@opengeni/db 3.5.2-canary.0 → 3.7.3-canary.0

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-U7NKCX5E.js";
-import "./chunk-X6T2P3L3.js";
-import "./chunk-6NYKC5DD.js";
+} from "./chunk-U4WPPEBH.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/{chunk-PERPE2UY.js → chunk-4NAR7FBA.js}

@@ -158,6 +158,8 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "list_organization_administration_members(uuid, text)",
   "get_organization_administration_overview(uuid, text)",
   "get_workspace_kind(uuid, uuid)",
+  "resolve_workspace_codex_subscription_source(uuid, uuid)",
+  "list_organization_workspace_ids(uuid)",
   "organization_workspace_command(jsonb)",
   "resolve_organization_workspace_removal_subject(uuid, text, uuid)",
   "prepare_organization_workspace_member_removal(jsonb)",
@@ -275,6 +277,7 @@ var USER_RESOURCE_LIFECYCLE_ROUTINES = [
   "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)",
   "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)",
   "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)",
+  "issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean)",
   "revoke_self_user_resource_grant(uuid, uuid, uuid)",
   "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)"
 ];
@@ -433,6 +436,10 @@ var TASK_NOTE_CAPABILITY_ROUTINES = [
   "replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)",
   "resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)"
 ];
+var WORK_CLAIM_CAPABILITY_ROUTINES = [
+  "upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)",
+  "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)"
+];
 var COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE = "company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer)";
 var COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE = "company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamp with time zone, uuid, integer)";
 var GOVERNED_LEARNING_EVALUATION_ROUTINE = "evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)";
@@ -456,15 +463,21 @@ var GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES = [
 ];
 var COMPANY_PROFILE_AGENT_ADMIN_ROUTINES = [
   "propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)",
-  "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)"
+  "propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text)",
+  "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)",
+  "get_company_profile_agent_policy(uuid, uuid, text)",
+  "update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid)"
 ];
 var COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES = [
   "company_profile_activation_events",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "company_profile_heads",
   "company_profile_revisions",
   "managed_accounts",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_memberships",
   "session_human_input_requests",
   "session_turn_attempts",
@@ -545,6 +558,7 @@ var SESSION_AUTHORITY_ROUTINES = /* @__PURE__ */ new Set([
   ...PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES,
   TRANSITION_SESSION_VISIBILITY_ROUTINE,
   ...TASK_NOTE_CAPABILITY_ROUTINES,
+  ...WORK_CLAIM_CAPABILITY_ROUTINES,
   COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE,
   COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE
 ]);
@@ -597,6 +611,7 @@ var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
   ...MANAGED_AUTH_SESSION_SET_ROUTINES,
   ...ORGANIZATION_RECOVERY_ROUTINES,
   ...TASK_NOTE_CAPABILITY_ROUTINES,
+  ...WORK_CLAIM_CAPABILITY_ROUTINES,
   SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
   SESSION_REFERENCE_VISIBLE_ROUTINE,
   SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE,
@@ -621,6 +636,7 @@ var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
   ...DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES
 ];
 var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
+  "resolve_workspace_codex_subscription_source(uuid, uuid)",
   SESSION_REFERENCE_VISIBLE_ROUTINE,
   XAI_SNAPSHOT_VALIDATOR_ROUTINE
 ];
@@ -677,6 +693,7 @@ var FORCE_RLS_TABLES = [
   "company_brain_preference_proposal_receipts",
   "company_brain_turn_context_snapshots",
   "company_profile_activation_events",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "company_profile_heads",
@@ -785,6 +802,9 @@ var FORCE_RLS_TABLES = [
   "model_call_facts",
   "network_routes",
   "new_session_drafts",
+  "organization_codex_rotation_settings",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -867,6 +887,7 @@ var FORCE_RLS_TABLES = [
   "session_attempt_tool_catalogs",
   "session_background_commands",
   "session_command_receipts",
+  "session_event_cursors",
   "session_events",
   "session_goal_revisions",
   "session_goals",
@@ -892,6 +913,9 @@ var FORCE_RLS_TABLES = [
   "session_turns",
   "session_variable_set_attachments",
   "session_visibility_write_capabilities",
+  "session_work_claim_revisions",
+  "session_work_claim_write_capabilities",
+  "session_work_claims",
   "session_workflow_wake_outbox",
   "sessions",
   "site_auth_connections",
@@ -940,6 +964,7 @@ var FORCE_RLS_TABLES = [
   "workspace_artifact_versions",
   "workspace_artifacts",
   "workspace_captures",
+  "workspace_codex_subscription_preferences",
   "workspace_control_events",
   "workspace_inference_controls",
   "workspace_instruction_policy_activation_events",
@@ -1053,6 +1078,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "memory_slack_publications",
   "model_call_facts",
   "new_session_drafts",
+  "organization_codex_rotation_settings",
   "pack_installation_components",
   "pack_installations",
   "pr_review_app_registrations",
@@ -1073,6 +1099,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "session_attempt_interruptions",
   "session_background_commands",
   "session_command_receipts",
+  "session_event_cursors",
   "session_events",
   "session_goals",
   "session_history_items",
@@ -1118,6 +1145,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "video_generation_references",
   "workspace_artifacts",
   "workspace_captures",
+  "workspace_codex_subscription_preferences",
   "workspace_control_events",
   "workspace_inference_controls",
   "workspace_instruction_policy_heads",
@@ -1146,6 +1174,7 @@ var RUNTIME_READ_ONLY_TABLES = [
   "preference_registry_events",
   "preference_registry_snapshots",
   "session_tenancy_activations",
+  "session_work_claims",
   "slack_installation_bindings",
   "slack_task_policy_activation_events",
   "slack_task_policy_heads",
@@ -1247,6 +1276,7 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "company_brain_context_selection_receipts",
   "company_brain_preference_proposal_receipts",
   "company_brain_turn_context_snapshots",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "connection_use_audit_facts",
@@ -1272,6 +1302,8 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "managed_auth_login_transactions",
   "managed_auth_session_set_operations",
   "managed_auth_session_sets",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -1329,6 +1361,8 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "session_tenancy_greenfield_activation_evidence",
   "session_variable_set_attachments",
   "session_visibility_write_capabilities",
+  "session_work_claim_revisions",
+  "session_work_claim_write_capabilities",
   "task_note_events",
   "task_note_knowledge_promotion_capabilities",
   "task_note_replacement_receipts",
@@ -3106,7 +3140,9 @@ END $$;
 `);
 }
 async function ensureLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
+  await executeRoleConvergence(
+    sql2,
+    `
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
@@ -3115,10 +3151,13 @@ BEGIN
     EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
   END IF;
 END $$;
-`);
+`
+  );
 }
 async function ensureRestrictedAppLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
+  await executeRoleConvergence(
+    sql2,
+    `
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
@@ -3146,7 +3185,26 @@ BEGIN
     );
   END IF;
 END $$;
-`);
+`
+  );
+}
+var ROLE_CONVERGENCE_MAX_ATTEMPTS = 20;
+function isRetryableConcurrentRoleMutation(error) {
+  const details = error;
+  return details.code === "XX000" && details.message === "tuple concurrently updated" && details.routine === "simple_heap_update" || details.code === "42710" && typeof details.message === "string" && /^role ".+" already exists$/u.test(details.message);
+}
+async function executeRoleConvergence(sql2, statement) {
+  for (let attempt = 1; attempt <= ROLE_CONVERGENCE_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      await sql2.unsafe(statement);
+      return;
+    } catch (error) {
+      if (!isRetryableConcurrentRoleMutation(error) || attempt === ROLE_CONVERGENCE_MAX_ATTEMPTS) {
+        throw error;
+      }
+      await new Promise((resolve) => setTimeout(resolve, Math.min(25 * attempt, 250)));
+    }
+  }
 }
 async function assertAppRoleSafeToNormalize(sql2, role) {
   const exists = await sql2`
@@ -3254,6 +3312,7 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
   const runtimeReadUpdateTables = `ARRAY[${RUNTIME_READ_UPDATE_TABLES.map(literal).join(", ")}]`;
   const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(", ")}]`;
   const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(", ")}]`;
+  const workClaimCapabilityRoutines = `ARRAY[${WORK_CLAIM_CAPABILITY_ROUTINES.map(literal).join(", ")}]`;
   const organizationMembershipLifecycleRoutines = `ARRAY[${[
     "list_self_organization_memberships(text)",
     "list_self_organization_invitations(text)",
@@ -3264,6 +3323,8 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "list_organization_invitations(uuid,text,uuid,integer)",
     "get_organization_administration_overview(uuid,text)",
     "get_workspace_kind(uuid,uuid)",
+    "resolve_workspace_codex_subscription_source(uuid,uuid)",
+    "list_organization_workspace_ids(uuid)",
     "organization_workspace_command(jsonb)",
     "resolve_organization_workspace_removal_subject(uuid,text,uuid)",
     "prepare_organization_workspace_member_removal(jsonb)",
@@ -3763,6 +3824,22 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    -- Migration 0365 creates the advisory work-claim mutation capabilities
+    -- before a custom runtime role may exist. Re-converge their exact grants
+    -- for migrate-then-provision installs without exposing claim history or
+    -- the write-capability ledger to direct runtime DML.
+    FOREACH routine_signature IN ARRAY ${workClaimCapabilityRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
     IF to_regprocedure(
       format(
         '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
@@ -3811,6 +3888,18 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.propose_company_profile_for_attempt_v2(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.confirm_company_profile_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid)',
@@ -3823,6 +3912,27 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format('%I.get_company_profile_agent_policy(uuid,uuid,text)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_company_profile_agent_policy(uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.update_company_profile_agent_policy(uuid,uuid,text,text,bigint,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',
@@ -4409,6 +4519,11 @@ BEGIN
       EXECUTE format('REVOKE ALL ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
     END IF;
+    IF to_regprocedure(format('%I.issue_self_local_connection_use_grant(uuid,uuid,uuid,text,boolean)', ${literal(schema)}))
+      IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+    END IF;
     IF to_regprocedure(format('%I.resolve_connection_use_authority(uuid,uuid,uuid,jsonb)', ${literal(schema)}))
       IS NOT NULL THEN
       EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_connection_authorities(uuid) FROM PUBLIC', ${literal(schema)});
@@ -4965,6 +5080,7 @@ if (import.meta.main) {
 }
 
 export {
+  WORK_CLAIM_CAPABILITY_ROUTINES,
   RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
   RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES,
   RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES,
@@ -4986,4 +5102,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-PERPE2UY.js.map
+//# sourceMappingURL=chunk-4NAR7FBA.js.map