@opengeni/db 1.0.2 → 1.1.0

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-KH3TYDGY.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-J4WFOVBV.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/mcp-operations.js

@@ -1,7 +1,7 @@
 import {
   withRlsContext
-} from "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   fromPostgresLosslessJson,

package/dist/organization-integration-policy.js

@@ -3,10 +3,10 @@ import {
   updateOrganizationIntegrationPolicy,
   withOrganizationIntegrationAcquisition,
   withOrganizationIntegrationPolicyFence
-} from "./chunk-PQGTWFRF.js";
+} from "./chunk-M3SWH4MU.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-N5QCKHYL.js";
+} from "./chunk-T5NHDEZW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/retained-provider-commands.js

@@ -14,13 +14,13 @@ import {
   retainedProviderCommandPersistence,
   supervisedCommandProtocolReady,
   validateRouterOutputAdvance
-} from "./chunk-OMHBVHX7.js";
-import "./chunk-F3YMVRF4.js";
-import "./chunk-7S53WLPI.js";
-import "./chunk-MACELCXG.js";
+} from "./chunk-ODKYBA3C.js";
+import "./chunk-GLA5YCQS.js";
+import "./chunk-EKXCF3FH.js";
+import "./chunk-CIGHXFPD.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/runtime-posture.d.ts

@@ -1,5 +1,6 @@
 import type { Database, RlsStrategy } from "./database.js";
 export declare const SANDBOX_FILE_PUBLICATION_RUNTIME_ROUTINES: readonly ["record_sandbox_file_publication(uuid, uuid, uuid, uuid)", "list_sandbox_file_publications(uuid, uuid, jsonb)"];
+export declare const ARTIFACT_PIN_RUNTIME_ROUTINES: readonly ["update_artifact_pin(uuid, uuid, text, text, boolean)", "list_artifact_pins(uuid, uuid)", "list_sandbox_file_publications_pinned(uuid, uuid, jsonb)"];
 export declare const SCHEDULED_SLACK_BOT_MESSAGE_RUNTIME_ROUTINES: readonly ["prepare_scheduled_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, text, text, text)", "read_scheduled_slack_bot_message(uuid, uuid, uuid, uuid)"];
 export declare const ORGANIZATION_SIGNUP_USE_CASE_RUNTIME_ROUTINES: readonly ["record_organization_signup_use_case(uuid, text, text)"];
 export declare const SLACK_FILE_UPLOAD_OPERATIONS_TABLE = "slack_file_upload_operations";
@@ -65,7 +66,6 @@ export type RuntimeDatabasePostureOptions = {
     targetSchemaForbiddenRoutines?: readonly string[];
     /** Frozen binary contract; current callers require both additive Insights capabilities. */
     modelFactCapabilityRoutines?: readonly string[];
-    organizationTenancyCanonicalActivationEnabled?: boolean;
 };
 export type RuntimeDatabaseIdentity = {
     currentUser: string;
@@ -130,6 +130,8 @@ export type RuntimePrivateTablePosture = {
     truncate?: boolean;
     references?: boolean;
     trigger?: boolean;
+    /** Effective relation ACL privileges not represented by the named flags. */
+    extraPrivileges?: string[];
 };
 export type RuntimeDatabasePosture = {
     identity: RuntimeDatabaseIdentity;
@@ -142,7 +144,6 @@ export type RuntimeDatabasePosture = {
     privateTables: RuntimePrivateTablePosture[];
     targetRoutines: RuntimeTargetRoutinePosture[];
     privateRoutines: RuntimeRoutinePosture[];
-    sessionTenancyProductActivationPresent: boolean;
     sessionVariableSetAttachmentsCutoverPresent: boolean;
     claudeSubscriptionPoolActivationPresent: boolean;
 };

package/dist/schema.d.ts

@@ -28905,6 +28905,99 @@ export declare const sandboxFilePublications: import("drizzle-orm/pg-core").PgTa
     };
     dialect: 'pg';
 }>;
+/** Shared discovery pins; no content or access authority. SQL owns target validation. */
+export declare const artifactCatalogPins: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "artifact_catalog_pins";
+    schema: "opengeni_private";
+    columns: {
+        accountId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "account_id";
+            tableName: "artifact_catalog_pins";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "artifact_catalog_pins";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "artifact_catalog_pins";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        artifactId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "artifact_id";
+            tableName: "artifact_catalog_pins";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        pinnedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "pinned_at";
+            tableName: "artifact_catalog_pins";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
 /** Source-session upload fence; never stores file bytes or expiring upload URLs. */
 export declare const slackFileUploadOperations: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "slack_file_upload_operations";

package/dist/schema.js

@@ -5,6 +5,7 @@ import {
   agentRunStates,
   agentUpdateStatusValues,
   apiKeys,
+  artifactCatalogPins,
   attachedBrowserDevices,
   attachedBrowserInventories,
   auditEvents,
@@ -399,7 +400,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-LDTQGYD2.js";
+} from "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -409,6 +410,7 @@ export {
   agentRunStates,
   agentUpdateStatusValues,
   apiKeys,
+  artifactCatalogPins,
   attachedBrowserDevices,
   attachedBrowserInventories,
   auditEvents,

package/dist/session-background-commands.js

@@ -27,11 +27,11 @@ import {
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction,
   unobservableRetainedProcessOutcomeSql
-} from "./chunk-7S53WLPI.js";
-import "./chunk-MACELCXG.js";
+} from "./chunk-EKXCF3FH.js";
+import "./chunk-CIGHXFPD.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-command-output.js

@@ -1,11 +1,11 @@
 import {
   appendSessionCommandOutput
-} from "./chunk-F3YMVRF4.js";
-import "./chunk-7S53WLPI.js";
-import "./chunk-MACELCXG.js";
+} from "./chunk-GLA5YCQS.js";
+import "./chunk-EKXCF3FH.js";
+import "./chunk-CIGHXFPD.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-event-slices.js

@@ -1,9 +1,9 @@
 import {
   listSessionEventSlices,
   readSessionMessageSliceInScope
-} from "./chunk-NLSG7GGA.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-KJVOBLFC.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-mcp-credential-rotation.js

@@ -1,23 +1,23 @@
 import {
   connectionMetadataMatchesBinding
-} from "./chunk-7POTLB24.js";
+} from "./chunk-M2YGXCCQ.js";
 import {
   lockSessionEventWriteRows,
   organizationApiKeyAllowsWorkspace
-} from "./chunk-7S53WLPI.js";
-import "./chunk-MACELCXG.js";
+} from "./chunk-EKXCF3FH.js";
+import "./chunk-CIGHXFPD.js";
 import "./chunk-4UJCXBR2.js";
 import {
   rawRows,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-56MYWKQV.js";
+} from "./chunk-SKYRM7R7.js";
 import {
   apiKeys,
   sessionCommandReceipts,
   sessionMcpServers,
   sessions
-} from "./chunk-LDTQGYD2.js";
+} from "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/session-tenancy.d.ts

@@ -6,6 +6,12 @@ export declare class SessionTenancyConflictError extends Error {
     readonly name = "SessionTenancyConflictError";
     constructor(reason: "not_quiescent" | "authority_epoch" | "operation_reuse", blocker?: SessionTenancyBlocker | null, options?: ErrorOptions);
 }
+/**
+ * The organization's owner/admin Only-me setting does not permit a new private
+ * session (or private transition) in this shared workspace. Activation itself is
+ * universal since migration 0611; the name and the SESSION_TENANCY_NOT_ACTIVATED
+ * wire code are kept for client compatibility.
+ */
 export declare class SessionTenancyNotActivatedError extends Error {
     readonly name = "SessionTenancyNotActivatedError";
     constructor(options?: ErrorOptions);
@@ -83,7 +89,6 @@ export type ForkSessionContentResult = {
     runtimeEventId: string | null;
     runtimeEventSequence: number | null;
 };
-export declare function sessionTenancyProductActivated(db: Database, workspaceId: string): Promise<boolean>;
 export declare function getPrivateSessionCreatePolicy(db: Database, input: {
     workspaceId: string;
     actorSubjectId: string;

package/dist/session-tenancy.js

@@ -12,11 +12,10 @@ import {
   openPrivateChildSessionCreateCapability,
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
-  sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-UEQQ2WWU.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-Z5HJXH3X.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -33,7 +32,6 @@ export {
   openPrivateChildSessionCreateCapability,
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
-  sessionTenancyProductActivated,
   transitionSessionVisibility
 };
 //# sourceMappingURL=session-tenancy.js.map

package/dist/video-generation.js

@@ -29,10 +29,10 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-MACELCXG.js";
+} from "./chunk-CIGHXFPD.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/workspace-tool-defaults.js

@@ -1,12 +1,12 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-7S53WLPI.js";
-import "./chunk-MACELCXG.js";
+} from "./chunk-EKXCF3FH.js";
+import "./chunk-CIGHXFPD.js";
 import "./chunk-4UJCXBR2.js";
 import {
   withWorkspaceRls
-} from "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/drizzle/0610_artifact_catalog_pins.sql

@@ -0,0 +1,165 @@
+-- deployment-mode: rolling
+-- Shared discovery metadata only. Existing content and authorization domains
+-- remain canonical; older binaries keep their original publication capability.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE TABLE opengeni_private.artifact_catalog_pins (
+  account_id uuid NOT NULL,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  kind text NOT NULL CHECK (kind IN ('site','document','spreadsheet','presentation','image','file')),
+  artifact_id text NOT NULL CHECK (length(artifact_id) BETWEEN 1 AND 128),
+  pinned_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (account_id, workspace_id, kind, artifact_id)
+);
+ALTER TABLE opengeni_private.artifact_catalog_pins ENABLE ROW LEVEL SECURITY;
+ALTER TABLE opengeni_private.artifact_catalog_pins FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON opengeni_private.artifact_catalog_pins
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+CREATE FUNCTION opengeni_private.update_artifact_pin(
+  p_account uuid, p_workspace uuid, p_kind text, p_id text, p_pinned boolean
+) RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $body$
+DECLARE v_visible boolean := false;
+BEGIN
+  IF p_account IS NULL OR p_workspace IS NULL OR p_kind IS NULL OR p_id IS NULL OR p_pinned IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR p_kind NOT IN ('site','document','spreadsheet','presentation','image','file')
+    OR length(p_id) NOT BETWEEN 1 AND 128
+  THEN RAISE EXCEPTION 'artifact pin scope mismatch' USING ERRCODE = '42501'; END IF;
+  -- Serialize opposite writes even before the first row exists.
+  PERFORM pg_advisory_xact_lock(hashtextextended('artifact-pin:' || p_account || ':' || p_workspace || ':' || p_kind || ':' || p_id, 0));
+  IF p_kind = 'site' THEN
+    SELECT EXISTS (SELECT 1 FROM workspace_artifacts a WHERE a.account_id=p_account
+      AND a.workspace_id=p_workspace AND a.id::text=p_id) INTO v_visible;
+  ELSIF p_kind IN ('document','spreadsheet','presentation') THEN
+    SELECT EXISTS (SELECT 1 FROM editable_artifacts a WHERE a.account_id=p_account
+      AND a.workspace_id=p_workspace AND a.id=p_id AND a.modality=p_kind) INTO v_visible;
+  ELSE
+    SELECT EXISTS (SELECT 1 FROM files f WHERE f.account_id=p_account AND f.workspace_id=p_workspace
+      AND f.id::text=p_id AND f.status='ready'
+      AND (f.private_owner_subject_ids IS NULL OR nullif(current_setting('opengeni.private_file_owner',true),'')=ANY(f.private_owner_subject_ids))
+      AND ((p_kind='image' AND EXISTS (SELECT 1 FROM generated_image_artifacts g
+        WHERE g.account_id=p_account AND g.workspace_id=p_workspace AND g.artifact_id=f.id AND g.status='ready'))
+        OR (EXISTS (SELECT 1 FROM opengeni_private.sandbox_file_publications p
+          WHERE p.account_id=p_account AND p.workspace_id=p_workspace AND p.file_id=f.id)
+          AND p_kind=CASE WHEN f.content_type IN ('image/png','image/jpeg','image/gif','image/webp','image/avif','image/svg+xml')
+            THEN 'image' ELSE 'file' END))) INTO v_visible;
+  END IF;
+  -- Also validate unpin: no probe or write for missing, foreign or hidden targets.
+  IF NOT v_visible THEN RAISE EXCEPTION 'artifact pin target unavailable' USING ERRCODE = '42501'; END IF;
+  IF p_pinned THEN
+    INSERT INTO opengeni_private.artifact_catalog_pins(account_id,workspace_id,kind,artifact_id)
+      VALUES(p_account,p_workspace,p_kind,p_id) ON CONFLICT DO NOTHING;
+  ELSE
+    DELETE FROM opengeni_private.artifact_catalog_pins p WHERE p.account_id=p_account
+      AND p.workspace_id=p_workspace AND p.kind=p_kind AND p.artifact_id=p_id;
+  END IF;
+END $body$;
+
+CREATE FUNCTION opengeni_private.list_artifact_pins(p_account uuid, p_workspace uuid)
+RETURNS TABLE(kind text, artifact_id text)
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $body$
+BEGIN
+  IF p_account IS NULL OR p_workspace IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace IS DISTINCT FROM opengeni_private.current_workspace_id()
+  THEN RAISE EXCEPTION 'artifact pin scope mismatch' USING ERRCODE = '42501'; END IF;
+  -- Only joined to independently authorized candidates. Private files remain
+  -- hidden even when the migration owner is a superuser rather than FORCE-RLS-bound.
+  RETURN QUERY SELECT p.kind,p.artifact_id FROM opengeni_private.artifact_catalog_pins p
+    WHERE p.account_id=p_account AND p.workspace_id=p_workspace
+      AND (p.kind NOT IN ('file','image') OR EXISTS (SELECT 1 FROM files f
+        WHERE f.account_id=p_account AND f.workspace_id=p_workspace AND f.id::text=p.artifact_id AND f.status='ready'
+          AND (f.private_owner_subject_ids IS NULL OR nullif(current_setting('opengeni.private_file_owner',true),'')=ANY(f.private_owner_subject_ids))));
+END $body$;
+
+-- A page-local re-sort is incorrect: this bounded branch must apply the same
+-- leading pin key and frontier as the complete union before taking its LIMIT.
+CREATE FUNCTION opengeni_private.list_sandbox_file_publications_pinned(
+  p_account uuid, p_workspace uuid, p_query jsonb
+) RETURNS TABLE(file_id uuid, title text, kind text, source_session_id uuid, published_at timestamptz, pinned boolean)
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $body$
+DECLARE
+  v_limit integer := (p_query->>'limit')::integer;
+  v_sort text := p_query->>'sort';
+  v_after text := p_query#>>'{after,key}';
+  v_after_pinned boolean := coalesce((p_query#>>'{after,pinned}')::boolean,false);
+BEGIN
+  IF p_account IS NULL OR p_workspace IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR v_limit IS NULL OR v_limit NOT BETWEEN 1 AND 201
+    OR v_sort IS NULL OR v_sort NOT IN ('updated','newest','title')
+    OR jsonb_typeof(p_query) IS DISTINCT FROM 'object'
+    OR jsonb_typeof(p_query->'kinds') IS DISTINCT FROM 'array'
+    OR jsonb_array_length(p_query->'kinds') NOT BETWEEN 1 AND 2
+    OR length(coalesce(p_query->>'q',''))>200
+  THEN RAISE EXCEPTION 'publication list scope mismatch' USING ERRCODE = '42501'; END IF;
+  RETURN QUERY WITH candidates AS (
+    SELECT p.file_id, f.filename AS title,
+      CASE WHEN f.content_type IN ('image/png','image/jpeg','image/gif','image/webp','image/avif','image/svg+xml')
+        THEN 'image' ELSE 'file' END AS kind,
+      p.source_session_id, p.published_at,
+      CASE WHEN v_sort='title' THEN lower(f.filename)
+        ELSE to_char(p.published_at AT TIME ZONE 'UTC','YYYY-MM-DD"T"HH24:MI:SS.US') END AS sort_key
+    FROM opengeni_private.sandbox_file_publications p JOIN files f
+      ON f.account_id=p.account_id AND f.workspace_id=p.workspace_id AND f.id=p.file_id
+    WHERE p.account_id=p_account AND p.workspace_id=p_workspace AND f.status='ready'
+      AND (f.private_owner_subject_ids IS NULL OR nullif(current_setting('opengeni.private_file_owner',true),'')=ANY(f.private_owner_subject_ids))
+      AND (p_query->>'sourceSessionId' IS NULL OR p.source_session_id=(p_query->>'sourceSessionId')::uuid)
+      AND p.published_at<=(p_query->>'snapshotAt')::timestamptz
+      AND strpos(lower(f.filename),lower(coalesce(p_query->>'q','')))>0
+  ), ordered AS (
+    SELECT c.*, (pins.artifact_id IS NOT NULL) AS pinned FROM candidates c
+      LEFT JOIN opengeni_private.list_artifact_pins(p_account,p_workspace) pins
+        ON pins.kind=c.kind AND pins.artifact_id=c.file_id::text
+  ) SELECT c.file_id,c.title,c.kind,c.source_session_id,c.published_at,c.pinned FROM ordered c
+    WHERE (p_query->'kinds') ? c.kind AND (v_after IS NULL OR c.pinned<v_after_pinned OR
+      (c.pinned=v_after_pinned AND (
+        (v_sort='title' AND c.sort_key COLLATE "C">v_after COLLATE "C") OR
+        (v_sort<>'title' AND c.sort_key COLLATE "C"<v_after COLLATE "C") OR
+        (c.sort_key=v_after AND (c.kind COLLATE "C",c.file_id::text COLLATE "C")>
+          ((p_query#>>'{after,kind}') COLLATE "C",(p_query#>>'{after,id}') COLLATE "C")))))
+    ORDER BY c.pinned DESC, CASE WHEN v_sort='title' THEN c.sort_key END COLLATE "C" ASC,
+      CASE WHEN v_sort<>'title' THEN c.sort_key END COLLATE "C" DESC,c.kind COLLATE "C",c.file_id::text COLLATE "C"
+    LIMIT v_limit;
+END $body$;
+REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.update_artifact_pin(uuid,uuid,text,text,boolean),
+  opengeni_private.list_artifact_pins(uuid,uuid),
+  opengeni_private.list_sandbox_file_publications_pinned(uuid,uuid,jsonb) FROM PUBLIC;
+
+DO $grants$
+DECLARE target_schema text := current_schema(); recipient record; routine text;
+BEGIN
+  FOREACH routine IN ARRAY ARRAY['update_artifact_pin(uuid,uuid,text,text,boolean)',
+    'list_artifact_pins(uuid,uuid)','list_sandbox_file_publications_pinned(uuid,uuid,jsonb)']
+  LOOP
+    EXECUTE format('ALTER FUNCTION opengeni_private.%s SET search_path = pg_catalog, %I, pg_temp', routine, target_schema);
+    -- Strip inherited default function ACLs, then grant only existing runtimes.
+    FOR recipient IN SELECT DISTINCT acl.grantee,r.rolname FROM pg_proc p
+      CROSS JOIN LATERAL aclexplode(p.proacl) acl LEFT JOIN pg_roles r ON r.oid=acl.grantee
+      WHERE p.oid=to_regprocedure('opengeni_private.' || routine) AND acl.grantee<>p.proowner
+    LOOP
+      EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.%s FROM %s', routine,
+        CASE WHEN recipient.grantee=0 THEN 'PUBLIC' ELSE quote_ident(recipient.rolname) END);
+    END LOOP;
+  END LOOP;
+  FOR recipient IN SELECT DISTINCT acl.grantee,r.rolname FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace
+    CROSS JOIN LATERAL aclexplode(c.relacl) acl LEFT JOIN pg_roles r ON r.oid=acl.grantee
+    WHERE n.nspname='opengeni_private' AND c.relname='artifact_catalog_pins' AND acl.grantee<>c.relowner
+  LOOP
+    EXECUTE format('REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM %s',
+      CASE WHEN recipient.grantee=0 THEN 'PUBLIC' ELSE quote_ident(recipient.rolname) END);
+  END LOOP;
+  FOR recipient IN SELECT DISTINCT r.rolname FROM pg_proc p
+    CROSS JOIN LATERAL aclexplode(p.proacl) acl JOIN pg_roles r ON r.oid=acl.grantee
+    WHERE p.oid=to_regprocedure('opengeni_private.record_sandbox_file_publication(uuid,uuid,uuid,uuid)')
+      AND acl.privilege_type='EXECUTE' AND acl.grantee<>p.proowner
+  LOOP
+    EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.update_artifact_pin(uuid,uuid,text,text,boolean), opengeni_private.list_artifact_pins(uuid,uuid), opengeni_private.list_sandbox_file_publications_pinned(uuid,uuid,jsonb) TO %I', recipient.rolname);
+  END LOOP;
+END $grants$;