@opengeni/db 1.0.1 → 3.1.0-canary.0

package/dist/user-resource-authority.d.ts

@@ -0,0 +1,109 @@
+import { PersonalResourceAttachmentSummary, type PersonalResourceAttachmentIntent, USER_RESOURCE_ACTION_BY_KIND, type UserResourceDelegation, type UserResourceKind } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+export type UserResourceAuthorityGrant = {
+    grantId: string;
+    targetWorkspaceId: string;
+    targetSessionId: string | null;
+    action: (typeof USER_RESOURCE_ACTION_BY_KIND)[UserResourceKind];
+    mode: "once" | "session" | "always";
+    context: "user_private" | "workspace_shared";
+    authorityEpoch: number | null;
+    generation: number;
+    status: "active" | "consumed" | "revoked" | "expired";
+    expiresAt: string | null;
+    delegation: UserResourceDelegation;
+};
+export type UserResourceAuthoritySummary = {
+    authorityId: string;
+    resourceKind: UserResourceKind;
+    resourceId: string;
+    originWorkspaceId: string | null;
+    generation: number;
+    status: "active" | "retained" | "revoked";
+    grants: UserResourceAuthorityGrant[];
+};
+export type AcceptedTurnPersonalResourceAttachment = {
+    summary: PersonalResourceAttachmentSummary;
+    replay: boolean;
+};
+export declare class PersonalResourceAttachmentAcceptanceError extends Error {
+    readonly kind: "invalid" | "forbidden" | "conflict";
+    readonly name = "PersonalResourceAttachmentAcceptanceError";
+    constructor(kind: "invalid" | "forbidden" | "conflict", options?: ErrorOptions);
+}
+/**
+ * Issue and freeze the locked session's personal Variable Set/Rig/Connected
+ * Machine closure on
+ * one already-inserted logical turn. The caller owns the surrounding accepted-
+ * work transaction; this helper must never be called as a standalone grant
+ * mutation.
+ */
+export declare function acceptTurnPersonalResourceAttachmentInTransaction(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    subjectId: string;
+    intent: PersonalResourceAttachmentIntent & {
+        expectedAuthorityEpoch: number;
+    };
+}): Promise<AcceptedTurnPersonalResourceAttachment>;
+export declare function listSelfUserResourceAuthorities(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    resourceKind: UserResourceKind;
+    cursor?: string | undefined;
+    limit: number;
+}): Promise<{
+    authorities: UserResourceAuthoritySummary[];
+    nextCursor: string | null;
+}>;
+export declare function issueSelfUserResourceGrant(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authorityId: string;
+    resourceKind: UserResourceKind;
+    mode: "session" | "always";
+    context: "user_private" | "workspace_shared";
+    sessionId?: string | null;
+    expectedAuthorityEpoch?: number | null;
+    workspaceSharedAcknowledged: boolean;
+}): Promise<UserResourceAuthorityGrant>;
+export declare function revokeSelfUserResourceGrant(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    grantId: string;
+}): Promise<{
+    grantId: string;
+    generation: number;
+    status: "revoked";
+    revokedAt: string;
+}>;
+export declare function resolveSessionAttemptPersonalResources(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    attemptId: string;
+}): Promise<void>;
+export type PersonalDocumentAuthority = {
+    authorityId: string;
+    ownerOrganizationMembershipId: string;
+    authorityGeneration: number;
+};
+/**
+ * Create the common organization-user authority before inserting a personal
+ * Document. Returns null for a configured/local or rolling-legacy subject that
+ * has no eligible active organization membership, preserving the existing
+ * workspace-anchored personal lane. Call this inside the same database
+ * transaction as the Document insert so a failed write cannot leave an orphan
+ * authority.
+ */
+export declare function createPersonalDocumentAuthority(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    documentId: string;
+}): Promise<PersonalDocumentAuthority | null>;

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-CUPM3FGB.js";
-import "./chunk-ZWREYEWA.js";
-import "./chunk-6ZYKCRFO.js";
+} from "./chunk-NJVZPWXY.js";
+import "./chunk-SCPUJS53.js";
+import "./chunk-PR2WMLOQ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/workspace-authority.d.ts

@@ -0,0 +1,81 @@
+import { type Database } from "./database.js";
+/**
+ * THE canonical live-workspace-authority resolver for one exact subject, run on
+ * a handle that is ALREADY inside the caller's transaction with that subject's
+ * RLS context applied.
+ *
+ * `getWorkspaceGrant` is a bare `workspace_memberships` join and is therefore
+ * NOT a complete authority answer: a managed human's personal workspace
+ * deliberately has no row in that table (migration 0219 raises on one), so its
+ * owner's access is the `organization_memberships.personal_workspace_id`
+ * pointer instead. Any seam that re-derives "does this subject still hold
+ * workspace authority here" from that bare join denies the one human who always
+ * belongs. This module exists so that rule has exactly one implementation.
+ *
+ * Seams that must serialize the answer with their own writes — session listing,
+ * session pins, the composer draft — call this variant so the read and the write
+ * share one transaction snapshot and one advisory fence. Seams that need to ask
+ * about a subject that is NOT the caller call
+ * {@link namedSubjectHasLiveWorkspaceAuthority} (`@opengeni/db`), which is a thin
+ * scope wrapper over exactly this body.
+ *
+ * True when the subject currently holds workspace authority the same way the
+ * route-time access builder derives it: a `workspace_memberships` row whose
+ * owning organization membership (when one exists) is active, or an active
+ * organization membership whose personal-workspace pointer is exactly this
+ * workspace. Never infers authority any other way; a deleted membership row and
+ * a suspended/revoked organization membership are both false. Only the
+ * membership's own `personal_workspace_id` counts as stated authority — nothing
+ * is read from `created_by`, a default workspace, a resource name, or current
+ * access.
+ *
+ * # This function is NOT an authorization. Read this before relying on it.
+ *
+ * It answers "does subject X hold authority over workspace W". It does NOT
+ * establish that the caller is X. Nothing here authenticates anybody.
+ *
+ * The scope assertion below is a **consistency check, not an authorization**.
+ * It prevents one thing: a caller naming a third-party subject while its
+ * transaction is scoped to someone else. It cannot detect a caller that scoped
+ * the transaction to an attacker-chosen subject in the first place, because
+ * `withWorkspaceSubjectRls(db, workspaceId, subjectId, ...)` takes that subject
+ * from its argument too. At today's three call sites both sides come from the
+ * same variable, so the check is a tautology there and fires only if a future
+ * refactor makes them diverge. Treat it as a tripwire against that refactor —
+ * never as evidence that the subject was authenticated.
+ *
+ * **The actual authorization for the personal-workspace exception lives in the
+ * API layer**: `AccessGrantAuthorization.canonicalManagedHumanSession`
+ * (`@opengeni/core`), stamped only where a Better Auth cookie was verified. A
+ * caller that has not proven that must not enable the exception. If you are
+ * adding a caller, that stamp is the part you have to get right; this function
+ * will happily answer `true` for any subject you scope a transaction to.
+ *
+ * Non-`user:` subjects (API keys, delegated service principals, configured and
+ * local principals) can never own an organization membership, so they
+ * short-circuit to the plain membership answer instead of tripping
+ * `list_self_organization_memberships`' `42501`.
+ */
+export declare function subjectHasLiveWorkspaceAuthorityInScope(scopedDb: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<boolean>;
+/**
+ * The applied subject GUC, or `""` when none is set. `""` is the canonical
+ * "unset" for this GUC: `current_subject_id()` is
+ * `nullif(current_setting('opengeni.subject_id', true), '')` (0239 precedent), so
+ * a caller restoring `""` genuinely clears it rather than pinning an empty
+ * subject. Never throws, so it is safe for capturing a prior value that may
+ * legitimately be absent.
+ */
+export declare function rlsSubjectIdOrEmpty(scopedDb: Database): Promise<string>;
+/**
+ * The tenant account of the caller's ALREADY-applied RLS scope. `withRlsContext`
+ * sets and read-back-verifies this GUC on the pinned backend before running the
+ * scoped body, so it is exact rather than a re-derivation — which lets a seam
+ * that only received a workspace id consult
+ * {@link subjectHasLiveWorkspaceAuthorityInScope} without a second round trip to
+ * resolve the account.
+ */
+export declare function accountIdInRlsScope(scopedDb: Database): Promise<string>;

package/dist/workspace-instruction-policies-schema.d.ts

@@ -801,6 +801,285 @@ export declare const workspaceInstructionPolicyActivationEvents: import("drizzle
     };
     dialect: 'pg';
 }>;
+export declare const workspaceInstructionPolicyDeactivationEvents: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workspace_instruction_policy_deactivation_events";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        operationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "operation_id";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_fingerprint";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        accountId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "account_id";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        scope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_key";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "type";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        activationVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "activation_version";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        oldRevisionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "old_revision_id";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        oldRevision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "old_revision";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        oldContentHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "old_content_hash";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorSubjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_subject_id";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "workspace_instruction_policy_deactivation_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
 export declare const workspaceInstructionPolicyOnboardingProposals: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "workspace_instruction_policy_onboarding_proposals";
     schema: undefined;

package/dist/workspace-instruction-policies.d.ts

@@ -34,6 +34,18 @@ type OnboardingProposalRequestInput = WorkspaceInstructionPolicyTarget & {
     expectedActivationVersion: number;
     createdBySubjectId: string;
 };
+export type WorkspaceInstructionPolicyKnowledgeProposalInput = WorkspaceInstructionPolicyTarget & {
+    operationId: string;
+    accountId: string;
+    workspaceId: string;
+    content: string;
+    knowledgeProposalId: string;
+    knowledgeProposalContentHash: string;
+    confidenceBps: number;
+    expectedCurrentRevisionId: string | null;
+    expectedActivationVersion: number;
+    createdBySubjectId: string;
+};
 export declare class WorkspaceInstructionPolicyConflictError extends Error {
     readonly currentHead: WorkspaceInstructionPolicyHead | null;
     readonly name = "WorkspaceInstructionPolicyConflictError";
@@ -61,6 +73,14 @@ export declare class WorkspaceInstructionPolicyOnboardingProposalContentError ex
     readonly name = "WorkspaceInstructionPolicyOnboardingProposalContentError";
     constructor(code: "WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_EMPTY" | "WORKSPACE_INSTRUCTION_POLICY_ONBOARDING_PROPOSAL_OVERSIZED");
 }
+/**
+ * The exact diagnostic `activate_human_confirmed_learning_decision` raises when
+ * a proposal's compare-and-set baseline no longer matches the live head. It is
+ * matched by message because the SQLSTATE (40001) is shared with other
+ * conflicts. Kept here so the SQL and the code that keys recovery off it cannot
+ * drift apart silently - the migration test pins the same string.
+ */
+export declare const INSTRUCTION_POLICY_STALE_BASELINE_DIAGNOSTIC = "instruction-policy proposal baseline is stale";
 export declare class WorkspaceInstructionPolicyOnboardingProposalStaleError extends Error {
     readonly currentHead: WorkspaceInstructionPolicyHead | null;
     readonly name = "WorkspaceInstructionPolicyOnboardingProposalStaleError";
@@ -123,6 +143,33 @@ export declare function importLegacyWorkspaceInstructionPolicyDraft(db: Database
 export declare function createWorkspaceInstructionPolicyOnboardingProposal(db: Database, input: Omit<OnboardingProposalRequestInput, "operationId"> & {
     operationId?: string;
 }): Promise<WorkspaceInstructionPolicyOnboardingProposal>;
+/**
+ * Materialize an immutable Knowledge change proposal as an inactive instruction
+ * draft. Human activation remains exclusively in the existing lifecycle API.
+ */
+export declare function createWorkspaceInstructionPolicyKnowledgeProposal(db: Database, input: WorkspaceInstructionPolicyKnowledgeProposalInput): Promise<WorkspaceInstructionPolicyOnboardingProposal>;
+/**
+ * Add a successor instruction-policy proposal for a knowledge proposal whose
+ * existing proposal was left behind by a moved head.
+ *
+ * This exists for one case: the human already answered "save", and only then
+ * did the head move. Re-asking them would be the alternative. The successor
+ * reuses the exact immutable source facts of the stranded proposal - same
+ * knowledge proposal id, same content hash, same target, same author - so the
+ * human's confirmation, which is bound to the knowledge proposal id, still
+ * describes precisely what gets activated. Only the compare-and-set baseline
+ * and the draft's place in the revision chain move forward.
+ *
+ * Returns the existing proposal unchanged when it is already current, so a
+ * retry of the same confirmation is idempotent.
+ */
+export declare function rebaselineWorkspaceInstructionPolicyKnowledgeProposal(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    knowledgeProposalId: string;
+    operationId: string;
+    initiatingHumanSubjectId: string;
+}): Promise<WorkspaceInstructionPolicyOnboardingProposal>;
 export declare function listWorkspaceInstructionPolicyOnboardingProposals(db: Database, workspaceId: string, query: WorkspaceInstructionPolicyOnboardingProposalListQuery): Promise<WorkspaceInstructionPolicyOnboardingProposalListResponse>;
 export declare function listWorkspaceInstructionPolicyRevisions(db: Database, workspaceId: string, query: WorkspaceInstructionPolicyListQuery): Promise<WorkspaceInstructionPolicyListResponse>;
 export declare function getWorkspaceInstructionPolicyRevision(db: Database, workspaceId: string, revisionId: string): Promise<WorkspaceInstructionPolicyRevision>;
@@ -185,4 +232,19 @@ export declare function getOrCreateWorkspaceInstructionPolicySnapshot(db: Databa
         content: string;
     }[];
 }>;
+/**
+ * Current activation baseline for one instruction-policy target: the active
+ * head's revision (or null) and the CAS activation version that a new draft
+ * proposal must expect. A deactivated-to-null target keeps its monotonic
+ * boundary, so the version is the max of the head and latest deactivation.
+ * Read-only under workspace RLS; used by `remember` to bind a user-directed
+ * rule to the exact current baseline instead of assuming an empty workspace.
+ */
+export declare function getWorkspaceInstructionPolicyBaseline(db: Database, input: {
+    workspaceId: string;
+    target: WorkspaceInstructionPolicyTarget;
+}): Promise<{
+    expectedCurrentRevisionId: string | null;
+    expectedActivationVersion: number;
+}>;
 export {};

package/dist/workspace-learning-policy.d.ts

@@ -156,6 +156,7 @@ export declare function listWorkspaceLearningPolicyHistory(db: Database, input:
     head: WorkspaceLearningPolicyHead | null;
     revisions: WorkspaceLearningPolicyRevision[];
     events: WorkspaceLearningPolicyActivationEvent[];
+    truncated: boolean;
 }>;
 export declare function getOrCreateWorkspaceLearningPolicySnapshot(db: Database, claims: WorkspaceLearningPolicyAttemptClaims): Promise<WorkspaceLearningPolicySnapshot>;
 export {};

package/dist/workspace-membership-permissions.d.ts

@@ -0,0 +1,2 @@
+import { type Permission } from "@opengeni/contracts";
+export declare function normalizeWorkspaceMembershipPermissions(value: unknown): Permission[];

package/drizzle/0240_enrollment_connection_authority.sql

@@ -0,0 +1,39 @@
+-- deployment-mode: rolling
+-- Fence each Connected Machine to one live runner instance. The credential
+-- generation proves enrollment authority; this independent connection lease
+-- prevents two processes holding the same still-valid credential from sharing
+-- one RPC subject and receiving work nondeterministically.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+ALTER TABLE "enrollments"
+  ADD COLUMN "connection_instance_id" text,
+  ADD COLUMN "connection_generation" integer NOT NULL DEFAULT 0,
+  ADD COLUMN "connection_lease_expires_at" timestamptz,
+  ADD COLUMN "connection_duplicate_denied_count" integer NOT NULL DEFAULT 0,
+  ADD COLUMN "connection_duplicate_denied_at" timestamptz;
+
+ALTER TABLE "enrollments"
+  ADD CONSTRAINT "enrollments_connection_authority_shape_chk" CHECK (
+    ("connection_instance_id" IS NULL AND "connection_lease_expires_at" IS NULL)
+    OR ("connection_instance_id" IS NOT NULL
+      AND length("connection_instance_id") BETWEEN 1 AND 128
+      AND "connection_lease_expires_at" IS NOT NULL)
+  ) NOT VALID,
+  ADD CONSTRAINT "enrollments_connection_generation_chk" CHECK (
+    "connection_generation" >= 0
+  ) NOT VALID,
+  ADD CONSTRAINT "enrollments_connection_duplicate_denied_count_chk" CHECK (
+    "connection_duplicate_denied_count" >= 0
+  ) NOT VALID;
+
+ALTER TABLE "enrollments"
+  VALIDATE CONSTRAINT "enrollments_connection_authority_shape_chk";
+ALTER TABLE "enrollments"
+  VALIDATE CONSTRAINT "enrollments_connection_generation_chk";
+ALTER TABLE "enrollments"
+  VALIDATE CONSTRAINT "enrollments_connection_duplicate_denied_count_chk";
+
+RESET statement_timeout;
+RESET lock_timeout;