@opengeni/db 3.2.0-canary.0 → 3.4.0-canary.1

package/dist/{chunk-UZNXG44K.js → chunk-PYMY3AJW.js}

@@ -114,7 +114,16 @@ var ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES = [
 var ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES = [
   "authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name)"
 ];
-var DEDICATED_ARTIFACT_CAPABILITY_ROUTINES = /* @__PURE__ */ new Set([
+var AUTOMATIC_SESSION_TITLE_FANOUT_RUNTIME_ROUTINES = [
+  "claim_automatic_session_title_fanout_v1(integer)",
+  "mark_automatic_session_title_fanout_delivered_v1(uuid, uuid)",
+  "mark_automatic_session_title_fanout_failed_v1(uuid, uuid, text)"
+];
+var AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE = "enqueue_automatic_session_title_fanout_v1(uuid, uuid, uuid, uuid)";
+var AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE = "enforce_automatic_session_title_policy_v1()";
+var AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE = "automatic_session_title_fanout_outbox_v1";
+var AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE = "acquire_automatic_session_title_quarantine_fences_v1(integer)";
+var OWNER_INTERNAL_PRIVATE_ROUTINES = /* @__PURE__ */ new Set([
   ...ARTIFACT_OUTBOX_CAPABILITY_ROUTINES,
   ...ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES,
   ...ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES
@@ -146,7 +155,13 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "get_self_organization_invitation(text, uuid)",
   "list_organization_invitations(uuid, text, uuid, integer)",
   "list_organization_members(uuid, text)",
+  "list_organization_administration_members(uuid, text)",
   "get_organization_administration_overview(uuid, text)",
+  "get_workspace_kind(uuid, uuid)",
+  "organization_workspace_command(jsonb)",
+  "resolve_organization_workspace_removal_subject(uuid, text, uuid)",
+  "prepare_organization_workspace_member_removal(jsonb)",
+  "record_organization_workspace_member_removal(jsonb, uuid, uuid)",
   "create_managed_organization(text, text, text, uuid)",
   "assert_organization_shared_workspace_administrator(uuid, uuid, text)",
   "open_organization_shared_workspace_administration_capability(uuid, uuid, text)",
@@ -158,6 +173,15 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "bind_pending_organization_invitations_for_verified_email(text, text)",
   "has_pending_organization_invitation_for_subject(text)",
   "accept_organization_invitation_v2(jsonb)",
+  "complete_self_service_organization_setup(jsonb)",
+  "ensure_organization_user_setup_intent(jsonb)",
+  "claim_organization_user_setup_delivery(jsonb)",
+  "prepare_organization_user_setup_delivery(jsonb)",
+  "settle_organization_user_setup_delivery(jsonb)",
+  "preview_organization_user_setup(text)",
+  "get_organization_invitation_for_administration(uuid, text, uuid)",
+  "preflight_organization_user_setup(text)",
+  "complete_organization_user_setup(jsonb)",
   "organization_membership_command(jsonb)",
   "prepare_organization_membership_protocol_settlements(jsonb)",
   "assert_active_managed_human_organization_membership(uuid, text)",
@@ -181,13 +205,19 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES = [
   "organization_memberships",
   "organization_profile_events",
   "organization_shared_workspace_administration_capabilities",
+  "organization_user_setup_deliveries",
+  "organization_user_setup_delivery_attempts",
+  "organization_user_setup_intents",
   "organization_user_resource_authorities",
   "organization_user_resource_grants",
   "organization_user_retention_deletion_events",
   "organization_user_retention_deletions",
   "organization_user_retention_object_deletion_receipts",
   "organization_user_retention_object_obligations",
-  "organization_user_retention_policies"
+  "organization_user_retention_policies",
+  "organization_workspace_lifecycle_events",
+  "organization_workspace_operation_receipts",
+  "self_service_organization_setup_receipts"
 ];
 var PRIVATE_SESSION_CREATE_POLICY_ROUTINE = "get_private_session_create_policy(uuid, uuid, text)";
 var ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE = "get_organization_private_session_settings(uuid, text)";
@@ -367,6 +397,7 @@ var GOVERNED_LEARNING_ACTIVATION_ROUTINES = [
   "activate_governed_learning_decision(uuid, uuid, uuid, uuid)",
   "activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid)",
   "confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)",
+  "materialize_remember_knowledge_memory(uuid, uuid, uuid)",
   "undo_governed_learning_activation(uuid, uuid, uuid, uuid)"
 ];
 var GOVERNED_LEARNING_INSPECTION_ROUTINES = [
@@ -429,6 +460,7 @@ var GOVERNED_LEARNING_ACTIVATION_AUTHORITY_TABLES = [
   "preference_registry_preferences",
   "preference_registry_revisions",
   "remember_knowledge_confirmation_receipts",
+  "remember_knowledge_memory_materializations",
   "session_human_input_requests",
   "workspace_instruction_policy_activation_events",
   "workspace_instruction_policy_deactivation_events",
@@ -446,6 +478,7 @@ var SESSION_TENANCY_ACTIVATED_ROUTINE = "session_tenancy_product_activated(uuid,
 var SESSION_TENANCY_ANY_ACTIVATION_ROUTINE = "session_tenancy_any_product_activation()";
 var SESSION_TENANCY_QUIESCENCE_ROUTINE = "assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean)";
 var TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE = "check_tenancy_backfill_activation_evidence(uuid)";
+var GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE = "activate_greenfield_session_tenancy_from_setup(text)";
 var SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE = "session_visibility_lifecycle_capability_held()";
 var PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES = [
   "open_private_session_create_capability(uuid, uuid, uuid, text)",
@@ -535,7 +568,9 @@ var RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET = new Set(
   RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES
 );
 var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
+  AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE,
   ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE,
+  GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE,
   SESSION_TENANCY_QUIESCENCE_ROUTINE,
   TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE,
   ...DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES
@@ -713,6 +748,11 @@ var FORCE_RLS_TABLES = [
   "organization_user_retention_object_deletion_receipts",
   "organization_user_retention_object_obligations",
   "organization_user_retention_policies",
+  "organization_user_setup_deliveries",
+  "organization_user_setup_delivery_attempts",
+  "organization_user_setup_intents",
+  "organization_workspace_lifecycle_events",
+  "organization_workspace_operation_receipts",
   "pack_installation_components",
   "pack_installations",
   "personal_document_once_consumption_receipts",
@@ -721,6 +761,7 @@ var FORCE_RLS_TABLES = [
   "personal_github_repository_selections",
   "personal_resource_once_consumption_receipts",
   "pr_review_app_registrations",
+  "pr_review_managed_github_authority_nonces",
   "pr_review_repository_bindings",
   "preference_registry_events",
   "preference_registry_preferences",
@@ -728,6 +769,7 @@ var FORCE_RLS_TABLES = [
   "preference_registry_snapshots",
   "private_session_create_capabilities",
   "remember_knowledge_confirmation_receipts",
+  "remember_knowledge_memory_materializations",
   "retained_screenshot_artifacts",
   "rig_changes",
   "rig_versions",
@@ -751,6 +793,7 @@ var FORCE_RLS_TABLES = [
   "scheduled_task_run_personal_resource_snapshots",
   "scheduled_task_runs",
   "scheduled_tasks",
+  "self_service_organization_setup_receipts",
   "session_attempt_codemode_calls",
   "session_attempt_connected_machine_authorizations",
   "session_attempt_interruptions",
@@ -780,9 +823,11 @@ var FORCE_RLS_TABLES = [
   "session_system_update_outbox",
   "session_system_updates",
   "session_tenancy_activations",
+  "session_tenancy_greenfield_activation_evidence",
   "session_turn_attempts",
   "session_turn_startup_milestones",
   "session_turns",
+  "session_variable_set_attachments",
   "session_visibility_write_capabilities",
   "session_workflow_wake_outbox",
   "sessions",
@@ -869,6 +914,7 @@ var NON_RLS_RUNTIME_TABLES = [
   "integration_oauth_clients",
   "managed_accounts",
   "nested_agent_depth_configuration",
+  "pr_review_managed_github_routes",
   "stripe_webhook_events",
   "workspace_memberships",
   "workspaces"
@@ -947,6 +993,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "pack_installation_components",
   "pack_installations",
   "pr_review_app_registrations",
+  "pr_review_managed_github_routes",
   "pr_review_repository_bindings",
   "retained_screenshot_artifacts",
   "rig_changes",
@@ -1079,6 +1126,7 @@ var RUNTIME_READ_INSERT_TABLES = [
   "knowledge_source_objects",
   "knowledge_sources",
   "knowledge_sync_runs",
+  "pr_review_managed_github_authority_nonces",
   "preference_registry_preferences",
   "preference_registry_revisions",
   "session_attempt_tool_catalogs",
@@ -1169,6 +1217,11 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "organization_user_retention_object_deletion_receipts",
   "organization_user_retention_object_obligations",
   "organization_user_retention_policies",
+  "organization_user_setup_deliveries",
+  "organization_user_setup_delivery_attempts",
+  "organization_user_setup_intents",
+  "organization_workspace_lifecycle_events",
+  "organization_workspace_operation_receipts",
   "personal_document_once_consumption_receipts",
   "personal_github_repository_selection_heads",
   "personal_github_repository_selection_operations",
@@ -1176,6 +1229,7 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "personal_resource_once_consumption_receipts",
   "private_session_create_capabilities",
   "remember_knowledge_confirmation_receipts",
+  "remember_knowledge_memory_materializations",
   "scheduled_task_connection_authority_snapshots",
   "scheduled_task_personal_resource_authorities",
   "scheduled_task_personal_resource_snapshots",
@@ -1185,11 +1239,14 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "scheduled_task_run_personal_resource_admissions",
   "scheduled_task_run_personal_resource_once_receipts",
   "scheduled_task_run_personal_resource_snapshots",
+  "self_service_organization_setup_receipts",
   "session_attempt_connected_machine_authorizations",
   "session_attempt_personal_document_admissions",
   "session_attempt_personal_document_snapshots",
   "session_attempt_personal_resource_admissions",
   "session_attempt_personal_resource_snapshots",
+  "session_tenancy_greenfield_activation_evidence",
+  "session_variable_set_attachments",
   "session_visibility_write_capabilities",
   "task_note_events",
   "task_note_knowledge_promotion_capabilities",
@@ -1297,6 +1354,14 @@ async function inspectRuntimeDatabasePosture(db, options) {
         await tx.execute(sql`select session_tenancy_any_product_activation() as activated`)
       );
       const sessionTenancyProductActivationPresent = activationRows[0]?.activated === true;
+      const variableSetCutoverRows = resultRows(
+        await tx.execute(sql`
+          select to_regprocedure(
+            'opengeni_private.session_variable_set_attachments_protocol_v1_active()'
+          ) is not null as present
+        `)
+      );
+      const sessionVariableSetAttachmentsCutoverPresent = variableSetCutoverRows[0]?.present === true;
       if (options.rlsStrategy === "scoped") {
         return {
           identity: mappedIdentity,
@@ -1308,7 +1373,8 @@ async function inspectRuntimeDatabasePosture(db, options) {
           privateTables: [],
           targetRoutines: [],
           privateRoutines: [],
-          sessionTenancyProductActivationPresent
+          sessionTenancyProductActivationPresent,
+          sessionVariableSetAttachmentsCutoverPresent
         };
       }
       const relationshipRows = resultRows(
@@ -1405,6 +1471,10 @@ async function inspectRuntimeDatabasePosture(db, options) {
           select
             c.relname::text as name,
             pg_get_userbyid(c.relowner)::text as owner,
+            c.relrowsecurity as rls_enabled,
+            c.relforcerowsecurity as rls_forced,
+            row_security_active(c.oid) as rls_active,
+            (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,
             has_table_privilege(current_user, c.oid, 'SELECT') as can_select,
             has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,
             has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,
@@ -1420,12 +1490,17 @@ async function inspectRuntimeDatabasePosture(db, options) {
               ${PERSONAL_DOCUMENT_CAPABILITY_TABLE},
               ${DOCUMENT_MIGRATION_CAPABILITY_TABLE},
               ${SCOPED_COMPUTE_CAPABILITY_TABLE},
-              ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE}
+              ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE},
+              ${AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE}
             )
         `)
       ).map((row) => ({
         name: row.name,
         owner: row.owner,
+        rlsEnabled: row.rls_enabled,
+        rlsForced: row.rls_forced,
+        rlsActive: row.rls_active,
+        policyCount: row.policy_count,
         select: row.can_select,
         insert: row.can_insert,
         update: row.can_update,
@@ -1502,7 +1577,8 @@ async function inspectRuntimeDatabasePosture(db, options) {
         privateTables,
         targetRoutines,
         privateRoutines,
-        sessionTenancyProductActivationPresent
+        sessionTenancyProductActivationPresent,
+        sessionVariableSetAttachmentsCutoverPresent
       };
     },
     { isolationLevel: "repeatable read", accessMode: "read only" }
@@ -1511,6 +1587,9 @@ async function inspectRuntimeDatabasePosture(db, options) {
 function evaluateRuntimeDatabasePosture(posture, options) {
   const violations = [];
   const identity = posture.identity;
+  if (!posture.sessionVariableSetAttachmentsCutoverPresent) {
+    violations.push("database is missing the 0352 session Variable Set attachment runtime receipt");
+  }
   if (posture.sessionTenancyProductActivationPresent && options.organizationTenancyCanonicalActivationEnabled !== true) {
     violations.push(
       "session-tenancy product activation is durable but OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED is not true"
@@ -2088,6 +2167,151 @@ function evaluateRuntimeDatabasePosture(posture, options) {
       }
     }
   }
+  const automaticTitleFanoutOutboxes = posture.privateTables.filter(
+    (table) => table.name === AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE
+  );
+  const automaticTitleFanoutRoutineNames = /* @__PURE__ */ new Set([
+    ...AUTOMATIC_SESSION_TITLE_FANOUT_RUNTIME_ROUTINES,
+    AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE,
+    AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE
+  ]);
+  const automaticTitleFanoutCatalogPresent = posture.privateRoutines.some(
+    (routine) => automaticTitleFanoutRoutineNames.has(routine.name)
+  );
+  if (automaticTitleFanoutCatalogPresent && automaticTitleFanoutOutboxes.length !== 1) {
+    violations.push(
+      `automatic session title fanout private outbox ${AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE} is missing or ambiguous`
+    );
+  }
+  const automaticTitleFanoutOutbox = automaticTitleFanoutOutboxes[0];
+  if (automaticTitleFanoutOutbox) {
+    if (automaticTitleFanoutOutbox.owner === expectedRole) {
+      violations.push(
+        `runtime role owns private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name}`
+      );
+    }
+    if (!automaticTitleFanoutOutbox.rlsEnabled) {
+      violations.push(
+        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} does not ENABLE RLS`
+      );
+    }
+    if (!automaticTitleFanoutOutbox.rlsForced) {
+      violations.push(
+        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} does not FORCE RLS`
+      );
+    }
+    if (!automaticTitleFanoutOutbox.rlsActive) {
+      violations.push(
+        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} has inactive RLS for runtime role`
+      );
+    }
+    if ((automaticTitleFanoutOutbox.policyCount ?? 0) < 1) {
+      violations.push(
+        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} has no RLS policy`
+      );
+    }
+    const directPrivileges = [
+      ["SELECT", automaticTitleFanoutOutbox.select],
+      ["INSERT", automaticTitleFanoutOutbox.insert],
+      ["UPDATE", automaticTitleFanoutOutbox.update],
+      ["DELETE", automaticTitleFanoutOutbox.delete]
+    ].filter(([, granted]) => granted);
+    if (directPrivileges.length > 0) {
+      violations.push(
+        `runtime role has forbidden direct privileges on private table ${automaticTitleFanoutOutbox.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+      );
+    }
+    for (const expectedRoutine of AUTOMATIC_SESSION_TITLE_FANOUT_RUNTIME_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
+      if (matches.length !== 1) {
+        violations.push(
+          `automatic session title fanout capability ${expectedRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(
+          `automatic session title fanout capability ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (routine.owner !== automaticTitleFanoutOutbox.owner) {
+        violations.push(
+          `automatic session title fanout capability ${routine.name} owner ${routine.owner} does not match table owner ${automaticTitleFanoutOutbox.owner}`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(
+          `runtime role lacks automatic session title fanout capability ${routine.name}`
+        );
+      }
+      if (routine.publicExecute) {
+        violations.push(
+          `PUBLIC has forbidden automatic session title fanout capability ${routine.name}`
+        );
+      }
+    }
+    const enqueueMatches = posture.privateRoutines.filter(
+      (routine) => routine.name === AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE
+    );
+    if (enqueueMatches.length !== 1) {
+      violations.push(
+        `automatic session title fanout migration helper ${AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE} is missing or ambiguous`
+      );
+    } else {
+      const routine = enqueueMatches[0];
+      if (routine.securityDefiner) {
+        violations.push(
+          `automatic session title fanout migration helper ${routine.name} must be SECURITY INVOKER`
+        );
+      }
+      if (routine.owner !== automaticTitleFanoutOutbox.owner) {
+        violations.push(
+          `automatic session title fanout migration helper ${routine.name} owner ${routine.owner} does not match table owner ${automaticTitleFanoutOutbox.owner}`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(
+          `runtime role lacks rolling-compatible automatic session title fanout migration helper ${routine.name}`
+        );
+      }
+      if (routine.publicExecute) {
+        violations.push(
+          `PUBLIC has forbidden automatic session title fanout migration helper ${routine.name}`
+        );
+      }
+    }
+    const policyTriggerMatches = posture.privateRoutines.filter(
+      (routine) => routine.name === AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE
+    );
+    if (policyTriggerMatches.length !== 1) {
+      violations.push(
+        `automatic session title policy trigger ${AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE} is missing or ambiguous`
+      );
+    } else {
+      const routine = policyTriggerMatches[0];
+      if (routine.securityDefiner) {
+        violations.push(
+          `automatic session title policy trigger ${routine.name} must be SECURITY INVOKER`
+        );
+      }
+      if (routine.owner !== automaticTitleFanoutOutbox.owner) {
+        violations.push(
+          `automatic session title policy trigger ${routine.name} owner ${routine.owner} does not match table owner ${automaticTitleFanoutOutbox.owner}`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(
+          `runtime role lacks rolling-compatible automatic session title policy trigger ${routine.name}`
+        );
+      }
+      if (routine.publicExecute) {
+        violations.push(
+          `PUBLIC has forbidden automatic session title policy trigger ${routine.name}`
+        );
+      }
+    }
+  }
   const artifactMaterializationJobs = tableByName.get("editable_artifact_materialization_jobs");
   if (artifactMaterializationJobs) {
     for (const tableName of [
@@ -2576,8 +2800,8 @@ function evaluateRuntimeDatabasePosture(posture, options) {
     if (routine.owner === expectedRole) {
       violations.push(`runtime role owns private routine ${routine.name}`);
     }
-    const dedicatedArtifactCapability = DEDICATED_ARTIFACT_CAPABILITY_ROUTINES.has(routine.name);
-    if (!routine.execute && !dedicatedArtifactCapability) {
+    const ownerInternalRoutine = OWNER_INTERNAL_PRIVATE_ROUTINES.has(routine.name);
+    if (!routine.execute && !ownerInternalRoutine) {
       violations.push(`runtime role lacks EXECUTE on private routine ${routine.name}`);
     }
   }
@@ -2916,8 +3140,14 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "list_self_organization_invitations(text,uuid,integer)",
     "get_self_organization_invitation(text,uuid)",
     "list_organization_members(uuid,text)",
+    "list_organization_administration_members(uuid,text)",
     "list_organization_invitations(uuid,text,uuid,integer)",
     "get_organization_administration_overview(uuid,text)",
+    "get_workspace_kind(uuid,uuid)",
+    "organization_workspace_command(jsonb)",
+    "resolve_organization_workspace_removal_subject(uuid,text,uuid)",
+    "prepare_organization_workspace_member_removal(jsonb)",
+    "record_organization_workspace_member_removal(jsonb,uuid,uuid)",
     "create_managed_organization(text,text,text,uuid)",
     "assert_organization_shared_workspace_administrator(uuid,uuid,text)",
     "open_organization_shared_workspace_administration_capability(uuid,uuid,text)",
@@ -2929,6 +3159,15 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "bind_pending_organization_invitations_for_verified_email(text,text)",
     "has_pending_organization_invitation_for_subject(text)",
     "accept_organization_invitation_v2(jsonb)",
+    "complete_self_service_organization_setup(jsonb)",
+    "ensure_organization_user_setup_intent(jsonb)",
+    "claim_organization_user_setup_delivery(jsonb)",
+    "prepare_organization_user_setup_delivery(jsonb)",
+    "settle_organization_user_setup_delivery(jsonb)",
+    "preview_organization_user_setup(text)",
+    "get_organization_invitation_for_administration(uuid,text,uuid)",
+    "preflight_organization_user_setup(text)",
+    "complete_organization_user_setup(jsonb)",
     "organization_membership_command(jsonb)",
     "prepare_organization_membership_protocol_settlements(jsonb)",
     "assert_active_managed_human_organization_membership(uuid,text)",
@@ -3310,6 +3549,19 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format('%I.materialize_remember_knowledge_memory(uuid,uuid,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.materialize_remember_knowledge_memory(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.materialize_remember_knowledge_memory(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format('%I.undo_governed_learning_activation(uuid,uuid,uuid,uuid)', ${literal(schema)})
     ) IS NOT NULL THEN
@@ -3724,6 +3976,38 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.fork_session_content_with_runtime(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,jsonb,uuid,uuid,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.fork_session_content_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, jsonb, uuid, uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.fork_session_content_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, jsonb, uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.replay_applied_session_fork_with_runtime(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.replay_applied_session_fork_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.replay_applied_session_fork_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format('%I.session_tenancy_product_activated(uuid,integer)', ${literal(schema)})
     ) IS NOT NULL THEN
@@ -4347,6 +4631,15 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure('opengeni_private.session_variable_set_attachments_protocol_v1_active()') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION
+        opengeni_private.session_variable_set_attachments_protocol_v1_active()
+        FROM PUBLIC;
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.session_variable_set_attachments_protocol_v1_active() TO %I',
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure('opengeni_private.scoped_compute_capability_active(text)') IS NOT NULL THEN
       REVOKE ALL ON FUNCTION opengeni_private.scoped_compute_capability_active(text) FROM PUBLIC;
       EXECUTE format(
@@ -4358,6 +4651,29 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    -- The automatic-title migration helper and policy trigger deliberately
+    -- retain role-scoped EXECUTE for pre-policy startup/readiness
+    -- compatibility. Both are SECURITY INVOKER and PUBLIC remains revoked; RLS
+    -- and the private-table ACL deny app-role enqueue writes, while PostgreSQL
+    -- refuses direct trigger calls, so neither grant conveys data authority.
+    IF to_regclass('opengeni_private.automatic_session_title_fanout_outbox_v1') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.automatic_session_title_fanout_outbox_v1 FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.enqueue_automatic_session_title_fanout_v1(uuid,uuid,uuid,uuid)') IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.enqueue_automatic_session_title_fanout_v1(uuid, uuid, uuid, uuid) TO %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.enforce_automatic_session_title_policy_v1()') IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.enforce_automatic_session_title_policy_v1() TO %I',
+        ${literal(role)}
+      );
+    END IF;
     -- Global cross-workspace artifact workers are separate capabilities. Never
     -- let the generic tenant-scoped app role inherit them from the historical
     -- blanket grant of already-installed helpers.
@@ -4505,4 +4821,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-UZNXG44K.js.map
+//# sourceMappingURL=chunk-PYMY3AJW.js.map