@opengeni/db 3.7.4 → 4.0.0-canary.0

package/dist/automations.d.ts

@@ -75,6 +75,8 @@ export declare function createAutomationTrigger(db: Database, input: {
     createdBySubjectId: string;
     request: CreateAutomationTriggerRequest;
     adapterId: string;
+    /** Trusted database-only admission seam. Throwing rolls creation back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger>;
 export declare function listAutomationTriggers(db: Database, workspaceId: string): Promise<AutomationTrigger[]>;
 export declare function listActiveAutomationTriggersForSource(db: Database, input: {
@@ -94,6 +96,8 @@ export declare function updateAutomationTrigger(db: Database, input: {
     triggerId: string;
     subjectId: string;
     request: UpdateAutomationTriggerRequest;
+    /** Trusted database-only admission seam. Throwing rolls the revision back. */
+    beforeUpdateCommit?: (tx: Database) => Promise<void>;
 }): Promise<AutomationTrigger | null>;
 export declare function recordAutomationEvent(db: Database, input: {
     accountId: string;

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-U4WPPEBH.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-NLFHMPUB.js";
+import "./chunk-UFAMOUWL.js";
+import "./chunk-QM6YOWHZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/capability-integrations.d.ts

@@ -137,6 +137,8 @@ export type ApiIntegrationRuntime = {
     providerDomain: string;
     authScheme: Record<string, unknown>;
     connectionRef: McpServerConnectionRef | null;
+    /** Live credential authority revision used to invalidate stale human approvals. */
+    connectionAuthorityGeneration: number | null;
     allowedTools: string[];
     requireApproval: true | string[];
     revision: StoredApiIntegrationRevision;

package/dist/{chunk-6DPJA36C.js → chunk-2XEZK4LF.js}

@@ -168,6 +168,11 @@ function migrationApplicationRoles(schema, options) {
     }
     return [DEFAULT_APPLICATION_DATABASE_ROLE];
   }
+  if (configured !== void 0 && configured.some((role) => typeof role !== "string" || role !== role.trim())) {
+    throw new Error(
+      "MigrationRuntimeOptions.applicationDatabaseRoles must contain canonical Postgres role names without surrounding whitespace"
+    );
+  }
   if (explicit.length < 1 || explicit.length > MAX_MIGRATION_APPLICATION_ROLES) {
     throw new Error(
       `Migration application database roles must contain 1-${MAX_MIGRATION_APPLICATION_ROLES} entries`
@@ -264,7 +269,8 @@ if (import.meta.main) {
 
 export {
   parseConcurrentIndexMigration,
+  migrationApplicationRoles,
   migrate,
   runMigrations
 };
-//# sourceMappingURL=chunk-6DPJA36C.js.map
+//# sourceMappingURL=chunk-2XEZK4LF.js.map

package/dist/chunk-2XEZK4LF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport postgres from \"postgres\";\n\nconst DEFAULT_DATABASE_URL = \"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\";\nconst DEFAULT_MAX_NESTED_AGENT_DEPTH = 3;\nconst MAX_NESTED_AGENT_DEPTH = 2_147_483_647;\nconst DEFAULT_APPLICATION_DATABASE_ROLE = \"opengeni_app\";\nconst MIGRATION_APPLICATION_ROLES_SETTING = \"opengeni.migration_application_roles\";\nconst MAX_MIGRATION_APPLICATION_ROLES = 16;\nconst batchedBackfillDirective =\n  /^-- opengeni:batched-backfill batch-size=(\\d+) lock-timeout=(\\d+(?:ms|s|min)) statement-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexStatement =\n  /^CREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+CONCURRENTLY\\s+(?:(IF\\s+NOT\\s+EXISTS)\\s+)?(?:\"((?:[^\"]|\"\")+)\"|([A-Za-z_][A-Za-z0-9_]*))\\s+ON\\b/is;\nconst governedLegacyConcurrentIndexMigrations = new Set([\n  \"0066_session_interruption_attempt_lookup.sql\",\n  \"0070_session_event_type_sequence_lookup.sql\",\n  \"0071_session_event_monitoring_tail.sql\",\n  \"0072_sessions_workspace_created_id_idx.sql\",\n  \"0073_sessions_workspace_updated_id_idx.sql\",\n  \"0075_sessions_workspace_activity_revision_idx.sql\",\n  \"0077_session_attempt_latest_lookup.sql\",\n]);\n\nexport interface ConcurrentIndexMigration {\n  indexName: string;\n  lockTimeout: string;\n  skipWhenValid: boolean;\n  statement: string;\n}\n\nexport type MigrationRuntimeOptions = {\n  maxNestedAgentDepth?: number;\n  /**\n   * Exact database login roles that may run an OpenGeni API or worker against\n   * this target. Maintenance cutovers use this list to reject a live mixed-\n   * version fleet, and rolling ACL migrations use it to preserve old-binary\n   * readiness until later role provisioning converges. Dedicated-schema and\n   * custom-role deployments must supply it.\n   */\n  applicationDatabaseRoles?: string[];\n};\n\ntype DeploymentDepthPolicy = {\n  maxNestedAgentDepth: number;\n  source: \"deployment\" | \"default\";\n};\n\n/** A bare Postgres identifier (schema/role name) safe to interpolate into DDL. */\nfunction assertIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\n/**\n * Most migration files intentionally execute as one implicit transaction.\n * PostgreSQL forbids CREATE INDEX CONCURRENTLY there, so a migration may opt\n * into one narrowly validated transactionless statement with:\n *\n *   -- opengeni:concurrent-index lock-timeout=5s\n *   CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS ...;\n *\n * The directive is deliberately not a generic \"no transaction\" escape hatch:\n * only one idempotent concurrent-index statement is accepted, lock acquisition\n * is always bounded, and an invalid artifact left by a failed concurrent build\n * is removed before retry. Seven governed historical migrations predate the\n * IF NOT EXISTS rule; only those exact filenames may use their immutable bare\n * statements, and the runner makes their retries idempotent by skipping an\n * already-valid index. This keeps additive large-table indexes online without\n * rewriting shipped history or making arbitrary partially-applied migration\n * scripts possible.\n */\nexport function parseConcurrentIndexMigration(\n  file: string,\n  sqlText: string,\n): ConcurrentIndexMigration | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const firstLine = lines[0]?.trim() ?? \"\";\n  const deploymentPrefixed = /^-- deployment-mode: (?:rolling|maintenance)$/.test(firstLine);\n  const directiveIndex = deploymentPrefixed ? 1 : 0;\n  const directiveLine = lines[directiveIndex]?.trim() ?? \"\";\n  const directive = concurrentIndexDirective.exec(directiveLine);\n  if (!directive) {\n    if (directiveLine.startsWith(\"-- opengeni:\")) {\n      throw new Error(`Unsupported OpenGeni migration directive in ${file}`);\n    }\n    return null;\n  }\n\n  const lockTimeout = directive[1]!;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const parsedStatement = concurrentIndexStatement.exec(withoutTrailingSemicolon);\n  if (!parsedStatement || withoutTrailingSemicolon.includes(\";\")) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires exactly one CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS statement with an unqualified index name`,\n    );\n  }\n  const idempotentInSql = parsedStatement[1] !== undefined;\n  if (!idempotentInSql && !governedLegacyConcurrentIndexMigrations.has(file)) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires IF NOT EXISTS; bare statements are supported only for governed historical migrations`,\n    );\n  }\n  return {\n    indexName: (parsedStatement[2] ?? parsedStatement[3]!).replaceAll('\"\"', '\"'),\n    lockTimeout,\n    skipWhenValid: !idempotentInSql,\n    statement,\n  };\n}\n\nfunction parseBatchedBackfillMigration(\n  file: string,\n  sqlText: string,\n): { batchSize: number; lockTimeout: string; statementTimeout: string; statement: string } | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const directiveIndex = /^-- deployment-mode: (?:rolling|maintenance)$/.test(\n    lines[0]?.trim() ?? \"\",\n  )\n    ? 1\n    : 0;\n  const directive = batchedBackfillDirective.exec(lines[directiveIndex]?.trim() ?? \"\");\n  if (!directive) return null;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .filter((line) => !line.trim().startsWith(\"--\"))\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const batchSize = Number(directive[1]!);\n  if (\n    !Number.isSafeInteger(batchSize) ||\n    batchSize < 1 ||\n    batchSize > 10_000 ||\n    !/^WITH\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bUPDATE\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bRETURNING\\b/is.test(withoutTrailingSemicolon) ||\n    !new RegExp(`\\\\bLIMIT\\\\s+${batchSize}\\\\b`, \"i\").test(withoutTrailingSemicolon) ||\n    withoutTrailingSemicolon.includes(\";\")\n  ) {\n    throw new Error(\n      `${file}: opengeni:batched-backfill requires one bounded WITH ... UPDATE ... RETURNING statement whose LIMIT matches batch-size`,\n    );\n  }\n  return {\n    batchSize,\n    lockTimeout: directive[2]!,\n    statementTimeout: directive[3]!,\n    statement,\n  };\n}\n\nasync function executeMigrationFile(\n  sql: postgres.Sql,\n  file: string,\n  sqlText: string,\n): Promise<void> {\n  const batchedBackfill = parseBatchedBackfillMigration(file, sqlText);\n  if (batchedBackfill) {\n    await sql`select set_config('lock_timeout', ${batchedBackfill.lockTimeout}, false)`;\n    await sql`select set_config('statement_timeout', ${batchedBackfill.statementTimeout}, false)`;\n    try {\n      for (;;) {\n        const result = await sql.begin(async (transaction) => {\n          await transaction`select\n            pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),\n            pg_catalog.set_config(\n              'opengeni.session_variable_set_attachments_v1',\n              '1',\n              true\n            )`;\n          return await transaction.unsafe(batchedBackfill.statement);\n        });\n        if (result.length === 0) break;\n      }\n    } finally {\n      await sql`select set_config('statement_timeout', '0', false)`;\n      await sql`select set_config('lock_timeout', '0', false)`;\n    }\n    return;\n  }\n  const concurrentIndex = parseConcurrentIndexMigration(file, sqlText);\n  if (!concurrentIndex) {\n    // Migration SQL is the only writer allowed to cross protocol generations.\n    // Keep the authority transaction-local and inside the same PostgreSQL simple\n    // query as the migration body: setting it in a prior statement would end\n    // that implicit transaction and silently lose the LOCAL value. This also\n    // makes a fresh database capable of applying maintenance migration 0138\n    // and later migrations capable of crossing the 0352 sessions policy\n    // without a process-global PGOPTIONS escape hatch.\n    await sql.unsafe(\n      `SELECT\n  pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),\n  pg_catalog.set_config('opengeni.session_variable_set_attachments_v1', '1', true);\\n${sqlText}`,\n    );\n    return;\n  }\n\n  await sql`select set_config('lock_timeout', ${concurrentIndex.lockTimeout}, false)`;\n  try {\n    const [existing] = await sql<Array<{ valid: boolean; ready: boolean }>>`\n      select i.indisvalid as valid, i.indisready as ready\n      from pg_catalog.pg_class c\n      join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n      join pg_catalog.pg_index i on i.indexrelid = c.oid\n      where n.nspname = current_schema() and c.relname = ${concurrentIndex.indexName}\n    `;\n    if (existing && (!existing.valid || !existing.ready)) {\n      const quotedIndexName = `\"${concurrentIndex.indexName.replaceAll('\"', '\"\"')}\"`;\n      await sql.unsafe(`DROP INDEX CONCURRENTLY ${quotedIndexName}`);\n    } else if (existing && concurrentIndex.skipWhenValid) {\n      return;\n    }\n    await sql.unsafe(concurrentIndex.statement);\n  } finally {\n    await sql`select set_config('lock_timeout', '0', false)`;\n  }\n}\n\nfunction deploymentDepthPolicy(\n  options: MigrationRuntimeOptions | undefined,\n): DeploymentDepthPolicy {\n  const raw =\n    options === undefined\n      ? process.env.OPENGENI_MAX_NESTED_AGENT_DEPTH?.trim() || undefined\n      : options.maxNestedAgentDepth;\n  if (raw === undefined) {\n    return { maxNestedAgentDepth: DEFAULT_MAX_NESTED_AGENT_DEPTH, source: \"default\" };\n  }\n  const value = typeof raw === \"number\" ? raw : Number(raw);\n  if (\n    !Number.isSafeInteger(value) ||\n    value < 0 ||\n    value > MAX_NESTED_AGENT_DEPTH ||\n    (typeof raw === \"string\" && !/^(0|[1-9][0-9]*)$/.test(raw))\n  ) {\n    throw new Error(\n      `OPENGENI_MAX_NESTED_AGENT_DEPTH must be a non-negative 32-bit integer: ${raw}`,\n    );\n  }\n  return { maxNestedAgentDepth: value, source: \"deployment\" };\n}\n\nexport function migrationApplicationRoles(\n  schema: string | undefined,\n  options: MigrationRuntimeOptions | undefined,\n): string[] {\n  const configured = options?.applicationDatabaseRoles;\n  const environment = process.env.OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES?.trim();\n  const explicit =\n    configured !== undefined\n      ? configured\n      : environment\n        ? environment.split(\",\").map((role) => role.trim())\n        : undefined;\n\n  if (!explicit) {\n    const configuredRuntimeRoles = [\n      process.env.OPENGENI_APP_DATABASE_USER?.trim(),\n      process.env.OPENGENI_RUNTIME_DATABASE_ROLE?.trim(),\n    ].filter((role): role is string => Boolean(role) && role !== DEFAULT_APPLICATION_DATABASE_ROLE);\n    if (schema || configuredRuntimeRoles.length > 0) {\n      throw new Error(\n        \"Pending migrations require the exact application database roles via \" +\n          \"MigrationRuntimeOptions.applicationDatabaseRoles or \" +\n          \"OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES for dedicated-schema or custom-role deployments\",\n      );\n    }\n    return [DEFAULT_APPLICATION_DATABASE_ROLE];\n  }\n\n  if (\n    configured !== undefined &&\n    configured.some((role) => typeof role !== \"string\" || role !== role.trim())\n  ) {\n    throw new Error(\n      \"MigrationRuntimeOptions.applicationDatabaseRoles must contain canonical Postgres role names without surrounding whitespace\",\n    );\n  }\n  if (explicit.length < 1 || explicit.length > MAX_MIGRATION_APPLICATION_ROLES) {\n    throw new Error(\n      `Migration application database roles must contain 1-${MAX_MIGRATION_APPLICATION_ROLES} entries`,\n    );\n  }\n  const normalized = [...new Set(explicit)].sort((left, right) =>\n    Buffer.compare(Buffer.from(left, \"utf8\"), Buffer.from(right, \"utf8\")),\n  );\n  if (\n    normalized.length !== explicit.length ||\n    normalized.some((role) => role.length === 0 || Buffer.byteLength(role, \"utf8\") > 63)\n  ) {\n    throw new Error(\n      \"Migration application database roles must be unique, non-empty Postgres role names of at most 63 UTF-8 bytes\",\n    );\n  }\n  return normalized;\n}\n\nasync function persistDeploymentDepthPolicy(\n  sql: postgres.Sql,\n  policy: DeploymentDepthPolicy,\n): Promise<void> {\n  const [relation] = await sql<{ exists: boolean }[]>`\n    select to_regclass('nested_agent_depth_configuration') is not null as exists\n  `;\n  if (!relation?.exists) return;\n  await sql`\n    insert into \"nested_agent_depth_configuration\" (\n      \"singleton\", \"max_nested_agent_depth\", \"policy_source\", \"updated_at\"\n    ) values (true, ${policy.maxNestedAgentDepth}, ${policy.source}, now())\n    on conflict (\"singleton\") do update\n    set \"max_nested_agent_depth\" = excluded.\"max_nested_agent_depth\",\n        \"policy_source\" = excluded.\"policy_source\",\n        \"updated_at\" = now()\n    where \"nested_agent_depth_configuration\".\"max_nested_agent_depth\"\n            is distinct from excluded.\"max_nested_agent_depth\"\n       or \"nested_agent_depth_configuration\".\"policy_source\"\n            is distinct from excluded.\"policy_source\"\n  `;\n}\n\n/**\n * Apply the OpenGeni SQL migration chain.\n *\n * STANDALONE (default, unchanged): `migrate()` / `migrate(databaseUrl)` runs the\n * whole chain with NO search_path manipulation, so every unqualified\n * table/index/policy lands in the server default schema (`public`). This is the\n * byte-for-byte historical behavior — the migration test suite calls\n * `migrate(DB_URL)` and is unaffected.\n *\n * EMBEDDED SCHEMA MODE: pass a `schema` (or set\n * `OPENGENI_DB_SCHEMA`). The migrate session then `CREATE SCHEMA IF NOT EXISTS`\n * for both `<schema>` and `opengeni_private`, and sets\n * `search_path = \"<schema>\", \"opengeni_private\", \"public\"`, so EVERY unqualified\n * DDL statement lands in the dedicated schema with NO per-statement SQL rewrite\n * (the schema-isolation contract). Two things make this work and stay idempotent:\n *   1. The policy-existence guards in the migration SQL use `current_schema()`\n *      (not a hardcoded `'public'`) — so a re-run finds the policy it already\n *      created in `<schema>` and DROP/CREATEs idempotently instead of failing\n *      with \"policy already exists\". (This guard substitution is the migrate-\n *      time enabler for the runtime search_path approach; without it the SDK\n *      entry point silently fails on re-run — the migration replay hazard.)\n *   2. `public` stays LAST on the path so `gen_random_uuid()` (pgcrypto) and the\n *      `vector` type — both installed into `public` by 0000 — still resolve. The\n *      `opengeni_private.*` helpers are always called with an absolute prefix.\n * Dedicated-schema callers must also pass the exact API/worker database login\n * identities in `applicationDatabaseRoles`; maintenance cutovers cannot infer\n * host-managed or scoped runtime roles from the admin connection.\n *\n * `OPENGENI_DB_SCHEMA` defaults UNSET → `public` → standalone, so the default\n * binding never regresses.\n */\nexport async function migrate(\n  databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_URL ??\n    DEFAULT_DATABASE_URL,\n  schema: string | undefined = process.env.OPENGENI_DB_SCHEMA?.trim() || undefined,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), \"../drizzle\");\n  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(\".sql\")).sort();\n  const depthPolicy = deploymentDepthPolicy(runtimeOptions);\n  const sql = postgres(databaseUrl, { max: 1 });\n  try {\n    // Serialize concurrent migrate() runs; the session-level lock is released\n    // when the connection closes.\n    await sql`SELECT pg_advisory_lock(727458)`;\n    if (schema) {\n      assertIdentifier(\"OPENGENI_DB_SCHEMA\", schema);\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"${schema}\"`);\n      // opengeni_private is also created by 0001 with an absolute prefix, but the\n      // session search_path must already resolve it for the policy predicates\n      // and the SECURITY DEFINER functions that inherit the caller's path.\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"opengeni_private\"`);\n      await sql.unsafe(`SET search_path = \"${schema}\", \"opengeni_private\", \"public\"`);\n    }\n    await sql`select set_config('opengeni.max_nested_agent_depth', ${String(depthPolicy.maxNestedAgentDepth)}, false)`;\n    await sql`select set_config('opengeni.nested_agent_depth_policy_source', ${depthPolicy.source}, false)`;\n    await sql.unsafe(\n      `CREATE TABLE IF NOT EXISTS \"schema_migrations\" (\"name\" text PRIMARY KEY, \"applied_at\" timestamptz NOT NULL DEFAULT now())`,\n    );\n    const appliedRows = await sql`SELECT \"name\" FROM \"schema_migrations\"`;\n    const applied = new Set(appliedRows.map((row) => row.name as string));\n    const pendingMigrationSources = new Map<string, string>();\n    for (const file of files) {\n      if (!applied.has(file)) {\n        pendingMigrationSources.set(file, await readFile(join(migrationsDir, file), \"utf8\"));\n      }\n    }\n    // Initialize this session GUC for every pending migration that consumes it,\n    // instead of maintaining a second filename list that can silently lag the\n    // shipped migration chain. The conservative source marker is intentional:\n    // setting the bounded role list for a migration that only mentions the GUC\n    // is harmless, while omitting it makes an otherwise valid upgrade fail.\n    if (\n      Array.from(pendingMigrationSources.values()).some((source) =>\n        source.includes(MIGRATION_APPLICATION_ROLES_SETTING),\n      )\n    ) {\n      const applicationRoles = migrationApplicationRoles(schema, runtimeOptions);\n      await sql`select set_config(\n        ${MIGRATION_APPLICATION_ROLES_SETTING},\n        ${JSON.stringify(applicationRoles)},\n        false\n      )`;\n    }\n    for (const file of files) {\n      if (applied.has(file)) {\n        continue;\n      }\n      const sqlText = pendingMigrationSources.get(file);\n      if (sqlText === undefined) {\n        throw new Error(`Pending migration source was not loaded: ${file}`);\n      }\n      await executeMigrationFile(sql, file, sqlText);\n      await sql`INSERT INTO \"schema_migrations\" (\"name\") VALUES (${file}) ON CONFLICT DO NOTHING`;\n    }\n    // Reconcile even when all migration names were already recorded. This is\n    // the only supported way to change deployment policy in a live database.\n    await persistDeploymentDepthPolicy(sql, depthPolicy);\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * SDK entry point (Step I): run the migration chain over a host-supplied admin\n * connection string against an explicit target schema. This is the embedded\n * topology's named entry — a host calls `runMigrations(adminConnection,\n * targetSchema, { applicationDatabaseRoles })` from its own provisioning code\n * instead of relying on env vars.\n * `targetSchema` undefined → `public` → standalone behavior. Thin wrapper over\n * `migrate` so there is one migration engine.\n */\nexport async function runMigrations(\n  adminConnection: string,\n  targetSchema?: string,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  await migrate(adminConnection, targetSchema, runtimeOptions);\n}\n\nif (import.meta.main) {\n  await migrate();\n  console.log(\"Applied Drizzle SQL migrations.\");\n}\n"],"mappings":";AAAA,SAAS,SAAS,gBAAgB;AAClC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,OAAO,cAAc;AAErB,IAAM,uBAAuB;AAC7B,IAAM,iCAAiC;AACvC,IAAM,yBAAyB;AAC/B,IAAM,oCAAoC;AAC1C,IAAM,sCAAsC;AAC5C,IAAM,kCAAkC;AACxC,IAAM,2BACJ;AACF,IAAM,2BAA2B;AACjC,IAAM,2BACJ;AACF,IAAM,0CAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA2BD,SAAS,iBAAiB,MAAc,OAAuB;AAC7D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,wCAAwC,KAAK,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAoBO,SAAS,8BACd,MACA,SACiC;AACjC,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,YAAY,MAAM,CAAC,GAAG,KAAK,KAAK;AACtC,QAAM,qBAAqB,gDAAgD,KAAK,SAAS;AACzF,QAAM,iBAAiB,qBAAqB,IAAI;AAChD,QAAM,gBAAgB,MAAM,cAAc,GAAG,KAAK,KAAK;AACvD,QAAM,YAAY,yBAAyB,KAAK,aAAa;AAC7D,MAAI,CAAC,WAAW;AACd,QAAI,cAAc,WAAW,cAAc,GAAG;AAC5C,YAAM,IAAI,MAAM,+CAA+C,IAAI,EAAE;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,UAAU,CAAC;AAC/B,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,kBAAkB,yBAAyB,KAAK,wBAAwB;AAC9E,MAAI,CAAC,mBAAmB,yBAAyB,SAAS,GAAG,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,kBAAkB,gBAAgB,CAAC,MAAM;AAC/C,MAAI,CAAC,mBAAmB,CAAC,wCAAwC,IAAI,IAAI,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY,gBAAgB,CAAC,KAAK,gBAAgB,CAAC,GAAI,WAAW,MAAM,GAAG;AAAA,IAC3E;AAAA,IACA,eAAe,CAAC;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,8BACP,MACA,SACgG;AAChG,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,iBAAiB,gDAAgD;AAAA,IACrE,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,EACtB,IACI,IACA;AACJ,QAAM,YAAY,yBAAyB,KAAK,MAAM,cAAc,GAAG,KAAK,KAAK,EAAE;AACnF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,WAAW,IAAI,CAAC,EAC9C,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,YAAY,OAAO,UAAU,CAAC,CAAE;AACtC,MACE,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAY,KACZ,YAAY,OACZ,CAAC,YAAY,KAAK,wBAAwB,KAC1C,CAAC,eAAe,KAAK,wBAAwB,KAC7C,CAAC,kBAAkB,KAAK,wBAAwB,KAChD,CAAC,IAAI,OAAO,eAAe,SAAS,OAAO,GAAG,EAAE,KAAK,wBAAwB,KAC7E,yBAAyB,SAAS,GAAG,GACrC;AACA,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,UAAU,CAAC;AAAA,IACxB,kBAAkB,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,eAAe,qBACb,KACA,MACA,SACe;AACf,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,iBAAiB;AACnB,UAAM,wCAAwC,gBAAgB,WAAW;AACzE,UAAM,6CAA6C,gBAAgB,gBAAgB;AACnF,QAAI;AACF,iBAAS;AACP,cAAM,SAAS,MAAM,IAAI,MAAM,OAAO,gBAAgB;AACpD,gBAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAON,iBAAO,MAAM,YAAY,OAAO,gBAAgB,SAAS;AAAA,QAC3D,CAAC;AACD,YAAI,OAAO,WAAW,EAAG;AAAA,MAC3B;AAAA,IACF,UAAE;AACA,YAAM;AACN,YAAM;AAAA,IACR;AACA;AAAA,EACF;AACA,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,CAAC,iBAAiB;AAQpB,UAAM,IAAI;AAAA,MACR;AAAA;AAAA;AAAA,EAEiF,OAAO;AAAA,IAC1F;AACA;AAAA,EACF;AAEA,QAAM,wCAAwC,gBAAgB,WAAW;AACzE,MAAI;AACF,UAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,2DAK8B,gBAAgB,SAAS;AAAA;AAEhF,QAAI,aAAa,CAAC,SAAS,SAAS,CAAC,SAAS,QAAQ;AACpD,YAAM,kBAAkB,IAAI,gBAAgB,UAAU,WAAW,KAAK,IAAI,CAAC;AAC3E,YAAM,IAAI,OAAO,2BAA2B,eAAe,EAAE;AAAA,IAC/D,WAAW,YAAY,gBAAgB,eAAe;AACpD;AAAA,IACF;AACA,UAAM,IAAI,OAAO,gBAAgB,SAAS;AAAA,EAC5C,UAAE;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,sBACP,SACuB;AACvB,QAAM,MACJ,YAAY,SACR,QAAQ,IAAI,iCAAiC,KAAK,KAAK,SACvD,QAAQ;AACd,MAAI,QAAQ,QAAW;AACrB,WAAO,EAAE,qBAAqB,gCAAgC,QAAQ,UAAU;AAAA,EAClF;AACA,QAAM,QAAQ,OAAO,QAAQ,WAAW,MAAM,OAAO,GAAG;AACxD,MACE,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ,0BACP,OAAO,QAAQ,YAAY,CAAC,oBAAoB,KAAK,GAAG,GACzD;AACA,UAAM,IAAI;AAAA,MACR,0EAA0E,GAAG;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,EAAE,qBAAqB,OAAO,QAAQ,aAAa;AAC5D;AAEO,SAAS,0BACd,QACA,SACU;AACV,QAAM,aAAa,SAAS;AAC5B,QAAM,cAAc,QAAQ,IAAI,+CAA+C,KAAK;AACpF,QAAM,WACJ,eAAe,SACX,aACA,cACE,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,IAChD;AAER,MAAI,CAAC,UAAU;AACb,UAAM,yBAAyB;AAAA,MAC7B,QAAQ,IAAI,4BAA4B,KAAK;AAAA,MAC7C,QAAQ,IAAI,gCAAgC,KAAK;AAAA,IACnD,EAAE,OAAO,CAAC,SAAyB,QAAQ,IAAI,KAAK,SAAS,iCAAiC;AAC9F,QAAI,UAAU,uBAAuB,SAAS,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,WAAO,CAAC,iCAAiC;AAAA,EAC3C;AAEA,MACE,eAAe,UACf,WAAW,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,SAAS,KAAK,KAAK,CAAC,GAC1E;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,SAAS,KAAK,SAAS,SAAS,iCAAiC;AAC5E,UAAM,IAAI;AAAA,MACR,uDAAuD,+BAA+B;AAAA,IACxF;AAAA,EACF;AACA,QAAM,aAAa,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE;AAAA,IAAK,CAAC,MAAM,UACpD,OAAO,QAAQ,OAAO,KAAK,MAAM,MAAM,GAAG,OAAO,KAAK,OAAO,MAAM,CAAC;AAAA,EACtE;AACA,MACE,WAAW,WAAW,SAAS,UAC/B,WAAW,KAAK,CAAC,SAAS,KAAK,WAAW,KAAK,OAAO,WAAW,MAAM,MAAM,IAAI,EAAE,GACnF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,6BACb,KACA,QACe;AACf,QAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAGzB,MAAI,CAAC,UAAU,OAAQ;AACvB,QAAM;AAAA;AAAA;AAAA,sBAGc,OAAO,mBAAmB,KAAK,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlE;AAiCA,eAAsB,QACpB,cAAc,QAAQ,IAAI,oCACxB,QAAQ,IAAI,yBACZ,sBACF,SAA6B,QAAQ,IAAI,oBAAoB,KAAK,KAAK,QACvE,gBACe;AACf,QAAM,gBAAgB,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,YAAY;AAChF,QAAM,SAAS,MAAM,QAAQ,aAAa,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AAC1F,QAAM,cAAc,sBAAsB,cAAc;AACxD,QAAM,MAAM,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AAC5C,MAAI;AAGF,UAAM;AACN,QAAI,QAAQ;AACV,uBAAiB,sBAAsB,MAAM;AAC7C,YAAM,IAAI,OAAO,gCAAgC,MAAM,GAAG;AAI1D,YAAM,IAAI,OAAO,gDAAgD;AACjE,YAAM,IAAI,OAAO,sBAAsB,MAAM,iCAAiC;AAAA,IAChF;AACA,UAAM,2DAA2D,OAAO,YAAY,mBAAmB,CAAC;AACxG,UAAM,qEAAqE,YAAY,MAAM;AAC7F,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,UAAU,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAc,CAAC;AACpE,UAAM,0BAA0B,oBAAI,IAAoB;AACxD,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,gCAAwB,IAAI,MAAM,MAAM,SAAS,KAAK,eAAe,IAAI,GAAG,MAAM,CAAC;AAAA,MACrF;AAAA,IACF;AAMA,QACE,MAAM,KAAK,wBAAwB,OAAO,CAAC,EAAE;AAAA,MAAK,CAAC,WACjD,OAAO,SAAS,mCAAmC;AAAA,IACrD,GACA;AACA,YAAM,mBAAmB,0BAA0B,QAAQ,cAAc;AACzE,YAAM;AAAA,UACF,mCAAmC;AAAA,UACnC,KAAK,UAAU,gBAAgB,CAAC;AAAA;AAAA;AAAA,IAGtC;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,IAAI,IAAI,GAAG;AACrB;AAAA,MACF;AACA,YAAM,UAAU,wBAAwB,IAAI,IAAI;AAChD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI,MAAM,4CAA4C,IAAI,EAAE;AAAA,MACpE;AACA,YAAM,qBAAqB,KAAK,MAAM,OAAO;AAC7C,YAAM,uDAAuD,IAAI;AAAA,IACnE;AAGA,UAAM,6BAA6B,KAAK,WAAW;AAAA,EACrD,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAWA,eAAsB,cACpB,iBACA,cACA,gBACe;AACf,QAAM,QAAQ,iBAAiB,cAAc,cAAc;AAC7D;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,QAAQ;AACd,UAAQ,IAAI,iCAAiC;AAC/C;","names":[]}

package/dist/{chunk-4NAR7FBA.js → chunk-3RI33YQN.js}

@@ -148,6 +148,7 @@ var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [
   "knowledge_source_objects"
 ];
 var MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE = "ensure_managed_human_personal_workspace(uuid, text, uuid)";
+var ADDITIONAL_ORGANIZATION_CREATION_ROUTINE = "create_additional_managed_organization(text, text, text, text, uuid)";
 var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "list_self_organization_memberships(text)",
   "list_self_organization_invitations(text)",
@@ -161,9 +162,11 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "resolve_workspace_codex_subscription_source(uuid, uuid)",
   "list_organization_workspace_ids(uuid)",
   "organization_workspace_command(jsonb)",
+  "authorize_organization_shared_workspace_administration(uuid, uuid, text)",
   "resolve_organization_workspace_removal_subject(uuid, text, uuid)",
   "prepare_organization_workspace_member_removal(jsonb)",
   "record_organization_workspace_member_removal(jsonb, uuid, uuid)",
+  ADDITIONAL_ORGANIZATION_CREATION_ROUTINE,
   "create_managed_organization(text, text, text, uuid)",
   "assert_organization_shared_workspace_administrator(uuid, uuid, text)",
   "open_organization_shared_workspace_administration_capability(uuid, uuid, text)",
@@ -178,7 +181,9 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
   "complete_self_service_organization_setup(jsonb)",
   "ensure_organization_user_setup_intent(jsonb)",
   "claim_organization_user_setup_delivery(jsonb)",
+  "claim_organization_user_setup_delivery_v2(jsonb)",
   "prepare_organization_user_setup_delivery(jsonb)",
+  "prepare_organization_user_setup_delivery_v2(jsonb)",
   "settle_organization_user_setup_delivery(jsonb)",
   "preview_organization_user_setup(text)",
   "get_organization_invitation_for_administration(uuid, text, uuid)",
@@ -221,6 +226,10 @@ var ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES = [
   "organization_workspace_operation_receipts",
   "self_service_organization_setup_receipts"
 ];
+var ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES = [
+  ...ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES,
+  "additional_organization_creation_receipts"
+];
 var PRIVATE_SESSION_CREATE_POLICY_ROUTINE = "get_private_session_create_policy(uuid, uuid, text)";
 var ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE = "get_organization_private_session_settings(uuid, text)";
 var ORGANIZATION_PRIVATE_SESSION_SETTINGS_UPDATE_ROUTINE = "update_organization_private_session_settings(uuid, text, boolean, bigint, uuid)";
@@ -535,6 +544,7 @@ var SESSION_TENANCY_ANY_ACTIVATION_ROUTINE = "session_tenancy_any_product_activa
 var SESSION_TENANCY_QUIESCENCE_ROUTINE = "assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean)";
 var TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE = "check_tenancy_backfill_activation_evidence(uuid)";
 var GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE = "activate_greenfield_session_tenancy_from_setup(text)";
+var ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE = "activate_session_tenancy_from_additional_organization(uuid)";
 var SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE = "session_visibility_lifecycle_capability_held()";
 var PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES = [
   "open_private_session_create_capability(uuid, uuid, uuid, text)",
@@ -628,6 +638,7 @@ var RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET = new Set(
   RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES
 );
 var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
+  ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE,
   AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE,
   ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE,
   GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE,
@@ -644,6 +655,7 @@ var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set(
   RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES
 );
 var FORCE_RLS_TABLES = [
+  "additional_organization_creation_receipts",
   "agent_run_states",
   "api_keys",
   "attached_browser_devices",
@@ -810,6 +822,9 @@ var FORCE_RLS_TABLES = [
   "organization_membership_lifecycle_events",
   "organization_membership_operation_receipts",
   "organization_memberships",
+  "organization_model_provider_connection_operations",
+  "organization_model_provider_connections",
+  "organization_model_provider_custom_models",
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
@@ -880,6 +895,7 @@ var FORCE_RLS_TABLES = [
   "session_attempt_codemode_calls",
   "session_attempt_connected_machine_authorizations",
   "session_attempt_interruptions",
+  "session_attempt_model_context_snapshots",
   "session_attempt_personal_document_admissions",
   "session_attempt_personal_document_snapshots",
   "session_attempt_personal_resource_admissions",
@@ -907,6 +923,7 @@ var FORCE_RLS_TABLES = [
   "session_system_update_outbox",
   "session_system_updates",
   "session_tenancy_activations",
+  "session_tenancy_additional_organization_activation_evidence",
   "session_tenancy_greenfield_activation_evidence",
   "session_turn_attempts",
   "session_turn_startup_milestones",
@@ -949,6 +966,7 @@ var FORCE_RLS_TABLES = [
   "temporal_schedule_cleanup_outbox",
   "tenancy_backfill_receipts",
   "tenancy_backfill_unresolved_rows",
+  "tool_gateway_approval_capabilities",
   "transcription_recording_chunks",
   "transcription_recording_objects",
   "transcription_recording_segments",
@@ -966,6 +984,7 @@ var FORCE_RLS_TABLES = [
   "workspace_captures",
   "workspace_codex_subscription_preferences",
   "workspace_control_events",
+  "workspace_gateway_custom_models",
   "workspace_inference_controls",
   "workspace_instruction_policy_activation_events",
   "workspace_instruction_policy_deactivation_events",
@@ -999,8 +1018,14 @@ var NON_RLS_RUNTIME_TABLES = [
   "auth_users",
   "auth_verifications",
   "automation_webhook_endpoints",
+  "deployment_model_catalog",
   "integration_oauth_clients",
   "managed_accounts",
+  "mcp_oauth_access_tokens",
+  "mcp_oauth_authorization_codes",
+  "mcp_oauth_authorization_requests",
+  "mcp_oauth_clients",
+  "mcp_oauth_refresh_tokens",
   "nested_agent_depth_configuration",
   "pr_review_managed_github_routes",
   "stripe_webhook_events",
@@ -1073,12 +1098,20 @@ var RUNTIME_FULL_DML_TABLES = [
   "machine_metrics_series",
   "machine_removal_operations",
   "managed_accounts",
+  "mcp_oauth_access_tokens",
+  "mcp_oauth_authorization_codes",
+  "mcp_oauth_authorization_requests",
+  "mcp_oauth_clients",
+  "mcp_oauth_refresh_tokens",
   "memory_slack_publication_configurations",
   "memory_slack_publication_receipts",
   "memory_slack_publications",
   "model_call_facts",
   "new_session_drafts",
   "organization_codex_rotation_settings",
+  "organization_model_provider_connection_operations",
+  "organization_model_provider_connections",
+  "organization_model_provider_custom_models",
   "pack_installation_components",
   "pack_installations",
   "pr_review_app_registrations",
@@ -1136,6 +1169,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "social_connections",
   "social_posts",
   "stripe_webhook_events",
+  "tool_gateway_approval_capabilities",
   "transcription_recording_chunks",
   "transcription_recording_objects",
   "transcription_recording_segments",
@@ -1147,6 +1181,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "workspace_captures",
   "workspace_codex_subscription_preferences",
   "workspace_control_events",
+  "workspace_gateway_custom_models",
   "workspace_inference_controls",
   "workspace_instruction_policy_heads",
   "workspace_memberships",
@@ -1166,6 +1201,7 @@ var RUNTIME_READ_ONLY_TABLES = [
   "company_profile_activation_events",
   "company_profile_heads",
   "company_profile_snapshots",
+  "deployment_model_catalog",
   "document_authority_reclassifications",
   "knowledge_lifecycle_events",
   "knowledge_memory_lifecycle_events",
@@ -1263,12 +1299,14 @@ var RUNTIME_READ_INSERT_UPDATE_TABLES = [
   "scheduled_task_runs",
   "scheduled_tasks",
   "session_attempt_codemode_calls",
+  "session_attempt_model_context_snapshots",
   "session_turn_startup_milestones",
   "site_auth_connections",
   "slack_user_link_access_requests",
   "workspace_interaction_revisions"
 ];
 var PROTECTED_NO_DIRECT_DML_TABLES = [
+  "additional_organization_creation_receipts",
   "canonical_human_identities",
   "canonical_human_identity_operations",
   "canonical_human_identity_subjects",
@@ -1358,6 +1396,7 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "session_attempt_personal_document_snapshots",
   "session_attempt_personal_resource_admissions",
   "session_attempt_personal_resource_snapshots",
+  "session_tenancy_additional_organization_activation_evidence",
   "session_tenancy_greenfield_activation_evidence",
   "session_variable_set_attachments",
   "session_visibility_write_capabilities",
@@ -2061,6 +2100,29 @@ function evaluateRuntimeDatabasePosture(posture, options) {
           );
         }
       }
+    } else if (routine.name === ADDITIONAL_ORGANIZATION_CREATION_ROUTINE) {
+      const missingAuthorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
     } else if (ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES.includes(routine.name)) {
       const missingAuthorityTables = ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES.filter(
         (tableName) => !tableByName.has(tableName)
@@ -3326,9 +3388,11 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "resolve_workspace_codex_subscription_source(uuid,uuid)",
     "list_organization_workspace_ids(uuid)",
     "organization_workspace_command(jsonb)",
+    "authorize_organization_shared_workspace_administration(uuid,uuid,text)",
     "resolve_organization_workspace_removal_subject(uuid,text,uuid)",
     "prepare_organization_workspace_member_removal(jsonb)",
     "record_organization_workspace_member_removal(jsonb,uuid,uuid)",
+    "create_additional_managed_organization(text,text,text,text,uuid)",
     "create_managed_organization(text,text,text,uuid)",
     "assert_organization_shared_workspace_administrator(uuid,uuid,text)",
     "open_organization_shared_workspace_administration_capability(uuid,uuid,text)",
@@ -3343,7 +3407,9 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "complete_self_service_organization_setup(jsonb)",
     "ensure_organization_user_setup_intent(jsonb)",
     "claim_organization_user_setup_delivery(jsonb)",
+    "claim_organization_user_setup_delivery_v2(jsonb)",
     "prepare_organization_user_setup_delivery(jsonb)",
+    "prepare_organization_user_setup_delivery_v2(jsonb)",
     "settle_organization_user_setup_delivery(jsonb)",
     "preview_organization_user_setup(text)",
     "get_organization_invitation_for_administration(uuid,text,uuid)",
@@ -5102,4 +5168,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-4NAR7FBA.js.map
+//# sourceMappingURL=chunk-3RI33YQN.js.map