@opengeni/db 3.2.0-canary.0 → 3.4.0-canary.0

package/src/pr-review.ts

@@ -3,6 +3,7 @@ import {
   OPENGENI_PR_REVIEW_PACK_ID,
   OPENGENI_PR_REVIEW_SESSION_ROLE,
   type PrReviewAppRegistration,
+  type GitHubRepository,
   type PrReviewProvider,
   type PrReviewRepositoryBinding,
 } from "@opengeni/contracts";
@@ -32,8 +33,11 @@ export async function createPrReviewAppRegistration(
     provider: PrReviewProvider;
     providerBaseUrl: string;
     appId: string | null;
-    credentialKind: "github_app" | "provider_token";
+    credentialKind: "github_app" | "managed_github_app" | "provider_token";
     credentialEncrypted: string | null;
+    installationId?: string | null;
+    providerAccountLogin?: string | null;
+    providerAccountType?: "User" | "Organization" | null;
     accessTokenExpiresAt: Date | null;
     webhookAuthKind: "hmac_sha256" | "shared_token" | "basic";
     webhookSecretEncrypted: string;
@@ -83,6 +87,9 @@ export async function createPrReviewAppRegistration(
           provider: input.provider,
           providerBaseUrl: input.providerBaseUrl,
           appId: input.appId,
+          installationId: input.installationId ?? null,
+          providerAccountLogin: input.providerAccountLogin ?? null,
+          providerAccountType: input.providerAccountType ?? null,
           credentialKind: input.credentialKind,
           credentialEncrypted: input.credentialEncrypted,
           accessTokenExpiresAt: input.accessTokenExpiresAt,
@@ -246,6 +253,11 @@ export async function updatePrReviewAppRegistration(
           ),
         )
         .returning();
+      if (input.status === "disabled") {
+        await tx
+          .delete(schema.prReviewManagedGithubRoutes)
+          .where(eq(schema.prReviewManagedGithubRoutes.registrationId, input.registrationId));
+      }
       return row ? mapRegistration(row, source.endpointId) : null;
     });
   });
@@ -268,6 +280,9 @@ export async function deletePrReviewAppRegistration(
         )
         .returning({ sourceId: schema.prReviewAppRegistrations.sourceId });
       if (!registration) return false;
+      await tx
+        .delete(schema.prReviewManagedGithubRoutes)
+        .where(eq(schema.prReviewManagedGithubRoutes.registrationId, input.registrationId));
       await tx
         .update(schema.automationSources)
         .set({
@@ -383,6 +398,425 @@ export async function createPrReviewRepositoryBinding(
   });
 }
 
+/** Atomically converge one owner-authorized installation of the deployment
+ * review App onto the Pack's ordinary source/trigger/binding model. Re-running
+ * the browser flow repairs disabled rows, follows GitHub repository selection,
+ * and removes shared-webhook routes for repositories no longer selected. */
+export async function syncManagedGitHubPrReviewInstallation(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    providerAccountLogin: string | null;
+    providerAccountType: "User" | "Organization";
+    githubActorId: number;
+    authorityKind: "personal_owner" | "organization_owner";
+    authorityCheckedAt: Date;
+    authorityExpiresAt: Date;
+    authorityNonce: string;
+    appId: string;
+    webhookSecretEncrypted: string;
+    repositories: GitHubRepository[];
+    createdBySubjectId: string;
+    packInstallationId: string;
+    packConnectorId: string;
+    packTemplateId: string;
+    adapterId: string;
+    eventTypes: string[];
+    configuration: Record<string, unknown>;
+    sessionTemplate: AutomationSessionTemplate;
+  },
+): Promise<{
+  registration: PrReviewAppRegistration;
+  repositories: PrReviewRepositoryBinding[];
+}> {
+  return await withRlsContext(
+    db,
+    input,
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const [packInstallation] = await tx
+          .select({ id: schema.packInstallations.id })
+          .from(schema.packInstallations)
+          .where(
+            and(
+              eq(schema.packInstallations.workspaceId, input.workspaceId),
+              eq(schema.packInstallations.id, input.packInstallationId),
+              eq(schema.packInstallations.packId, OPENGENI_PR_REVIEW_PACK_ID),
+              eq(schema.packInstallations.status, "active"),
+            ),
+          )
+          .limit(1)
+          .for("update");
+        if (!packInstallation) {
+          throw new PrReviewDispatchAuthorityError("OpenGeni Review Bot Pack is not active");
+        }
+        const installationId = String(input.installationId);
+        const [nonceReceipt] = await tx
+          .insert(schema.prReviewManagedGithubAuthorityNonces)
+          .values({
+            authorityNonce: input.authorityNonce,
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            installationId,
+            authorityExpiresAt: input.authorityExpiresAt,
+          })
+          .onConflictDoNothing()
+          .returning({
+            authorityNonce: schema.prReviewManagedGithubAuthorityNonces.authorityNonce,
+          });
+        if (!nonceReceipt) {
+          throw new PrReviewDispatchAuthorityError("OpenGeni Lens authorization was already used");
+        }
+        const [existingRegistration] = await tx
+          .select()
+          .from(schema.prReviewAppRegistrations)
+          .where(
+            and(
+              eq(schema.prReviewAppRegistrations.workspaceId, input.workspaceId),
+              eq(schema.prReviewAppRegistrations.credentialKind, "managed_github_app"),
+              eq(schema.prReviewAppRegistrations.installationId, installationId),
+            ),
+          )
+          .limit(1)
+          .for("update");
+
+        const registrationId = existingRegistration?.id ?? randomUUID();
+        const registrationName = `OpenGeni Lens · ${
+          input.providerAccountLogin ?? `installation ${installationId}`
+        } (${installationId})`;
+        let source: typeof schema.automationSources.$inferSelect;
+        let registration: typeof schema.prReviewAppRegistrations.$inferSelect;
+
+        if (existingRegistration) {
+          const nextSourceConfiguration = {
+            provider: "github",
+            providerBaseUrl: "https://github.com",
+            registrationId,
+            webhookUsername: null,
+          };
+          const [updatedSource] = await tx
+            .update(schema.automationSources)
+            .set({
+              name: `${registrationName} webhooks`,
+              adapterId: input.adapterId,
+              configuration: nextSourceConfiguration,
+              webhookSecretEncrypted: input.webhookSecretEncrypted,
+              status: "active",
+              packInstallationId: input.packInstallationId,
+              packConnectorId: input.packConnectorId,
+              version: sql`${schema.automationSources.version} + 1`,
+              updatedAt: new Date(),
+            })
+            .where(
+              and(
+                eq(schema.automationSources.workspaceId, input.workspaceId),
+                eq(schema.automationSources.id, existingRegistration.sourceId),
+              ),
+            )
+            .returning();
+          if (!updatedSource) {
+            throw new PrReviewDispatchAuthorityError(
+              "OpenGeni Lens automation source is unavailable",
+            );
+          }
+          source = updatedSource;
+          const [updatedRegistration] = await tx
+            .update(schema.prReviewAppRegistrations)
+            .set({
+              name: registrationName,
+              appId: input.appId,
+              providerAccountLogin: input.providerAccountLogin,
+              providerAccountType: input.providerAccountType,
+              githubActorId: String(input.githubActorId),
+              authorityKind: input.authorityKind,
+              authorityCheckedAt: input.authorityCheckedAt,
+              authorityExpiresAt: input.authorityExpiresAt,
+              authorityNonce: input.authorityNonce,
+              status: "active",
+              updatedAt: new Date(),
+            })
+            .where(eq(schema.prReviewAppRegistrations.id, existingRegistration.id))
+            .returning();
+          if (!updatedRegistration) throw new Error("Failed to update OpenGeni Lens registration");
+          registration = updatedRegistration;
+        } else {
+          const [createdSource] = await tx
+            .insert(schema.automationSources)
+            .values({
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              name: `${registrationName} webhooks`,
+              adapterId: input.adapterId,
+              configuration: {
+                provider: "github",
+                providerBaseUrl: "https://github.com",
+                registrationId,
+                webhookUsername: null,
+              },
+              webhookSecretEncrypted: input.webhookSecretEncrypted,
+              packInstallationId: input.packInstallationId,
+              packConnectorId: input.packConnectorId,
+              createdBySubjectId: input.createdBySubjectId,
+            })
+            .returning();
+          if (!createdSource) throw new Error("Failed to create OpenGeni Lens automation source");
+          source = createdSource;
+          const [createdRegistration] = await tx
+            .insert(schema.prReviewAppRegistrations)
+            .values({
+              id: registrationId,
+              sourceId: source.id,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              name: registrationName,
+              provider: "github",
+              providerBaseUrl: "https://github.com",
+              appId: input.appId,
+              installationId,
+              providerAccountLogin: input.providerAccountLogin,
+              providerAccountType: input.providerAccountType,
+              githubActorId: String(input.githubActorId),
+              authorityKind: input.authorityKind,
+              authorityCheckedAt: input.authorityCheckedAt,
+              authorityExpiresAt: input.authorityExpiresAt,
+              authorityNonce: input.authorityNonce,
+              credentialKind: "managed_github_app",
+              credentialEncrypted: null,
+              accessTokenExpiresAt: null,
+              webhookAuthKind: "hmac_sha256",
+              webhookUsername: null,
+              createdBySubjectId: input.createdBySubjectId,
+            })
+            .returning();
+          if (!createdRegistration) throw new Error("Failed to create OpenGeni Lens registration");
+          registration = createdRegistration;
+        }
+
+        const existingBindings = await tx
+          .select({
+            binding: schema.prReviewRepositoryBindings,
+            trigger: schema.automationTriggers,
+            revision: schema.automationTriggerRevisions,
+          })
+          .from(schema.prReviewRepositoryBindings)
+          .innerJoin(
+            schema.automationTriggers,
+            and(
+              eq(
+                schema.automationTriggers.workspaceId,
+                schema.prReviewRepositoryBindings.workspaceId,
+              ),
+              eq(schema.automationTriggers.id, schema.prReviewRepositoryBindings.triggerId),
+            ),
+          )
+          .innerJoin(
+            schema.automationTriggerRevisions,
+            and(
+              eq(schema.automationTriggerRevisions.triggerId, schema.automationTriggers.id),
+              eq(
+                schema.automationTriggerRevisions.revision,
+                schema.automationTriggers.currentRevision,
+              ),
+            ),
+          )
+          .where(
+            and(
+              eq(schema.prReviewRepositoryBindings.workspaceId, input.workspaceId),
+              eq(schema.prReviewRepositoryBindings.registrationId, registrationId),
+            ),
+          )
+          .for("update", { of: schema.automationTriggers });
+        const existingByRepositoryId = new Map(
+          existingBindings.map((row) => [row.binding.providerRepositoryId, row] as const),
+        );
+        const selectedIds = new Set(input.repositories.map((repository) => String(repository.id)));
+        const synchronized: Array<typeof schema.prReviewRepositoryBindings.$inferSelect> = [];
+
+        for (const repository of input.repositories) {
+          if (repository.installationId !== input.installationId) {
+            throw new PrReviewDispatchAuthorityError(
+              "OpenGeni Lens repository does not belong to the authorized installation",
+            );
+          }
+          const providerRepositoryId = String(repository.id);
+          const current = existingByRepositoryId.get(providerRepositoryId);
+          if (!current) {
+            const bindingId = randomUUID();
+            const [trigger] = await tx
+              .insert(schema.automationTriggers)
+              .values({
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                sourceId: source.id,
+                name: `Review ${repository.fullName}`,
+                status: "active",
+                packInstallationId: input.packInstallationId,
+                packTemplateId: input.packTemplateId,
+                createdBySubjectId: input.createdBySubjectId,
+              })
+              .returning();
+            if (!trigger) throw new Error("Failed to create OpenGeni Lens trigger");
+            const bindingShape = {
+              registrationId,
+              provider: "github" as const,
+              repositoryUri: repository.cloneUrl,
+              repositoryFullName: repository.fullName,
+              providerRepositoryId,
+              installationId,
+              projectId: null,
+              model: null,
+              additionalInstructions: null,
+            };
+            await tx.insert(schema.automationTriggerRevisions).values({
+              triggerId: trigger.id,
+              revision: 1,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              adapterId: input.adapterId,
+              eventTypes: input.eventTypes,
+              configuration: input.configuration,
+              parameters: prReviewTriggerParameters(bindingShape, bindingId),
+              sessionTemplate: input.sessionTemplate,
+              createdBySubjectId: input.createdBySubjectId,
+            });
+            const [binding] = await tx
+              .insert(schema.prReviewRepositoryBindings)
+              .values({
+                id: bindingId,
+                triggerId: trigger.id,
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                ...bindingShape,
+                status: "active",
+                createdBySubjectId: input.createdBySubjectId,
+              })
+              .returning();
+            if (!binding) throw new Error("Failed to create OpenGeni Lens repository binding");
+            await tx.insert(schema.prReviewManagedGithubRoutes).values({
+              bindingId,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              registrationId,
+              sourceId: source.id,
+              installationId,
+              providerRepositoryId,
+            });
+            synchronized.push(binding);
+            continue;
+          }
+
+          const nextBinding = {
+            ...current.binding,
+            repositoryUri: repository.cloneUrl,
+            repositoryFullName: repository.fullName,
+            installationId,
+            status: "active" as const,
+          };
+          const nextRevision = current.trigger.currentRevision + 1;
+          await tx.insert(schema.automationTriggerRevisions).values({
+            triggerId: current.trigger.id,
+            revision: nextRevision,
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            adapterId: input.adapterId,
+            eventTypes: input.eventTypes,
+            configuration: input.configuration,
+            parameters: prReviewTriggerParameters(nextBinding, current.binding.id),
+            sessionTemplate: input.sessionTemplate,
+            createdBySubjectId: input.createdBySubjectId,
+          });
+          await tx
+            .update(schema.automationTriggers)
+            .set({
+              name: `Review ${repository.fullName}`,
+              status: "active",
+              currentRevision: nextRevision,
+              updatedAt: new Date(),
+            })
+            .where(eq(schema.automationTriggers.id, current.trigger.id));
+          const [binding] = await tx
+            .update(schema.prReviewRepositoryBindings)
+            .set({
+              repositoryUri: repository.cloneUrl,
+              repositoryFullName: repository.fullName,
+              installationId,
+              status: "active",
+              updatedAt: new Date(),
+            })
+            .where(eq(schema.prReviewRepositoryBindings.id, current.binding.id))
+            .returning();
+          if (!binding) throw new Error("Failed to update OpenGeni Lens repository binding");
+          await tx
+            .insert(schema.prReviewManagedGithubRoutes)
+            .values({
+              bindingId: binding.id,
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              registrationId,
+              sourceId: source.id,
+              installationId,
+              providerRepositoryId,
+            })
+            .onConflictDoUpdate({
+              target: schema.prReviewManagedGithubRoutes.bindingId,
+              set: {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                registrationId,
+                sourceId: source.id,
+                installationId,
+                providerRepositoryId,
+              },
+            });
+          synchronized.push(binding);
+        }
+
+        for (const current of existingBindings) {
+          if (selectedIds.has(current.binding.providerRepositoryId)) continue;
+          await tx
+            .update(schema.prReviewRepositoryBindings)
+            .set({ status: "disabled", updatedAt: new Date() })
+            .where(eq(schema.prReviewRepositoryBindings.id, current.binding.id));
+          await tx
+            .update(schema.automationTriggers)
+            .set({ status: "disabled", updatedAt: new Date() })
+            .where(eq(schema.automationTriggers.id, current.trigger.id));
+          await tx
+            .delete(schema.prReviewManagedGithubRoutes)
+            .where(eq(schema.prReviewManagedGithubRoutes.bindingId, current.binding.id));
+        }
+
+        return {
+          registration: mapRegistration(registration, source.endpointId),
+          repositories: synchronized.map(mapRepositoryBinding),
+        };
+      }),
+  );
+}
+
+export async function resolveManagedGitHubPrReviewRoute(
+  db: Database,
+  input: { installationId: string; providerRepositoryId: string },
+): Promise<{ accountId: string; workspaceId: string; sourceId: string } | null> {
+  const [row] = await db
+    .select({
+      accountId: schema.prReviewManagedGithubRoutes.accountId,
+      workspaceId: schema.prReviewManagedGithubRoutes.workspaceId,
+      sourceId: schema.prReviewManagedGithubRoutes.sourceId,
+    })
+    .from(schema.prReviewManagedGithubRoutes)
+    .where(
+      and(
+        eq(schema.prReviewManagedGithubRoutes.installationId, input.installationId),
+        eq(schema.prReviewManagedGithubRoutes.providerRepositoryId, input.providerRepositoryId),
+      ),
+    )
+    .limit(1);
+  return row ?? null;
+}
+
 export async function listPrReviewRepositoryBindings(
   db: Database,
   accountId: string,
@@ -529,7 +963,7 @@ export async function resolvePrReviewGitCredential(
     }>;
   },
 ): Promise<{
-  credentialKind: "github_app" | "provider_token";
+  credentialKind: "github_app" | "managed_github_app" | "provider_token";
   appId: string | null;
   credentialEncrypted: string | null;
   expiresAt: string | null;
@@ -754,7 +1188,10 @@ export async function resolvePrReviewGitCredential(
     if (pack?.status !== "active")
       throw new PrReviewDispatchAuthorityError("OpenGeni Review Bot Pack is not active");
     return {
-      credentialKind: registration.credentialKind as "github_app" | "provider_token",
+      credentialKind: registration.credentialKind as
+        | "github_app"
+        | "managed_github_app"
+        | "provider_token",
       appId: registration.appId,
       credentialEncrypted: registration.credentialEncrypted,
       expiresAt: registration.accessTokenExpiresAt?.toISOString() ?? null,
@@ -851,13 +1288,19 @@ function mapRegistration(
     provider: row.provider as PrReviewProvider,
     providerBaseUrl: row.providerBaseUrl,
     appId: row.appId,
-    credentialKind: row.credentialKind as "github_app" | "provider_token",
-    hasCredential: row.credentialEncrypted !== null,
+    credentialKind: row.credentialKind as "github_app" | "managed_github_app" | "provider_token",
+    installationId: row.installationId,
+    providerAccountLogin: row.providerAccountLogin,
+    providerAccountType: row.providerAccountType as "User" | "Organization" | null,
+    hasCredential: row.credentialKind === "managed_github_app" || row.credentialEncrypted !== null,
     accessTokenExpiresAt: row.accessTokenExpiresAt?.toISOString() ?? null,
     webhookAuthKind: row.webhookAuthKind as "hmac_sha256" | "shared_token" | "basic",
     hasWebhookSecret: true,
     webhookUsername: row.webhookUsername,
-    webhookPath: `/v1/webhooks/automations/${endpointId}`,
+    webhookPath:
+      row.credentialKind === "managed_github_app"
+        ? "/v1/webhooks/pr-review/github"
+        : `/v1/webhooks/automations/${endpointId}`,
     status: row.status as "active" | "disabled",
     createdBySubjectId: row.createdBySubjectId,
     createdAt: row.createdAt.toISOString(),

package/src/provision-roles.ts

@@ -488,8 +488,14 @@ async function grantAppRoleIfSchemaExists(
     "list_self_organization_invitations(text,uuid,integer)",
     "get_self_organization_invitation(text,uuid)",
     "list_organization_members(uuid,text)",
+    "list_organization_administration_members(uuid,text)",
     "list_organization_invitations(uuid,text,uuid,integer)",
     "get_organization_administration_overview(uuid,text)",
+    "get_workspace_kind(uuid,uuid)",
+    "organization_workspace_command(jsonb)",
+    "resolve_organization_workspace_removal_subject(uuid,text,uuid)",
+    "prepare_organization_workspace_member_removal(jsonb)",
+    "record_organization_workspace_member_removal(jsonb,uuid,uuid)",
     "create_managed_organization(text,text,text,uuid)",
     "assert_organization_shared_workspace_administrator(uuid,uuid,text)",
     "open_organization_shared_workspace_administration_capability(uuid,uuid,text)",
@@ -501,6 +507,15 @@ async function grantAppRoleIfSchemaExists(
     "bind_pending_organization_invitations_for_verified_email(text,text)",
     "has_pending_organization_invitation_for_subject(text)",
     "accept_organization_invitation_v2(jsonb)",
+    "complete_self_service_organization_setup(jsonb)",
+    "ensure_organization_user_setup_intent(jsonb)",
+    "claim_organization_user_setup_delivery(jsonb)",
+    "prepare_organization_user_setup_delivery(jsonb)",
+    "settle_organization_user_setup_delivery(jsonb)",
+    "preview_organization_user_setup(text)",
+    "get_organization_invitation_for_administration(uuid,text,uuid)",
+    "preflight_organization_user_setup(text)",
+    "complete_organization_user_setup(jsonb)",
     "organization_membership_command(jsonb)",
     "prepare_organization_membership_protocol_settlements(jsonb)",
     "assert_active_managed_human_organization_membership(uuid,text)",
@@ -884,6 +899,19 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format('%I.materialize_remember_knowledge_memory(uuid,uuid,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.materialize_remember_knowledge_memory(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.materialize_remember_knowledge_memory(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format('%I.undo_governed_learning_activation(uuid,uuid,uuid,uuid)', ${literal(schema)})
     ) IS NOT NULL THEN
@@ -1298,6 +1326,38 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.fork_session_content_with_runtime(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,jsonb,uuid,uuid,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.fork_session_content_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, jsonb, uuid, uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.fork_session_content_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, jsonb, uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.replay_applied_session_fork_with_runtime(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.replay_applied_session_fork_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.replay_applied_session_fork_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format('%I.session_tenancy_product_activated(uuid,integer)', ${literal(schema)})
     ) IS NOT NULL THEN
@@ -1921,6 +1981,15 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure('opengeni_private.session_variable_set_attachments_protocol_v1_active()') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION
+        opengeni_private.session_variable_set_attachments_protocol_v1_active()
+        FROM PUBLIC;
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.session_variable_set_attachments_protocol_v1_active() TO %I',
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure('opengeni_private.scoped_compute_capability_active(text)') IS NOT NULL THEN
       REVOKE ALL ON FUNCTION opengeni_private.scoped_compute_capability_active(text) FROM PUBLIC;
       EXECUTE format(
@@ -1932,6 +2001,29 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    -- The automatic-title migration helper and policy trigger deliberately
+    -- retain role-scoped EXECUTE for pre-policy startup/readiness
+    -- compatibility. Both are SECURITY INVOKER and PUBLIC remains revoked; RLS
+    -- and the private-table ACL deny app-role enqueue writes, while PostgreSQL
+    -- refuses direct trigger calls, so neither grant conveys data authority.
+    IF to_regclass('opengeni_private.automatic_session_title_fanout_outbox_v1') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.automatic_session_title_fanout_outbox_v1 FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.enqueue_automatic_session_title_fanout_v1(uuid,uuid,uuid,uuid)') IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.enqueue_automatic_session_title_fanout_v1(uuid, uuid, uuid, uuid) TO %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.enforce_automatic_session_title_policy_v1()') IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.enforce_automatic_session_title_policy_v1() TO %I',
+        ${literal(role)}
+      );
+    END IF;
     -- Global cross-workspace artifact workers are separate capabilities. Never
     -- let the generic tenant-scoped app role inherit them from the historical
     -- blanket grant of already-installed helpers.