@opengeni/db 1.0.2 → 1.2.0

package/src/managed-user-setup.ts

@@ -84,6 +84,7 @@ export async function completeSelfServiceOrganizationSetup(
     operationId: string;
     requestFingerprint: string;
     trialCreditsEnabled?: boolean;
+    trialCreditModelIds?: string[] | undefined;
   },
 ): Promise<CompleteSelfServiceOrganizationSetupResponseType> {
   return await db.transaction(async (tx) => {
@@ -99,6 +100,13 @@ export async function completeSelfServiceOrganizationSetup(
       ${input.trialCreditsEnabled === true ? "on" : "off"}, true
     )`,
     );
+    await rawRows(
+      txDb,
+      sql`select pg_catalog.set_config(
+      'opengeni.signup_credit_model_ids',
+      ${input.trialCreditModelIds ? JSON.stringify(input.trialCreditModelIds) : ""}, true
+    )`,
+    );
     const [row] = await rawRows<{ result: unknown }>(
       txDb,
       sql`select complete_self_service_organization_setup(

package/src/organization-membership-lifecycle.ts

@@ -60,6 +60,7 @@ export async function createManagedOrganization(
     name: string;
     operationId: string;
     trialCreditsEnabled?: boolean;
+    trialCreditModelIds?: string[] | undefined;
   },
 ): Promise<CreateOrganizationResponseType> {
   return await db.transaction(async (tx) => {
@@ -74,6 +75,13 @@ export async function createManagedOrganization(
       ${input.trialCreditsEnabled === true ? "on" : "off"}, true
     )`,
     );
+    await rawRows(
+      tx,
+      sql`select pg_catalog.set_config(
+      'opengeni.signup_credit_model_ids',
+      ${input.trialCreditModelIds ? JSON.stringify(input.trialCreditModelIds) : ""}, true
+    )`,
+    );
     const [row] = await rawRows<{ result: unknown }>(
       tx,
       sql`select create_managed_organization(

package/src/persistence-errors.ts

@@ -213,12 +213,23 @@ export function safeDatabaseErrorFacts(error: unknown): SafeDatabaseErrorFacts {
   return facts;
 }
 
-/**
- * Typed persistence classification that retains the exact original failure as
- * `cause` for internal diagnostics. The ordinary Error message is deliberately
- * stable and source-free so a generic presentation path can never disclose SQL,
- * parameters, or driver detail by rendering `.message`.
- */
+/** Own-driver transaction boundary; callback errors never establish provenance. */
+export class DatabaseTransactionError extends Error {
+  readonly name = "DatabaseTransactionError";
+
+  constructor(
+    readonly stage: "admission" | "settlement",
+    cause: unknown,
+    // A rollback failure must not erase a callback's no-replay/permanent
+    // evidence. The recovery classifier inspects both branches for vetoes.
+    readonly original?: unknown,
+  ) {
+    super(`Database transaction ${stage} failed`, { cause });
+  }
+}
+
+/** Typed persistence classification retaining the original cause internally.
+ * Its ordinary message is stable and contains no SQL or driver parameters. */
 export class SessionEventPersistenceError extends Error {
   readonly name = "SessionEventPersistenceError";
 

package/src/provision-roles.ts

@@ -1629,6 +1629,10 @@ BEGIN
     END IF;
     -- The trial-credit kill switch setter is operator-only (migration owner).
     -- Reprovisioning repairs any accidental runtime or PUBLIC grant.
+    IF to_regprocedure(format('%I.set_credit_promotion_policy(jsonb,text,text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.set_credit_promotion_policy(jsonb,text,text) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.set_credit_promotion_policy(jsonb,text,text) FROM %I', ${literal(schema)}, ${literal(role)});
+    END IF;
     IF to_regprocedure(
       format('%I.set_verified_signup_trial_credits_enabled(boolean,text,text)', ${literal(schema)})
     ) IS NOT NULL THEN
@@ -2110,6 +2114,11 @@ BEGIN
       REVOKE ALL (singleton, consent_enabled, release_evidence) ON TABLE opengeni_private.sandbox_recovery_rollout FROM PUBLIC;
       EXECUTE format('GRANT SELECT ON TABLE opengeni_private.sandbox_recovery_rollout TO %I', ${literal(role)});
     END IF;
+    IF to_regclass('opengeni_private.credit_promotion_policy_revisions') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.credit_promotion_policy_revisions FROM %I', ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.credit_promotion_policy_revisions FROM PUBLIC;
+      EXECUTE format('GRANT SELECT ON TABLE opengeni_private.credit_promotion_policy_revisions TO %I', ${literal(role)});
+    END IF;
     IF to_regclass('opengeni_private.verified_signup_trial_switch_revisions') IS NOT NULL THEN
       -- Read-only for the operator gauge. Only the owner-only audited setter
       -- appends revisions; runtime identities and PUBLIC never write them.
@@ -2163,6 +2172,22 @@ BEGIN
       REVOKE ALL ON FUNCTION opengeni_private.record_sandbox_file_publication(uuid,uuid,uuid,uuid) FROM PUBLIC;
       REVOKE ALL ON FUNCTION opengeni_private.list_sandbox_file_publications(uuid,uuid,jsonb) FROM PUBLIC;
     END IF;
+    IF to_regclass('opengeni_private.artifact_catalog_pins') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM %I', ${literal(role)});
+      -- Table revocation does not remove column ACLs. Reconcile every current
+      -- column for both the runtime and PUBLIC, including future additions.
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.artifact_catalog_pins FROM %I',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.artifact_catalog_pins'::regclass AND attnum>0 AND NOT attisdropped),
+        ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC;
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.artifact_catalog_pins'::regclass AND attnum>0 AND NOT attisdropped));
+      REVOKE ALL ON FUNCTION opengeni_private.update_artifact_pin(uuid,uuid,text,text,boolean),
+        opengeni_private.list_artifact_pins(uuid,uuid),
+        opengeni_private.list_sandbox_file_publications_pinned(uuid,uuid,jsonb) FROM PUBLIC;
+    END IF;
     IF to_regclass('opengeni_private.slack_file_upload_operations') IS NOT NULL THEN
       -- Ordinary RLS repositories own the upload CAS, not owner capabilities.
       -- Never allow deletion/truncation to erase its durable completion fence.

package/src/runtime-posture-cli.ts

@@ -25,8 +25,6 @@ try {
     rlsStrategy: settings.rlsStrategy,
     expectedRole: settings.runtimeDatabaseRole,
     targetSchema: settings.dbSchema.trim() || "public",
-    organizationTenancyCanonicalActivationEnabled:
-      settings.organizationTenancyCanonicalActivationEnabled,
   });
   // Structural evidence only: never print a connection string, secret, GUC, or
   // tenant row. The command is intended for release Jobs and audit artifacts.

package/src/runtime-posture.ts

@@ -80,6 +80,12 @@ export const SANDBOX_FILE_PUBLICATION_RUNTIME_ROUTINES = [
   "list_sandbox_file_publications(uuid, uuid, jsonb)",
 ] as const;
 const SANDBOX_FILE_PUBLICATIONS_TABLE = "sandbox_file_publications";
+export const ARTIFACT_PIN_RUNTIME_ROUTINES = [
+  "update_artifact_pin(uuid, uuid, text, text, boolean)",
+  "list_artifact_pins(uuid, uuid)",
+  "list_sandbox_file_publications_pinned(uuid, uuid, jsonb)",
+] as const;
+const ARTIFACT_PINS_TABLE = "artifact_catalog_pins";
 export const SCHEDULED_SLACK_BOT_MESSAGE_RUNTIME_ROUTINES = [
   "prepare_scheduled_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, text, text, text)",
   "read_scheduled_slack_bot_message(uuid, uuid, uuid, uuid)",
@@ -788,11 +794,13 @@ export const RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
   SESSION_TENANCY_QUIESCENCE_ROUTINE,
   TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE,
   VERIFIED_SIGNUP_TRIAL_SWITCH_SETTER_ROUTINE,
+  "set_credit_promotion_policy(jsonb, text, text)",
   MANAGED_AUTH_NEW_SIGNUPS_SWITCH_SETTER_ROUTINE,
   ...DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES,
 ] as const;
 
 export const RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
+  "set_credit_promotion_policy(jsonb, text, text)",
   CLAUDE_SNAPSHOT_VALIDATOR_ROUTINE,
   "usage_allowance_period(jsonb, timestamp with time zone)",
   "validate_usage_allowance_config(jsonb)",
@@ -888,6 +896,7 @@ export const FORCE_RLS_TABLES = [
   "connections",
   "connector_action_policies",
   "connector_action_requests",
+  "credit_debit_allocations",
   "credit_ledger_entries",
   "device_enrollment_requests",
   "document_authority_reclassifications",
@@ -1470,6 +1479,7 @@ export const RUNTIME_READ_INSERT_TABLES = [
   "browser_revision_components",
   "browser_revisions",
   "company_profile_revisions",
+  "credit_debit_allocations",
   "editable_artifact_blob_refs",
   "editable_artifact_idempotency_receipts",
   "editable_artifact_live_outbox",
@@ -1732,7 +1742,6 @@ export type RuntimeDatabasePostureOptions = {
   targetSchemaForbiddenRoutines?: readonly string[];
   /** Frozen binary contract; current callers require both additive Insights capabilities. */
   modelFactCapabilityRoutines?: readonly string[];
-  organizationTenancyCanonicalActivationEnabled?: boolean;
 };
 
 export type RuntimeDatabaseIdentity = {
@@ -1803,6 +1812,8 @@ export type RuntimePrivateTablePosture = {
   truncate?: boolean;
   references?: boolean;
   trigger?: boolean;
+  /** Effective relation ACL privileges not represented by the named flags. */
+  extraPrivileges?: string[];
 };
 
 export type RuntimeDatabasePosture = {
@@ -1816,7 +1827,6 @@ export type RuntimeDatabasePosture = {
   privateTables: RuntimePrivateTablePosture[];
   targetRoutines: RuntimeTargetRoutinePosture[];
   privateRoutines: RuntimeRoutinePosture[];
-  sessionTenancyProductActivationPresent: boolean;
   sessionVariableSetAttachmentsCutoverPresent: boolean;
   claudeSubscriptionPoolActivationPresent: boolean;
 };
@@ -1942,14 +1952,6 @@ export async function inspectRuntimeDatabasePosture(
         bypassRls: identity.rolbypassrls,
       };
 
-      // The forward-only activation receipt outlives topology. Embedded/scoped
-      // deployments must enforce the same environment interlock as standalone
-      // FORCE-RLS deployments, so inspect the value-free predicate before the
-      // scoped catalog fast-path.
-      const activationRows = resultRows<{ activated: boolean }>(
-        await tx.execute(sql`select session_tenancy_any_product_activation() as activated`),
-      );
-      const sessionTenancyProductActivationPresent = activationRows[0]?.activated === true;
       const variableSetCutoverRows = resultRows<{ present: boolean }>(
         await tx.execute(sql`
           select to_regprocedure(
@@ -1980,7 +1982,6 @@ export async function inspectRuntimeDatabasePosture(
           privateTables: [],
           targetRoutines: [],
           privateRoutines: [],
-          sessionTenancyProductActivationPresent,
           sessionVariableSetAttachmentsCutoverPresent,
           claudeSubscriptionPoolActivationPresent,
         };
@@ -2115,6 +2116,7 @@ export async function inspectRuntimeDatabasePosture(
         can_truncate: boolean;
         can_references: boolean;
         can_trigger: boolean;
+        extra_privileges: string[];
       }>(
         await tx.execute(sql`
           select
@@ -2124,25 +2126,31 @@ export async function inspectRuntimeDatabasePosture(
             c.relforcerowsecurity as rls_forced,
             row_security_active(c.oid) as rls_active,
             (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,
-            -- Column-only grants on the inventory stamp are also unsafe; in
-            -- particular INSERT can mint authority without a table grant.
+            -- Column-only grants on capability tables are also unsafe; a pin
+            -- table must remain EXECUTE-only even after column ACL drift.
             (has_table_privilege(current_user, c.oid, 'SELECT') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches') or
+              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'SELECT'))) as can_select,
             (has_table_privilege(current_user, c.oid, 'INSERT') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches') or
+              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'INSERT'))) as can_insert,
             (has_table_privilege(current_user, c.oid, 'UPDATE') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches') or
+              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'UPDATE'))) as can_update,
             has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,
             has_table_privilege(current_user, c.oid, 'TRUNCATE') as can_truncate,
             (has_table_privilege(current_user, c.oid, 'REFERENCES') or
               has_any_column_privilege(current_user, c.oid, 'REFERENCES')) as can_references,
-            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger
+            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger,
+            CASE WHEN c.relname = ${ARTIFACT_PINS_TABLE} THEN ARRAY(
+              SELECT DISTINCT acl.privilege_type FROM aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) acl
+              WHERE acl.privilege_type NOT IN ('SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER')
+                AND CASE WHEN acl.grantee = 0 THEN true ELSE pg_has_role(current_user, acl.grantee, 'USAGE') END
+              ORDER BY acl.privilege_type
+            ) ELSE ARRAY[]::text[] END AS extra_privileges
           from pg_class c
           join pg_namespace n on n.oid = c.relnamespace
           where n.nspname = 'opengeni_private'
@@ -2156,6 +2164,7 @@ export async function inspectRuntimeDatabasePosture(
               ${SCOPED_COMPUTE_CAPABILITY_TABLE},
               ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE},
               ${SANDBOX_FILE_PUBLICATIONS_TABLE},
+              ${ARTIFACT_PINS_TABLE},
               ${SCHEDULED_SLACK_BOT_MESSAGES_TABLE},
               ${ORGANIZATION_SIGNUP_USE_CASES_TABLE},
               ${SLACK_FILE_UPLOAD_OPERATIONS_TABLE},
@@ -2176,6 +2185,7 @@ export async function inspectRuntimeDatabasePosture(
               'modal_inventory_read_capabilities',
               ${AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE},
               ${VERIFIED_SIGNUP_TRIAL_SWITCH_TABLE},
+              'credit_promotion_policy_revisions',
               ${MANAGED_AUTH_NEW_SIGNUPS_SWITCH_TABLE}
             )
         `),
@@ -2193,6 +2203,7 @@ export async function inspectRuntimeDatabasePosture(
         truncate: row.can_truncate,
         references: row.can_references,
         trigger: row.can_trigger,
+        ...(row.extra_privileges?.length ? { extraPrivileges: row.extra_privileges } : {}),
       }));
 
       const targetRoutines = resultRows<{
@@ -2284,7 +2295,6 @@ export async function inspectRuntimeDatabasePosture(
         privateTables,
         targetRoutines,
         privateRoutines,
-        sessionTenancyProductActivationPresent,
         sessionVariableSetAttachmentsCutoverPresent,
         claudeSubscriptionPoolActivationPresent,
       };
@@ -2321,15 +2331,6 @@ export function evaluateRuntimeDatabasePosture(
     violations.push("database is missing the 0352 session Variable Set attachment runtime receipt");
   }
 
-  if (
-    posture.sessionTenancyProductActivationPresent &&
-    options.organizationTenancyCanonicalActivationEnabled !== true
-  ) {
-    violations.push(
-      "session-tenancy product activation is durable but OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED is not true",
-    );
-  }
-
   if (!identity.currentUser || !identity.sessionUser) {
     violations.push("database identity is empty");
   }
@@ -3756,6 +3757,23 @@ export function evaluateRuntimeDatabasePosture(
 
   // The trial-credit kill switch is operator state. Runtime roles may read it
   // for the gauge (SELECT is optional) but must never append or rewrite it.
+  const creditPolicyTable = posture.privateTables.find(
+    (table) => table.name === "credit_promotion_policy_revisions",
+  );
+  if (!creditPolicyTable) {
+    violations.push("credit promotion policy table is missing");
+  } else if (!creditPolicyTable.select) {
+    violations.push("runtime role cannot read the credit promotion policy");
+  }
+  if (
+    creditPolicyTable &&
+    (creditPolicyTable.owner === expectedRole ||
+      creditPolicyTable.insert ||
+      creditPolicyTable.update ||
+      creditPolicyTable.delete)
+  ) {
+    violations.push("runtime role has forbidden write authority on the credit promotion policy");
+  }
   const trialSwitchTable = posture.privateTables.find(
     (table) => table.name === VERIFIED_SIGNUP_TRIAL_SWITCH_TABLE,
   );
@@ -3886,6 +3904,47 @@ export function evaluateRuntimeDatabasePosture(
     }
   }
 
+  const pinTables = posture.privateTables.filter((table) => table.name === ARTIFACT_PINS_TABLE);
+  if (pinTables.length !== 1) {
+    if (!options.protectedTables)
+      violations.push("artifact pin private relation is missing or ambiguous");
+  } else {
+    const table = pinTables[0]!;
+    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1)
+      violations.push("artifact pin relation lacks active FORCE-RLS workspace isolation");
+    if (
+      table.select ||
+      table.insert ||
+      table.update ||
+      table.delete ||
+      table.truncate ||
+      table.references ||
+      table.trigger ||
+      table.extraPrivileges?.length ||
+      table.owner === expectedRole
+    )
+      violations.push("runtime role has forbidden direct artifact pin authority");
+    if (tableByName.get("files")?.owner && table.owner !== tableByName.get("files")!.owner)
+      violations.push("artifact pin owner does not match workspace authority");
+    const quotedSchema = `"${targetSchema.replaceAll('"', '""')}"`;
+    const searchPaths = new Set([
+      `search_path=pg_catalog, ${quotedSchema}, pg_temp`,
+      `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedSchema}, pg_temp`,
+    ]);
+    for (const name of ARTIFACT_PIN_RUNTIME_ROUTINES) {
+      const routines = posture.privateRoutines.filter((routine) => routine.name === name);
+      if (
+        routines.length !== 1 ||
+        !routines[0]!.execute ||
+        routines[0]!.publicExecute ||
+        !routines[0]!.securityDefiner ||
+        routines[0]!.owner !== table.owner ||
+        !routines[0]!.configuration?.some((configuration) => searchPaths.has(configuration))
+      )
+        violations.push(`artifact pin capability ${name} is missing or unsafe`);
+    }
+  }
+
   const slackFileUploadTables = posture.privateTables.filter(
     (table) => table.name === SLACK_FILE_UPLOAD_OPERATIONS_TABLE,
   );

package/src/schema.ts

@@ -5870,6 +5870,23 @@ export const sandboxFilePublications = opengeniPrivateSchema.table(
   }),
 );
 
+/** Shared discovery pins; no content or access authority. SQL owns target validation. */
+export const artifactCatalogPins = opengeniPrivateSchema.table(
+  "artifact_catalog_pins",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    kind: text("kind").notNull(),
+    artifactId: text("artifact_id").notNull(),
+    pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({ columns: [table.accountId, table.workspaceId, table.kind, table.artifactId] }),
+  }),
+);
+
 /** Source-session upload fence; never stores file bytes or expiring upload URLs. */
 export const slackFileUploadOperations = opengeniPrivateSchema.table(
   "slack_file_upload_operations",
@@ -9663,7 +9680,7 @@ export const sandboxLeases = pgTable(
     // Why an enrolled drain contains its commands (0547); cleared with the
     // enrollment. Null for a pre-0547 enrollment: settle with neutral wording.
     commandContainmentReason: text("command_containment_reason", {
-      enum: ["idle_containment", "provider_deadline_containment"],
+      enum: ["idle_containment", "provider_deadline_containment", "quiescence_containment"],
     }),
     liveness: text("liveness", { enum: sandboxLeaseLivenessValues }).notNull().default("cold"),
     refcount: integer("refcount").notNull().default(0),
@@ -12611,6 +12628,8 @@ export const creditLedgerEntries = pgTable(
     }),
     type: text("type").notNull(),
     amountMicros: bigint("amount_micros", { mode: "number" }).notNull(),
+    /** Null preserves the unrestricted terms of legacy credits. */
+    eligibleModelIds: text("eligible_model_ids").array(),
     currency: text("currency").notNull().default("usd"),
     sourceType: text("source_type"),
     sourceId: text("source_id"),
@@ -12621,6 +12640,19 @@ export const creditLedgerEntries = pgTable(
   },
   (table) => ({
     idempotency: uniqueIndex("credit_ledger_entries_idempotency_idx").on(table.idempotencyKey),
+    idAccount: uniqueIndex("credit_ledger_entries_id_account_idx").on(table.id, table.accountId),
+    scopedGrants: index("credit_ledger_scoped_grants_idx")
+      .on(table.accountId, table.createdAt, table.id)
+      .where(sql`${table.eligibleModelIds} is not null`),
+    scopeValid: check(
+      "credit_ledger_scope_valid",
+      sql`${table.eligibleModelIds} is null or (
+      ${table.type} = 'grant' and ${table.amountMicros} > 0
+      and cardinality(${table.eligibleModelIds}) between 1 and 40
+      and array_position(${table.eligibleModelIds}, null) is null
+      and array_position(${table.eligibleModelIds}, '') is null
+    )`,
+    ),
     modelDebitPeriod: index("credit_ledger_entries_model_debit_period_idx")
       .on(table.accountId, table.occurredAt, table.workspaceId)
       .where(
@@ -12633,6 +12665,30 @@ export const creditLedgerEntries = pgTable(
   }),
 );
 
+/** One debit can consume several grants; the remainder is paid by general credits. */
+export const creditDebitAllocations = pgTable(
+  "credit_debit_allocations",
+  {
+    accountId: uuid("account_id").notNull(),
+    debitEntryId: uuid("debit_entry_id").notNull(),
+    grantEntryId: uuid("grant_entry_id").notNull(),
+    amountMicros: bigint("amount_micros", { mode: "number" }).notNull(),
+  },
+  (table) => ({
+    pk: primaryKey({ columns: [table.debitEntryId, table.grantEntryId] }),
+    debit: foreignKey({
+      columns: [table.debitEntryId, table.accountId],
+      foreignColumns: [creditLedgerEntries.id, creditLedgerEntries.accountId],
+    }).onDelete("cascade"),
+    grant: foreignKey({
+      columns: [table.grantEntryId, table.accountId],
+      foreignColumns: [creditLedgerEntries.id, creditLedgerEntries.accountId],
+    }).onDelete("cascade"),
+    grantIndex: index("credit_debit_allocations_grant_idx").on(table.accountId, table.grantEntryId),
+    positive: check("credit_debit_allocations_positive", sql`${table.amountMicros} > 0`),
+  }),
+);
+
 /** Content-free immutable accepted billing facts; no runtime table privileges. */
 export const usageAllowanceAttributionReceipts = opengeniPrivateSchema.table(
   "usage_allowance_attribution_receipts",

package/src/session-tenancy.ts

@@ -8,12 +8,13 @@ import {
   rawRows,
   type Database,
   rlsContextForWorkspace,
-  withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
 } from "./database";
 import { nestedPostgresSqlState } from "./persistence-errors";
 
+// Frozen SQL protocol argument: every organization is activated at version 1
+// since migration 0611, but the lifecycle routines still require it explicitly.
 const SESSION_TENANCY_ACTIVATION_VERSION = 1;
 
 export class SessionTenancyConflictError extends Error {
@@ -34,10 +35,16 @@ export class SessionTenancyConflictError extends Error {
   }
 }
 
+/**
+ * The organization's owner/admin Only-me setting does not permit a new private
+ * session (or private transition) in this shared workspace. Activation itself is
+ * universal since migration 0611; the name and the SESSION_TENANCY_NOT_ACTIVATED
+ * wire code are kept for client compatibility.
+ */
 export class SessionTenancyNotActivatedError extends Error {
   readonly name = "SessionTenancyNotActivatedError";
   constructor(options?: ErrorOptions) {
-    super("Session tenancy product surface is not activated for this organization", options);
+    super("Only-me chats are not enabled for this organization", options);
   }
 }
 
@@ -151,23 +158,6 @@ export type ForkSessionContentResult = {
   runtimeEventSequence: number | null;
 };
 
-export async function sessionTenancyProductActivated(
-  db: Database,
-  workspaceId: string,
-): Promise<boolean> {
-  const { accountId } = await rlsContextForWorkspace(db, workspaceId);
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await rawRows<{ activated: boolean }>(
-      scopedDb,
-      sql`select session_tenancy_product_activated(
-        ${accountId}::uuid,
-        ${SESSION_TENANCY_ACTIVATION_VERSION}
-      ) as activated`,
-    );
-    return rows[0]?.activated === true;
-  });
-}
-
 export async function getPrivateSessionCreatePolicy(
   db: Database,
   input: { workspaceId: string; actorSubjectId: string },
@@ -286,15 +276,6 @@ export async function closePrivateSessionCreateCapability(
   await db.execute(sql`select close_private_session_create_capability(${capabilityId}::uuid)`);
 }
 
-async function assertSessionTenancyProductActivated(
-  db: Database,
-  workspaceId: string,
-): Promise<void> {
-  if (!(await sessionTenancyProductActivated(db, workspaceId))) {
-    throw new SessionTenancyNotActivatedError();
-  }
-}
-
 function mapSessionTenancyPersistenceError(
   error: unknown,
   options: { authorityEpochConflict: boolean },
@@ -420,7 +401,6 @@ export async function transitionSessionVisibility(
   if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
   const requestHash = canonicalSessionVisibilityTransitionHash(input);
   const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
-  await assertSessionTenancyProductActivated(db, input.workspaceId);
   try {
     return await withWorkspaceSubjectSessionActivityRls(
       db,
@@ -505,7 +485,6 @@ export async function forkSessionContent(
     throw new Error("Resolved session fork runtime configuration does not match its request");
   }
   const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
-  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
   const requestHash = canonicalSessionForkHash(input);
   try {
     return await withWorkspaceSubjectRls(
@@ -616,7 +595,6 @@ export async function replayAppliedSessionFork(
     throw new Error("The first session fork contract is same-workspace only");
   }
   const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
-  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
   const requestHash = canonicalSessionForkHash(input);
   try {
     return await withWorkspaceSubjectRls(

package/src/video-generation.ts

@@ -17,6 +17,7 @@ import { rawRows, withRlsContext, withWorkspaceRls } from "./database";
 import * as schema from "./schema";
 import { checkWorkspaceAllowance } from "./usage-allowances";
 import { creditDebitAttributionForTurn } from "./credit-debit-attribution";
+import { getSpendableCreditBalance } from "./credit-balances";
 
 export const ACTIVE_VIDEO_GENERATION_STATUSES = [
   "preparing",
@@ -1381,13 +1382,7 @@ async function debitVideoGenerationCredits(
     subjectId: attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null,
   });
   if (refusal) throw Object.assign(new VideoGenerationCreditError(refusal.message), refusal);
-  const [balanceRow] = await tx
-    .select({
-      balanceMicros: sql<number>`coalesce(sum(${schema.creditLedgerEntries.amountMicros}), 0)`,
-    })
-    .from(schema.creditLedgerEntries)
-    .where(eq(schema.creditLedgerEntries.accountId, operation.accountId));
-  const balanceMicros = Number(balanceRow?.balanceMicros ?? 0);
+  const { balanceMicros } = await getSpendableCreditBalance(tx, operation.accountId);
   if (!Number.isSafeInteger(balanceMicros) || balanceMicros < operation.pricedCostMicros) {
     throw new VideoGenerationCreditError();
   }