@opengeni/db 3.7.4-canary.0 → 3.8.2-canary.0

package/dist/{chunk-JS3AWDKZ.js → chunk-5S4BQAHX.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-ZTSJPFDH.js";
+} from "./chunk-HZV7O6JR.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-DXJ2WY6W.js";
+} from "./chunk-53A2PEHT.js";
 
 // src/video-generation.ts
 import {
@@ -992,4 +992,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-JS3AWDKZ.js.map
+//# sourceMappingURL=chunk-5S4BQAHX.js.map

package/dist/{chunk-JP6IYGYI.js → chunk-CITYUGMW.js}

@@ -1,11 +1,11 @@
 import {
   withRlsContext
-} from "./chunk-ZTSJPFDH.js";
+} from "./chunk-HZV7O6JR.js";
 import {
   sandboxRetainedProcesses,
   sessionBackgroundCommands,
   sessions
-} from "./chunk-DXJ2WY6W.js";
+} from "./chunk-53A2PEHT.js";
 
 // src/session-background-commands.ts
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
@@ -513,4 +513,4 @@ export {
   settleSessionBackgroundCommandForRetainedProcess,
   settleConnectedMachineSessionBackgroundCommand
 };
-//# sourceMappingURL=chunk-JP6IYGYI.js.map
+//# sourceMappingURL=chunk-CITYUGMW.js.map

package/dist/{chunk-6FIVOJ3V.js → chunk-F5YOZEYQ.js}

@@ -148,6 +148,7 @@ var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [
   "knowledge_source_objects"
 ];
 var MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE = "ensure_managed_human_personal_workspace(uuid, text, uuid)";
+var ADDITIONAL_ORGANIZATION_CREATION_ROUTINE = "create_additional_managed_organization(text, text, text, text, uuid)";
 var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "list_self_organization_memberships(text)",
   "list_self_organization_invitations(text)",
@@ -161,9 +162,11 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "resolve_workspace_codex_subscription_source(uuid, uuid)",
   "list_organization_workspace_ids(uuid)",
   "organization_workspace_command(jsonb)",
+  "authorize_organization_shared_workspace_administration(uuid, uuid, text)",
   "resolve_organization_workspace_removal_subject(uuid, text, uuid)",
   "prepare_organization_workspace_member_removal(jsonb)",
   "record_organization_workspace_member_removal(jsonb, uuid, uuid)",
+  ADDITIONAL_ORGANIZATION_CREATION_ROUTINE,
   "create_managed_organization(text, text, text, uuid)",
   "assert_organization_shared_workspace_administrator(uuid, uuid, text)",
   "open_organization_shared_workspace_administration_capability(uuid, uuid, text)",
@@ -221,6 +224,10 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES = [
   "organization_workspace_operation_receipts",
   "self_service_organization_setup_receipts"
 ];
+var ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES = [
+  ...ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES,
+  "additional_organization_creation_receipts"
+];
 var PRIVATE_SESSION_CREATE_POLICY_ROUTINE = "get_private_session_create_policy(uuid, uuid, text)";
 var ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE = "get_organization_private_session_settings(uuid, text)";
 var ORGANIZATION_PRIVATE_SESSION_SETTINGS_UPDATE_ROUTINE = "update_organization_private_session_settings(uuid, text, boolean, bigint, uuid)";
@@ -535,6 +542,7 @@ var SESSION_TENANCY_ANY_ACTIVATION_ROUTINE = "session_tenancy_any_product_activa
 var SESSION_TENANCY_QUIESCENCE_ROUTINE = "assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean)";
 var TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE = "check_tenancy_backfill_activation_evidence(uuid)";
 var GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE = "activate_greenfield_session_tenancy_from_setup(text)";
+var ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE = "activate_session_tenancy_from_additional_organization(uuid)";
 var SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE = "session_visibility_lifecycle_capability_held()";
 var PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES = [
   "open_private_session_create_capability(uuid, uuid, uuid, text)",
@@ -628,6 +636,7 @@ var RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET = new Set(
   RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES
 );
 var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
+  ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE,
   AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE,
   ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE,
   GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE,
@@ -644,6 +653,7 @@ var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set(
   RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES
 );
 var FORCE_RLS_TABLES = [
+  "additional_organization_creation_receipts",
   "agent_run_states",
   "api_keys",
   "attached_browser_devices",
@@ -810,6 +820,9 @@ var FORCE_RLS_TABLES = [
   "organization_membership_lifecycle_events",
   "organization_membership_operation_receipts",
   "organization_memberships",
+  "organization_model_provider_connection_operations",
+  "organization_model_provider_connections",
+  "organization_model_provider_custom_models",
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
@@ -907,6 +920,7 @@ var FORCE_RLS_TABLES = [
   "session_system_update_outbox",
   "session_system_updates",
   "session_tenancy_activations",
+  "session_tenancy_additional_organization_activation_evidence",
   "session_tenancy_greenfield_activation_evidence",
   "session_turn_attempts",
   "session_turn_startup_milestones",
@@ -1081,6 +1095,9 @@ var RUNTIME_FULL_DML_TABLES = [
   "model_call_facts",
   "new_session_drafts",
   "organization_codex_rotation_settings",
+  "organization_model_provider_connection_operations",
+  "organization_model_provider_connections",
+  "organization_model_provider_custom_models",
   "pack_installation_components",
   "pack_installations",
   "pr_review_app_registrations",
@@ -1273,6 +1290,7 @@ var RUNTIME_READ_INSERT_UPDATE_TABLES = [
   "workspace_interaction_revisions"
 ];
 var PROTECTED_NO_DIRECT_DML_TABLES = [
+  "additional_organization_creation_receipts",
   "canonical_human_identities",
   "canonical_human_identity_operations",
   "canonical_human_identity_subjects",
@@ -1362,6 +1380,7 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "session_attempt_personal_document_snapshots",
   "session_attempt_personal_resource_admissions",
   "session_attempt_personal_resource_snapshots",
+  "session_tenancy_additional_organization_activation_evidence",
   "session_tenancy_greenfield_activation_evidence",
   "session_variable_set_attachments",
   "session_visibility_write_capabilities",
@@ -2065,6 +2084,29 @@ function evaluateRuntimeDatabasePosture(posture, options) {
           );
         }
       }
+    } else if (routine.name === ADDITIONAL_ORGANIZATION_CREATION_ROUTINE) {
+      const missingAuthorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
     } else if (ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES.includes(routine.name)) {
       const missingAuthorityTables = ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES.filter(
         (tableName) => !tableByName.has(tableName)
@@ -3330,9 +3372,11 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "resolve_workspace_codex_subscription_source(uuid,uuid)",
     "list_organization_workspace_ids(uuid)",
     "organization_workspace_command(jsonb)",
+    "authorize_organization_shared_workspace_administration(uuid,uuid,text)",
     "resolve_organization_workspace_removal_subject(uuid,text,uuid)",
     "prepare_organization_workspace_member_removal(jsonb)",
     "record_organization_workspace_member_removal(jsonb,uuid,uuid)",
+    "create_additional_managed_organization(text,text,text,text,uuid)",
     "create_managed_organization(text,text,text,uuid)",
     "assert_organization_shared_workspace_administrator(uuid,uuid,text)",
     "open_organization_shared_workspace_administration_capability(uuid,uuid,text)",
@@ -5106,4 +5150,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-6FIVOJ3V.js.map
+//# sourceMappingURL=chunk-F5YOZEYQ.js.map