@opengeni/db 5.0.1 → 6.0.0

package/dist/insights-usage-bundle.d.ts

@@ -28,5 +28,8 @@ export type WorkspaceInsightsUsageBundle = {
  * One read for the three existing usage windows. The event-type arrays are
  * deliberately closed so the authority function can keep selective predicates
  * inside its scan while all rollup math remains outside the billing path.
+ * Only the reused current window needs a second materialization: aggregate the
+ * single-use prior/month SRFs directly, since their volatile calls prevent CTE
+ * inlining even without an explicit MATERIALIZED keyword.
  */
 export declare function readWorkspaceInsightsUsageBundle(db: Database, input: WorkspaceInsightsUsageBundleInput): Promise<WorkspaceInsightsUsageBundle>;

package/dist/integration-bindings.d.ts

@@ -1,7 +1,7 @@
 import type { Database } from "./database.js";
 import * as schema from "./schema.js";
 export type IntegrationFacetBindingOwner = {
-    kind: "direct" | "plugin" | "pack" | "migration";
+    kind: "direct" | "plugin" | "migration";
     id: string;
     removable: boolean;
 };

package/dist/integration-facets.d.ts

@@ -49,7 +49,7 @@ export type IntegrationFacetRemovalResult = {
     status: "not_configured" | "removed" | "retained_by_other_owners";
     binding: IntegrationFacetBindingSummary | null;
     remainingOwners: {
-        kind: "direct" | "plugin" | "pack" | "migration";
+        kind: "direct" | "plugin" | "migration";
         id: string;
         removable: boolean;
     }[];
@@ -92,6 +92,21 @@ export declare function replayCompletedIntegrationFacetOperation<T extends Recor
     kind: IntegrationFacetOperationKind;
     expectedRequestDigest: string | ((result: T) => string);
 }): Promise<T | null>;
+type IntegrationInstanceContext = {
+    accountId: string;
+    integrationFacetInstallationId: string;
+    integrationFacetId: string;
+    providerDomain: string;
+    connectionId: string | null;
+    apiProtocol: string | null;
+    definitionId: string | null;
+    definitionProvenance: string | null;
+};
+/** Trusted server callback, never part of a serialized mutation request. The
+ * caller must acquire its policy fence before invoking the facet operation.
+ * IDs/domains in this context identify installed records, not curated provenance.
+ */
+export type IntegrationFacetAcquisitionAuthorizer = (tx: Database, context: Readonly<IntegrationInstanceContext>) => Promise<void>;
 export declare function listIntegrationInstanceFacets(db: Database, workspaceId: string, subjectId: string, capabilityId: string, instanceKey: string): Promise<IntegrationInstanceFacets>;
 export declare function configureIntegrationFacet(db: Database, input: {
     accountId: string;
@@ -104,6 +119,7 @@ export declare function configureIntegrationFacet(db: Database, input: {
     config: Record<string, unknown>;
     expectedVersion?: number;
     idempotencyKey: string;
+    beforeAcquire?: IntegrationFacetAcquisitionAuthorizer;
 }): Promise<IntegrationFacetMutationResult>;
 export declare function setIntegrationFacetLifecycle(db: Database, input: {
     accountId: string;
@@ -115,6 +131,7 @@ export declare function setIntegrationFacetLifecycle(db: Database, input: {
     action: "pause" | "resume";
     expectedVersion: number;
     idempotencyKey: string;
+    beforeAcquire?: IntegrationFacetAcquisitionAuthorizer;
 }): Promise<IntegrationFacetMutationResult>;
 export declare function removeIntegrationFacet(db: Database, input: {
     accountId: string;

package/dist/knowledge-entries-schema.d.ts

@@ -1031,6 +1031,7 @@ export declare const knowledgeEntryRevisions: import("drizzle-orm/pg-core").PgTa
                     version?: string | undefined;
                     capturedAt?: string | undefined;
                     retention?: "full_text" | "passages" | "reference" | undefined;
+                    purpose?: "evidence" | "reference" | undefined;
                 } | undefined;
                 evidence: {
                     entryId: string;
@@ -1079,6 +1080,7 @@ export declare const knowledgeEntryRevisions: import("drizzle-orm/pg-core").PgTa
                     version?: string | undefined;
                     capturedAt?: string | undefined;
                     retention?: "full_text" | "passages" | "reference" | undefined;
+                    purpose?: "evidence" | "reference" | undefined;
                 } | undefined;
                 evidence: {
                     entryId: string;

package/dist/knowledge-entries.d.ts

@@ -311,6 +311,7 @@ export declare function completeKnowledgeFilePreparation(db: Database, context:
     title: string;
     content: string;
     sourceVersion?: string;
+    purpose?: "evidence" | "reference";
 }): Promise<{
     status: "retained";
     fileId: string;

package/dist/knowledge-indexing.d.ts

@@ -43,6 +43,7 @@ export declare function readKnowledgeIndexSource(db: Database, claim: KnowledgeI
             version?: string | undefined;
             capturedAt?: string | undefined;
             retention?: "full_text" | "passages" | "reference" | undefined;
+            purpose?: "evidence" | "reference" | undefined;
         } | undefined;
         evidence: {
             entryId: string;

package/dist/live-session-attempt.d.ts

@@ -59,11 +59,16 @@ export declare function getLiveSessionAttemptTurn(db: Database, workspaceId: str
         text: string;
         successCriteria: string | null;
         rootConstraints: string[];
+        reportRequirements?: {
+            id: string;
+            title: string;
+        }[] | undefined;
         mutationPolicy: "autonomous_adaptation" | "preserve_intent" | "review_changes";
         capturedAt: string;
     } | null;
     personalConnectionDelegations: {
         serverId: string;
+        canonicalServerId?: string | undefined;
         connectionId: string;
         originWorkspaceId?: string | undefined;
         ownerSubjectId: string;
@@ -105,140 +110,39 @@ export declare function getLiveSessionAttemptTurn(db: Database, workspaceId: str
             selectedAt: string;
         } | undefined;
     }[];
-    personalResourceAttachmentSummary: {
-        mode: "always" | "once" | "session";
-        context: "user_private" | "workspace_shared";
-        resourceCount: number;
-        resourceKinds: ("connected_machine" | "rig" | "variable_set")[];
-        sharedOutputWarningVersion: 1;
-    } | null;
-    personalResourceProtocolVersion: number;
-    scheduledTaskRunId: string | null;
-    xaiProviderAccountAuthoritySnapshot: {
-        version: 1;
-        scope: "organization";
-    } | {
-        version: 1;
-        scope: "workspace";
-    } | {
-        version: 1;
-        scope: "user";
-        authorityGeneration: number;
-    };
-    cancelledBy: string | null;
-    cancelReason: string | null;
-    codemodeCallCount: number;
-    startedAt: Date | null;
-    finishedAt: Date | null;
-    createdAt: Date;
-    updatedAt: Date;
-} | null>;
-/** Host credential reads need provenance and live authority, not a runnable
- * execution projection or a write to the turn's frozen goal snapshot. */
-export declare function getHostMcpLiveAttempt(db: Database, workspaceId: string, sessionId: string, attemptId: string): Promise<{
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-    triggerEventId: string;
-    temporalWorkflowId: string;
-    status: string;
-    source: string;
-    promptRouting: string | null;
-    position: number;
-    prompt: string;
-    promptCodecVersion: number | null;
-    annotations: {
-        id: string;
-        source: {
-            kind: "assistant_message" | "tool_output" | "user_message";
-            eventId: string;
-            eventType: "agent.message.completed" | "agent.toolCall.output" | "user.message";
-            sequence: number;
-            turnId: string | null;
-            startOffset: number;
-            endOffset: number;
-            contextBefore: string;
-            contextAfter: string;
-            label?: string | undefined;
-        };
-        quote: string;
-        note: string;
-        ordinal: number;
-    }[];
-    modelContext: string | null;
-    resources: unknown[];
-    tools: unknown[];
-    toolsProvided: boolean;
-    model: string;
-    reasoningEffort: string;
-    latencyMode: string;
-    sandboxBackend: string;
-    sandboxOs: string | null;
-    metadata: Record<string, unknown>;
-    version: number;
-    executionGeneration: number;
-    activeAttemptId: string | null;
-    lineage: Record<string, unknown>;
-    initiatorKind: string;
-    initiatorSubjectId: string;
-    initiatingHumanSubjectId: string | null;
-    goalSnapshot: {
-        state: "none";
-        capturedAt: string;
-    } | {
-        state: "active" | "completed" | "paused";
-        goalId: string;
-        objectiveRevision: number;
-        text: string;
-        successCriteria: string | null;
-        rootConstraints: string[];
-        mutationPolicy: "autonomous_adaptation" | "preserve_intent" | "review_changes";
-        capturedAt: string;
-    } | null;
-    personalConnectionDelegations: {
+    mcpAccountBindings: {
         serverId: string;
+        canonicalServerId: string;
         connectionId: string;
-        originWorkspaceId?: string | undefined;
-        ownerSubjectId: string;
+        originWorkspaceId: string;
+        subjectScope: "subject" | "workspace";
+        ownerSubjectId: string | null;
+        accountLabel: string;
         providerDomain: string;
-        kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
-        connectionType?: "atlassian" | "github_personal" | "mcp" | "social" | undefined;
-        userDelegation?: {
-            authorityId: string;
-            grantId: string;
-            organizationId: string;
-            workspaceId: string;
-            sessionId: string | null;
-            action: string;
-            mode: "always" | "once" | "session";
-            context: "user_private" | "workspace_shared";
-            authorityEpoch: number | null;
-            authorityGeneration: number;
-            grantGeneration: number;
-            resourceVersionId?: string | null | undefined;
-        } | undefined;
-        personalGitHubRepositorySelection?: {
-            credentialBindingId: string;
-            connectionAuthorityGeneration: number;
-            selectionGeneration: number;
-            repositories: {
-                repositoryId: string;
-                fullName: string;
-                canonicalUrl: string;
-                ref: string;
-                access: "read" | "write";
-                selectionGeneration: number;
-            }[];
-        } | undefined;
-        outputDestination?: {
-            folderId: string;
-            folderName: string;
-            driveId: string | null;
-            location: "my_drive" | "shared_drive";
-            selectedAt: string;
-        } | undefined;
-    }[];
+        kind: "api_key" | "app_install" | "delegated" | "oauth2";
+        connectionRef: {
+            connectionId?: string | undefined;
+            accountSelection?: "all_eligible" | undefined;
+            authoritySource?: "host" | undefined;
+            hostBinding?: {
+                bindingId: string;
+                generation: number;
+            } | {
+                selection: "accepted_turn";
+            } | undefined;
+            provider?: string | undefined;
+            providerDomain: string;
+            kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+            scopes?: string[] | undefined;
+            resource?: string | undefined;
+            selectedResources?: {
+                id: string;
+                kind: "repository";
+            }[] | undefined;
+            subjectScope?: "subject" | "workspace" | undefined;
+        };
+        connectionAuthorityGeneration?: number | undefined;
+    }[] | null;
     personalResourceAttachmentSummary: {
         mode: "always" | "once" | "session";
         context: "user_private" | "workspace_shared";
@@ -266,10 +170,4 @@ export declare function getHostMcpLiveAttempt(db: Database, workspaceId: string,
     finishedAt: Date | null;
     createdAt: Date;
     updatedAt: Date;
-    initiator: {
-        subjectId: string;
-        label?: string | undefined;
-        kind: "service" | "subject";
-    };
-    initiatorContext: Record<string, unknown>;
 } | null>;

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-MWMXWHJD.js";
-import "./chunk-DPONPYJD.js";
-import "./chunk-F73UKJY6.js";
+} from "./chunk-7JCDSMX2.js";
+import "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/mcp-account-bindings.d.ts

@@ -0,0 +1,4 @@
+import { type McpConnectionAccountBinding } from "@opengeni/contracts";
+/** NULL is a pre-account-routing receipt, not an empty accepted selection.
+ * Never default it to [] (or default [] to NULL) during replay/inheritance. */
+export declare function parseAcceptedMcpAccountBindings(value: unknown): McpConnectionAccountBinding[] | null;

package/dist/mcp-oauth.d.ts

@@ -50,6 +50,17 @@ export declare function getMcpOAuthClient(db: Database, clientId: string): Promi
 export declare function createMcpOAuthAuthorizationRequest(db: Database, input: McpOAuthAuthorizationRequest): Promise<void>;
 export declare function getMcpOAuthAuthorizationRequest(db: Database, requestHash: string): Promise<McpOAuthAuthorizationRequest | null>;
 export declare function deleteMcpOAuthAuthorizationRequest(db: Database, requestHash: string): Promise<void>;
+export declare function rebindMcpOAuthAuthorizationRequest(db: Database, input: {
+    requestHash: string;
+    subjectId: string;
+    accountId: string;
+    workspaceId: string;
+    permissions: AccessGrant["permissions"];
+    toolIdentities: Array<{
+        serverId: string;
+        toolName: string;
+    }>;
+}): Promise<boolean>;
 export declare function consumeMcpOAuthAuthorizationRequest(db: Database, input: {
     requestHash: string;
     subjectId: string;

package/dist/mcp-operations.js

@@ -1,7 +1,7 @@
 import {
   withRlsContext
-} from "./chunk-DPONPYJD.js";
-import "./chunk-F73UKJY6.js";
+} from "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   fromPostgresLosslessJson,

package/dist/migrate.js

@@ -5,7 +5,7 @@ import {
   parseBatchedBackfillMigration,
   parseConcurrentIndexMigration,
   runMigrations
-} from "./chunk-45CP2YKY.js";
+} from "./chunk-MAMBI2HR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/organization-integration-policy.d.ts

@@ -0,0 +1,51 @@
+import { OrganizationIntegrationPolicy, UpdateOrganizationIntegrationPolicyRequest } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+export type OrganizationIntegrationPolicyScope = {
+    accountId: string;
+};
+export type OrganizationIntegrationAcquisitionScope = {
+    accountId: string;
+    workspaceId: string;
+};
+/** Trusted application adapter MUST verify canonical human/local organization-admin
+ * provenance or accountScopedApiKeyWorkspaceAuthority (exact account + workspace:admin).
+ * This callback is a server dependency, never deserialized request data. The returned
+ * subject alone is NOT authentication. DB checks below are live authority fences only.
+ */
+export type AuthorizeOrganizationIntegrationPolicyAdministration = () => Promise<{
+    accountId: string;
+    subjectId: string;
+}>;
+export declare function getOrganizationIntegrationPolicy(db: Database, inputScope: OrganizationIntegrationPolicyScope, authorize: AuthorizeOrganizationIntegrationPolicyAdministration): Promise<OrganizationIntegrationPolicy>;
+/** Call before acquiring membership/workspace/credential locks in any enclosing
+ * transaction. The SQL operation owns policy-exclusive -> membership -> admin
+ * row order; it never locks a workspace and rejects acquisition-lock upgrades.
+ */
+export declare function updateOrganizationIntegrationPolicy(db: Database, inputScope: OrganizationIntegrationPolicyScope, input: UpdateOrganizationIntegrationPolicyRequest, authorize: AuthorizeOrganizationIntegrationPolicyAdministration): Promise<OrganizationIntegrationPolicy>;
+/** Internal serialization primitive, NOT acquisition authorization. Authenticate
+ * the caller normally. A callback may first return an exact completed receipt;
+ * before any new claim, uncommitted progress, or commit it MUST assert the trusted
+ * integration classification against the supplied runtime-frozen policy snapshot.
+ * Do not put network operations or retries inside this transaction.
+ *
+ * Requires read committed isolation. The shared policy fence precedes EVERY
+ * organization-membership, workspace/tenancy, and credential lock. In particular,
+ * persistProviderOAuthConnection may take the membership fence inside acquire.
+ * Policy writers take exclusive policy -> membership -> live administrator rows,
+ * and never workspace rows. Ordinary connection lifecycle writers do not take
+ * the policy fence. A caller passing an existing transaction must honor this
+ * prefix. Never administer policy inside or after an acquisition in that transaction:
+ * the SQL writer rejects shared-to-exclusive upgrades rather than risking deadlock.
+ * All final persistence must use tx, never a separate connection. No automatic
+ * retries: external effects cannot be rolled back. For slow external preparation,
+ * preflight separately and use this guard for final persistence. Existing execution,
+ * refresh, credential lifecycle, and cleanup do not belong behind this guard.
+ */
+export declare function withOrganizationIntegrationPolicyFence<T>(db: Database, inputScope: OrganizationIntegrationAcquisitionScope, run: (tx: Database, policy: OrganizationIntegrationPolicy) => Promise<T>): Promise<T>;
+/** New acquisitions always assert before effects and before returning to commit.
+ * The immutable snapshot stays authoritative through commit: the shared fence
+ * excludes policy writers and the SQL writer rejects same-transaction upgrades.
+ * Receipt-aware callers instead use withOrganizationIntegrationPolicyFence and
+ * assert only after distinguishing completed replay from new workflow progress.
+ */
+export declare function withOrganizationIntegrationAcquisition<T>(db: Database, inputScope: OrganizationIntegrationAcquisitionScope, integrationKeys: readonly (string | null)[], acquire: (tx: Database) => Promise<T>): Promise<T>;

package/dist/organization-integration-policy.js

@@ -0,0 +1,18 @@
+import {
+  getOrganizationIntegrationPolicy,
+  updateOrganizationIntegrationPolicy,
+  withOrganizationIntegrationAcquisition,
+  withOrganizationIntegrationPolicyFence
+} from "./chunk-ZPJ6V2VG.js";
+import "./chunk-4UJCXBR2.js";
+import "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
+import "./chunk-S2TZ3F4L.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getOrganizationIntegrationPolicy,
+  updateOrganizationIntegrationPolicy,
+  withOrganizationIntegrationAcquisition,
+  withOrganizationIntegrationPolicyFence
+};
+//# sourceMappingURL=organization-integration-policy.js.map

package/dist/organization-integration-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/organization-usage.d.ts

@@ -0,0 +1,20 @@
+import { OrganizationUsageSummary, OrganizationUsageWorkspacePage, type OrganizationUsagePeriod } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+/** Same UTC semantics as Insights: week is today and the previous six days. */
+export declare function organizationUsageWindow(period: OrganizationUsagePeriod, now?: Date): {
+    since: string;
+    until: string;
+    granularity: "day" | "hour";
+};
+type UsageInput = {
+    accountId: string;
+    period?: OrganizationUsagePeriod | undefined;
+};
+/** One set-based, actor-visible aggregate. Must use the writable primary. */
+export declare function getOrganizationUsageSummary(db: Database, input: UsageInput, now?: Date): Promise<OrganizationUsageSummary>;
+/** Bounded page-only scan; never recomputes organization-wide totals/buckets. */
+export declare function getOrganizationUsageWorkspacePage(db: Database, input: UsageInput & {
+    until: string;
+    afterWorkspaceId?: string | undefined;
+}): Promise<OrganizationUsageWorkspacePage>;
+export {};

package/dist/plugin-packages.d.ts

@@ -1,6 +1,6 @@
-import { type CapabilityCatalogAuthKind, type SkillActor } from "@opengeni/contracts";
+import { type CapabilityCatalogAuthKind, type SkillActor, type PluginUninstallPreview } from "@opengeni/contracts";
 import { type Database } from "./database.js";
-import type { SkillSourceReleaseReceipt } from "./skill-source-release.js";
+import { type SkillSourceReleaseReceipt } from "./skill-source-release.js";
 import type { SkillPublicationReceipt } from "@opengeni/contracts";
 export type PluginBomComponent = {
     key: string;
@@ -44,6 +44,11 @@ export declare class PluginOperationIdempotencyError extends Error {
 export declare class PluginInstallationVersionConflictError extends Error {
     readonly name = "PluginInstallationVersionConflictError";
 }
+export declare class PluginUninstallPreviewChangedError extends Error {
+    readonly preview?: PluginUninstallPreview | undefined;
+    readonly code = "plugin_uninstall_preview_changed";
+    constructor(preview?: PluginUninstallPreview | undefined);
+}
 export declare class PluginInstallationVersionRequiredError extends Error {
     readonly name = "PluginInstallationVersionRequiredError";
 }
@@ -110,22 +115,14 @@ export declare function installPluginMcpReference(db: Database, input: {
     capabilityId: string;
     facetInstallationId: string;
 }>;
-export declare function getPluginPackageUninstallPreview(db: Database, workspaceId: string, pluginKey: string): Promise<{
-    installed: boolean;
-    version: string | null;
-    installationVersion: number | null;
-    components: Array<{
-        capabilityId: string;
-        kind: "skill" | "integration" | "mcp";
-        retainedByOtherOwners: boolean;
-    }>;
-}>;
+export declare function getPluginPackageUninstallPreview(db: Database, workspaceId: string, pluginKey: string, subjectId?: string): Promise<Omit<PluginUninstallPreview, "pluginKey">>;
 export declare function uninstallPluginPackage(db: Database, input: {
     accountId: string;
     workspaceId: string;
     subjectId: string;
     pluginKey: string;
     expectedInstallationVersion: number;
+    expectedPreviewToken?: string;
     idempotencyKey: string;
     skillActor?: SkillActor;
 }): Promise<{

package/dist/pr-review.d.ts

@@ -23,8 +23,6 @@ export declare function createPrReviewAppRegistration(db: Database, input: {
     webhookSecretEncrypted: string;
     webhookUsername: string | null;
     createdBySubjectId: string;
-    packInstallationId: string;
-    packConnectorId: string;
 }): Promise<PrReviewAppRegistration>;
 export declare function listPrReviewAppRegistrations(db: Database, accountId: string, workspaceId: string): Promise<PrReviewAppRegistration[]>;
 export declare function getPrReviewAppRegistrationSecret(db: Database, input: {
@@ -62,8 +60,6 @@ export declare function createPrReviewRepositoryBinding(db: Database, input: {
     additionalInstructions: string | null;
     status: "active" | "disabled";
     createdBySubjectId: string;
-    packInstallationId: string;
-    packTemplateId: string;
     adapterId: string;
     eventTypes: string[];
     configuration: Record<string, unknown>;
@@ -71,10 +67,6 @@ export declare function createPrReviewRepositoryBinding(db: Database, input: {
     /** Trusted database-only admission seam. Throwing rolls the binding and trigger back. */
     beforeCreateCommit?: (tx: Database) => Promise<void>;
 }): Promise<PrReviewRepositoryBinding>;
-/** Atomically converge one owner-authorized installation of the deployment
- * review App onto the Pack's ordinary source/trigger/binding model. Re-running
- * the browser flow repairs disabled rows, follows GitHub repository selection,
- * and removes shared-webhook routes for repositories no longer selected. */
 export declare function syncManagedGitHubPrReviewInstallation(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -90,9 +82,6 @@ export declare function syncManagedGitHubPrReviewInstallation(db: Database, inpu
     webhookSecretEncrypted: string;
     repositories: GitHubRepository[];
     createdBySubjectId: string;
-    packInstallationId: string;
-    packConnectorId: string;
-    packTemplateId: string;
     adapterId: string;
     eventTypes: string[];
     configuration: Record<string, unknown>;

package/dist/preference-registry-schema.d.ts

@@ -459,6 +459,23 @@ export declare const preferenceRegistryRevisions: import("drizzle-orm/pg-core").
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        skillRemovalOperationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "skill_removal_operation_id";
+            tableName: "preference_registry_revisions";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         precedenceRank: import("drizzle-orm/pg-core").PgColumn<{
             name: "precedence_rank";
             tableName: "preference_registry_revisions";

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-T6YLHJLS.js";
+} from "./chunk-XIXVVBW2.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles