "editable_artifact_scope_authorization_heads", "host_export_config", "host_export_consumers", "host_export_cursor_state", "host_export_dead_letters", "host_export_outbox", "organization_memberships", "organization_user_resource_authorities", "organization_user_resource_grants", "organization_user_retention_policies", "session_visibility_write_capabilities", "task_note_events", "task_note_write_capabilities", "task_notes"];
 export type RuntimeTableDmlPrivilege = "SELECT" | "INSERT" | "UPDATE" | "DELETE";
 export type RuntimeTablePrivilegeContract = Readonly<Record<string, readonly RuntimeTableDmlPrivilege[]>>;
 /** Exact per-table DML contract. Absence means no direct table privileges. */