@opengeni/db 3.6.0 → 3.7.3-canary.0

package/dist/schema.js

@@ -46,6 +46,7 @@ import {
   companyBrainContextSelectionReceipts,
   companyBrainTurnContextSnapshots,
   companyProfileActivationEvents,
+  companyProfileAgentAutomaticActivationReceipts,
   companyProfileAgentConfirmationReceipts,
   companyProfileAgentProposalReceipts,
   companyProfileHeads,
@@ -160,6 +161,9 @@ import {
   nestedAgentDepthConfiguration,
   networkRoutes,
   newSessionDrafts,
+  organizationCodexRotationSettings,
+  organizationCompanyProfileAgentPolicies,
+  organizationCompanyProfileAgentPolicyEvents,
   organizationInvitationBindingEvents,
   organizationMembershipInvitations,
   organizationMembershipLifecycleEvents,
@@ -224,6 +228,7 @@ import {
   sessionAttemptToolCatalogs,
   sessionBackgroundCommands,
   sessionCommandReceipts,
+  sessionEventCursors,
   sessionEvents,
   sessionGoalRevisions,
   sessionGoals,
@@ -303,6 +308,7 @@ import {
   workspaceArtifactVersions,
   workspaceArtifacts,
   workspaceCaptures,
+  workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,
@@ -331,7 +337,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-UJ2EW3QI.js";
+} from "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -381,6 +387,7 @@ export {
   companyBrainContextSelectionReceipts,
   companyBrainTurnContextSnapshots,
   companyProfileActivationEvents,
+  companyProfileAgentAutomaticActivationReceipts,
   companyProfileAgentConfirmationReceipts,
   companyProfileAgentProposalReceipts,
   companyProfileHeads,
@@ -495,6 +502,9 @@ export {
   nestedAgentDepthConfiguration,
   networkRoutes,
   newSessionDrafts,
+  organizationCodexRotationSettings,
+  organizationCompanyProfileAgentPolicies,
+  organizationCompanyProfileAgentPolicyEvents,
   organizationInvitationBindingEvents,
   organizationMembershipInvitations,
   organizationMembershipLifecycleEvents,
@@ -559,6 +569,7 @@ export {
   sessionAttemptToolCatalogs,
   sessionBackgroundCommands,
   sessionCommandReceipts,
+  sessionEventCursors,
   sessionEvents,
   sessionGoalRevisions,
   sessionGoals,
@@ -638,6 +649,7 @@ export {
   workspaceArtifactVersions,
   workspaceArtifacts,
   workspaceCaptures,
+  workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,

package/dist/session-background-commands.js

@@ -12,9 +12,9 @@ import {
   settleClaimedConnectedMachineBackgroundCommand,
   settleConnectedMachineSessionBackgroundCommand,
   settleSessionBackgroundCommandForRetainedProcess
-} from "./chunk-CDMMSUWJ.js";
-import "./chunk-WW7AJ5IC.js";
-import "./chunk-UJ2EW3QI.js";
+} from "./chunk-S3TDDCS2.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   backgroundCommandActivityForSessions,

package/dist/session-control.d.ts

@@ -60,6 +60,17 @@ export type EffectiveSessionControl = {
         commandCount: number;
     } | null;
 };
+/**
+ * The bounded control projection required by a locked activity-write fence.
+ * Settlement and background-command summaries are read-model concerns and must
+ * not extend the session-event critical section when admission only needs the
+ * effective run state and blocker scope.
+ */
+export type SessionWriteAdmissionControl = {
+    state: EffectiveControlState;
+    controlVersion: number;
+    primaryBlockerKind: EffectiveControlBlocker["kind"] | null;
+};
 export declare const SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS = 200;
 export declare const SESSION_DISCOVERY_CONTROL_TARGET_LIMIT = 100;
 /**
@@ -272,6 +283,13 @@ export type SessionEventWriteLockInput = {
     controlLock: WorkspaceControlLockMode | "already_locked" | "none";
     /** Used only when a staged caller already established the workspace prefix. */
     workspaceLock?: "key_share" | "already_locked";
+    /**
+     * Semantic writers retain FOR NO KEY UPDATE. Cursor-authoritative raw-only
+     * appends need only the FK-compatible identity hold; KEY SHARE is compatible
+     * with semantic NO KEY UPDATE and therefore removes the wide session row as
+     * their serialization mutex without inverting the rolling lock order.
+     */
+    sessionLock?: "no_key_update" | "key_share";
     sessionIds?: string[];
     turnIds?: string[];
     attemptIds?: string[];
@@ -280,6 +298,7 @@ export type SessionEventWriteLocks = {
     control: WorkspaceControlRow | null;
     workspace: typeof schema.workspaces.$inferSelect | null;
     sessions: Array<typeof schema.sessions.$inferSelect>;
+    cursors: Array<typeof schema.sessionEventCursors.$inferSelect>;
     turns: Array<typeof schema.sessionTurns.$inferSelect>;
     attempts: Array<typeof schema.sessionTurnAttempts.$inferSelect>;
 };
@@ -289,7 +308,8 @@ export type SessionEventWriteLocks = {
  *   workspace-control advisory lock + workspace_inference_controls row
  *     (when control-aware; see `lockWorkspaceInferenceControl`)
  *     -> actual workspaces row FOR KEY SHARE
- *     -> session rows FOR NO KEY UPDATE, UUID ordered
+ *     -> session rows FOR NO KEY UPDATE (semantic) or KEY SHARE (raw), UUID ordered
+ *     -> session event cursor rows FOR UPDATE, UUID ordered
  *     -> exact turn rows FOR UPDATE, UUID ordered
  *     -> exact attempt rows FOR UPDATE, UUID ordered
  *
@@ -304,10 +324,12 @@ export type SessionEventWriteLocks = {
  * `FOR UPDATE` lock serialized unrelated sessions and inverted the activity
  * path's session -> implicit workspace-FK edge.
  *
- * `FOR NO KEY UPDATE` is equally deliberate for sessions. Session primary and
- * composite identity keys are immutable, so writers need to exclude only concurrent
- * non-key mutation. Keeping FK `FOR KEY SHARE` checks compatible prevents the
- * activity finalizer's workspace counter from participating in a lock cycle.
+ * `FOR NO KEY UPDATE` is equally deliberate for semantic session writers.
+ * Cursor-authoritative raw-only writers use `FOR KEY SHARE`: it preserves the
+ * session identity against deletion while remaining compatible with semantic
+ * `FOR NO KEY UPDATE`. Keeping this rolling session-before-cursor order avoids
+ * an inversion with old binaries and quiescent cascade deletion; the compact
+ * cursor row, not the wide session row, is the raw ordering mutex.
  *
  * Complex lifecycle transactions may acquire allocator/control locks before
  * this helper and may discover exact turn IDs only after locking the session.
@@ -379,6 +401,19 @@ export declare function evaluateSessionControls(db: Database, workspaceId: strin
     /** Reuse a control row already locked before workspace/session/turn rows. */
     workspaceControl?: WorkspaceControlRow | undefined;
 }): Promise<Map<string, EffectiveSessionControl>>;
+/**
+ * Evaluate only the control facts needed to admit an already locked session
+ * write. The workspace-control row must be reused when the caller established
+ * the canonical prefix before session/turn/attempt locks.
+ *
+ * Deliberately omit settlementAttemptCounts and
+ * stoppingBackgroundCommandCounts: those recursive summaries do not affect
+ * effective pause state and their results are discarded by the write fence.
+ */
+export declare function evaluateSessionWriteAdmissionControl(db: Database, workspaceId: string, sessionId: string, options?: {
+    lock?: WorkspaceControlLockMode;
+    workspaceControl?: WorkspaceControlRow | undefined;
+}): Promise<SessionWriteAdmissionControl>;
 /**
  * Return one compact aggregate row per target for `sessions_list`.
  *

package/dist/session-queue-commands.d.ts

@@ -67,8 +67,10 @@ export type AgentInternalUpdateCommandResult = {
 };
 type SteerSupersessionResult = {
     interruptionCount: number;
+    steerTargetTurn: typeof schema.sessionTurns.$inferSelect | null;
     replacedTurn: typeof schema.sessionTurns.$inferSelect | null;
     liveCurrentTurnId: string | null;
+    deferredUntilCompaction: boolean;
     lastSequence: number;
 };
 /**

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-IW6O6G7R.js";
-import "./chunk-WW7AJ5IC.js";
-import "./chunk-UJ2EW3QI.js";
+} from "./chunk-5NNCGFQY.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/user-resource-authority.d.ts

@@ -71,6 +71,14 @@ export declare function issueSelfUserResourceGrant(db: Database, input: {
     expectedAuthorityEpoch?: number | null;
     workspaceSharedAcknowledged: boolean;
 }): Promise<UserResourceAuthorityGrant>;
+export declare function issueSelfLocalConnectionUseGrant(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authorityId: string;
+    context: "user_private" | "workspace_shared";
+    workspaceSharedAcknowledged: boolean;
+}): Promise<UserResourceAuthorityGrant>;
 export declare function revokeSelfUserResourceGrant(db: Database, input: {
     accountId: string;
     workspaceId: string;

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-Q5YUGQVK.js";
-import "./chunk-WW7AJ5IC.js";
-import "./chunk-UJ2EW3QI.js";
+} from "./chunk-SZAWDXQC.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/drizzle/0369_local_human_personal_authority.sql

@@ -0,0 +1,350 @@
+-- deployment-mode: rolling
+-- Give the explicit single-user local identity the same private authority
+-- anchor as a managed human. This does not add runtime access to the hidden
+-- personal workspace and does not authorize configured keys or host services.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $local_human_personal_authority$
+DECLARE
+  data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION %1$I.ensure_managed_human_personal_workspace(
+      p_account_id uuid,
+      p_subject_id text,
+      p_personal_workspace_id uuid
+    )
+    RETURNS TABLE (
+      organization_membership_id uuid,
+      personal_workspace_id uuid
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = %1$I, pg_catalog
+    AS $body$
+    DECLARE
+      expected_external_id text;
+      managed_identity boolean := false;
+      local_identity boolean := false;
+      membership_row organization_memberships%%ROWTYPE;
+      workspace_row workspaces%%ROWTYPE;
+      previous_workspace_id text := pg_catalog.current_setting(
+        'opengeni.workspace_id', true
+      );
+      previous_lifecycle_marker text := pg_catalog.current_setting(
+        'opengeni.organization_tenancy_lifecycle', true
+      );
+    BEGIN
+      IF p_account_id IS NULL
+        OR p_subject_id IS NULL
+        OR p_personal_workspace_id IS NULL
+        OR p_subject_id <> pg_catalog.btrim(p_subject_id)
+        OR pg_catalog.length(p_subject_id) NOT BETWEEN 1 AND 1024
+      THEN
+        RAISE EXCEPTION 'human provisioning requires a valid complete identity'
+          USING ERRCODE = '42501';
+      END IF;
+
+      IF p_account_id IS DISTINCT FROM opengeni_private.current_account_id() THEN
+        RAISE EXCEPTION 'human provisioning account authority is invalid'
+          USING ERRCODE = '42501';
+      END IF;
+
+      IF p_subject_id LIKE 'user:%%' THEN
+        expected_external_id := pg_catalog.substr(p_subject_id, 6);
+        SELECT EXISTS (
+          SELECT 1
+          FROM managed_accounts account_row
+          WHERE account_row.id = p_account_id
+            AND account_row.external_source = 'better-auth:user'
+            AND account_row.external_id = expected_external_id
+        ) INTO managed_identity;
+      END IF;
+      SELECT EXISTS (
+        SELECT 1
+        FROM managed_accounts account_row
+        WHERE account_row.id = p_account_id
+          AND account_row.external_source = 'opengeni:local'
+          AND account_row.external_id = 'default'
+          AND p_subject_id = 'dev'
+          AND opengeni_private.current_subject_id() = p_subject_id
+      ) INTO local_identity;
+      IF NOT managed_identity AND NOT local_identity THEN
+        RAISE EXCEPTION 'human provisioning account identity is invalid'
+          USING ERRCODE = '42501';
+      END IF;
+
+      IF NOT EXISTS (
+        SELECT 1
+        FROM workspace_memberships owner_membership
+        INNER JOIN workspaces owner_workspace
+          ON owner_workspace.id = owner_membership.workspace_id
+         AND owner_workspace.account_id = owner_membership.account_id
+        WHERE owner_membership.account_id = p_account_id
+          AND owner_membership.subject_id = p_subject_id
+          AND owner_membership.role = 'owner'
+          AND (
+            NOT local_identity
+            OR (
+              owner_workspace.external_source = 'opengeni:local'
+              AND owner_workspace.external_id = 'default'
+            )
+          )
+      ) THEN
+        RAISE EXCEPTION 'human provisioning owner membership is invalid'
+          USING ERRCODE = '42501';
+      END IF;
+
+      SELECT * INTO workspace_row
+      FROM workspaces candidate_workspace
+      WHERE candidate_workspace.id = p_personal_workspace_id
+      FOR UPDATE;
+      IF NOT FOUND
+        OR workspace_row.account_id IS DISTINCT FROM p_account_id
+        OR workspace_row.external_source IS DISTINCT FROM 'opengeni:organization-membership'
+        OR workspace_row.external_id IS DISTINCT FROM (
+          p_account_id::text || ':' || p_subject_id
+        )
+      THEN
+        RAISE EXCEPTION 'human provisioning personal workspace identity is invalid'
+          USING ERRCODE = '42501';
+      END IF;
+
+      IF EXISTS (
+        SELECT 1 FROM workspaces conflicting_workspace
+        WHERE conflicting_workspace.external_source = 'opengeni:organization-membership'
+          AND conflicting_workspace.external_id = p_account_id::text || ':' || p_subject_id
+          AND conflicting_workspace.id <> p_personal_workspace_id
+      ) THEN
+        RAISE EXCEPTION 'human provisioning personal workspace identity conflicts'
+          USING ERRCODE = '23505';
+      END IF;
+
+      IF EXISTS (
+        SELECT 1 FROM workspace_memberships personal_access
+        WHERE personal_access.workspace_id = p_personal_workspace_id
+      ) THEN
+        RAISE EXCEPTION 'human personal workspace already has runtime access'
+          USING ERRCODE = '42501';
+      END IF;
+
+      PERFORM pg_catalog.set_config(
+        'opengeni.workspace_id', p_personal_workspace_id::text, true
+      );
+      IF NOT EXISTS (
+        SELECT 1 FROM workspace_inference_controls control_row
+        WHERE control_row.workspace_id = p_personal_workspace_id
+          AND control_row.account_id = p_account_id
+      ) THEN
+        RAISE EXCEPTION 'human personal workspace control is missing'
+          USING ERRCODE = '42501';
+      END IF;
+
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle',
+        'managed_human_provisioning',
+        true
+      );
+      INSERT INTO organization_memberships (
+        account_id, subject_id, status, personal_workspace_id
+      ) VALUES (
+        p_account_id, p_subject_id, 'active', p_personal_workspace_id
+      ) ON CONFLICT (account_id, subject_id) DO NOTHING;
+
+      SELECT * INTO membership_row
+      FROM organization_memberships candidate_membership
+      WHERE candidate_membership.account_id = p_account_id
+        AND candidate_membership.subject_id = p_subject_id
+      FOR UPDATE;
+      IF NOT FOUND THEN
+        RAISE EXCEPTION 'human organization membership was not created'
+          USING ERRCODE = 'P0002';
+      END IF;
+      IF membership_row.status IN ('suspended', 'revoked') THEN
+        RAISE EXCEPTION 'human organization membership is not active'
+          USING ERRCODE = '42501';
+      END IF;
+      IF membership_row.personal_workspace_id IS NOT NULL
+        AND membership_row.personal_workspace_id IS DISTINCT FROM p_personal_workspace_id
+      THEN
+        RAISE EXCEPTION 'human organization membership personal workspace conflicts'
+          USING ERRCODE = '23505';
+      END IF;
+      IF membership_row.status = 'provisioning' THEN
+        UPDATE organization_memberships
+        SET status = 'active',
+            personal_workspace_id = p_personal_workspace_id,
+            updated_at = pg_catalog.clock_timestamp()
+        WHERE id = membership_row.id;
+        membership_row.status := 'active';
+        membership_row.personal_workspace_id := p_personal_workspace_id;
+      END IF;
+      IF membership_row.status <> 'active'
+        OR membership_row.personal_workspace_id IS DISTINCT FROM p_personal_workspace_id
+      THEN
+        RAISE EXCEPTION 'human organization membership did not converge'
+          USING ERRCODE = '42501';
+      END IF;
+
+      PERFORM pg_catalog.set_config(
+        'opengeni.workspace_id', coalesce(previous_workspace_id, ''), true
+      );
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle',
+        coalesce(previous_lifecycle_marker, ''),
+        true
+      );
+      organization_membership_id := membership_row.id;
+      personal_workspace_id := membership_row.personal_workspace_id;
+      RETURN NEXT;
+    EXCEPTION WHEN OTHERS THEN
+      PERFORM pg_catalog.set_config(
+        'opengeni.workspace_id', coalesce(previous_workspace_id, ''), true
+      );
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle',
+        coalesce(previous_lifecycle_marker, ''),
+        true
+      );
+      RAISE;
+    END;
+    $body$;
+  $ddl$, data_schema);
+
+  EXECUTE format(
+    'REVOKE ALL ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid,text,uuid) FROM PUBLIC',
+    data_schema
+  );
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid,text,uuid) TO opengeni_app',
+      data_schema
+    );
+  END IF;
+END
+$local_human_personal_authority$;
+
+COMMENT ON FUNCTION ensure_managed_human_personal_workspace(uuid, text, uuid) IS
+  'Lifecycle-only managed or explicit local-human organization membership and personal-workspace provisioning; no workspace access grant.';
+
+CREATE FUNCTION issue_self_local_connection_use_grant(
+  p_account_id uuid,
+  p_authority_id uuid,
+  p_workspace_id uuid,
+  p_context text,
+  p_workspace_shared_acknowledged boolean DEFAULT false
+) RETURNS TABLE (
+  grant_id uuid, organization_id uuid, authority_generation bigint,
+  target_workspace_id uuid, target_session_id uuid, action text,
+  grant_mode text, grant_context text, authority_epoch integer,
+  grant_generation bigint, grant_status text, expires_at timestamptz
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+#variable_conflict use_column
+DECLARE
+  caller_subject text := nullif(current_setting('opengeni.subject_id', true), '');
+  owner_membership_id uuid;
+BEGIN
+  PERFORM set_config(
+    'opengeni.organization_tenancy_lifecycle', 'personal_resource_grant_management', true
+  );
+  IF p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace_id IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR caller_subject IS DISTINCT FROM 'dev'
+    OR p_context NOT IN ('user_private', 'workspace_shared')
+    OR (p_context = 'workspace_shared' AND p_workspace_shared_acknowledged IS NOT TRUE)
+    OR NOT EXISTS (
+      SELECT 1 FROM managed_accounts account_row
+      WHERE account_row.id = p_account_id
+        AND account_row.external_source = 'opengeni:local'
+        AND account_row.external_id = 'default'
+    )
+  THEN
+    RAISE EXCEPTION 'local connection grant authority is invalid'
+      USING ERRCODE = '42501';
+  END IF;
+
+  SELECT membership.id INTO owner_membership_id
+  FROM organization_memberships membership
+  WHERE membership.account_id = p_account_id
+    AND membership.subject_id = caller_subject
+    AND membership.status = 'active'
+    AND membership.revoked_at IS NULL
+  FOR SHARE;
+  IF NOT FOUND OR NOT EXISTS (
+    SELECT 1 FROM workspace_memberships workspace_membership
+    WHERE workspace_membership.account_id = p_account_id
+      AND workspace_membership.workspace_id = p_workspace_id
+      AND workspace_membership.subject_id = caller_subject
+      AND workspace_membership.role = 'owner'
+  ) THEN
+    RAISE EXCEPTION 'local connection grant owner is invalid'
+      USING ERRCODE = '42501';
+  END IF;
+
+  SELECT authority.generation INTO authority_generation
+  FROM organization_user_resource_authorities authority
+  WHERE authority.id = p_authority_id
+    AND authority.account_id = p_account_id
+    AND authority.organization_membership_id = owner_membership_id
+    AND authority.resource_kind = 'connection'
+    AND authority.status = 'active'
+    AND authority.revoked_at IS NULL
+  FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'local connection authority is unavailable'
+      USING ERRCODE = '42501';
+  END IF;
+
+  INSERT INTO organization_user_resource_grants (
+    account_id, authority_id, owner_organization_membership_id, workspace_id,
+    session_id, action, mode, context, authority_epoch, generation, status
+  ) VALUES (
+    p_account_id, p_authority_id, owner_membership_id, p_workspace_id,
+    NULL, 'connection.use', 'always', p_context, NULL, 1, 'active'
+  )
+  ON CONFLICT (account_id, authority_id, workspace_id, action, mode, context,
+    (coalesce(session_id, '00000000-0000-0000-0000-000000000000'::uuid)),
+    (coalesce(authority_epoch, 0))) WHERE status = 'active'
+  DO UPDATE SET updated_at = organization_user_resource_grants.updated_at
+  RETURNING id, workspace_id, session_id, organization_user_resource_grants.action,
+    mode, context, organization_user_resource_grants.authority_epoch, generation,
+    status, organization_user_resource_grants.expires_at
+  INTO grant_id, target_workspace_id, target_session_id, action, grant_mode,
+    grant_context, authority_epoch, grant_generation, grant_status, expires_at;
+  organization_id := p_account_id;
+  RETURN NEXT;
+END
+$body$;
+
+DO $local_connection_grant_search_path$
+DECLARE
+  data_schema text := current_schema();
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION %I.issue_self_local_connection_use_grant(uuid,uuid,uuid,text,boolean) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+END
+$local_connection_grant_search_path$;
+REVOKE ALL ON FUNCTION issue_self_local_connection_use_grant(
+  uuid, uuid, uuid, text, boolean
+) FROM PUBLIC;
+DO $local_connection_grant_role$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION issue_self_local_connection_use_grant(
+      uuid, uuid, uuid, text, boolean
+    ) TO opengeni_app;
+  END IF;
+END
+$local_connection_grant_role$;
+
+COMMENT ON FUNCTION issue_self_local_connection_use_grant(
+  uuid, uuid, uuid, text, boolean
+) IS 'Idempotently issues standing connection.use only for the explicit local dev human and exact local owner workspace.';

package/drizzle/0370_workspace_member_management_scope.sql

@@ -0,0 +1,98 @@
+-- deployment-mode: rolling
+-- Workspace administrators may manage access to their exact shared workspace,
+-- but they may only add active human members of the owning organization.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE FUNCTION assert_workspace_member_management_candidate(
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_actor_subject_id text,
+  p_target_subject_id text
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  previous_lifecycle text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+BEGIN
+  IF p_account_id IS NULL OR p_workspace_id IS NULL
+    OR nullif(pg_catalog.btrim(p_actor_subject_id), '') IS NULL
+    OR nullif(pg_catalog.btrim(p_target_subject_id), '') IS NULL
+    OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace_id IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR p_actor_subject_id IS DISTINCT FROM opengeni_private.current_subject_id()
+  THEN
+    RAISE EXCEPTION 'workspace member management authority required' USING ERRCODE = '42501';
+  END IF;
+
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle',
+    'organization_membership_lifecycle', true
+  );
+
+  IF NOT EXISTS (
+    SELECT 1 FROM workspaces workspace
+    WHERE workspace.id = p_workspace_id AND workspace.account_id = p_account_id
+  ) THEN
+    RAISE EXCEPTION 'workspace not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  IF EXISTS (
+    SELECT 1 FROM organization_memberships membership
+    WHERE membership.account_id = p_account_id
+      AND membership.personal_workspace_id = p_workspace_id
+  ) THEN
+    RAISE EXCEPTION 'Personal workspace membership is owner-only' USING ERRCODE = '42501';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1
+    FROM organization_memberships organization_membership
+    JOIN workspace_memberships workspace_membership
+      ON workspace_membership.account_id = organization_membership.account_id
+     AND workspace_membership.subject_id = organization_membership.subject_id
+     AND workspace_membership.workspace_id = p_workspace_id
+    WHERE organization_membership.account_id = p_account_id
+      AND organization_membership.subject_id = p_actor_subject_id
+      AND organization_membership.status = 'active'
+      AND (
+        workspace_membership.permissions ? 'members:manage'
+        OR workspace_membership.permissions ? 'workspace:admin'
+      )
+  ) THEN
+    RAISE EXCEPTION 'workspace member management authority required' USING ERRCODE = '42501';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM organization_memberships target
+    WHERE target.account_id = p_account_id
+      AND target.subject_id = p_target_subject_id
+      AND target.status = 'active'
+  ) THEN
+    RAISE EXCEPTION 'active organization member not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle', COALESCE(previous_lifecycle, ''), true
+  );
+EXCEPTION WHEN OTHERS THEN
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle', COALESCE(previous_lifecycle, ''), true
+  );
+  RAISE;
+END
+$body$;
+
+REVOKE ALL ON FUNCTION assert_workspace_member_management_candidate(uuid, uuid, text, text)
+  FROM PUBLIC;
+DO $workspace_member_management_role$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION assert_workspace_member_management_candidate(
+      uuid, uuid, text, text
+    ) TO opengeni_app;
+  END IF;
+END
+$workspace_member_management_role$;