@opengeni/db 4.0.0-canary.2 → 4.0.0-canary.4

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-VU2IK37Y.js";
-import "./chunk-XIYAXH47.js";
-import "./chunk-PWJJKCTF.js";
+} from "./chunk-OWZ36ST7.js";
+import "./chunk-GPKHEPVX.js";
+import "./chunk-WU3MSPZS.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ManagedAuthActorMutationInFlightError,

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-FRIYCNK2.js";
+} from "./chunk-SOLRMQCL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/runtime-posture.d.ts

@@ -1,6 +1,6 @@
 import type { Database, RlsStrategy } from "./database.js";
 export declare const WORK_CLAIM_CAPABILITY_ROUTINES: readonly ["upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)", "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)"];
-export declare const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES: readonly ["company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamp with time zone, uuid, integer)", "company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer)", "propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)", "propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text)", "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)", "get_company_profile_agent_policy(uuid, uuid, text)", "update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid)", "evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)", "activate_governed_learning_decision(uuid, uuid, uuid, uuid)", "activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid)", "confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)", "materialize_remember_knowledge_memory(uuid, uuid, uuid)", "undo_governed_learning_activation(uuid, uuid, uuid, uuid)", "inspect_governed_learning_decisions(uuid, uuid, text, integer)", "inspect_governed_learning_activations(uuid, uuid, text, integer)", "inspect_governed_learning_activation_undos(uuid, uuid, text, integer)", "fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)", "fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer)", "replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)", "session_tenancy_product_activated(uuid, integer)", "session_tenancy_any_product_activation()", "xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint)", "create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamp with time zone)", "disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb)", "google_drive_document_citation(uuid, uuid, text, uuid, uuid)", "google_drive_file_authorized(uuid, uuid, text, uuid)", "knowledge_source_sync_lock_authority(uuid, uuid, uuid)", "ensure_managed_human_personal_workspace(uuid, text, uuid)", "list_self_organization_memberships(text)", "list_self_organization_invitations(text)", "list_self_organization_invitations(text, uuid, integer)", "get_self_organization_invitation(text, uuid)", "list_organization_invitations(uuid, text, uuid, integer)", "list_organization_members(uuid, text)", "list_organization_administration_members(uuid, text)", "get_organization_administration_overview(uuid, text)", "get_workspace_kind(uuid, uuid)", "resolve_workspace_codex_subscription_source(uuid, uuid)", "list_organization_workspace_ids(uuid)", "organization_workspace_command(jsonb)", "authorize_organization_shared_workspace_administration(uuid, uuid, text)", "resolve_organization_workspace_removal_subject(uuid, text, uuid)", "prepare_organization_workspace_member_removal(jsonb)", "record_organization_workspace_member_removal(jsonb, uuid, uuid)", "create_additional_managed_organization(text, text, text, text, uuid)", "create_managed_organization(text, text, text, uuid)", "assert_organization_shared_workspace_administrator(uuid, uuid, text)", "open_organization_shared_workspace_administration_capability(uuid, uuid, text)", "close_organization_shared_workspace_administration_capability(uuid)", "create_organization_shared_workspace(uuid, text, text, text, text, uuid)", "upsert_organization_shared_workspace_member(uuid, uuid, text, uuid, text, text, jsonb, boolean)", "update_organization_name(uuid, text, text, timestamp with time zone, uuid)", "create_organization_invitation_v2(jsonb)", "bind_pending_organization_invitations_for_verified_email(text, text)", "has_pending_organization_invitation_for_subject(text)", "accept_organization_invitation_v2(jsonb)", "complete_self_service_organization_setup(jsonb)", "ensure_organization_user_setup_intent(jsonb)", "claim_organization_user_setup_delivery(jsonb)", "claim_organization_user_setup_delivery_v2(jsonb)", "prepare_organization_user_setup_delivery(jsonb)", "prepare_organization_user_setup_delivery_v2(jsonb)", "settle_organization_user_setup_delivery(jsonb)", "preview_organization_user_setup(text)", "get_organization_invitation_for_administration(uuid, text, uuid)", "preflight_organization_user_setup(text)", "complete_organization_user_setup(jsonb)", "organization_membership_command(jsonb)", "prepare_organization_membership_protocol_settlements(jsonb)", "assert_active_managed_human_organization_membership(uuid, text)", "resolve_workspace_writer_grant_identity(uuid, text)", "prepare_workspace_membership_removal_settlements(jsonb)", "workspace_membership_removal_command(jsonb)", "get_organization_retention_policy(uuid, text)", "preview_organization_retention_deletions(uuid, integer)", "claim_organization_retention_deletion(uuid, uuid, uuid[])", "list_organization_retention_deletion_objects(uuid, uuid, uuid, text, integer)", "record_organization_retention_object_deleted(uuid, uuid, uuid, text, text, text, text)", "fail_organization_retention_deletion(uuid, uuid, uuid, text)", "finalize_organization_retention_deletion(uuid, uuid, uuid, text)", "complete_organization_retention_deletion(uuid, uuid, uuid, text)", ...string[], "open_private_session_create_capability(uuid, uuid, uuid, text)", "open_private_child_session_create_capability(uuid, uuid, uuid, uuid, uuid, uuid, integer)", "close_private_session_create_capability(uuid)", "resolve_session_attempt_personal_resources(uuid, uuid, uuid)", "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)", "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)", "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)", "issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean)", "revoke_self_user_resource_grant(uuid, uuid, uuid)", "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)", "preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamp with time zone, text)", "create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)", "list_scoped_variable_sets(uuid, uuid, uuid, text, text)", "count_scoped_variable_sets(uuid, uuid, text)", "mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean)", "read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer)", "materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid)", "connection_authority_convergence_audit_capability_active(uuid)", "resolve_personal_connection_authority_selection(uuid, uuid, text, uuid, jsonb)", "resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)", "resolve_connection_use_authority(uuid, uuid, uuid, jsonb)", "inspect_organization_connection_authority_convergence(uuid, integer, uuid)", "get_self_personal_github_repository_selection(uuid, uuid, text, uuid)", "mutate_self_personal_github_repository_selection(uuid, uuid, text, uuid, bigint, bigint, text, jsonb, boolean)", "create_personal_document_authority(uuid, uuid, uuid)", "resolve_document_original_file(uuid, uuid, text, uuid)", "resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)", "list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)", "reclassify_document_authority(jsonb)", "run_document_default_collection_backfill(jsonb)", "list_document_default_collection_backfill_runs(jsonb)", "get_document_default_collection_backfill_audit(jsonb)", "list_organization_document_authority_reclassifications(jsonb)", "create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean)", "list_scoped_rigs(uuid, uuid, uuid, text, text)", "count_scoped_rigs(uuid, uuid, text)", "mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean)", "finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean)", "list_scoped_enrollments(uuid, uuid, uuid, text)", "get_scoped_sandbox(uuid, uuid, uuid)", "authorize_scoped_sandbox_attach(uuid, uuid, uuid)", "materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer)", "authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean)", "list_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "detach_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint)", "clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint)", "refresh_scheduled_task_personal_resources_clone_connections(uuid, uuid, uuid, bigint, bigint)", "create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb)", "materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text)", "scheduled_task_run_personal_resource_authority(uuid, uuid, uuid)", "scheduled_task_run_connection_authority_subject(uuid, uuid, uuid)", "scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint)", "record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint)", "clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint)", "scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint)", "scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint)", "validate_scheduled_agent_run_live_authority(uuid, uuid, uuid)", "scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid)", "scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "bind_scheduled_task_run_session(uuid, uuid, uuid, uuid)", "transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text)", "ensure_canonical_human_identity(text, text)", "validate_canonical_human_session(text, text, boolean)", "get_canonical_human_identity_projection(text)", "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)", "get_canonical_human_exact_login_binding(text, text)", "managed_auth_session_set_authority_state(text)", "managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)", "managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)", "managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)", "managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)", "managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)", "managed_auth_actor_mutation_fence(text, bigint, uuid)", "managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)", "managed_auth_actor_mutation_lease_release(text, uuid)", "managed_auth_actor_mutation_lease_validate(text, bigint, uuid)", "managed_auth_adopted_session_snapshot(text)", "managed_auth_isolated_session_reap(integer)", "managed_auth_expired_session_set_reap(integer)", "managed_auth_session_set_operation_receipt(text, uuid, text, text)", "get_organization_recovery_overview(uuid, text, jsonb, text, text)", "organization_recovery_command(jsonb)", "create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)", "archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)", "replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)", "resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)", "upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)", "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "session_private_actor_visible(uuid, uuid, uuid, text)", "session_reference_visible(uuid, uuid, uuid)", "session_visibility_lifecycle_capability_held()", "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer)", "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)", "resolve_xai_authority_pool(uuid, uuid, text, jsonb)", "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)", "xai_provider_account_authority_snapshot_v1_valid(jsonb)"];
+export declare const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES: readonly ["company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamp with time zone, uuid, integer)", "company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer)", "propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)", "propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text)", "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)", "get_company_profile_agent_policy(uuid, uuid, text)", "update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid)", "evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)", "activate_governed_learning_decision(uuid, uuid, uuid, uuid)", "activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid)", "confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)", "materialize_remember_knowledge_memory(uuid, uuid, uuid)", "undo_governed_learning_activation(uuid, uuid, uuid, uuid)", "inspect_governed_learning_decisions(uuid, uuid, text, integer)", "inspect_governed_learning_activations(uuid, uuid, text, integer)", "inspect_governed_learning_activation_undos(uuid, uuid, text, integer)", "fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)", "fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer)", "replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)", "session_tenancy_product_activated(uuid, integer)", "session_tenancy_any_product_activation()", "xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint)", "create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamp with time zone)", "disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb)", "google_drive_document_citation(uuid, uuid, text, uuid, uuid)", "google_drive_file_authorized(uuid, uuid, text, uuid)", "knowledge_source_sync_lock_authority(uuid, uuid, uuid)", "ensure_managed_human_personal_workspace(uuid, text, uuid)", "list_self_organization_memberships(text)", "list_self_organization_invitations(text)", "list_self_organization_invitations(text, uuid, integer)", "get_self_organization_invitation(text, uuid)", "list_organization_invitations(uuid, text, uuid, integer)", "list_organization_members(uuid, text)", "list_organization_administration_members(uuid, text)", "get_organization_administration_overview(uuid, text)", "get_workspace_kind(uuid, uuid)", "resolve_workspace_codex_subscription_source(uuid, uuid)", "list_organization_workspace_ids(uuid)", "list_organization_codex_workspace_ids(uuid)", "organization_workspace_command(jsonb)", "authorize_organization_shared_workspace_administration(uuid, uuid, text)", "resolve_organization_workspace_removal_subject(uuid, text, uuid)", "prepare_organization_workspace_member_removal(jsonb)", "record_organization_workspace_member_removal(jsonb, uuid, uuid)", "create_additional_managed_organization(text, text, text, text, uuid)", "create_managed_organization(text, text, text, uuid)", "assert_organization_shared_workspace_administrator(uuid, uuid, text)", "open_organization_shared_workspace_administration_capability(uuid, uuid, text)", "close_organization_shared_workspace_administration_capability(uuid)", "create_organization_shared_workspace(uuid, text, text, text, text, uuid)", "upsert_organization_shared_workspace_member(uuid, uuid, text, uuid, text, text, jsonb, boolean)", "update_organization_name(uuid, text, text, timestamp with time zone, uuid)", "create_organization_invitation_v2(jsonb)", "bind_pending_organization_invitations_for_verified_email(text, text)", "has_pending_organization_invitation_for_subject(text)", "accept_organization_invitation_v2(jsonb)", "complete_self_service_organization_setup(jsonb)", "ensure_organization_user_setup_intent(jsonb)", "claim_organization_user_setup_delivery(jsonb)", "claim_organization_user_setup_delivery_v2(jsonb)", "prepare_organization_user_setup_delivery(jsonb)", "prepare_organization_user_setup_delivery_v2(jsonb)", "settle_organization_user_setup_delivery(jsonb)", "preview_organization_user_setup(text)", "get_organization_invitation_for_administration(uuid, text, uuid)", "preflight_organization_user_setup(text)", "complete_organization_user_setup(jsonb)", "organization_membership_command(jsonb)", "prepare_organization_membership_protocol_settlements(jsonb)", "assert_active_managed_human_organization_membership(uuid, text)", "resolve_workspace_writer_grant_identity(uuid, text)", "prepare_workspace_membership_removal_settlements(jsonb)", "workspace_membership_removal_command(jsonb)", "get_organization_retention_policy(uuid, text)", "preview_organization_retention_deletions(uuid, integer)", "claim_organization_retention_deletion(uuid, uuid, uuid[])", "list_organization_retention_deletion_objects(uuid, uuid, uuid, text, integer)", "record_organization_retention_object_deleted(uuid, uuid, uuid, text, text, text, text)", "fail_organization_retention_deletion(uuid, uuid, uuid, text)", "finalize_organization_retention_deletion(uuid, uuid, uuid, text)", "complete_organization_retention_deletion(uuid, uuid, uuid, text)", ...string[], "open_private_session_create_capability(uuid, uuid, uuid, text)", "open_private_child_session_create_capability(uuid, uuid, uuid, uuid, uuid, uuid, integer)", "close_private_session_create_capability(uuid)", "resolve_session_attempt_personal_resources(uuid, uuid, uuid)", "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)", "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)", "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)", "issue_self_local_connection_use_grant(uuid, uuid, uuid, text, boolean)", "revoke_self_user_resource_grant(uuid, uuid, uuid)", "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)", "preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamp with time zone, text)", "create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)", "list_scoped_variable_sets(uuid, uuid, uuid, text, text)", "count_scoped_variable_sets(uuid, uuid, text)", "mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean)", "read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer)", "materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid)", "connection_authority_convergence_audit_capability_active(uuid)", "resolve_personal_connection_authority_selection(uuid, uuid, text, uuid, jsonb)", "resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)", "resolve_connection_use_authority(uuid, uuid, uuid, jsonb)", "inspect_organization_connection_authority_convergence(uuid, integer, uuid)", "get_self_personal_github_repository_selection(uuid, uuid, text, uuid)", "mutate_self_personal_github_repository_selection(uuid, uuid, text, uuid, bigint, bigint, text, jsonb, boolean)", "create_personal_document_authority(uuid, uuid, uuid)", "resolve_document_original_file(uuid, uuid, text, uuid)", "resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)", "list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)", "reclassify_document_authority(jsonb)", "run_document_default_collection_backfill(jsonb)", "list_document_default_collection_backfill_runs(jsonb)", "get_document_default_collection_backfill_audit(jsonb)", "list_organization_document_authority_reclassifications(jsonb)", "create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean)", "list_scoped_rigs(uuid, uuid, uuid, text, text)", "count_scoped_rigs(uuid, uuid, text)", "mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean)", "finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean)", "list_scoped_enrollments(uuid, uuid, uuid, text)", "get_scoped_sandbox(uuid, uuid, uuid)", "authorize_scoped_sandbox_attach(uuid, uuid, uuid)", "materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer)", "authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean)", "list_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "detach_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint)", "clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint)", "refresh_scheduled_task_personal_resources_clone_connections(uuid, uuid, uuid, bigint, bigint)", "create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb)", "materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text)", "scheduled_task_run_personal_resource_authority(uuid, uuid, uuid)", "scheduled_task_run_connection_authority_subject(uuid, uuid, uuid)", "scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint)", "record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint)", "clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint)", "scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint)", "scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint)", "validate_scheduled_agent_run_live_authority(uuid, uuid, uuid)", "scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid)", "scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "bind_scheduled_task_run_session(uuid, uuid, uuid, uuid)", "transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text)", "ensure_canonical_human_identity(text, text)", "validate_canonical_human_session(text, text, boolean)", "get_canonical_human_identity_projection(text)", "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)", "get_canonical_human_exact_login_binding(text, text)", "managed_auth_session_set_authority_state(text)", "managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)", "managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)", "managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)", "managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)", "managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)", "managed_auth_actor_mutation_fence(text, bigint, uuid)", "managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)", "managed_auth_actor_mutation_lease_release(text, uuid)", "managed_auth_actor_mutation_lease_validate(text, bigint, uuid)", "managed_auth_adopted_session_snapshot(text)", "managed_auth_isolated_session_reap(integer)", "managed_auth_expired_session_set_reap(integer)", "managed_auth_session_set_operation_receipt(text, uuid, text, text)", "get_organization_recovery_overview(uuid, text, jsonb, text, text)", "organization_recovery_command(jsonb)", "create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)", "archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)", "replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)", "resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)", "upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)", "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "session_private_actor_visible(uuid, uuid, uuid, text)", "session_reference_visible(uuid, uuid, uuid)", "session_visibility_lifecycle_capability_held()", "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer)", "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)", "resolve_xai_authority_pool(uuid, uuid, text, jsonb)", "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)", "xai_provider_account_authority_snapshot_v1_valid(jsonb)"];
 /**
  * Boolean-only predicates that shared-table RLS policies must be able to
  * evaluate under table owners and SECURITY DEFINER roles unknown at migration

package/dist/schema.d.ts

@@ -1463,6 +1463,91 @@ export declare const workspaceInferenceControls: import("drizzle-orm/pg-core").P
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        timerId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "timer_id";
+            tableName: "workspace_inference_controls";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        timerAction: import("drizzle-orm/pg-core").PgColumn<{
+            name: "timer_action";
+            tableName: "workspace_inference_controls";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        timerDueAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "timer_due_at";
+            tableName: "workspace_inference_controls";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        timerPauseForSeconds: import("drizzle-orm/pg-core").PgColumn<{
+            name: "timer_pause_for_seconds";
+            tableName: "workspace_inference_controls";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        timerPauseRevision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "timer_pause_revision";
+            tableName: "workspace_inference_controls";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         workspacePauseRevision: import("drizzle-orm/pg-core").PgColumn<{
             name: "workspace_pause_revision";
             tableName: "workspace_inference_controls";

package/dist/schema.js

@@ -350,7 +350,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-PWJJKCTF.js";
+} from "./chunk-WU3MSPZS.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,

package/dist/session-background-commands.js

@@ -22,10 +22,10 @@ import {
   settleClaimedConnectedMachineBackgroundCommandWithMutation,
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction
-} from "./chunk-DUB3LUVM.js";
-import "./chunk-CQF6G4IF.js";
-import "./chunk-XIYAXH47.js";
-import "./chunk-PWJJKCTF.js";
+} from "./chunk-R6LIJYG6.js";
+import "./chunk-HUCU5BDD.js";
+import "./chunk-GPKHEPVX.js";
+import "./chunk-WU3MSPZS.js";
 import "./chunk-PZ5AY32C.js";
 export {
   COMMAND_OUTPUT_DEFAULT_BYTES,

package/dist/session-command-output.js

@@ -1,10 +1,10 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-DUB3LUVM.js";
-import "./chunk-CQF6G4IF.js";
+} from "./chunk-R6LIJYG6.js";
+import "./chunk-HUCU5BDD.js";
 import {
   withSessionActivityRlsContext
-} from "./chunk-XIYAXH47.js";
+} from "./chunk-GPKHEPVX.js";
 import {
   fromPostgresLosslessJson,
   sandboxRetainedProcesses,
@@ -12,7 +12,7 @@ import {
   sessionEvents,
   sessions,
   withLosslessContentWriteVersion
-} from "./chunk-PWJJKCTF.js";
+} from "./chunk-WU3MSPZS.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-command-output.ts

package/dist/session-control.d.ts

@@ -1,4 +1,4 @@
-import { type SessionMcpApprovalPolicy, type TurnInitiatorContext } from "@opengeni/contracts";
+import { type WorkspacePauseTimerRequest, type SessionMcpApprovalPolicy, type TurnInitiatorContext } from "@opengeni/contracts";
 import type { Database, SessionActivityDatabase } from "./database.js";
 import * as schema from "./schema.js";
 export declare const SESSION_ANCESTRY_LIMIT = 10000;
@@ -131,6 +131,11 @@ export type WorkspaceControlRow = {
     revision: number | string;
     workspaceState: string;
     workspacePauseRevision: number | string | null;
+    timerId: string | null;
+    timerAction: string | null;
+    timerDueAt: Date | string | null;
+    timerPauseForSeconds: number | null;
+    timerPauseRevision: number | string | null;
     reason: string | null;
     changedBy: string | null;
     changedAt: Date | string | null;
@@ -584,7 +589,27 @@ export declare function mutateWorkspaceControlInTransaction(db: Database, input:
     operationKey: string;
     action: "pause" | "resume";
     reason?: string | null;
+    /** Internal timer executor retains/replaces its own timer atomically. */
+    timerExecution?: boolean;
     expectedRevision?: number | null;
     /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
     controlLockTimeoutMs?: number;
 }): Promise<WorkspaceControlMutationResult>;
+export declare class WorkspacePauseTimerInputError extends Error {
+}
+/** Called under workspace RLS. The same control fence serializes timers and human actions. */
+export declare function setWorkspacePauseTimerInTransaction(db: Database, input: WorkspacePauseTimerRequest & {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<{
+    workspaceControlEventId: string | null;
+}>;
+/** Discovery is a hint. Identity, deadline and pause ownership are rechecked under the fence. */
+export declare function fireWorkspacePauseTimerInTransaction(db: Database, input: {
+    workspaceId: string;
+    timerId: string;
+}): Promise<{
+    workspaceControlEventId: string | null;
+    wakeCount: number;
+} | null>;

package/dist/session-event-slices.js

@@ -1,13 +1,13 @@
 import {
   rawRows,
   withWorkspaceRls
-} from "./chunk-XIYAXH47.js";
+} from "./chunk-GPKHEPVX.js";
 import {
   LOSSLESS_JSON_STRING_PREFIX,
   fromPostgresLosslessJson,
   sessionEvents,
   sessionTurns
-} from "./chunk-PWJJKCTF.js";
+} from "./chunk-WU3MSPZS.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-event-slices.ts

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-B5Y3TCSP.js";
-import "./chunk-XIYAXH47.js";
-import "./chunk-PWJJKCTF.js";
+} from "./chunk-3JGOYOWD.js";
+import "./chunk-GPKHEPVX.js";
+import "./chunk-WU3MSPZS.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-CQF6G4IF.js";
-import "./chunk-XIYAXH47.js";
-import "./chunk-PWJJKCTF.js";
+} from "./chunk-HUCU5BDD.js";
+import "./chunk-GPKHEPVX.js";
+import "./chunk-WU3MSPZS.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/workspace-artifacts.d.ts

@@ -45,6 +45,7 @@ export declare function listWorkspaceArtifacts(db: Database, workspaceId: string
     limit?: number;
     cursor?: string;
     status?: "active" | "archived";
+    sourceSessionId?: string;
 }): Promise<{
     artifacts: WorkspaceArtifact[];
     nextCursor: string | null;

package/drizzle/0420_workspace_pause_timers.sql

@@ -0,0 +1,53 @@
+-- deployment-mode: maintenance
+-- Drain old API/control/turn workers before activation. New timer event actions
+-- and manual-control cancellation semantics must be installed together.
+ALTER TABLE workspace_inference_controls
+  ADD COLUMN timer_id uuid,
+  ADD COLUMN timer_action text,
+  ADD COLUMN timer_due_at timestamptz,
+  ADD COLUMN timer_pause_for_seconds integer,
+  ADD COLUMN timer_pause_revision bigint,
+  ADD CONSTRAINT workspace_pause_timer_shape CHECK (
+    (timer_id IS NULL AND timer_action IS NULL AND timer_due_at IS NULL
+      AND timer_pause_for_seconds IS NULL AND timer_pause_revision IS NULL)
+    OR (timer_id IS NOT NULL AND timer_action IS NOT NULL AND timer_due_at IS NOT NULL
+      AND ((timer_action = 'pause' AND timer_pause_revision IS NULL)
+        OR (timer_action = 'resume' AND timer_pause_revision IS NOT NULL AND timer_pause_for_seconds IS NULL))
+      AND (timer_pause_for_seconds IS NULL OR timer_pause_for_seconds BETWEEN 60 AND 2592000))
+  );
+CREATE INDEX workspace_pause_timer_due_idx ON workspace_inference_controls(timer_due_at, workspace_id)
+  WHERE timer_id IS NOT NULL;
+ALTER TABLE workspace_control_events DROP CONSTRAINT workspace_control_events_action_check;
+ALTER TABLE workspace_control_events ADD CONSTRAINT workspace_control_events_action_check
+  CHECK (action IN ('pause', 'resume', 'timer_set', 'timer_cancelled'));
+
+-- Narrow, read-only inventory capability. FORCE RLS stays enabled; only the
+-- table owner inside this SECURITY DEFINER function gets cross-tenant discovery.
+DO $migration$
+DECLARE data_schema text := current_schema(); owner_name text := current_user;
+BEGIN
+  EXECUTE format('CREATE POLICY workspace_pause_timer_discovery ON %I.workspace_inference_controls
+    FOR SELECT TO %I USING (current_setting(''opengeni.pause_timer_discovery'', true) = ''1'')',
+    data_schema, owner_name);
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.list_due_workspace_pause_timers(p_limit integer)
+    RETURNS TABLE(workspace_id uuid, timer_id uuid)
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog
+    AS $body$
+    DECLARE previous text := current_setting('opengeni.pause_timer_discovery', true);
+    BEGIN
+      PERFORM set_config('opengeni.pause_timer_discovery', '1', true);
+      RETURN QUERY SELECT c.workspace_id, c.timer_id FROM %I.workspace_inference_controls c
+        WHERE c.timer_id IS NOT NULL AND c.timer_due_at <= clock_timestamp()
+        ORDER BY c.timer_due_at, c.workspace_id LIMIT greatest(1, least(coalesce(p_limit, 100), 1000));
+      PERFORM set_config('opengeni.pause_timer_discovery', coalesce(previous, ''), true);
+    END $body$;
+  $create$, data_schema);
+END $migration$;
+REVOKE ALL ON FUNCTION opengeni_private.list_due_workspace_pause_timers(integer) FROM PUBLIC;
+DO $grant$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.list_due_workspace_pause_timers(integer) TO opengeni_app;
+  END IF;
+END $grant$;