@opengeni/db 3.6.0 → 3.7.4-canary.0

package/drizzle/0389_model_catalog_and_gateway_custom_models.sql

@@ -0,0 +1,241 @@
+-- deployment-mode: maintenance
+-- Migration 0389: deployment-owned model catalog authority, provider-scoped
+-- workspace Vercel AI Gateway/OpenRouter slugs, and indexed pre-catalog prompt
+-- receipt replay.
+-- This changes the exact runtime-posture table/grant contract. Stop every API,
+-- control worker, and turn worker before applying it, and never restart a
+-- pre-0389 image after commit.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+DO $model_catalog_runtime_drain_before$
+DECLARE
+  configured_roles_text text := nullif(
+    current_setting('opengeni.migration_application_roles', true), ''
+  );
+  configured_roles jsonb;
+BEGIN
+  IF configured_roles_text IS NULL THEN
+    RAISE EXCEPTION
+      '0389 model catalog activation requires an explicit application database role list'
+      USING ERRCODE = '55000';
+  END IF;
+  BEGIN
+    configured_roles := configured_roles_text::jsonb;
+  EXCEPTION WHEN OTHERS THEN
+    RAISE EXCEPTION
+      '0389 model catalog activation received a malformed application database role list'
+      USING ERRCODE = '55000';
+  END;
+  IF jsonb_typeof(configured_roles) <> 'array'
+    OR jsonb_array_length(configured_roles) NOT BETWEEN 1 AND 16
+    OR EXISTS (
+      SELECT 1 FROM jsonb_array_elements(configured_roles) AS roles(value)
+      WHERE jsonb_typeof(value) <> 'string'
+        OR btrim(value #>> '{}') = ''
+        OR octet_length(value #>> '{}') > 63
+    )
+    OR (
+      SELECT count(*) FROM jsonb_array_elements_text(configured_roles)
+    ) <> (
+      SELECT count(DISTINCT value)
+      FROM jsonb_array_elements_text(configured_roles) AS roles(value)
+    )
+  THEN
+    RAISE EXCEPTION
+      '0389 model catalog activation received an invalid application database role list'
+      USING ERRCODE = '55000';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM pg_stat_activity activity
+    JOIN jsonb_array_elements_text(configured_roles) roles(role_name)
+      ON roles.role_name = activity.usename
+    WHERE activity.datname = current_database()
+      AND activity.pid <> pg_backend_pid()
+  )
+  THEN
+    RAISE EXCEPTION
+      '0389 model catalog activation requires all configured OpenGeni application database sessions to be stopped'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$model_catalog_runtime_drain_before$;
+
+-- Exactly one deployment-global, secret-free catalog document. Ordinary API
+-- and worker roles may only read it; the operator upsert command uses a
+-- migration/admin credential. No seed or boot-time rewrite is intentional.
+CREATE TABLE deployment_model_catalog (
+  singleton boolean PRIMARY KEY DEFAULT true,
+  document jsonb NOT NULL,
+  version bigint NOT NULL DEFAULT 1,
+  updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  CONSTRAINT deployment_model_catalog_singleton_chk CHECK (singleton),
+  CONSTRAINT deployment_model_catalog_document_chk CHECK (jsonb_typeof(document) = 'object'),
+  CONSTRAINT deployment_model_catalog_version_chk CHECK (version > 0)
+);
+
+COMMENT ON TABLE deployment_model_catalog IS
+  'Deployment-global, secret-free model catalog singleton. Runtime is SELECT-only; operators update it explicitly.';
+
+CREATE TABLE workspace_gateway_custom_models (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  provider_kind text NOT NULL,
+  upstream_model_id text NOT NULL,
+  label text,
+  version integer NOT NULL DEFAULT 1,
+  create_operation_id uuid NOT NULL,
+  create_request_hash text NOT NULL,
+  delete_operation_id uuid,
+  delete_request_hash text,
+  created_by_subject_id text NOT NULL,
+  retired_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  CONSTRAINT workspace_gateway_custom_models_workspace_account_fk
+    FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id) ON DELETE CASCADE,
+  CONSTRAINT workspace_gateway_custom_models_provider_kind_chk CHECK (
+    provider_kind IN ('vercel_gateway', 'openrouter')
+  ),
+  CONSTRAINT workspace_gateway_custom_models_upstream_chk CHECK (
+    octet_length(upstream_model_id) BETWEEN 1 AND 238
+    AND upstream_model_id ~ '^[!-~]+$'
+    AND upstream_model_id !~ '[|]'
+  ),
+  CONSTRAINT workspace_gateway_custom_models_label_chk CHECK (
+    label IS NULL OR (
+      octet_length(label) BETWEEN 1 AND 128
+      AND label !~ '[\r\n|]'
+    )
+  ),
+  CONSTRAINT workspace_gateway_custom_models_actor_chk CHECK (
+    octet_length(created_by_subject_id) BETWEEN 1 AND 1024
+  ),
+  CONSTRAINT workspace_gateway_custom_models_version_chk CHECK (version > 0),
+  CONSTRAINT workspace_gateway_custom_models_create_hash_chk CHECK (
+    create_request_hash ~ '^[a-f0-9]{64}$'
+  ),
+  CONSTRAINT workspace_gateway_custom_models_delete_receipt_chk CHECK (
+    (delete_operation_id IS NULL AND delete_request_hash IS NULL)
+    OR (
+      delete_operation_id IS NOT NULL
+      AND delete_request_hash ~ '^[a-f0-9]{64}$'
+      AND retired_at IS NOT NULL
+    )
+  )
+);
+
+CREATE UNIQUE INDEX workspace_gateway_custom_models_workspace_upstream_uq
+  ON workspace_gateway_custom_models (workspace_id, provider_kind, upstream_model_id)
+  WHERE retired_at IS NULL;
+
+CREATE UNIQUE INDEX workspace_gateway_custom_models_create_operation_uq
+  ON workspace_gateway_custom_models (workspace_id, provider_kind, create_operation_id);
+
+CREATE UNIQUE INDEX workspace_gateway_custom_models_delete_operation_uq
+  ON workspace_gateway_custom_models (workspace_id, provider_kind, delete_operation_id)
+  WHERE delete_operation_id IS NOT NULL;
+
+-- New Send/Steer receipts persist one parsed boundary-request fingerprint and
+-- replay it before mutable model-catalog resolution. Legacy receipt identity
+-- remains unchanged; this partial index keeps the actor/key compatibility
+-- probe bounded even when the prior action or target session differs.
+CREATE INDEX session_command_receipts_prompt_actor_operation_idx
+  ON session_command_receipts (
+    workspace_id,
+    actor_type,
+    actor_subject_id,
+    actor_attempt_id,
+    operation_key
+  )
+  WHERE action IN ('prompt.send', 'prompt.steer');
+
+ALTER TABLE workspace_gateway_custom_models ENABLE ROW LEVEL SECURITY;
+ALTER TABLE workspace_gateway_custom_models FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON workspace_gateway_custom_models
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- Migration 0040 registers owner default privileges for the historical
+-- opengeni_app role. Rotated-role deployments must not inherit that stale
+-- grant on these new tables, and host defaults may name other obsolete
+-- application roles. Strip every explicit non-owner table grantee. The
+-- migration_application_roles list above is drain detection only; the
+-- post-migration role provisioner grants only the deployment's current target
+-- runtime role.
+DO $model_catalog_table_acl_reset$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  relation_name text;
+  role_name text;
+BEGIN
+  FOR relation_name IN
+    SELECT relation.value
+    FROM pg_catalog.unnest(
+      ARRAY[
+        'deployment_model_catalog',
+        'workspace_gateway_custom_models'
+      ]::text[]
+    ) AS relation(value)
+  LOOP
+    EXECUTE pg_catalog.format(
+      'REVOKE ALL ON TABLE %I.%I FROM PUBLIC',
+      data_schema,
+      relation_name
+    );
+    FOR role_name IN
+      SELECT grantee_role.rolname
+      FROM pg_catalog.pg_class relation
+      CROSS JOIN LATERAL pg_catalog.aclexplode(
+        coalesce(
+          relation.relacl,
+          pg_catalog.acldefault('r', relation.relowner)
+        )
+      ) privilege
+      INNER JOIN pg_catalog.pg_roles grantee_role
+        ON grantee_role.oid = privilege.grantee
+      WHERE relation.oid = pg_catalog.to_regclass(
+          pg_catalog.format('%I.%I', data_schema, relation_name)
+        )
+        AND privilege.grantee <> 0
+        AND privilege.grantee <> relation.relowner
+      GROUP BY grantee_role.rolname
+      ORDER BY grantee_role.rolname COLLATE "C"
+    LOOP
+      EXECUTE pg_catalog.format(
+        'REVOKE ALL ON TABLE %I.%I FROM %I',
+        data_schema,
+        relation_name,
+        role_name
+      );
+    END LOOP;
+  END LOOP;
+END
+$model_catalog_table_acl_reset$;
+
+COMMENT ON TABLE workspace_gateway_custom_models IS
+  'Workspace-owned Vercel AI Gateway and OpenRouter upstream slugs. Retired rows remain execution evidence; capabilities and billing are never stored here.';
+
+DO $model_catalog_runtime_drain_after$
+DECLARE
+  configured_roles jsonb := current_setting(
+    'opengeni.migration_application_roles', false
+  )::jsonb;
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_stat_activity activity
+    JOIN jsonb_array_elements_text(configured_roles) roles(role_name)
+      ON roles.role_name = activity.usename
+    WHERE activity.datname = current_database()
+      AND activity.pid <> pg_backend_pid()
+  )
+  THEN
+    RAISE EXCEPTION
+      '0389 model catalog activation observed a configured OpenGeni application database session after schema installation'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$model_catalog_runtime_drain_after$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "3.6.0",
+  "version": "3.7.4-canary.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -78,11 +78,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.4.17",
-    "@opengeni/codex": "^0.2.19",
-    "@opengeni/config": "^0.22.0",
-    "@opengeni/contracts": "^2.7.0",
-    "@opengeni/network": "^0.2.3",
+    "@opengeni/codemode": "^0.4.22-canary.1",
+    "@opengeni/codex": "^0.2.20-canary.1",
+    "@opengeni/config": "^0.22.5-canary.1",
+    "@opengeni/contracts": "^2.9.2-canary.1",
+    "@opengeni/network": "^0.2.3-canary.6",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/automations.ts

@@ -223,6 +223,8 @@ export async function createAutomationTrigger(
     createdBySubjectId: string;
     request: CreateAutomationTriggerRequest;
     adapterId: string;
+    /** Trusted database-only admission seam. Throwing rolls creation back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
   },
 ): Promise<AutomationTrigger> {
   return await withWorkspaceRls(
@@ -289,6 +291,7 @@ export async function createAutomationTrigger(
             throw new Error("Automation Pack trigger must use its frozen manifest template");
           }
         }
+        await input.beforeCreateCommit?.(tx);
         const [head] = await tx
           .insert(schema.automationTriggers)
           .values({
@@ -438,6 +441,8 @@ export async function updateAutomationTrigger(
     triggerId: string;
     subjectId: string;
     request: UpdateAutomationTriggerRequest;
+    /** Trusted database-only admission seam. Throwing rolls the revision back. */
+    beforeUpdateCommit?: (tx: Database) => Promise<void>;
   },
 ): Promise<AutomationTrigger | null> {
   return await withWorkspaceRls(
@@ -478,6 +483,7 @@ export async function updateAutomationTrigger(
             "Pack-owned automation triggers must be managed through their Pack setup API",
           );
         }
+        await input.beforeUpdateCommit?.(tx);
         const revisionNumber = existing.head.currentRevision + 1;
         const [head] = await tx
           .update(schema.automationTriggers)
@@ -696,7 +702,9 @@ export async function claimAutomationRun(
           .for("update")
           .limit(1);
         if (!row) return null;
-        if (row.status === "dispatched" || row.status === "skipped") return mapRunExecution(row);
+        if (row.status === "dispatched" || row.status === "skipped" || row.status === "failed") {
+          return mapRunExecution(row);
+        }
         const [updated] = await tx
           .update(schema.automationRuns)
           .set({

package/src/codex-token-resolver.ts

@@ -24,6 +24,7 @@ import {
   CODEX_REFRESH_FALLBACK_MS,
   CODEX_REFRESH_WINDOW_MS,
   CodexReloginRequired,
+  codexUsageConfirmsQuotaAvailable,
   type CodexTokenSnapshot,
   type CodexUsagePayload,
   type CodexFetch,
@@ -43,6 +44,8 @@ export type CodexCredentialTokens = {
   idToken: string;
 };
 
+export type CodexCredentialCooldownKind = "quota" | "rate_limit";
+
 export type CodexCredentialForRun = {
   id: string;
   version: number;
@@ -56,6 +59,9 @@ export type CodexCredentialForRun = {
   lastRefreshAt: Date | null;
   status: string;
   lastError: string | null;
+  exhaustedUntil: Date | null;
+  exhaustedKind: CodexCredentialCooldownKind | null;
+  exhaustedRevision: number;
 };
 
 export type CodexAccountUsageSnapshot = {
@@ -66,6 +72,12 @@ export type CodexAccountUsageSnapshot = {
   checkedAt?: Date;
   resetCreditAvailableCount?: number | null;
   resetCreditsCheckedAt?: Date | null;
+  /**
+   * Clear only a quota cooldown with this exact revision. Set solely after a
+   * live provider response proves allowance is open; a concurrent refusal
+   * advances the revision and makes this observation stale.
+   */
+  clearQuotaCooldownRevision?: number;
 };
 
 type CodexCredentialRefreshInput = {
@@ -375,7 +387,8 @@ function errorUsagePayload(reason?: "needs_relogin"): CodexUsagePayload {
  *      account's expired JWT from 401-ing the usage read.
  *   2. fetch GET /wham/usage with that bearer.
  *   3. normalize (§3) into the P2/P3 contract.
- *   4. on any windows present, write the five usage-cache columns (the TTL clock).
+ *   4. on any windows present, write the usage cache and conditionally reconcile
+ *      the exact older typed quota cooldown observed before provider I/O.
  *
  * A refresh that stamps needs_relogin returns { status:"error", reason } and never
  * hits the provider; a transient refresh error returns a plain error payload.
@@ -396,6 +409,13 @@ export async function fetchCodexUsageForAccount(
     return errorUsagePayload(error instanceof CodexReloginRequired ? "needs_relogin" : undefined);
   }
 
+  // Snapshot cooldown authority immediately before provider I/O. The usage
+  // write may clear only this exact revision; any concurrent refusal advances
+  // it and wins. A metadata-read failure must not sink the usage response.
+  const observedCredential = await deps
+    .loadCredential(db, settings, workspaceId, credentialId)
+    .catch(() => null);
+
   let normalized: CodexUsagePayload;
   try {
     const usage = await fetchCodexUsage(
@@ -438,6 +458,11 @@ export async function fetchCodexUsageForAccount(
               checkedAt,
             }
           : {}),
+        ...(observedCredential?.exhaustedUntil &&
+        observedCredential.exhaustedKind === "quota" &&
+        codexUsageConfirmsQuotaAvailable(normalized)
+          ? { clearQuotaCooldownRevision: observedCredential.exhaustedRevision }
+          : {}),
         ...(normalized.rateLimitResetCredits
           ? {
               resetCreditAvailableCount: normalized.rateLimitResetCredits.availableCount,

package/src/company-brain-governed-writes.ts

@@ -15,7 +15,11 @@ import {
 import { and, eq, inArray, sql } from "drizzle-orm";
 import type { Database } from "./database";
 import { rawRows, setSubjectRlsContext, withRlsContext } from "./database";
-import { sanitizePreferenceDescriptorText } from "./preference-registry";
+import {
+  PreferenceRegistryStableKeyConflictError,
+  sanitizePreferenceDescriptorText,
+} from "./preference-registry";
+import { nestedPostgresSqlState, safeDatabaseErrorFacts } from "./persistence-errors";
 import {
   appendKnowledgeClaim,
   appendKnowledgeClaimReview,
@@ -847,6 +851,26 @@ function isInstructionPolicyProposal(
   );
 }
 
+function isPreferenceProposal(
+  request: CompanyBrainGovernedWriteRequestType,
+): request is PreferenceProposalRequest {
+  return request.kind === "propose_preference" || request.kind === "promote_task_note_preference";
+}
+
+const PREFERENCE_PROPOSAL_STABLE_KEY_CONFLICT_DIAGNOSTIC =
+  "workspace preference key is bound to another proposal";
+
+function isPreferenceProposalStableKeyConflict(error: unknown): boolean {
+  if (nestedPostgresSqlState(error) !== "23505") return false;
+  const constraint = safeDatabaseErrorFacts(error).constraint ?? "";
+  if (constraint.startsWith("preference_registry_preferences_")) return true;
+  for (let current = error, depth = 0; current instanceof Error && depth < 8; depth += 1) {
+    if (current.message.includes(PREFERENCE_PROPOSAL_STABLE_KEY_CONFLICT_DIAGNOSTIC)) return true;
+    current = current.cause;
+  }
+  return false;
+}
+
 async function materializeWaysOfWorkingProposal(
   db: Database,
   input: {
@@ -1008,6 +1032,11 @@ export async function writeCompanyBrainGovernedProposal(
     ) {
       throw error;
     }
+    if (isPreferenceProposal(request) && isPreferenceProposalStableKeyConflict(error)) {
+      throw new PreferenceRegistryStableKeyConflictError(
+        "A preference with this stable key already exists for the workspace",
+      );
+    }
     if (error instanceof ScopedKnowledgeAuthorityError) {
       throw new CompanyBrainGovernedWriteAuthorityError(error.message);
     }

package/src/company-profile-agent-admin.ts

@@ -28,6 +28,7 @@ export class CompanyProfileAgentAdminError extends Error {
   constructor(
     readonly code:
       | "authority_unavailable"
+      | "policy_disabled"
       | "confirmation_unavailable"
       | "profile_conflict"
       | "operation_reused"
@@ -62,6 +63,13 @@ function translate(error: unknown, stage: "propose" | "confirm"): never {
       { cause: error },
     );
   }
+  if (state === "P1852") {
+    throw new CompanyProfileAgentAdminError(
+      "policy_disabled",
+      "Agent-authored company-profile changes are disabled by organization policy.",
+      { cause: error },
+    );
+  }
   if (state === "40001") {
     throw new CompanyProfileAgentAdminError(
       "profile_conflict",
@@ -86,6 +94,18 @@ function translate(error: unknown, stage: "propose" | "confirm"): never {
   throw error;
 }
 
+/** Deterministic UUID-shaped id for the activation stage of one proposal operation. */
+export function derivedCompanyProfileAutomaticActivationOperationId(operationId: string): string {
+  const bytes = createHash("sha256")
+    .update(`company-profile-agent-admin:v1:${operationId}:automatic-activation`, "utf8")
+    .digest()
+    .subarray(0, 16);
+  bytes[6] = (bytes[6]! & 0x0f) | 0x50;
+  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
 async function withAgentAttemptContext<T>(
   db: Database,
   attempt: CompanyProfileAgentAttemptType,
@@ -119,10 +139,13 @@ export async function proposeCompanyProfileForAgent(
         receipt_id: string;
         revision_id: string;
         human_input: unknown;
+        policy_mode: "suggest" | "automatic";
+        automatic_activation_receipt_id: string | null;
+        activation_event_id: string | null;
         replayed: boolean;
       }>(
         scoped,
-        sql`select * from propose_company_profile_for_attempt(
+        sql`select * from propose_company_profile_for_attempt_v2(
           ${attempt.accountId}::uuid,
           ${attempt.workspaceId}::uuid,
           ${attempt.sessionId}::uuid,
@@ -130,6 +153,7 @@ export async function proposeCompanyProfileForAgent(
           ${attempt.attemptId}::uuid,
           ${attempt.executionGeneration},
           ${request.operationId}::uuid,
+          ${derivedCompanyProfileAutomaticActivationOperationId(request.operationId)}::uuid,
           ${contentJson},
           ${contentHash},
           ${request.reason}
@@ -138,6 +162,48 @@ export async function proposeCompanyProfileForAgent(
       if (!row) throw new Error("Company-profile proposal returned no receipt");
       return row;
     });
+    if (
+      result.policy_mode === "automatic" &&
+      result.automatic_activation_receipt_id &&
+      result.activation_event_id
+    ) {
+      const [inventory, event] = await Promise.all([
+        listCompanyProfile(db, {
+          accountId: attempt.accountId,
+          workspaceId: attempt.workspaceId,
+          limit: 1,
+        }),
+        getCompanyProfileActivationEvent(db, {
+          accountId: attempt.accountId,
+          workspaceId: attempt.workspaceId,
+          eventId: result.activation_event_id,
+        }),
+      ]);
+      if (!event?.newRevision) {
+        throw new Error("Company-profile automatic activation event is unavailable");
+      }
+      const revision = await getCompanyProfileRevision(db, {
+        accountId: attempt.accountId,
+        workspaceId: attempt.workspaceId,
+        revisionId: event.newRevision.id,
+      });
+      return CompanyProfileAgentProposalReceipt.parse({
+        status: "activated",
+        operationId: request.operationId,
+        proposalReceiptId: result.receipt_id,
+        automaticActivationReceiptId: result.automatic_activation_receipt_id,
+        policyMode: "automatic",
+        mutation: {
+          revision,
+          head: inventory.current?.revisionId === revision.id ? inventory.current : null,
+          event,
+        },
+        replayed: result.replayed,
+      });
+    }
+    if (result.policy_mode !== "suggest") {
+      throw new Error("Company-profile proposal returned an incomplete automatic activation");
+    }
     const revision = await getCompanyProfileRevision(db, {
       accountId: attempt.accountId,
       workspaceId: attempt.workspaceId,
@@ -148,6 +214,7 @@ export async function proposeCompanyProfileForAgent(
       operationId: request.operationId,
       proposalReceiptId: result.receipt_id,
       revision,
+      policyMode: "suggest",
       humanInput: CompanyProfileAgentHumanInputPrompt.parse(result.human_input),
       confirmWith: "company_profile_confirm",
       replayed: result.replayed,

package/src/company-profile-agent-policy.ts

@@ -0,0 +1,126 @@
+import {
+  CompanyProfileAgentPolicy,
+  CompanyProfileAgentPolicyMode,
+  type CompanyProfileAgentPolicy as CompanyProfileAgentPolicyType,
+  type CompanyProfileAgentPolicyMode as CompanyProfileAgentPolicyModeType,
+} from "@opengeni/contracts";
+import { sql } from "drizzle-orm";
+import { rawRows, withRlsContext, withSessionRlsActorContext, type Database } from "./database";
+import { nestedPostgresSqlState } from "./persistence-errors";
+
+export class CompanyProfileAgentPolicyError extends Error {
+  readonly name = "CompanyProfileAgentPolicyError";
+
+  constructor(
+    readonly code: "authority_unavailable" | "policy_conflict" | "operation_reused" | "invalid",
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+function translate(error: unknown): never {
+  const state = nestedPostgresSqlState(error);
+  if (state === "42501") {
+    throw new CompanyProfileAgentPolicyError(
+      "authority_unavailable",
+      "An active organization owner is required to manage company-profile agent autonomy.",
+      { cause: error },
+    );
+  }
+  if (state === "40001") {
+    throw new CompanyProfileAgentPolicyError(
+      "policy_conflict",
+      "The company-profile agent policy changed in another request. Reload and try again.",
+      { cause: error },
+    );
+  }
+  if (state === "23505" || state === "P1851") {
+    throw new CompanyProfileAgentPolicyError(
+      "operation_reused",
+      "The company-profile agent policy operation id was already used for different input.",
+      { cause: error },
+    );
+  }
+  if (state === "22023" || state === "23514" || state === "55000") {
+    throw new CompanyProfileAgentPolicyError(
+      "invalid",
+      "The company-profile agent policy request is invalid.",
+      { cause: error },
+    );
+  }
+  throw error;
+}
+
+async function withHumanPolicyContext<T>(
+  db: Database,
+  input: { accountId: string; workspaceId: string; actorSubjectId: string },
+  fn: (scoped: Database) => Promise<T>,
+): Promise<T> {
+  return await withSessionRlsActorContext({ subjectId: input.actorSubjectId }, async () =>
+    withRlsContext(
+      db,
+      { accountId: input.accountId, workspaceId: input.workspaceId },
+      async (scoped) => {
+        await scoped.execute(
+          sql`select set_config('opengeni.principal_kind', 'human_session', true)`,
+        );
+        return await fn(scoped);
+      },
+    ),
+  );
+}
+
+export async function getCompanyProfileAgentPolicy(
+  db: Database,
+  input: { accountId: string; workspaceId: string; actorSubjectId: string },
+): Promise<CompanyProfileAgentPolicyType> {
+  try {
+    return await withHumanPolicyContext(db, input, async (scoped) => {
+      const [row] = await rawRows<{ result: unknown }>(
+        scoped,
+        sql`select get_company_profile_agent_policy(
+          ${input.accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.actorSubjectId}
+        ) as result`,
+      );
+      return CompanyProfileAgentPolicy.parse(row?.result);
+    });
+  } catch (error) {
+    translate(error);
+  }
+}
+
+export async function updateCompanyProfileAgentPolicy(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    actorSubjectId: string;
+    mode: CompanyProfileAgentPolicyModeType;
+    expectedVersion: number;
+    operationId: string;
+  },
+): Promise<CompanyProfileAgentPolicyType> {
+  const mode = CompanyProfileAgentPolicyMode.parse(input.mode);
+  try {
+    return await withHumanPolicyContext(db, input, async (scoped) => {
+      const [row] = await rawRows<{ result: unknown }>(
+        scoped,
+        sql`select update_company_profile_agent_policy(
+          ${input.accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.actorSubjectId},
+          ${mode},
+          ${input.expectedVersion}::bigint,
+          ${input.operationId}::uuid
+        ) as result`,
+      );
+      return CompanyProfileAgentPolicy.parse(row?.result);
+    });
+  } catch (error) {
+    translate(error);
+  }
+}