@opengeni/db 3.6.0 → 3.7.4-canary.0

package/dist/automations.d.ts

@@ -75,6 +75,8 @@ export declare function createAutomationTrigger(db: Database, input: {
     createdBySubjectId: string;
     request: CreateAutomationTriggerRequest;
     adapterId: string;
+    /** Trusted database-only admission seam. Throwing rolls creation back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger>;
 export declare function listAutomationTriggers(db: Database, workspaceId: string): Promise<AutomationTrigger[]>;
 export declare function listActiveAutomationTriggersForSource(db: Database, input: {
@@ -94,6 +96,8 @@ export declare function updateAutomationTrigger(db: Database, input: {
     triggerId: string;
     subjectId: string;
     request: UpdateAutomationTriggerRequest;
+    /** Trusted database-only admission seam. Throwing rolls the revision back. */
+    beforeUpdateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger | null>;
 export declare function recordAutomationEvent(db: Database, input: {
     accountId: string;

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-UGDVSQ6U.js";
-import "./chunk-WW7AJ5IC.js";
-import "./chunk-UJ2EW3QI.js";
+} from "./chunk-3ZMN4EXC.js";
+import "./chunk-ZTSJPFDH.js";
+import "./chunk-DXJ2WY6W.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/{chunk-UGDVSQ6U.js → chunk-3ZMN4EXC.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-WW7AJ5IC.js";
+} from "./chunk-ZTSJPFDH.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -309,4 +309,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-UGDVSQ6U.js.map
+//# sourceMappingURL=chunk-3ZMN4EXC.js.map

package/dist/{chunk-744DFC65.js → chunk-6FIVOJ3V.js}

@@ -158,6 +158,8 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "list_organization_administration_members(uuid, text)",
   "get_organization_administration_overview(uuid, text)",
   "get_workspace_kind(uuid, uuid)",
+  "resolve_workspace_codex_subscription_source(uuid, uuid)",
+  "list_organization_workspace_ids(uuid)",
   "organization_workspace_command(jsonb)",
   "resolve_organization_workspace_removal_subject(uuid, text, uuid)",
   "prepare_organization_workspace_member_removal(jsonb)",
@@ -275,6 +277,7 @@ var USER_RESOURCE_LIFECYCLE_ROUTINES = [
   "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)",
   "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)",
   "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)",
+  "issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean)",
   "revoke_self_user_resource_grant(uuid, uuid, uuid)",
   "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)"
 ];
@@ -460,15 +463,21 @@ var GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES = [
 ];
 var COMPANY_PROFILE_AGENT_ADMIN_ROUTINES = [
   "propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)",
-  "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)"
+  "propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text)",
+  "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)",
+  "get_company_profile_agent_policy(uuid, uuid, text)",
+  "update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid)"
 ];
 var COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES = [
   "company_profile_activation_events",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "company_profile_heads",
   "company_profile_revisions",
   "managed_accounts",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_memberships",
   "session_human_input_requests",
   "session_turn_attempts",
@@ -627,6 +636,7 @@ var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
   ...DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES
 ];
 var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
+  "resolve_workspace_codex_subscription_source(uuid, uuid)",
   SESSION_REFERENCE_VISIBLE_ROUTINE,
   XAI_SNAPSHOT_VALIDATOR_ROUTINE
 ];
@@ -683,6 +693,7 @@ var FORCE_RLS_TABLES = [
   "company_brain_preference_proposal_receipts",
   "company_brain_turn_context_snapshots",
   "company_profile_activation_events",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "company_profile_heads",
@@ -791,6 +802,9 @@ var FORCE_RLS_TABLES = [
   "model_call_facts",
   "network_routes",
   "new_session_drafts",
+  "organization_codex_rotation_settings",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -873,6 +887,7 @@ var FORCE_RLS_TABLES = [
   "session_attempt_tool_catalogs",
   "session_background_commands",
   "session_command_receipts",
+  "session_event_cursors",
   "session_events",
   "session_goal_revisions",
   "session_goals",
@@ -949,7 +964,9 @@ var FORCE_RLS_TABLES = [
   "workspace_artifact_versions",
   "workspace_artifacts",
   "workspace_captures",
+  "workspace_codex_subscription_preferences",
   "workspace_control_events",
+  "workspace_gateway_custom_models",
   "workspace_inference_controls",
   "workspace_instruction_policy_activation_events",
   "workspace_instruction_policy_deactivation_events",
@@ -983,6 +1000,7 @@ var NON_RLS_RUNTIME_TABLES = [
   "auth_users",
   "auth_verifications",
   "automation_webhook_endpoints",
+  "deployment_model_catalog",
   "integration_oauth_clients",
   "managed_accounts",
   "nested_agent_depth_configuration",
@@ -1062,6 +1080,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "memory_slack_publications",
   "model_call_facts",
   "new_session_drafts",
+  "organization_codex_rotation_settings",
   "pack_installation_components",
   "pack_installations",
   "pr_review_app_registrations",
@@ -1082,6 +1101,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "session_attempt_interruptions",
   "session_background_commands",
   "session_command_receipts",
+  "session_event_cursors",
   "session_events",
   "session_goals",
   "session_history_items",
@@ -1127,7 +1147,9 @@ var RUNTIME_FULL_DML_TABLES = [
   "video_generation_references",
   "workspace_artifacts",
   "workspace_captures",
+  "workspace_codex_subscription_preferences",
   "workspace_control_events",
+  "workspace_gateway_custom_models",
   "workspace_inference_controls",
   "workspace_instruction_policy_heads",
   "workspace_memberships",
@@ -1147,6 +1169,7 @@ var RUNTIME_READ_ONLY_TABLES = [
   "company_profile_activation_events",
   "company_profile_heads",
   "company_profile_snapshots",
+  "deployment_model_catalog",
   "document_authority_reclassifications",
   "knowledge_lifecycle_events",
   "knowledge_memory_lifecycle_events",
@@ -1257,6 +1280,7 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "company_brain_context_selection_receipts",
   "company_brain_preference_proposal_receipts",
   "company_brain_turn_context_snapshots",
+  "company_profile_agent_automatic_activation_receipts",
   "company_profile_agent_confirmation_receipts",
   "company_profile_agent_proposal_receipts",
   "connection_use_audit_facts",
@@ -1282,6 +1306,8 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "managed_auth_login_transactions",
   "managed_auth_session_set_operations",
   "managed_auth_session_sets",
+  "organization_company_profile_agent_policies",
+  "organization_company_profile_agent_policy_events",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -3118,7 +3144,9 @@ END $$;
 `);
 }
 async function ensureLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
+  await executeRoleConvergence(
+    sql2,
+    `
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
@@ -3127,10 +3155,13 @@ BEGIN
     EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
   END IF;
 END $$;
-`);
+`
+  );
 }
 async function ensureRestrictedAppLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
+  await executeRoleConvergence(
+    sql2,
+    `
 DO $$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
@@ -3158,7 +3189,26 @@ BEGIN
     );
   END IF;
 END $$;
-`);
+`
+  );
+}
+var ROLE_CONVERGENCE_MAX_ATTEMPTS = 20;
+function isRetryableConcurrentRoleMutation(error) {
+  const details = error;
+  return details.code === "XX000" && details.message === "tuple concurrently updated" && details.routine === "simple_heap_update" || details.code === "42710" && typeof details.message === "string" && /^role ".+" already exists$/u.test(details.message);
+}
+async function executeRoleConvergence(sql2, statement) {
+  for (let attempt = 1; attempt <= ROLE_CONVERGENCE_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      await sql2.unsafe(statement);
+      return;
+    } catch (error) {
+      if (!isRetryableConcurrentRoleMutation(error) || attempt === ROLE_CONVERGENCE_MAX_ATTEMPTS) {
+        throw error;
+      }
+      await new Promise((resolve) => setTimeout(resolve, Math.min(25 * attempt, 250)));
+    }
+  }
 }
 async function assertAppRoleSafeToNormalize(sql2, role) {
   const exists = await sql2`
@@ -3277,6 +3327,8 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "list_organization_invitations(uuid,text,uuid,integer)",
     "get_organization_administration_overview(uuid,text)",
     "get_workspace_kind(uuid,uuid)",
+    "resolve_workspace_codex_subscription_source(uuid,uuid)",
+    "list_organization_workspace_ids(uuid)",
     "organization_workspace_command(jsonb)",
     "resolve_organization_workspace_removal_subject(uuid,text,uuid)",
     "prepare_organization_workspace_member_removal(jsonb)",
@@ -3840,6 +3892,18 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.propose_company_profile_for_attempt_v2(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.confirm_company_profile_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid)',
@@ -3852,6 +3916,27 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format('%I.get_company_profile_agent_policy(uuid,uuid,text)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_company_profile_agent_policy(uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.update_company_profile_agent_policy(uuid,uuid,text,text,bigint,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',
@@ -4438,6 +4523,11 @@ BEGIN
       EXECUTE format('REVOKE ALL ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
     END IF;
+    IF to_regprocedure(format('%I.issue_self_local_connection_use_grant(uuid,uuid,uuid,text,boolean)', ${literal(schema)}))
+      IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+    END IF;
     IF to_regprocedure(format('%I.resolve_connection_use_authority(uuid,uuid,uuid,jsonb)', ${literal(schema)}))
       IS NOT NULL THEN
       EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_connection_authorities(uuid) FROM PUBLIC', ${literal(schema)});
@@ -5016,4 +5106,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-744DFC65.js.map
+//# sourceMappingURL=chunk-6FIVOJ3V.js.map