@opengeni/db 3.4.0-canary.2 → 3.6.0

package/dist/canonical-human-identities.d.ts

@@ -6,6 +6,16 @@ export type CanonicalHumanSessionAuthority = {
     authRevision: number;
     identityStatus: "active" | "recovery_required" | "disputed" | "disabled";
 };
+export type CanonicalHumanExactLoginBinding = {
+    id: string;
+    identityId: string;
+    revision: number;
+    status: "active" | "recovery_pending" | "stale" | "disputed" | "revoked";
+};
+export declare function getCanonicalHumanExactLoginBindingForAuthUser(db: Database, input: {
+    authUserId: string;
+    providerId: string;
+}): Promise<CanonicalHumanExactLoginBinding>;
 export declare class CanonicalHumanIdentityConflictError extends Error {
     readonly name = "CanonicalHumanIdentityConflictError";
     readonly code = "CANONICAL_HUMAN_IDENTITY_CONFLICT";
@@ -16,6 +26,11 @@ export declare class CanonicalHumanIdentityOperationReuseError extends Error {
     readonly code = "CANONICAL_HUMAN_IDENTITY_OPERATION_REUSED";
     constructor();
 }
+export declare class CanonicalHumanIdentityMutationInFlightError extends Error {
+    readonly name = "CanonicalHumanIdentityMutationInFlightError";
+    readonly code = "CANONICAL_HUMAN_IDENTITY_MUTATION_IN_FLIGHT";
+    constructor();
+}
 export declare class CanonicalHumanIdentityNotFoundError extends Error {
     readonly name = "CanonicalHumanIdentityNotFoundError";
     constructor(message?: string);
@@ -44,5 +59,10 @@ export type ApplyCanonicalHumanIdentityOperationInput = {
     providerId?: string | null;
     providerAccountId?: string | null;
     reason: string;
+    actorFence?: {
+        authorityHash: string;
+        actorEpoch: string;
+        requestId: string;
+    };
 };
 export declare function applyCanonicalHumanIdentityOperation(db: Database, input: ApplyCanonicalHumanIdentityOperationInput): Promise<CanonicalHumanIdentityMutationResponseType>;

package/dist/canonical-human-identities.js

@@ -1,26 +1,30 @@
 import {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
+  CanonicalHumanIdentityMutationInFlightError,
   CanonicalHumanIdentityNotFoundError,
   CanonicalHumanIdentityOperationReuseError,
   applyCanonicalHumanIdentityOperation,
   ensureCanonicalHumanIdentity,
   ensureCanonicalHumanIdentityForAuthUser,
+  getCanonicalHumanExactLoginBindingForAuthUser,
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-V3TRUXFJ.js";
-import "./chunk-H7MXYG7R.js";
-import "./chunk-C2AFP7SB.js";
+} from "./chunk-UGDVSQ6U.js";
+import "./chunk-WW7AJ5IC.js";
+import "./chunk-UJ2EW3QI.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
+  CanonicalHumanIdentityMutationInFlightError,
   CanonicalHumanIdentityNotFoundError,
   CanonicalHumanIdentityOperationReuseError,
   applyCanonicalHumanIdentityOperation,
   ensureCanonicalHumanIdentity,
   ensureCanonicalHumanIdentityForAuthUser,
+  getCanonicalHumanExactLoginBindingForAuthUser,
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession

package/dist/{chunk-ZWRIPCTR.js → chunk-2NT476HD.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-WW7AJ5IC.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3540,4 +3540,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-ZWRIPCTR.js.map
+//# sourceMappingURL=chunk-2NT476HD.js.map

package/dist/{chunk-PYMY3AJW.js → chunk-744DFC65.js}

@@ -381,6 +381,49 @@ var CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES = [
   "canonical_human_login_bindings",
   "canonical_human_identity_operations"
 ];
+var MANAGED_AUTH_SESSION_SET_ROUTINES = [
+  "get_canonical_human_exact_login_binding(text, text)",
+  "managed_auth_session_set_authority_state(text)",
+  "managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)",
+  "managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)",
+  "managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)",
+  "managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)",
+  "managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)",
+  "managed_auth_actor_mutation_fence(text, bigint, uuid)",
+  "managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)",
+  "managed_auth_actor_mutation_lease_release(text, uuid)",
+  "managed_auth_actor_mutation_lease_validate(text, bigint, uuid)",
+  "managed_auth_adopted_session_snapshot(text)",
+  "managed_auth_isolated_session_reap(integer)",
+  "managed_auth_expired_session_set_reap(integer)",
+  "managed_auth_session_set_operation_receipt(text, uuid, text, text)"
+];
+var MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES = [
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_session_sets",
+  "managed_auth_login_slots",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations"
+];
+var ORGANIZATION_RECOVERY_ROUTINES = [
+  "get_organization_recovery_overview(uuid, text, jsonb, text, text)",
+  "organization_recovery_command(jsonb)"
+];
+var ORGANIZATION_RECOVERY_AUTHORITY_TABLES = [
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads"
+];
 var SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE = "session_private_actor_visible(uuid, uuid, uuid, text)";
 var SESSION_REFERENCE_VISIBLE_ROUTINE = "session_reference_visible(uuid, uuid, uuid)";
 var TASK_NOTE_CAPABILITY_ROUTINES = [
@@ -390,6 +433,10 @@ var TASK_NOTE_CAPABILITY_ROUTINES = [
   "replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)",
   "resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)"
 ];
+var WORK_CLAIM_CAPABILITY_ROUTINES = [
+  "upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)",
+  "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)"
+];
 var COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE = "company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer)";
 var COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE = "company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamp with time zone, uuid, integer)";
 var GOVERNED_LEARNING_EVALUATION_ROUTINE = "evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)";
@@ -502,6 +549,7 @@ var SESSION_AUTHORITY_ROUTINES = /* @__PURE__ */ new Set([
   ...PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES,
   TRANSITION_SESSION_VISIBILITY_ROUTINE,
   ...TASK_NOTE_CAPABILITY_ROUTINES,
+  ...WORK_CLAIM_CAPABILITY_ROUTINES,
   COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE,
   COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE
 ]);
@@ -551,7 +599,10 @@ var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
   ...SCOPED_COMPUTE_AUTHORITY_ROUTINES,
   ...SCHEDULED_PERSONAL_RESOURCE_ROUTINES,
   ...CANONICAL_HUMAN_IDENTITY_ROUTINES,
+  ...MANAGED_AUTH_SESSION_SET_ROUTINES,
+  ...ORGANIZATION_RECOVERY_ROUTINES,
   ...TASK_NOTE_CAPABILITY_ROUTINES,
+  ...WORK_CLAIM_CAPABILITY_ROUTINES,
   SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
   SESSION_REFERENCE_VISIBLE_ROUTINE,
   SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE,
@@ -726,6 +777,14 @@ var FORCE_RLS_TABLES = [
   "machine_metrics_latest",
   "machine_metrics_series",
   "machine_removal_operations",
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_slots",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations",
+  "managed_auth_session_sets",
   "memory_slack_publication_configurations",
   "memory_slack_publication_receipts",
   "memory_slack_publications",
@@ -740,6 +799,16 @@ var FORCE_RLS_TABLES = [
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads",
   "organization_shared_workspace_administration_capabilities",
   "organization_user_resource_authorities",
   "organization_user_resource_grants",
@@ -829,6 +898,9 @@ var FORCE_RLS_TABLES = [
   "session_turns",
   "session_variable_set_attachments",
   "session_visibility_write_capabilities",
+  "session_work_claim_revisions",
+  "session_work_claim_write_capabilities",
+  "session_work_claims",
   "session_workflow_wake_outbox",
   "sessions",
   "site_auth_connections",
@@ -1083,6 +1155,7 @@ var RUNTIME_READ_ONLY_TABLES = [
   "preference_registry_events",
   "preference_registry_snapshots",
   "session_tenancy_activations",
+  "session_work_claims",
   "slack_installation_bindings",
   "slack_task_policy_activation_events",
   "slack_task_policy_heads",
@@ -1201,6 +1274,14 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "host_export_cursor_state",
   "host_export_dead_letters",
   "host_export_outbox",
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_slots",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations",
+  "managed_auth_session_sets",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -1209,6 +1290,16 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads",
   "organization_shared_workspace_administration_capabilities",
   "organization_user_resource_authorities",
   "organization_user_resource_grants",
@@ -1248,6 +1339,8 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "session_tenancy_greenfield_activation_evidence",
   "session_variable_set_attachments",
   "session_visibility_write_capabilities",
+  "session_work_claim_revisions",
+  "session_work_claim_write_capabilities",
   "task_note_events",
   "task_note_knowledge_promotion_capabilities",
   "task_note_replacement_receipts",
@@ -1308,6 +1401,8 @@ function difference(left, right) {
 }
 async function inspectRuntimeDatabasePosture(db, options) {
   const targetSchema = options.targetSchema?.trim() || "public";
+  const targetSchemaCapabilityRoutines = options.targetSchemaCapabilityRoutines ?? RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES;
+  const targetSchemaForbiddenRoutines = options.targetSchemaForbiddenRoutines ?? RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES;
   return await db.transaction(
     async (tx) => {
       const identityRows = resultRows(
@@ -1525,10 +1620,9 @@ async function inspectRuntimeDatabasePosture(db, options) {
             and (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')') = any(
               array[
                 ${sql.join(
-          [
-            ...RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
-            ...RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES
-          ].map((name) => sql`${name}`),
+          [...targetSchemaCapabilityRoutines, ...targetSchemaForbiddenRoutines].map(
+            (name) => sql`${name}`
+          ),
           sql`, `
         )}
               ]::text[]
@@ -1617,6 +1711,8 @@ function evaluateRuntimeDatabasePosture(posture, options) {
   const protectedNoDirectDmlTables = new Set(
     options.protectedNoDirectDmlTables ?? (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES)
   );
+  const targetSchemaCapabilityRoutines = options.targetSchemaCapabilityRoutines ?? RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES;
+  const targetSchemaForbiddenRoutines = options.targetSchemaForbiddenRoutines ?? RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES;
   if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {
     violations.push(
       `runtime identity must be ${expectedRole} (current_user=${identity.currentUser}, session_user=${identity.sessionUser})`
@@ -1737,7 +1833,7 @@ function evaluateRuntimeDatabasePosture(posture, options) {
     if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);
   }
   const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;
-  for (const forbiddenRoutine of RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES) {
+  for (const forbiddenRoutine of targetSchemaForbiddenRoutines) {
     const matches = posture.targetRoutines.filter((routine2) => routine2.name === forbiddenRoutine);
     if (matches.length !== 1) {
       violations.push(
@@ -1764,7 +1860,7 @@ function evaluateRuntimeDatabasePosture(posture, options) {
       violations.push(`PUBLIC has forbidden owner-internal helper ${routine.name}`);
     }
   }
-  for (const expectedRoutine of RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES) {
+  for (const expectedRoutine of targetSchemaCapabilityRoutines) {
     const matches = posture.targetRoutines.filter((routine2) => routine2.name === expectedRoutine);
     if (matches.length !== 1) {
       violations.push(
@@ -2017,6 +2113,42 @@ function evaluateRuntimeDatabasePosture(posture, options) {
           );
         }
       }
+    } else if (ORGANIZATION_RECOVERY_ROUTINES.includes(routine.name)) {
+      const authorityTables = ORGANIZATION_RECOVERY_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== ORGANIZATION_RECOVERY_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} organization recovery authority tables are missing`
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
+    } else if (MANAGED_AUTH_SESSION_SET_ROUTINES.includes(routine.name)) {
+      const authorityTables = MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} managed auth session-set authority tables are missing`
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
     } else if (CANONICAL_HUMAN_IDENTITY_ROUTINES.includes(routine.name)) {
       const authorityTables = CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.filter(
         (tableName) => tableByName.has(tableName)
@@ -3134,6 +3266,7 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
   const runtimeReadUpdateTables = `ARRAY[${RUNTIME_READ_UPDATE_TABLES.map(literal).join(", ")}]`;
   const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(", ")}]`;
   const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(", ")}]`;
+  const workClaimCapabilityRoutines = `ARRAY[${WORK_CLAIM_CAPABILITY_ROUTINES.map(literal).join(", ")}]`;
   const organizationMembershipLifecycleRoutines = `ARRAY[${[
     "list_self_organization_memberships(text)",
     "list_self_organization_invitations(text)",
@@ -3183,6 +3316,27 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "finalize_organization_retention_deletion(uuid,uuid,uuid,text)",
     "complete_organization_retention_deletion(uuid,uuid,uuid,text)"
   ].map(literal).join(", ")}]`;
+  const managedAuthSessionSetRoutines = `ARRAY[${[
+    "get_canonical_human_exact_login_binding(text,text)",
+    "managed_auth_session_set_authority_state(text)",
+    "managed_auth_session_set_snapshot(text,text,boolean,boolean,boolean)",
+    "managed_auth_session_set_bootstrap(text,text,text,text,uuid,text,bigint,bigint)",
+    "managed_auth_session_set_begin_transaction(text,text,text,uuid,text,bigint,uuid,bigint,text,text,uuid,uuid,text,timestamp with time zone)",
+    "managed_auth_session_set_complete_transaction(text,text,uuid,text,bigint,bigint,uuid,text,text,text)",
+    "managed_auth_session_set_mutate(text,text,uuid,text,bigint,bigint,text,uuid,uuid,uuid,text,text)",
+    "managed_auth_actor_mutation_fence(text,bigint,uuid)",
+    "managed_auth_actor_mutation_lease_acquire(text,bigint,uuid,integer)",
+    "managed_auth_actor_mutation_lease_release(text,uuid)",
+    "managed_auth_actor_mutation_lease_validate(text,bigint,uuid)",
+    "managed_auth_adopted_session_snapshot(text)",
+    "managed_auth_isolated_session_reap(integer)",
+    "managed_auth_expired_session_set_reap(integer)",
+    "managed_auth_session_set_operation_receipt(text,uuid,text,text)"
+  ].map(literal).join(", ")}]`;
+  const organizationRecoveryRoutines = `ARRAY[${[
+    "get_organization_recovery_overview(uuid,text,jsonb,text,text)",
+    "organization_recovery_command(jsonb)"
+  ].map(literal).join(", ")}]`;
   await sql2.unsafe(`
 DO $$
 DECLARE
@@ -3622,6 +3776,22 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    -- Migration 0365 creates the advisory work-claim mutation capabilities
+    -- before a custom runtime role may exist. Re-converge their exact grants
+    -- for migrate-then-provision installs without exposing claim history or
+    -- the write-capability ledger to direct runtime DML.
+    FOREACH routine_signature IN ARRAY ${workClaimCapabilityRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
     IF to_regprocedure(
       format(
         '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
@@ -3876,6 +4046,30 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    FOREACH routine_signature IN ARRAY ${managedAuthSessionSetRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH routine_signature IN ARRAY ${organizationRecoveryRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
     -- Migration 0225 creates these target-schema-local session visibility
     -- capabilities before opengeni_app may exist. Re-converge their exact
     -- EXECUTE grants for migrate-then-provision installs without granting
@@ -4800,6 +4994,7 @@ if (import.meta.main) {
 }
 
 export {
+  WORK_CLAIM_CAPABILITY_ROUTINES,
   RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
   RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES,
   RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES,
@@ -4821,4 +5016,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-PYMY3AJW.js.map
+//# sourceMappingURL=chunk-744DFC65.js.map