@opengeni/db 3.6.0 → 3.7.3-canary.0

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-UGDVSQ6U.js";
-import "./chunk-WW7AJ5IC.js";
-import "./chunk-UJ2EW3QI.js";
+} from "./chunk-U4WPPEBH.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/{chunk-744DFC65.js → chunk-4NAR7FBA.js}

@@ -158,6 +158,8 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "list_organization_administration_members(uuid, text)",
   "get_organization_administration_overview(uuid, text)",
   "get_workspace_kind(uuid, uuid)",
+  "resolve_workspace_codex_subscription_source(uuid, uuid)",
+  "list_organization_workspace_ids(uuid)",
   "organization_workspace_command(jsonb)",
   "resolve_organization_workspace_removal_subject(uuid, text, uuid)",
   "prepare_organization_workspace_member_removal(jsonb)",
@@ -275,6 +277,7 @@ var USER_RESOURCE_LIFECYCLE_ROUTINES = [
   "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)",
   "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)",
   "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)",
+  "issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean)",
   "revoke_self_user_resource_grant(uuid, uuid, uuid)",
   "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)"
 ];
@@ -460,15 +463,21 @@ var GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES = [
 ];
 var COMPANY_PROFILE_AGENT_ADMIN_ROUTINES = [
   "propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)",
-  "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)"
+  "propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text)",
+  "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)",
+  "get_company_profile_agent_policy(uuid, uuid, text)",
+  "update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid)"
 ];
 var COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES = [
   "company_profile_activation_events",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "company_profile_heads",
   "company_profile_revisions",
   "managed_accounts",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_memberships",
   "session_human_input_requests",
   "session_turn_attempts",
@@ -627,6 +636,7 @@ var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
   ...DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES
 ];
 var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
+  "resolve_workspace_codex_subscription_source(uuid, uuid)",
   SESSION_REFERENCE_VISIBLE_ROUTINE,
   XAI_SNAPSHOT_VALIDATOR_ROUTINE
 ];
@@ -683,6 +693,7 @@ var FORCE_RLS_TABLES = [
   "company_brain_preference_proposal_receipts",
   "company_brain_turn_context_snapshots",
   "company_profile_activation_events",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "company_profile_heads",
@@ -791,6 +802,9 @@ var FORCE_RLS_TABLES = [
   "model_call_facts",
   "network_routes",
   "new_session_drafts",
+  "organization_codex_rotation_settings",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -873,6 +887,7 @@ var FORCE_RLS_TABLES = [
   "session_attempt_tool_catalogs",
   "session_background_commands",
   "session_command_receipts",
+  "session_event_cursors",
   "session_events",
   "session_goal_revisions",
   "session_goals",
@@ -949,6 +964,7 @@ var FORCE_RLS_TABLES = [
   "workspace_artifact_versions",
   "workspace_artifacts",
   "workspace_captures",
+  "workspace_codex_subscription_preferences",
   "workspace_control_events",
   "workspace_inference_controls",
   "workspace_instruction_policy_activation_events",
@@ -1062,6 +1078,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "memory_slack_publications",
   "model_call_facts",
   "new_session_drafts",
+  "organization_codex_rotation_settings",
   "pack_installation_components",
   "pack_installations",
   "pr_review_app_registrations",
@@ -1082,6 +1099,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "session_attempt_interruptions",
   "session_background_commands",
   "session_command_receipts",
+  "session_event_cursors",
   "session_events",
   "session_goals",
   "session_history_items",
@@ -1127,6 +1145,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "video_generation_references",
   "workspace_artifacts",
   "workspace_captures",
+  "workspace_codex_subscription_preferences",
   "workspace_control_events",
   "workspace_inference_controls",
   "workspace_instruction_policy_heads",
@@ -1257,6 +1276,7 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "company_brain_context_selection_receipts",
   "company_brain_preference_proposal_receipts",
   "company_brain_turn_context_snapshots",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "connection_use_audit_facts",
@@ -1282,6 +1302,8 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "managed_auth_login_transactions",
   "managed_auth_session_set_operations",
   "managed_auth_session_sets",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -3118,7 +3140,9 @@ END $$;
 `);
 }
 async function ensureLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
+  await executeRoleConvergence(
+    sql2,
+    `
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
@@ -3127,10 +3151,13 @@ BEGIN
     EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
   END IF;
 END $$;
-`);
+`
+  );
 }
 async function ensureRestrictedAppLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
+  await executeRoleConvergence(
+    sql2,
+    `
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
@@ -3158,7 +3185,26 @@ BEGIN
     );
   END IF;
 END $$;
-`);
+`
+  );
+}
+var ROLE_CONVERGENCE_MAX_ATTEMPTS = 20;
+function isRetryableConcurrentRoleMutation(error) {
+  const details = error;
+  return details.code === "XX000" && details.message === "tuple concurrently updated" && details.routine === "simple_heap_update" || details.code === "42710" && typeof details.message === "string" && /^role ".+" already exists$/u.test(details.message);
+}
+async function executeRoleConvergence(sql2, statement) {
+  for (let attempt = 1; attempt <= ROLE_CONVERGENCE_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      await sql2.unsafe(statement);
+      return;
+    } catch (error) {
+      if (!isRetryableConcurrentRoleMutation(error) || attempt === ROLE_CONVERGENCE_MAX_ATTEMPTS) {
+        throw error;
+      }
+      await new Promise((resolve) => setTimeout(resolve, Math.min(25 * attempt, 250)));
+    }
+  }
 }
 async function assertAppRoleSafeToNormalize(sql2, role) {
   const exists = await sql2`
@@ -3277,6 +3323,8 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "list_organization_invitations(uuid,text,uuid,integer)",
     "get_organization_administration_overview(uuid,text)",
     "get_workspace_kind(uuid,uuid)",
+    "resolve_workspace_codex_subscription_source(uuid,uuid)",
+    "list_organization_workspace_ids(uuid)",
     "organization_workspace_command(jsonb)",
     "resolve_organization_workspace_removal_subject(uuid,text,uuid)",
     "prepare_organization_workspace_member_removal(jsonb)",
@@ -3840,6 +3888,18 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.propose_company_profile_for_attempt_v2(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.confirm_company_profile_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid)',
@@ -3852,6 +3912,27 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format('%I.get_company_profile_agent_policy(uuid,uuid,text)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_company_profile_agent_policy(uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.update_company_profile_agent_policy(uuid,uuid,text,text,bigint,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',
@@ -4438,6 +4519,11 @@ BEGIN
       EXECUTE format('REVOKE ALL ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
     END IF;
+    IF to_regprocedure(format('%I.issue_self_local_connection_use_grant(uuid,uuid,uuid,text,boolean)', ${literal(schema)}))
+      IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+    END IF;
     IF to_regprocedure(format('%I.resolve_connection_use_authority(uuid,uuid,uuid,jsonb)', ${literal(schema)}))
       IS NOT NULL THEN
       EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_connection_authorities(uuid) FROM PUBLIC', ${literal(schema)});
@@ -5016,4 +5102,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-744DFC65.js.map
+//# sourceMappingURL=chunk-4NAR7FBA.js.map