@opengeni/db 0.31.1 → 0.36.0

package/dist/{chunk-YHZXQ7HP.js → chunk-VKLB2ZGI.js}

@@ -124,9 +124,77 @@ var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [
   "knowledge_sources",
   "knowledge_source_objects"
 ];
+var MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE = "ensure_managed_human_personal_workspace(uuid, text, uuid)";
+var MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES = [
+  "organization_memberships",
+  "organization_user_retention_policies",
+  "organization_user_resource_authorities",
+  "organization_user_resource_grants"
+];
+var CANONICAL_HUMAN_IDENTITY_ROUTINES = [
+  "ensure_canonical_human_identity(text, text)",
+  "validate_canonical_human_session(text, text, boolean)",
+  "get_canonical_human_identity_projection(text)",
+  "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)"
+];
+var CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES = [
+  "canonical_human_identities",
+  "canonical_human_identity_subjects",
+  "canonical_human_login_bindings",
+  "canonical_human_identity_operations"
+];
+var SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE = "session_private_actor_visible(uuid, uuid, uuid, text)";
+var SESSION_REFERENCE_VISIBLE_ROUTINE = "session_reference_visible(uuid, uuid, uuid)";
+var TASK_NOTE_CAPABILITY_ROUTINES = [
+  "create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)",
+  "archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)",
+  "list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)"
+];
+var TRANSITION_SESSION_VISIBILITY_ROUTINE = "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text)";
+var FORK_SESSION_CONTENT_ROUTINE = "fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text)";
+var SESSION_AUTHORITY_ROUTINES = /* @__PURE__ */ new Set([
+  FORK_SESSION_CONTENT_ROUTINE,
+  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
+  SESSION_REFERENCE_VISIBLE_ROUTINE,
+  TRANSITION_SESSION_VISIBILITY_ROUTINE,
+  ...TASK_NOTE_CAPABILITY_ROUTINES
+]);
+var XAI_CREATE_CREDENTIAL_ROUTINE = "create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamp with time zone)";
+var XAI_DISCONNECT_CREDENTIAL_ROUTINE = "disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb)";
+var XAI_SNAPSHOT_VALIDATOR_ROUTINE = "xai_provider_account_authority_snapshot_v1_valid(jsonb)";
+var XAI_AUTHORITY_LIVE_ROUTINE = "xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint)";
+var XAI_POOL_VISIBLE_ROUTINE = "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)";
+var XAI_RESOLVE_POOL_ROUTINE = "resolve_xai_authority_pool(uuid, uuid, text, jsonb)";
+var XAI_REVALIDATE_CREDENTIAL_ROUTINE = "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)";
+var XAI_AUTHORITY_TABLES = [
+  "organization_memberships",
+  "organization_user_resource_authorities",
+  "workspace_memberships",
+  "xai_subscription_credentials"
+];
 var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
-  KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE
+  FORK_SESSION_CONTENT_ROUTINE,
+  XAI_AUTHORITY_LIVE_ROUTINE,
+  XAI_CREATE_CREDENTIAL_ROUTINE,
+  XAI_DISCONNECT_CREDENTIAL_ROUTINE,
+  KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE,
+  MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE,
+  ...CANONICAL_HUMAN_IDENTITY_ROUTINES,
+  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
+  SESSION_REFERENCE_VISIBLE_ROUTINE,
+  TRANSITION_SESSION_VISIBILITY_ROUTINE,
+  XAI_POOL_VISIBLE_ROUTINE,
+  XAI_RESOLVE_POOL_ROUTINE,
+  XAI_REVALIDATE_CREDENTIAL_ROUTINE,
+  XAI_SNAPSHOT_VALIDATOR_ROUTINE
+];
+var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
+  SESSION_REFERENCE_VISIBLE_ROUTINE,
+  XAI_SNAPSHOT_VALIDATOR_ROUTINE
 ];
+var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set(
+  RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES
+);
 var FORCE_RLS_TABLES = [
   "agent_run_states",
   "api_keys",
@@ -141,6 +209,11 @@ var FORCE_RLS_TABLES = [
   "browser_session_associations",
   "browser_sessions",
   "browser_state_artifacts",
+  "browser_state_uploads",
+  "canonical_human_identities",
+  "canonical_human_identity_operations",
+  "canonical_human_identity_subjects",
+  "canonical_human_login_bindings",
   "capability_api_facets",
   "capability_catalog_items",
   "capability_component_owners",
@@ -155,6 +228,7 @@ var FORCE_RLS_TABLES = [
   "capability_plugins",
   "capability_skill_facets",
   "capability_skill_files",
+  "channels",
   "codex_apps_settings",
   "codex_capacity_waiters",
   "codex_credential_leases",
@@ -207,9 +281,9 @@ var FORCE_RLS_TABLES = [
   "host_export_outbox",
   "image_generation_operations",
   "import_batches",
-  "integration_feature_binding_owners",
-  "integration_feature_bindings",
-  "integration_feature_facets",
+  "integration_facet_binding_owners",
+  "integration_facet_bindings",
+  "integration_facet_definitions",
   "integration_oauth_state_nonces",
   "integration_spec_revisions",
   "integration_tools",
@@ -249,6 +323,10 @@ var FORCE_RLS_TABLES = [
   "model_call_facts",
   "network_routes",
   "new_session_drafts",
+  "organization_memberships",
+  "organization_user_resource_authorities",
+  "organization_user_resource_grants",
+  "organization_user_retention_policies",
   "pack_installation_components",
   "pack_installations",
   "preference_registry_events",
@@ -274,6 +352,7 @@ var FORCE_RLS_TABLES = [
   "session_attempt_tool_catalogs",
   "session_command_receipts",
   "session_events",
+  "session_goal_revisions",
   "session_goals",
   "session_history_items",
   "session_human_input_requests",
@@ -292,20 +371,30 @@ var FORCE_RLS_TABLES = [
   "session_system_updates",
   "session_turn_attempts",
   "session_turns",
+  "session_visibility_write_capabilities",
   "session_workflow_wake_outbox",
   "sessions",
   "site_auth_connections",
   "slack_bot_delete_operations",
   "slack_bot_post_operations",
+  "slack_bot_update_operations",
   "slack_bot_user_links",
   "slack_installation_bindings",
+  "slack_interaction_action_handles",
   "slack_interaction_inbox",
   "slack_interaction_progress_deliveries",
   "slack_interactions",
+  "slack_shared_task_origins",
+  "slack_task_policy_activation_events",
+  "slack_task_policy_heads",
+  "slack_task_policy_revisions",
   "slack_user_link_access_request_operations",
   "slack_user_link_access_requests",
   "social_connections",
   "social_posts",
+  "task_note_events",
+  "task_note_write_capabilities",
+  "task_notes",
   "temporal_schedule_cleanup_outbox",
   "transcription_recording_chunks",
   "transcription_recording_objects",
@@ -337,7 +426,12 @@ var FORCE_RLS_TABLES = [
   "workspace_variable_set_variables",
   "workspace_variable_sets",
   "workspace_video_generation_policies",
-  "workspace_video_generation_quotas"
+  "workspace_video_generation_quotas",
+  "xai_capacity_waiters",
+  "xai_credential_leases",
+  "xai_rotation_settings",
+  "xai_session_account_pins",
+  "xai_subscription_credentials"
 ];
 var NON_RLS_RUNTIME_TABLES = [
   "auth_identities",
@@ -369,6 +463,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "capability_installations",
   "capability_operations",
   "capability_plugin_installations",
+  "channels",
   "codex_apps_settings",
   "codex_capacity_waiters",
   "codex_credential_leases",
@@ -396,8 +491,8 @@ var RUNTIME_FULL_DML_TABLES = [
   "github_installations",
   "image_generation_operations",
   "import_batches",
-  "integration_feature_binding_owners",
-  "integration_feature_bindings",
+  "integration_facet_binding_owners",
+  "integration_facet_bindings",
   "integration_oauth_clients",
   "integration_oauth_state_nonces",
   "knowledge_memories",
@@ -455,7 +550,9 @@ var RUNTIME_FULL_DML_TABLES = [
   "sessions",
   "slack_bot_delete_operations",
   "slack_bot_post_operations",
+  "slack_bot_update_operations",
   "slack_bot_user_links",
+  "slack_interaction_action_handles",
   "slack_interaction_inbox",
   "slack_interaction_progress_deliveries",
   "slack_interactions",
@@ -482,7 +579,12 @@ var RUNTIME_FULL_DML_TABLES = [
   "workspace_variable_sets",
   "workspace_video_generation_policies",
   "workspace_video_generation_quotas",
-  "workspaces"
+  "workspaces",
+  "xai_capacity_waiters",
+  "xai_credential_leases",
+  "xai_rotation_settings",
+  "xai_session_account_pins",
+  "xai_subscription_credentials"
 ];
 var RUNTIME_READ_ONLY_TABLES = [
   "company_profile_activation_events",
@@ -495,6 +597,9 @@ var RUNTIME_READ_ONLY_TABLES = [
   "preference_registry_events",
   "preference_registry_snapshots",
   "slack_installation_bindings",
+  "slack_task_policy_activation_events",
+  "slack_task_policy_heads",
+  "slack_task_policy_revisions",
   "workspace_instruction_policy_snapshots",
   "workspace_learning_policy_activation_events",
   "workspace_learning_policy_heads",
@@ -534,7 +639,9 @@ var RUNTIME_READ_INSERT_TABLES = [
   "preference_registry_preferences",
   "preference_registry_revisions",
   "session_attempt_tool_catalogs",
+  "session_goal_revisions",
   "session_spawn_denials",
+  "slack_shared_task_origins",
   "slack_user_link_access_request_operations",
   "temporal_schedule_cleanup_outbox",
   "workspace_artifact_events",
@@ -551,6 +658,7 @@ var RUNTIME_READ_INSERT_UPDATE_TABLES = [
   "browser_identities",
   "browser_sessions",
   "browser_state_artifacts",
+  "browser_state_uploads",
   "capability_api_facets",
   "capability_facets",
   "capability_integration_facets",
@@ -562,7 +670,7 @@ var RUNTIME_READ_INSERT_UPDATE_TABLES = [
   "computer_sessions",
   "editable_artifact_session_links",
   "editable_artifacts",
-  "integration_feature_facets",
+  "integration_facet_definitions",
   "integration_spec_revisions",
   "integration_tools",
   "interaction_interventions",
@@ -575,13 +683,25 @@ var RUNTIME_READ_INSERT_UPDATE_TABLES = [
   "workspace_interaction_revisions"
 ];
 var PROTECTED_NO_DIRECT_DML_TABLES = [
+  "canonical_human_identities",
+  "canonical_human_identity_operations",
+  "canonical_human_identity_subjects",
+  "canonical_human_login_bindings",
   "editable_artifact_live_tickets",
   "editable_artifact_scope_authorization_heads",
   "host_export_config",
   "host_export_consumers",
   "host_export_cursor_state",
   "host_export_dead_letters",
-  "host_export_outbox"
+  "host_export_outbox",
+  "organization_memberships",
+  "organization_user_resource_authorities",
+  "organization_user_resource_grants",
+  "organization_user_retention_policies",
+  "session_visibility_write_capabilities",
+  "task_note_events",
+  "task_note_write_capabilities",
+  "task_notes"
 ];
 var FULL_DML_PRIVILEGES = ["SELECT", "INSERT", "UPDATE", "DELETE"];
 var RUNTIME_TABLE_PRIVILEGES = Object.freeze({
@@ -786,14 +906,16 @@ async function inspectRuntimeDatabasePosture(db, options) {
             p.prosecdef as security_definer
           from pg_proc p
           join pg_namespace n on n.oid = p.pronamespace
-          where p.oid = to_regprocedure(
-            format(
-              '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',
-              ${targetSchema}::text
-            )
-          )
-            and n.nspname = ${targetSchema}
+          where n.nspname = ${targetSchema}
             and p.prokind in ('f', 'p')
+            and (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')') = any(
+              array[
+                ${sql.join(
+          RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES.map((name) => sql`${name}`),
+          sql`, `
+        )}
+              ]::text[]
+            )
           order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)
         `)
       ).map((row) => ({
@@ -990,7 +1112,13 @@ function evaluateRuntimeDatabasePosture(posture, options) {
       continue;
     }
     const routine = matches[0];
-    if (!routine.securityDefiner) {
+    if (RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET.has(routine.name)) {
+      if (routine.securityDefiner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} must be SECURITY INVOKER`
+        );
+      }
+    } else if (!routine.securityDefiner) {
       violations.push(`target-schema runtime capability ${routine.name} is not SECURITY DEFINER`);
     }
     if (routine.name === KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE) {
@@ -1016,6 +1144,72 @@ function evaluateRuntimeDatabasePosture(posture, options) {
           );
         }
       }
+    } else if (routine.name === MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE) {
+      const authorityTables = MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityOwners.size > 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (authorityTables[0] && routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
+    } else if (CANONICAL_HUMAN_IDENTITY_ROUTINES.includes(routine.name)) {
+      const authorityTables = CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} canonical identity authority tables are missing`
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
+    } else if (SESSION_AUTHORITY_ROUTINES.has(routine.name)) {
+      const authorityOwner = tableByName.get("sessions")?.owner ?? targetSchemaOwner;
+      if (authorityOwner && routine.owner !== authorityOwner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match session authority owner ${authorityOwner}`
+        );
+      }
+    } else if (routine.name === XAI_SNAPSHOT_VALIDATOR_ROUTINE) {
+    } else if (routine.name === XAI_CREATE_CREDENTIAL_ROUTINE || routine.name === XAI_DISCONNECT_CREDENTIAL_ROUTINE || routine.name === XAI_AUTHORITY_LIVE_ROUTINE || routine.name === XAI_POOL_VISIBLE_ROUTINE || routine.name === XAI_RESOLVE_POOL_ROUTINE || routine.name === XAI_REVALIDATE_CREDENTIAL_ROUTINE) {
+      if (!tableByName.has("xai_subscription_credentials")) {
+        continue;
+      }
+      const missingAuthorityTables = XAI_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = XAI_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
     } else if (targetSchemaOwner && routine.owner !== targetSchemaOwner) {
       violations.push(
         `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match schema owner ${targetSchemaOwner}`
@@ -1663,6 +1857,28 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.create_task_note_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
@@ -1741,6 +1957,18 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.slack_task_policy_update(uuid,text,uuid,uuid,jsonb,uuid,bigint,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.slack_task_policy_update(uuid, text, uuid, uuid, jsonb, uuid, bigint, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',
@@ -1773,6 +2001,204 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.ensure_managed_human_personal_workspace(uuid,text,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.ensure_canonical_human_identity(text,text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.ensure_canonical_human_identity(text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.ensure_canonical_human_identity(text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.validate_canonical_human_session(text,text,boolean)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.get_canonical_human_identity_projection(text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.get_canonical_human_identity_projection(text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_canonical_human_identity_projection(text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.apply_canonical_human_identity_operation(uuid,text,bigint,text,uuid,text,text,text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0225 creates these target-schema-local session visibility
+    -- capabilities before opengeni_app may exist. Re-converge their exact
+    -- EXECUTE grants for migrate-then-provision installs without granting
+    -- blanket execution on target-schema routines.
+    IF to_regprocedure(
+      format(
+        '%I.session_private_actor_visible(uuid,uuid,uuid,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.session_reference_visible(uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.transition_session_visibility(uuid,uuid,uuid,text,text,integer,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.create_xai_subscription_credential(uuid,uuid,text,text,text,text,text,text,text,timestamptz)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
@@ -1942,6 +2368,7 @@ if (import.meta.main) {
 
 export {
   RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
+  RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES,
   FORCE_RLS_TABLES,
   NON_RLS_RUNTIME_TABLES,
   RUNTIME_FULL_DML_TABLES,
@@ -1959,4 +2386,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-YHZXQ7HP.js.map
+//# sourceMappingURL=chunk-VKLB2ZGI.js.map