@alma-harness/postgres-execution 0.6.0

package/dist/index.js

@@ -0,0 +1,1177 @@
+// src/index.ts
+import { equalExecution as equalExecution4, ExecutionConflictError as ExecutionConflictError6, ExecutionStateError as ExecutionStateError6, settlementIdentifier as id6, settlementLimit as settlementLimit2, settlementScope as settlementScope6 } from "@alma-harness/core";
+import { checkOperationCall, checkOperationDeadline as checkOperationDeadline2, normalizeOperationCall as normalizeOperationCall2, normalizeOperationFence, normalizeOperationRoot as normalizeOperationRoot3, operationCallQuery as operationCallQuery4 } from "@alma-harness/execution";
+import { inScope as inScope6, resolveRlsRole as resolveRlsRole6, resolveStatementTimeout as resolveStatementTimeout6 } from "@alma-harness/postgres";
+
+// src/schema.ts
+import { functionPathSql as functionPathSql2 } from "@alma-harness/postgres";
+import { assertRoleIdentifier, DEFAULT_RLS_ROLE, executionStoreMigrationSql, rlsPolicySql } from "@alma-harness/postgres";
+
+// src/request-schema.ts
+import { functionPathSql } from "@alma-harness/postgres";
+var operationRequestShapeSql = `
+create or replace function alma_operation_request_v1(v jsonb) returns boolean language plpgsql immutable as $request$
+declare field text;
+begin
+ if (jsonb_typeof(v)='object' and v ?& array['inputRevision','configRevision','resultContractVersion','resultRetentionMs']
+  and (v-array['inputRevision','configRevision','resultContractVersion','resultRetentionMs'])='{}'::jsonb
+  and jsonb_typeof(v->'resultRetentionMs')='number' and (v->>'resultRetentionMs')::numeric between 1 and 31536000000
+  and trunc((v->>'resultRetentionMs')::numeric)=(v->>'resultRetentionMs')::numeric) is not true then return false; end if;
+ foreach field in array array['inputRevision','configRevision','resultContractVersion'] loop
+  if (jsonb_typeof(v->field)='string' and v->>field ~ '^[!-~]{1,200}$') is not true then return false; end if;
+ end loop; return true;
+exception when others then return false;
+end $request$;
+`;
+var operationRequestRootSql = `
+alter table alma_operation_roots add column if not exists request jsonb;
+do $request_check$ begin
+ if not exists(select from pg_constraint where conrelid='alma_operation_roots'::regclass and conname='alma_operation_request_check') then
+  alter table alma_operation_roots add constraint alma_operation_request_check check(request is null or alma_operation_request_v1(request) is true);
+ end if;
+end $request_check$;
+create or replace function alma_operation_binding_immutable() returns trigger language plpgsql as $binding$
+begin
+ if (new.org,new.uid,new.key,new.id,new.session_id,new.policy_version,new.caps,new.max_sensitivity,new.deadline_at,new.max_calls,new.token,new.created_at,new.request)
+  is distinct from (old.org,old.uid,old.key,old.id,old.session_id,old.policy_version,old.caps,old.max_sensitivity,old.deadline_at,old.max_calls,old.token,old.created_at,old.request) then
+  raise exception 'Immutable operation binding' using errcode='23514';
+ end if; return new;
+end $binding$;
+do $binding_trigger$ begin
+ if not exists(select from pg_trigger where tgrelid='alma_operation_roots'::regclass and tgname='alma_operation_binding_immutable') then
+  create trigger alma_operation_binding_immutable before update on alma_operation_roots for each row execute function alma_operation_binding_immutable();
+ end if;
+end $binding_trigger$;
+`;
+var operationRequestAdmissionSql = `
+create or replace function alma_admission_input_v2(v jsonb) returns boolean language sql immutable as $shape$
+ select (alma_admission_input(v-'request') and (not(v ? 'request') or alma_operation_request_v1(v->'request'))) is true;
+$shape$;
+do $admission_check$ declare legacy record;
+begin
+ -- Replace only the original input-shape check, not state, fence or scope controls.
+ for legacy in select conname from pg_constraint where conrelid='alma_operation_admissions'::regclass
+  and contype='c' and pg_get_constraintdef(oid) like '%alma_admission_input(input)%' loop
+  execute format('alter table alma_operation_admissions drop constraint %I',legacy.conname);
+ end loop;
+ if not exists(select from pg_constraint where conrelid='alma_operation_admissions'::regclass and conname='alma_admission_input_v2_check') then
+  alter table alma_operation_admissions add constraint alma_admission_input_v2_check check((alma_admission_input_v2(input)
+   and input->'scope'->>'org'=org and input->'scope'->>'uid'=uid and input->>'key'=root_key
+   and input->>'id'=root_id and input->>'sessionId'=session_id and (input->>'deadlineAt')::timestamptz=deadline_at) is true);
+ end if;
+end $admission_check$;
+${functionPathSql("alma_admission_input_v2(jsonb)")}
+`;
+
+// src/schema.ts
+function operationTreeMigrationSql(role = DEFAULT_RLS_ROLE) {
+  assertRoleIdentifier(role);
+  return `${executionStoreMigrationSql(role)}${operationRequestShapeSql}
+create or replace function alma_operation_caps(v jsonb) returns boolean language plpgsql immutable as $caps$
+declare item record;
+begin
+ if jsonb_typeof(v) <> 'object' then return false; end if;
+ for item in select * from jsonb_each(v) loop
+  if (item.key in ('perTurnUsd','perSessionUsd','perTenantDayUsd') and jsonb_typeof(item.value)='object'
+    and item.value ?& array['usd','onExceeded'] and (item.value-'usd'-'onExceeded')='{}'::jsonb
+    and jsonb_typeof(item.value->'usd')='number' and item.value->'usd'>='0'::jsonb
+    and item.value->>'onExceeded' in ('warn','block')) is not true then return false; end if;
+ end loop; return true;
+end $caps$;
+create table if not exists alma_operation_roots (
+ org text not null, uid text not null, key text collate "C" not null, id text not null,
+ session_id text not null, policy_version text not null, caps jsonb not null,
+ max_sensitivity text not null check(max_sensitivity in ('public','internal','personal','health')),
+ deadline_at timestamptz not null, max_calls int not null check(max_calls between 1 and 512),
+ status text not null check(status in ('active','closed','reconciliation_required')),
+ token text not null, call_count int not null default 0 check(call_count between 0 and max_calls),
+ created_at timestamptz not null, updated_at timestamptz not null,
+ primary key(org,uid,key), unique(org,uid,id),
+ check((${["org", "uid", "key", "id", "session_id", "policy_version", "token"].map((k) => `${k} ~ '^[!-~]{1,200}$'`).join(" and ")}) is true),
+ check(alma_operation_caps(caps) is true)
+);
+create index if not exists alma_operation_expired on alma_operation_roots(org,uid,deadline_at,key) where status='active';
+create table if not exists alma_operation_calls (
+ org text not null, uid text not null, root_id text not null, slot text collate "C" not null,
+ ordinal int not null check(ordinal between 1 and 512), kind text not null check(kind in ('main','direct','delegate','summary')),
+ parent_call_id text, call_id text not null, settlement_id text not null, operation_key text not null,
+ input jsonb not null, reserved_at timestamptz not null,
+ primary key(org,uid,root_id,slot), unique(org,uid,root_id,ordinal), unique(org,uid,root_id,call_id),
+ unique(org,uid,call_id), unique(org,uid,settlement_id), unique(org,uid,operation_key),
+ foreign key(org,uid,root_id) references alma_operation_roots(org,uid,id),
+ foreign key(org,uid,root_id,parent_call_id) references alma_operation_calls(org,uid,root_id,call_id),
+ check((kind='main')=(parent_call_id is null)), check(parent_call_id is null or parent_call_id<>call_id),
+ check(slot ~ '^[!-~]{1,200}$'),
+ constraint alma_operation_call_shape check((alma_execution_shape_v2(jsonb_set(input,'{controls}',(input->'controls')-'temperature'),'input')
+  and input ?& array['scope','operationKey','operationId','attemptId','callId','settlementId','sessionId','inputRevision','policyVersion','outputContractVersion','intent','model','requestedTier','priceVersion','prices','controls','occurredAt','deadlineAt','governance']
+  and input->'scope'->>'org'=org and input->'scope'->>'uid'=uid and input->>'callId'=call_id
+  and input->>'settlementId'=settlement_id and input->>'operationKey'=operation_key) is true),
+ constraint alma_operation_temperature_check check((not (input->'controls' ? 'temperature') or
+  (jsonb_typeof(input->'controls'->'temperature')='number' and input->'controls'->'temperature'>='0'::jsonb and input->'controls'->'temperature'<='2'::jsonb)) is true)
+);
+-- Replace only the legacy parent-kind CHECK; old migration replay uses CREATE IF NOT EXISTS.
+alter table alma_operation_calls drop constraint if exists alma_operation_calls_check;
+do $parent_kind$ begin
+ if not exists(select from pg_constraint where conrelid='alma_operation_calls'::regclass and conname='alma_operation_parent_kind') then
+  alter table alma_operation_calls add constraint alma_operation_parent_kind
+   check((kind='main' and parent_call_id is null) or kind='summary' or (kind in ('direct','delegate') and parent_call_id is not null));
+ end if;
+end $parent_kind$;
+create or replace function alma_operation_reserve() returns trigger language plpgsql as $reserve$
+declare r alma_operation_roots%rowtype;
+begin
+ select * into r from alma_operation_roots where org=new.org and uid=new.uid and id=new.root_id for update;
+ if (r.status='active' and r.deadline_at>clock_timestamp() and new.ordinal=r.call_count+1 and new.ordinal<=r.max_calls
+  and new.input->>'sessionId'=r.session_id and new.input->>'policyVersion'=r.policy_version
+  and new.input->'governance'->'caps'=r.caps and (new.input->>'deadlineAt')::timestamptz<=r.deadline_at
+  and array_position(array['public','internal','personal','health'],new.input->'intent'->>'sensitivity')<=array_position(array['public','internal','personal','health'],r.max_sensitivity)) is not true then
+  raise exception 'Invalid operation reservation' using errcode='23514';
+ end if;
+ if new.parent_call_id is not null and not exists(select from alma_operation_calls where org=new.org and uid=new.uid and root_id=new.root_id and call_id=new.parent_call_id and ordinal<new.ordinal) then
+  raise exception 'Invalid operation parent' using errcode='23514';
+ end if;
+ update alma_operation_roots set call_count=new.ordinal,updated_at=clock_timestamp() where org=new.org and uid=new.uid and id=new.root_id;
+ return new;
+end $reserve$;
+do $trigger$ begin
+ if not exists(select from pg_trigger where tgrelid='alma_operation_calls'::regclass and tgname='alma_operation_reserve') then
+ create trigger alma_operation_reserve before insert on alma_operation_calls for each row execute function alma_operation_reserve();
+ end if;
+end $trigger$;
+${rlsPolicySql("alma_operation_roots")}${rlsPolicySql("alma_operation_calls")}
+grant select,insert,update on alma_operation_roots to ${role};
+grant select,insert on alma_operation_calls to ${role};
+${operationRequestRootSql}
+${functionPathSql2("alma_operation_reserve()")}
+`;
+}
+async function migrateOperationTreeStore(pool, opts = {}) {
+  await pool.query(operationTreeMigrationSql(opts.role));
+}
+
+// src/rows.ts
+import { normalizeOperationRoot, normalizeOperationCall } from "@alma-harness/execution";
+var ROOT = "org,uid,key,id,session_id,policy_version,caps,max_sensitivity,deadline_at,max_calls,status,call_count,created_at,updated_at,request";
+function record(r) {
+  return { input: normalizeOperationRoot({ ...r.request === null ? {} : { request: r.request }, scope: { org: r.org, uid: r.uid }, key: r.key, id: r.id, sessionId: r.session_id, policyVersion: r.policy_version, caps: r.caps, maxSensitivity: r.max_sensitivity, deadlineAt: r.deadline_at.toISOString(), maxCalls: r.max_calls }), status: r.status, callCount: r.call_count, createdAt: r.created_at.toISOString(), updatedAt: r.updated_at.toISOString() };
+}
+function call(r) {
+  return { rootId: r.root_id, ordinal: r.ordinal, input: normalizeOperationCall({ slot: r.slot, kind: r.kind, ...r.parent_call_id !== null ? { parentCallId: r.parent_call_id } : {}, execution: r.input }), reservedAt: r.reserved_at.toISOString() };
+}
+
+// src/accounting.ts
+import { ExecutionConflictError, ExecutionStateError, settlementIdentifier as id, settlementScope } from "@alma-harness/core";
+import { normalizeGovernedCostReceipt, normalizeRootCallReceipt, operationCallQuery, rootCallReceipt, rootWarnings } from "@alma-harness/execution";
+import { inScope, resolveRlsRole, resolveStatementTimeout } from "@alma-harness/postgres";
+function receipt(r) {
+  return normalizeRootCallReceipt({ rootId: r.root_id, callId: r.call_id, settlementId: r.settlement_id, accountingOrdinal: r.accounting_ordinal, reservationOrdinal: r.reservation_ordinal, costUsd: r.cost_usd, previousUsd: r.previous_usd, currentUsd: r.current_usd, decisions: r.decisions, newWarnings: r.new_warnings, recordedAt: r.recorded_at.toISOString() });
+}
+var PostgresOperationAccountingStore = class {
+  constructor(pool, opts = {}) {
+    this.pool = pool;
+    this.#role = resolveRlsRole(opts);
+    this.#timeout = resolveStatementTimeout(opts);
+  }
+  pool;
+  #role;
+  #timeout;
+  async #scope(scope, fn) {
+    try {
+      return await inScope(this.pool, this.#role, scope, fn, this.#timeout);
+    } catch (e) {
+      if (["23505", "23503", "23514"].includes(e.code ?? "")) throw new ExecutionConflictError();
+      throw e;
+    }
+  }
+  async #root(c, s, k, write) {
+    return (await c.query(`select ${ROOT} from alma_operation_roots where org=$1 and uid=$2 and key=$3 for ${write ? "update" : "share"}`, [s.org, s.uid, k])).rows[0];
+  }
+  async record(scope, rootKey, callId) {
+    const s = settlementScope(scope), k = id(rootKey), identity = id(callId);
+    return this.#scope(s, async (c) => {
+      const root = await this.#root(c, s, k, true);
+      if (!root) throw new ExecutionStateError();
+      const args = [s.org, s.uid, root.id];
+      const old = (await c.query("select * from alma_operation_financial_calls where org=$1 and uid=$2 and root_id=$3 and call_id=$4", [...args, identity])).rows[0];
+      if (old) return { status: "replayed", receipt: receipt(old) };
+      const row = (await c.query("select * from alma_operation_calls where org=$1 and uid=$2 and root_id=$3 and call_id=$4", [...args, identity])).rows[0];
+      if (!row) throw new ExecutionStateError();
+      const member = call(row);
+      const cost = (await c.query(`select c.id,c.settlement_payload,c.settlement_session_usd,c.settlement_day_usd,g.request,g.decisions
+        from alma_audit_cost c left join alma_governed_cost g on (g.org,g.uid,g.cost_id)=(c.org,c.uid,c.id)
+        where c.org=$1 and c.uid=$2 and c.settlement_id=$3 and c.settlement_governed`, [s.org, s.uid, member.input.execution.settlementId])).rows[0];
+      if (!cost) return { status: "pending" };
+      const source = normalizeGovernedCostReceipt({ request: cost.request, decisions: cost.decisions, receipt: { settlement: cost.settlement_payload, totals: { sessionUsd: cost.settlement_session_usd, tenantDayUsd: cost.settlement_day_usd } } });
+      const last = (await c.query("select * from alma_operation_financial_calls where org=$1 and uid=$2 and root_id=$3 order by accounting_ordinal desc limit 1", args)).rows[0];
+      const warned = (await c.query("select cap from alma_operation_warnings where org=$1 and uid=$2 and root_id=$3", args)).rows.map((r) => r.cap);
+      const now = (await c.query("select clock_timestamp() at")).rows[0].at.toISOString();
+      const value = rootCallReceipt(record(root).input, member, source, last ? receipt(last) : void 0, warned, now);
+      const saved = (await c.query(`insert into alma_operation_financial_calls(org,uid,root_id,call_id,settlement_id,cost_id,accounting_ordinal,reservation_ordinal,cost_usd,previous_usd,current_usd,decisions,new_warnings,recorded_at)
+        values($1,$2,$3,$4,$5,$6::uuid,$7,$8,$9,$10,$11,$12::jsonb,$13::text[],$14::timestamptz) returning *`, [...args, value.callId, value.settlementId, cost.id, value.accountingOrdinal, value.reservationOrdinal, value.costUsd, value.previousUsd, value.currentUsd, JSON.stringify(value.decisions), value.newWarnings, value.recordedAt])).rows[0];
+      return { status: "applied", receipt: receipt(saved) };
+    });
+  }
+  async get(scope, rootKey) {
+    const s = settlementScope(scope), k = id(rootKey);
+    return this.#scope(s, async (c) => {
+      const root = await this.#root(c, s, k, false);
+      if (!root) return null;
+      const args = [s.org, s.uid, root.id], last = (await c.query("select * from alma_operation_financial_calls where org=$1 and uid=$2 and root_id=$3 order by accounting_ordinal desc limit 1", args)).rows[0];
+      const rows = (await c.query(`select f.*,w.cap from alma_operation_warnings w join alma_operation_financial_calls f on (f.org,f.uid,f.root_id,f.call_id)=(w.org,w.uid,w.root_id,w.call_id)
+        where w.org=$1 and w.uid=$2 and w.root_id=$3 order by f.accounting_ordinal,w.cap`, args)).rows;
+      const warnings = rows.map((r) => {
+        const found = rootWarnings(s, receipt(r)).find((w) => w.cap === r.cap);
+        if (!found) throw new ExecutionConflictError();
+        return found;
+      });
+      return { rootId: root.id, costUsd: last ? receipt(last).currentUsd : 0, reservedCalls: root.call_count, settledCalls: last?.accounting_ordinal ?? 0, rootStatus: root.status, warnings };
+    });
+  }
+  async list(scope, rootKey, query) {
+    const s = settlementScope(scope), k = id(rootKey), q = operationCallQuery(query);
+    return this.#scope(s, async (c) => (await c.query(`select f.* from alma_operation_financial_calls f join alma_operation_roots r on (r.org,r.uid,r.id)=(f.org,f.uid,f.root_id)
+      where r.org=$1 and r.uid=$2 and r.key=$3 and f.accounting_ordinal>$4 order by f.accounting_ordinal limit $5`, [s.org, s.uid, k, q.afterOrdinal, q.limit])).rows.map(receipt));
+  }
+};
+
+// src/accounting-schema.ts
+import { functionPathSql as functionPathSql3 } from "@alma-harness/postgres";
+import { assertRoleIdentifier as assertRoleIdentifier2, DEFAULT_RLS_ROLE as DEFAULT_RLS_ROLE2, governedCostSettlementStoreMigrationSql, rlsPolicySql as rlsPolicySql2 } from "@alma-harness/postgres";
+function operationAccountingMigrationSql(role = DEFAULT_RLS_ROLE2) {
+  assertRoleIdentifier2(role);
+  return `${operationTreeMigrationSql(role)}${governedCostSettlementStoreMigrationSql(role)}
+create table if not exists alma_operation_financial_calls (
+ org text not null, uid text not null, root_id text not null, call_id text not null, settlement_id text not null, cost_id uuid not null,
+ accounting_ordinal int not null check(accounting_ordinal between 1 and 512), reservation_ordinal int not null check(reservation_ordinal between 1 and 512),
+ cost_usd double precision not null, previous_usd double precision not null, current_usd double precision not null,
+ decisions jsonb not null, new_warnings text[] not null, recorded_at timestamptz not null,
+ primary key(org,uid,root_id,call_id), unique(org,uid,root_id,accounting_ordinal), unique(org,uid,root_id,settlement_id),
+ foreign key(org,uid,root_id,call_id) references alma_operation_calls(org,uid,root_id,call_id),
+ foreign key(org,uid,cost_id) references alma_audit_cost(org,uid,id),
+ check(cost_usd>=0 and cost_usd<'Infinity'::float8 and previous_usd>=0 and previous_usd<'Infinity'::float8 and current_usd=previous_usd+cost_usd and current_usd<'Infinity'::float8),
+ check(jsonb_typeof(decisions)='array' and jsonb_array_length(decisions)<=3),
+ check(cardinality(new_warnings)<=3 and new_warnings<@array['perTurnUsd','perSessionUsd','perTenantDayUsd']::text[])
+);
+create table if not exists alma_operation_warnings (
+ org text not null, uid text not null, root_id text not null, cap text not null check(cap in ('perTurnUsd','perSessionUsd','perTenantDayUsd')), call_id text not null,
+ primary key(org,uid,root_id,cap), foreign key(org,uid,root_id,call_id) references alma_operation_financial_calls(org,uid,root_id,call_id)
+);
+create or replace function alma_operation_financial_validate() returns trigger language plpgsql as $financial$
+declare root alma_operation_roots%rowtype; member alma_operation_calls%rowtype; previous alma_operation_financial_calls%rowtype;
+ source record; expected jsonb; warnings text[]; field text;
+begin
+ select * into root from alma_operation_roots where org=new.org and uid=new.uid and id=new.root_id for update;
+ select * into member from alma_operation_calls where org=new.org and uid=new.uid and root_id=new.root_id and call_id=new.call_id;
+ select * into previous from alma_operation_financial_calls where org=new.org and uid=new.uid and root_id=new.root_id order by accounting_ordinal desc limit 1;
+ select c.settlement_payload payload,g.request,g.decisions into source from alma_audit_cost c join alma_governed_cost g on (g.org,g.uid,g.cost_id)=(c.org,c.uid,c.id)
+  where c.org=new.org and c.uid=new.uid and c.id=new.cost_id and c.settlement_governed;
+ if (root.id is not null and member.call_id is not null and source.payload is not null
+  and new.reservation_ordinal=member.ordinal and new.accounting_ordinal=coalesce(previous.accounting_ordinal,0)+1
+  and new.previous_usd=coalesce(previous.current_usd,0) and new.cost_usd=(source.payload->>'costUsd')::float8
+  and source.payload->>'callId'=new.call_id and source.payload->>'id'=new.settlement_id
+  and source.payload->>'id'=member.input->>'settlementId' and source.payload->'scope'=member.input->'scope'
+  and source.payload->'model'=member.input->'model' and source.payload->>'at'=member.input->>'occurredAt'
+  and source.payload->'consumers'=member.input->'governance'->'consumers' and source.request->>'policyVersion'=root.policy_version and source.request->'caps'=root.caps
+  and (not(source.payload ? 'parentCallId') or source.payload->>'parentCallId'=member.parent_call_id)) is not true then
+  raise exception 'Invalid root financial association' using errcode='23514';
+ end if;
+ foreach field in array array['sessionId','operationId','attemptId','priceVersion'] loop
+  if (source.payload->>field=member.input->>field) is not true then raise exception 'Invalid root financial binding' using errcode='23514'; end if;
+ end loop;
+ select coalesce(jsonb_agg(case when d->>'cap'='perTurnUsd' then d || jsonb_build_object('previousUsd',new.previous_usd,'currentUsd',new.current_usd,'exceeded',new.current_usd>(d->>'thresholdUsd')::float8) else d end order by n),'[]'::jsonb)
+  into expected from jsonb_array_elements(source.decisions) with ordinality as x(d,n);
+ if new.decisions<>expected then raise exception 'Invalid root financial decisions' using errcode='23514'; end if;
+ select coalesce(array_agg(d->>'cap' order by n),array[]::text[]) into warnings from jsonb_array_elements(expected) with ordinality as x(d,n)
+  where d->>'onExceeded'='warn' and (d->>'exceeded')::boolean and not exists(select from alma_operation_warnings w where w.org=new.org and w.uid=new.uid and w.root_id=new.root_id and w.cap=d->>'cap');
+ if new.new_warnings<>warnings then raise exception 'Invalid root financial warnings' using errcode='23514'; end if;
+ return new;
+end $financial$;
+create or replace function alma_operation_financial_warn() returns trigger language plpgsql as $warnings$
+declare cap text;
+begin
+ foreach cap in array new.new_warnings loop insert into alma_operation_warnings(org,uid,root_id,cap,call_id) values(new.org,new.uid,new.root_id,cap,new.call_id); end loop;
+ return new;
+end $warnings$;
+create or replace function alma_operation_warning_validate() returns trigger language plpgsql as $validate$
+begin
+ if not exists(select from alma_operation_financial_calls f where f.org=new.org and f.uid=new.uid and f.root_id=new.root_id and f.call_id=new.call_id and new.cap=any(f.new_warnings)) then
+  raise exception 'Invalid root warning association' using errcode='23514';
+ end if; return new;
+end $validate$;
+do $triggers$ begin
+ if not exists(select from pg_trigger where tgrelid='alma_operation_financial_calls'::regclass and tgname='alma_operation_financial_validate') then
+ create trigger alma_operation_financial_validate before insert on alma_operation_financial_calls for each row execute function alma_operation_financial_validate();
+ create trigger alma_operation_financial_warn after insert on alma_operation_financial_calls for each row execute function alma_operation_financial_warn();
+ end if;
+ if not exists(select from pg_trigger where tgrelid='alma_operation_warnings'::regclass and tgname='alma_operation_warning_validate') then
+ create trigger alma_operation_warning_validate before insert on alma_operation_warnings for each row execute function alma_operation_warning_validate();
+ end if;
+end $triggers$;
+${rlsPolicySql2("alma_operation_financial_calls")}${rlsPolicySql2("alma_operation_warnings")}
+grant select,insert on alma_operation_financial_calls,alma_operation_warnings to ${role};
+${functionPathSql3("alma_operation_financial_validate()", "alma_operation_financial_warn()", "alma_operation_warning_validate()")}
+`;
+}
+async function migrateOperationAccountingStore(pool, opts = {}) {
+  await pool.query(operationAccountingMigrationSql(opts.role));
+}
+
+// src/session.ts
+import { equalExecution, ExecutionConflictError as ExecutionConflictError2, ExecutionStateError as ExecutionStateError2, settlementIdentifier as id2, settlementLimit, settlementScope as settlementScope2 } from "@alma-harness/core";
+import { checkOperationDeadline, normalizeOperationRoot as normalizeOperationRoot2, normalizeOperationSessionFence, operationCallQuery as operationCallQuery2 } from "@alma-harness/execution";
+import { assertRoleIdentifier as assertRoleIdentifier3, DEFAULT_RETENTION_ROLE, inScope as inScope2, resolveRlsRole as resolveRlsRole2, resolveStatementTimeout as resolveStatementTimeout2 } from "@alma-harness/postgres";
+var record2 = (r) => ({ input: normalizeOperationRoot2(r.input), ordinal: Number(r.ordinal), status: r.status, createdAt: r.created_at.toISOString(), updatedAt: r.updated_at.toISOString(), ...r.resolution_id === null ? {} : { resolutionId: r.resolution_id } });
+var PostgresOperationSessionStore = class {
+  constructor(pool, opts = {}) {
+    this.pool = pool;
+    this.#role = resolveRlsRole2(opts);
+    this.#timeout = resolveStatementTimeout2(opts);
+    this.#operator = opts.operatorRole ?? DEFAULT_RETENTION_ROLE;
+    assertRoleIdentifier3(this.#operator);
+    if (this.#role === this.#operator) throw new TypeError("Admission operator must have a separate role");
+  }
+  pool;
+  #role;
+  #operator;
+  #timeout;
+  async #scope(s, fn, operator = false) {
+    try {
+      return await inScope2(this.pool, operator ? this.#operator : this.#role, s, fn, this.#timeout);
+    } catch (e) {
+      const code = e.code;
+      if (code === "23505") throw new ExecutionConflictError2();
+      if (code === "23514" || code === "23503") throw new ExecutionStateError2();
+      throw e;
+    }
+  }
+  async #read(c, s, k, lock = false) {
+    return (await c.query(`select * from alma_operation_admissions where org=$1 and uid=$2 and root_key=$3${lock ? " for update" : ""}`, [s.org, s.uid, k])).rows[0];
+  }
+  async #lock(c, s, sessionId) {
+    await c.query("select session_id from alma_operation_sessions where org=$1 and uid=$2 and session_id=$3 for update", [s.org, s.uid, sessionId]);
+  }
+  async claim(value) {
+    const i = normalizeOperationRoot2(value);
+    return this.#scope(i.scope, async (c) => {
+      await c.query("insert into alma_operation_sessions(org,uid,session_id) values($1,$2,$3) on conflict do nothing", [i.scope.org, i.scope.uid, i.sessionId]);
+      await this.#lock(c, i.scope, i.sessionId);
+      const old = await this.#read(c, i.scope, i.key);
+      if (old) {
+        if (!equalExecution(old.input, i)) throw new ExecutionConflictError2();
+        return { status: "existing", record: record2(old) };
+      }
+      if ((await c.query("select 1 from alma_operation_admissions where org=$1 and uid=$2 and root_id=$3", [i.scope.org, i.scope.uid, i.id])).rowCount) throw new ExecutionConflictError2();
+      const occupied = (await c.query("select * from alma_operation_admissions where org=$1 and uid=$2 and session_id=$3 and status<>'released'", [i.scope.org, i.scope.uid, i.sessionId])).rows[0];
+      if (occupied) return { status: "busy", rootKey: occupied.input.key, rootId: occupied.input.id };
+      const at2 = (await c.query("select clock_timestamp() at")).rows[0].at.toISOString();
+      checkOperationDeadline(i, at2);
+      const token = crypto.randomUUID();
+      const row = (await c.query(
+        `insert into alma_operation_admissions(org,uid,root_key,root_id,session_id,input,deadline_at,token,ordinal,status,created_at,updated_at)
+        values($1,$2,$3,$4,$5,$6::jsonb,$7,$8,(select coalesce(max(ordinal),0)+1 from alma_operation_admissions where org=$1 and uid=$2 and session_id=$5),'active',clock_timestamp(),clock_timestamp()) returning *`,
+        [i.scope.org, i.scope.uid, i.key, i.id, i.sessionId, JSON.stringify(i), i.deadlineAt, token]
+      )).rows[0];
+      return { status: "claimed", record: record2(row), fence: { scope: { ...i.scope }, sessionId: i.sessionId, rootKey: i.key, token } };
+    });
+  }
+  async get(scope, rootKey) {
+    const s = settlementScope2(scope), k = id2(rootKey);
+    return this.#scope(s, async (c) => {
+      const r = await this.#read(c, s, k);
+      return r ? record2(r) : null;
+    });
+  }
+  async list(scope, sessionId, query) {
+    const s = settlementScope2(scope), session = id2(sessionId), q = operationCallQuery2(query);
+    return this.#scope(s, async (c) => (await c.query("select * from alma_operation_admissions where org=$1 and uid=$2 and session_id=$3 and ordinal>$4 order by ordinal limit $5", [s.org, s.uid, session, q.afterOrdinal, q.limit])).rows.map(record2));
+  }
+  async #owner(value, finish) {
+    const f = normalizeOperationSessionFence(value);
+    return this.#scope(f.scope, async (c) => {
+      await this.#lock(c, f.scope, f.sessionId);
+      const r = await this.#read(c, f.scope, f.rootKey, true);
+      if (!r || r.token !== f.token || r.input.sessionId !== f.sessionId) throw new ExecutionStateError2();
+      if (finish) {
+        if (r.status === "released" && r.resolution_id === null) return record2(r);
+        if (r.status !== "active") throw new ExecutionStateError2();
+      } else if (r.status !== "active") return record2(r);
+      await c.query("select set_config('alma.operation_admission_token',$1,true)", [f.token]);
+      return record2((await c.query("update alma_operation_admissions set status=$4 where org=$1 and uid=$2 and root_key=$3 returning *", [f.scope.org, f.scope.uid, f.rootKey, finish ? "released" : "reconciliation_required"])).rows[0]);
+    });
+  }
+  finish(fence) {
+    return this.#owner(fence, true);
+  }
+  markUncertain(fence) {
+    return this.#owner(fence, false);
+  }
+  async reconcileExpired(scope, opts = {}) {
+    const s = settlementScope2(scope), limit = settlementLimit(opts.limit);
+    return this.#scope(s, async (c) => {
+      const sessions = (await c.query(`select session_id from alma_operation_sessions s where org=$1 and uid=$2
+        and exists(select from alma_operation_admissions a where (a.org,a.uid,a.session_id)=(s.org,s.uid,s.session_id) and status='active' and deadline_at<=clock_timestamp())
+        order by session_id limit $3 for update of s skip locked`, [s.org, s.uid, limit])).rows;
+      const records = [];
+      for (const row of sessions) records.push(...(await c.query("update alma_operation_admissions set status='reconciliation_required' where org=$1 and uid=$2 and session_id=$3 and status='active' and deadline_at<=clock_timestamp() returning *", [s.org, s.uid, row.session_id])).rows.map(record2));
+      return records;
+    });
+  }
+  async resolve(scope, rootKey, opts) {
+    const s = settlementScope2(scope), k = id2(rootKey), resolutionId = id2(opts.resolutionId);
+    return this.#scope(s, async (c) => {
+      const meta = await this.#read(c, s, k);
+      if (!meta) throw new ExecutionStateError2();
+      await this.#lock(c, s, meta.input.sessionId);
+      const r = await this.#read(c, s, k, true);
+      if (r.status === "released") {
+        if (r.resolution_id !== resolutionId) throw new ExecutionConflictError2();
+        return record2(r);
+      }
+      if (r.status !== "reconciliation_required") throw new ExecutionStateError2();
+      return record2((await c.query("update alma_operation_admissions set status='released',resolution_id=$4 where org=$1 and uid=$2 and root_key=$3 returning *", [s.org, s.uid, k, resolutionId])).rows[0]);
+    }, true);
+  }
+};
+
+// src/session-schema.ts
+import { functionPathSql as functionPathSql4 } from "@alma-harness/postgres";
+import { assertRoleIdentifier as assertRoleIdentifier4, DEFAULT_RLS_ROLE as DEFAULT_RLS_ROLE3, DEFAULT_RETENTION_ROLE as DEFAULT_RETENTION_ROLE2, rlsPolicySql as rlsPolicySql3, roleBootstrapSql } from "@alma-harness/postgres";
+function operationSessionMigrationSql(role = DEFAULT_RLS_ROLE3, operatorRole = DEFAULT_RETENTION_ROLE2) {
+  assertRoleIdentifier4(role);
+  assertRoleIdentifier4(operatorRole);
+  if (role === operatorRole) throw new TypeError("Admission operator must have a separate role");
+  return `${operationTreeMigrationSql(role)}${roleBootstrapSql(operatorRole)}
+create table if not exists alma_operation_sessions (
+ org text not null, uid text not null, session_id text not null,
+ primary key(org,uid,session_id),
+ check(org ~ '^[!-~]{1,200}$' and uid ~ '^[!-~]{1,200}$' and session_id ~ '^[!-~]{1,200}$')
+);
+create or replace function alma_admission_input(v jsonb) returns boolean language plpgsql immutable as $shape$
+declare item record;
+begin
+ if (jsonb_typeof(v)='object' and v ?& array['scope','key','id','sessionId','policyVersion','caps','maxSensitivity','deadlineAt','maxCalls']
+ and (v-array['scope','key','id','sessionId','policyVersion','caps','maxSensitivity','deadlineAt','maxCalls'])='{}'::jsonb
+ and jsonb_typeof(v->'scope')='object' and ((v->'scope')-'org'-'uid')='{}'::jsonb
+ and jsonb_typeof(v->'maxCalls')='number' and (v->>'maxCalls')::numeric between 1 and 512
+ and trunc((v->>'maxCalls')::numeric)=(v->>'maxCalls')::numeric
+ and v->>'maxSensitivity' in ('public','internal','personal','health')
+ and jsonb_typeof(v->'deadlineAt')='string' and v->>'deadlineAt' ~ '^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}[.][0-9]{3}Z$'
+ and isfinite((v->>'deadlineAt')::timestamptz) and alma_operation_caps(v->'caps')) is not true then return false; end if;
+ for item in select value from jsonb_each(v->'scope') union all select value from jsonb_each(v) where key in ('key','id','sessionId','policyVersion') loop
+  if (jsonb_typeof(item.value)='string' and (item.value#>>'{}') ~ '^[!-~]{1,200}$') is not true then return false; end if;
+ end loop;
+ if not (v->'scope' ?& array['org','uid']) then return false; end if;
+ for item in select value from jsonb_each(v->'caps') loop
+  if (item.value->>'usd')::numeric > 1.7976931348623157e308 then return false; end if;
+ end loop;
+ return true;
+exception when others then return false;
+end $shape$;
+create table if not exists alma_operation_admissions (
+ org text not null, uid text not null, root_key text not null, root_id text not null,
+ session_id text not null, input jsonb not null, deadline_at timestamptz not null,
+ token text not null check(token ~ '^[!-~]{1,200}$'),
+ ordinal bigint not null check(ordinal between 1 and 9007199254740991),
+ status text not null check(status in ('active','reconciliation_required','released')),
+ created_at timestamptz not null, updated_at timestamptz not null,
+ resolution_id text check(resolution_id ~ '^[!-~]{1,200}$'),
+ primary key(org,uid,root_key), unique(org,uid,root_id), unique(org,uid,session_id,ordinal),
+ foreign key(org,uid,session_id) references alma_operation_sessions(org,uid,session_id),
+ check((alma_admission_input(input) and input->'scope'->>'org'=org and input->'scope'->>'uid'=uid
+  and input->>'key'=root_key and input->>'id'=root_id and input->>'sessionId'=session_id
+  and (input->>'deadlineAt')::timestamptz=deadline_at) is true),
+ check(resolution_id is null or status='released')
+);
+create unique index if not exists alma_admission_occupancy on alma_operation_admissions(org,uid,session_id) where status<>'released';
+create or replace function alma_session_lock_immutable() returns trigger language plpgsql as $lock$
+begin
+ if new is distinct from old then raise exception 'Immutable session identity' using errcode='23514'; end if;
+ return new;
+end $lock$;
+create or replace function alma_admission_transition() returns trigger language plpgsql as $transition$
+declare owner boolean; expected bigint;
+begin
+ perform from alma_operation_sessions where org=new.org and uid=new.uid and session_id=new.session_id for update;
+ if tg_op='INSERT' then
+  select coalesce(max(ordinal),0)+1 into expected from alma_operation_admissions where org=new.org and uid=new.uid and session_id=new.session_id;
+  if (new.status='active' and new.resolution_id is null and new.ordinal=expected
+   and new.deadline_at>clock_timestamp() and new.deadline_at<=clock_timestamp()+interval '1 hour') is not true then
+   raise exception 'Invalid admission' using errcode='23514';
+  end if;
+  new.created_at=clock_timestamp(); new.updated_at=new.created_at; return new;
+ end if;
+ if (new.org,new.uid,new.root_key,new.root_id,new.session_id,new.input,new.deadline_at,new.token,new.ordinal,new.created_at)
+  is distinct from (old.org,old.uid,old.root_key,old.root_id,old.session_id,old.input,old.deadline_at,old.token,old.ordinal,old.created_at) then
+  raise exception 'Immutable admission binding' using errcode='23514';
+ end if;
+ owner=coalesce(current_setting('alma.operation_admission_token',true)=old.token,false);
+ if not (
+  (old.status='active' and new.status='released' and new.resolution_id is null and owner and old.deadline_at>clock_timestamp())
+  or (old.status='active' and new.status='reconciliation_required' and new.resolution_id is null and (owner or old.deadline_at<=clock_timestamp()))
+  or (old.status='reconciliation_required' and new.status='released' and new.resolution_id is not null and pg_has_role(current_user,'${operatorRole}','MEMBER'))
+ ) then raise exception 'Invalid admission transition' using errcode='23514'; end if;
+ new.updated_at=clock_timestamp(); return new;
+end $transition$;
+do $triggers$ begin
+ if not exists(select from pg_trigger where tgrelid='alma_operation_sessions'::regclass and tgname='alma_session_lock_immutable') then
+  create trigger alma_session_lock_immutable before update on alma_operation_sessions for each row execute function alma_session_lock_immutable();
+ end if;
+ if not exists(select from pg_trigger where tgrelid='alma_operation_admissions'::regclass and tgname='alma_admission_transition') then
+  create trigger alma_admission_transition before insert or update on alma_operation_admissions for each row execute function alma_admission_transition();
+ end if;
+end $triggers$;
+${rlsPolicySql3("alma_operation_sessions")}${rlsPolicySql3("alma_operation_admissions")}
+grant select,insert,update on alma_operation_sessions to ${role};
+grant select,update on alma_operation_sessions to ${operatorRole};
+grant select,insert,update on alma_operation_admissions to ${role};
+grant select,update on alma_operation_admissions to ${operatorRole};
+${operationRequestAdmissionSql}
+${functionPathSql4("alma_admission_input(jsonb)", "alma_admission_transition()")}
+`;
+}
+async function migrateOperationSessionStore(pool, opts = {}) {
+  await pool.query(operationSessionMigrationSql(opts.role, opts.operatorRole));
+}
+
+// src/batch.ts
+import { equalExecution as equalExecution2, ExecutionConflictError as ExecutionConflictError3, ExecutionStateError as ExecutionStateError3, settlementIdentifier as id3, settlementScope as settlementScope3 } from "@alma-harness/core";
+import { batchQuery, normalizeBatchSummary, bindBatchHandle, checkBatchDeadline, normalizeBatchFence, normalizeBatchHandle, normalizeBatchRecord, normalizeBatchSubmission } from "@alma-harness/execution";
+import { inScope as inScope3, resolveRlsRole as resolveRlsRole3, resolveStatementTimeout as resolveStatementTimeout3 } from "@alma-harness/postgres";
+var record3 = (r) => normalizeBatchRecord({ input: r.input, state: r.state, createdAt: r.created_at.toISOString(), updatedAt: r.updated_at.toISOString(), ...r.dispatched_at ? { dispatchedAt: r.dispatched_at.toISOString() } : {}, ...r.accepted_at ? { acceptedAt: r.accepted_at.toISOString(), handle: r.handle } : {} });
+var PostgresBatchSubmissionStore = class {
+  constructor(pool, opts = {}) {
+    this.pool = pool;
+    this.#role = resolveRlsRole3(opts);
+    this.#timeout = resolveStatementTimeout3(opts);
+  }
+  pool;
+  #role;
+  #timeout;
+  async #scope(s, fn) {
+    try {
+      return await inScope3(this.pool, this.#role, s, fn, this.#timeout);
+    } catch (e) {
+      const code = e.code;
+      if (code === "23505") throw new ExecutionConflictError3();
+      if (code === "23514" || code === "23503") throw new ExecutionStateError3();
+      throw e;
+    }
+  }
+  async #read(c, s, k, lock = false) {
+    return (await c.query(`select * from alma_batch_submissions where org=$1 and uid=$2 and key=$3${lock ? " for update" : ""}`, [s.org, s.uid, k])).rows[0];
+  }
+  async claim(value) {
+    const input = normalizeBatchSubmission(value);
+    return this.#scope(input.scope, async (c) => {
+      let row = await this.#read(c, input.scope, input.key, true);
+      if (!row) {
+        const at2 = (await c.query("select clock_timestamp() at")).rows[0].at.toISOString();
+        checkBatchDeadline(input, at2);
+        row = (await c.query(`insert into alma_batch_submissions(org,uid,key,id,input,state,token,created_at,updated_at) values($1,$2,$3,$4,$5::jsonb,'prepared',$6,clock_timestamp(),clock_timestamp()) on conflict(org,uid,key) do nothing returning *`, [input.scope.org, input.scope.uid, input.key, input.id, JSON.stringify(input), crypto.randomUUID()])).rows[0];
+        if (row) return { status: "claimed", record: record3(row), fence: { scope: { ...input.scope }, key: input.key, id: input.id, token: row.token } };
+        row = await this.#read(c, input.scope, input.key, true);
+      }
+      if (!row || !equalExecution2(record3(row).input, input)) throw new ExecutionConflictError3();
+      return { status: "existing", record: record3(row) };
+    });
+  }
+  async #owner(value, fn) {
+    const f = normalizeBatchFence(value);
+    return this.#scope(f.scope, async (c) => {
+      const r = await this.#read(c, f.scope, f.key, true);
+      if (!r || r.token !== f.token || r.input.id !== f.id) throw new ExecutionStateError3();
+      await c.query("select set_config('alma.batch_token',$1,true)", [f.token]);
+      return fn(c, r, f);
+    });
+  }
+  async beginDispatch(fence) {
+    return this.#owner(fence, async (c, r, f) => {
+      if (r.state !== "prepared") return { dispatch: false, record: record3(r) };
+      const row = (await c.query("update alma_batch_submissions set state='dispatching' where org=$1 and uid=$2 and key=$3 returning *", [f.scope.org, f.scope.uid, f.key])).rows[0];
+      return { dispatch: true, record: record3(row) };
+    });
+  }
+  async accept(value, raw) {
+    const f = normalizeBatchFence(value), handle = normalizeBatchHandle(raw);
+    return this.#owner(f, async (c, r) => {
+      bindBatchHandle(record3(r).input, handle);
+      if (r.handle) {
+        if (!equalExecution2(r.handle, handle)) throw new ExecutionConflictError3();
+        return record3(r);
+      }
+      if (!r.dispatched_at) throw new ExecutionStateError3();
+      return record3((await c.query(`update alma_batch_submissions set handle=$4::jsonb,state=case when state='dispatching' and (input->>'submitDeadlineAt')::timestamptz>clock_timestamp() then 'submitted' else 'reconciliation_required' end where org=$1 and uid=$2 and key=$3 returning *`, [f.scope.org, f.scope.uid, f.key, JSON.stringify(handle)])).rows[0]);
+    });
+  }
+  async markUncertain(fence) {
+    return this.#owner(fence, async (c, r, f) => r.state === "reconciliation_required" ? record3(r) : record3((await c.query("update alma_batch_submissions set state='reconciliation_required' where org=$1 and uid=$2 and key=$3 returning *", [f.scope.org, f.scope.uid, f.key])).rows[0]));
+  }
+  async get(scope, identity) {
+    const s = settlementScope3(scope), k = id3(identity);
+    return this.#scope(s, async (c) => {
+      const r = await this.#read(c, s, k);
+      return r ? record3(r) : null;
+    });
+  }
+  async list(scope, query) {
+    const s = settlementScope3(scope), q = batchQuery(query);
+    return this.#scope(s, async (c) => (await c.query(`select key,id,input->>'sessionId' session_id,input->>'submitDeadlineAt' deadline,jsonb_array_length(input->'items') item_count,state,created_at,updated_at,dispatched_at,accepted_at,handle from alma_batch_submissions where org=$1 and uid=$2 and ($3::text is null or key>$3 collate "C") order by key limit $4`, [s.org, s.uid, q.afterKey ?? null, q.limit])).rows.map((r) => normalizeBatchSummary({ key: r.key, id: r.id, sessionId: r.session_id, submitDeadlineAt: r.deadline, itemCount: r.item_count, state: r.state, createdAt: r.created_at.toISOString(), updatedAt: r.updated_at.toISOString(), ...r.dispatched_at ? { dispatchedAt: r.dispatched_at.toISOString() } : {}, ...r.accepted_at ? { acceptedAt: r.accepted_at.toISOString(), handle: r.handle } : {} })));
+  }
+};
+
+// src/batch-schema.ts
+import { functionPathSql as functionPathSql5 } from "@alma-harness/postgres";
+import { assertRoleIdentifier as assertRoleIdentifier5, DEFAULT_RLS_ROLE as DEFAULT_RLS_ROLE4, executionStoreMigrationSql as executionStoreMigrationSql2, rlsPolicySql as rlsPolicySql4 } from "@alma-harness/postgres";
+function batchSubmissionMigrationSql(role = DEFAULT_RLS_ROLE4) {
+  assertRoleIdentifier5(role);
+  return `${executionStoreMigrationSql2(role)}
+create or replace function alma_batch_input_v1(v jsonb) returns boolean language plpgsql immutable as $shape$
+declare item jsonb; e jsonb; first jsonb; field text;
+begin
+ if (jsonb_typeof(v)='object' and v ?& array['scope','key','id','sessionId','configRevision','submitDeadlineAt','items']
+  and (v-array['scope','key','id','sessionId','configRevision','submitDeadlineAt','items'])='{}'::jsonb
+  and jsonb_typeof(v->'scope')='object' and v->'scope' ?& array['org','uid'] and ((v->'scope')-'org'-'uid')='{}'::jsonb
+  and jsonb_typeof(v->'items')='array' and jsonb_array_length(v->'items') between 1 and 512
+  and octet_length(v::text)<=4194304) is not true then return false; end if;
+ foreach field in array array['key','id','sessionId','configRevision'] loop
+  if (jsonb_typeof(v->field)='string' and v->>field ~ '^[!-~]{1,200}$') is not true then return false; end if;
+ end loop;
+ first=v->'items'->0->'execution';
+ for item in select value from jsonb_array_elements(v->'items') loop
+  e=item->'execution';
+  if (jsonb_typeof(item)='object' and item ?& array['id','execution'] and (item-'id'-'execution')='{}'::jsonb
+   and jsonb_typeof(item->'id')='string' and item->>'id' ~ '^[!-~]{1,200}$'
+   and alma_execution_shape_v2(jsonb_set(e,'{controls}',(e->'controls')-'temperature'),'input')
+   and e ?& array['scope','operationKey','operationId','attemptId','callId','settlementId','sessionId','inputRevision','policyVersion','outputContractVersion','intent','model','requestedTier','priceVersion','prices','controls','occurredAt','deadlineAt','governance']
+   and (not(e->'controls' ? 'temperature') or (jsonb_typeof(e->'controls'->'temperature')='number' and (e->'controls'->>'temperature')::numeric between 0 and 2))
+   and e->'scope'=v->'scope' and e->>'sessionId'=v->>'sessionId' and e->>'requestedTier'='batch'
+   and e->>'deadlineAt'=v->>'submitDeadlineAt' and e->'model'=first->'model'
+   and e->>'policyVersion'=first->>'policyVersion' and e->'governance'->'caps'=first->'governance'->'caps') is not true then return false; end if;
+ end loop; return true;
+exception when others then return false;
+end $shape$;
+create table if not exists alma_batch_submissions (
+ org text not null,uid text not null,key text collate "C" not null,id text not null,input jsonb not null,
+ state text not null check(state in ('prepared','dispatching','submitted','reconciliation_required')),
+ token text not null check(token ~ '^[!-~]{1,200}$'),created_at timestamptz not null,updated_at timestamptz not null,
+ dispatched_at timestamptz,accepted_at timestamptz,handle jsonb,
+ primary key(org,uid,key),unique(org,uid,id),
+ check((alma_batch_input_v1(input) and input->'scope'->>'org'=org and input->'scope'->>'uid'=uid and input->>'key'=key and input->>'id'=id) is true),
+ check((handle is null)=(accepted_at is null)),
+ check(handle is null or (jsonb_typeof(handle)='object' and handle ?& array['provider','id','model'] and (handle-'provider'-'id'-'model')='{}'::jsonb
+  and jsonb_typeof(handle->'id')='string' and handle->>'id' ~ '^[!-~]{1,200}$'
+  and handle->'model'=input->'items'->0->'execution'->'model' and handle->>'provider'=handle->'model'->>'provider') is true),
+ check(state<>'prepared' or (dispatched_at is null and handle is null)),
+ check(state<>'dispatching' or (dispatched_at is not null and handle is null)),
+ check(state<>'submitted' or (handle is not null and accepted_at<(input->>'submitDeadlineAt')::timestamptz)),
+ check(accepted_at is null or (dispatched_at is not null and accepted_at>=dispatched_at)),
+ check(dispatched_at is null or (dispatched_at>=created_at and dispatched_at<(input->>'submitDeadlineAt')::timestamptz)),
+ check(updated_at>=created_at and (accepted_at is null or updated_at>=accepted_at) and (dispatched_at is null or updated_at>=dispatched_at))
+);
+create table if not exists alma_batch_items (
+ org text not null,uid text not null,batch_key text not null,ordinal int not null check(ordinal between 1 and 512),
+ item_id text not null,operation_key text not null,operation_id text not null,call_id text not null,settlement_id text not null,
+ primary key(org,uid,batch_key,ordinal),unique(org,uid,batch_key,item_id),
+ unique(org,uid,operation_key),unique(org,uid,operation_id),unique(org,uid,call_id),unique(org,uid,settlement_id),
+ foreign key(org,uid,batch_key) references alma_batch_submissions(org,uid,key)
+);
+create or replace function alma_batch_transition() returns trigger language plpgsql as $transition$
+declare at timestamptz; deadline timestamptz;
+begin
+ at=clock_timestamp();deadline=(new.input->>'submitDeadlineAt')::timestamptz;
+ if tg_op='INSERT' then
+  if (new.state='prepared' and new.dispatched_at is null and new.accepted_at is null and new.handle is null and deadline>at and deadline<=at+interval '1 hour') is not true then raise exception 'Invalid batch claim' using errcode='23514'; end if;
+  new.created_at=at;new.updated_at=at;return new;
+ end if;
+ if (new.org,new.uid,new.key,new.id,new.input,new.token,new.created_at) is distinct from (old.org,old.uid,old.key,old.id,old.input,old.token,old.created_at)
+  or coalesce(current_setting('alma.batch_token',true)=old.token,false) is not true then raise exception 'Invalid batch binding or fence' using errcode='23514'; end if;
+ if old.state='prepared' and new.state='dispatching' and deadline>at and new.handle is null and new.accepted_at is null then
+  new.dispatched_at=at;
+ elsif old.handle is null and new.handle is not null and old.dispatched_at is not null
+  and new.dispatched_at=old.dispatched_at and new.state in ('submitted','reconciliation_required') then
+  new.state=case when old.state='dispatching' and deadline>at then 'submitted' else 'reconciliation_required' end;new.accepted_at=at;
+ elsif old.state<>'reconciliation_required' and new.state='reconciliation_required' and (new.dispatched_at,new.accepted_at,new.handle) is not distinct from (old.dispatched_at,old.accepted_at,old.handle) then null;
+ else raise exception 'Invalid batch transition' using errcode='23514';
+ end if;
+ new.updated_at=at;return new;
+end $transition$;
+create or replace function alma_batch_member() returns trigger language plpgsql as $member$
+declare item jsonb;
+begin
+ select input->'items'->(new.ordinal-1) into item from alma_batch_submissions where org=new.org and uid=new.uid and key=new.batch_key;
+ if (item->>'id'=new.item_id and item->'execution'->>'operationKey'=new.operation_key and item->'execution'->>'operationId'=new.operation_id
+  and item->'execution'->>'callId'=new.call_id and item->'execution'->>'settlementId'=new.settlement_id) is not true then raise exception 'Invalid batch member' using errcode='23514'; end if;return new;
+end $member$;
+create or replace function alma_batch_members() returns trigger language plpgsql as $members$
+begin
+ insert into alma_batch_items(org,uid,batch_key,ordinal,item_id,operation_key,operation_id,call_id,settlement_id)
+ select new.org,new.uid,new.key,n,value->>'id',value->'execution'->>'operationKey',value->'execution'->>'operationId',value->'execution'->>'callId',value->'execution'->>'settlementId'
+ from jsonb_array_elements(new.input->'items') with ordinality as x(value,n);return new;
+end $members$;
+do $triggers$ begin
+ if not exists(select from pg_trigger where tgrelid='alma_batch_submissions'::regclass and tgname='alma_batch_transition') then
+  create trigger alma_batch_transition before insert or update on alma_batch_submissions for each row execute function alma_batch_transition();
+  create trigger alma_batch_members after insert on alma_batch_submissions for each row execute function alma_batch_members();
+ end if;
+ if not exists(select from pg_trigger where tgrelid='alma_batch_items'::regclass and tgname='alma_batch_member') then
+  create trigger alma_batch_member before insert on alma_batch_items for each row execute function alma_batch_member();
+ end if;
+end $triggers$;
+${rlsPolicySql4("alma_batch_submissions")}${rlsPolicySql4("alma_batch_items")}
+grant select,insert,update on alma_batch_submissions to ${role};
+grant select,insert on alma_batch_items to ${role};
+${functionPathSql5("alma_batch_input_v1(jsonb)", "alma_batch_member()", "alma_batch_members()")}
+`;
+}
+async function migrateBatchSubmissionStore(pool, opts = {}) {
+  await pool.query(batchSubmissionMigrationSql(opts.role));
+}
+
+// src/batch-usage.ts
+import { equalExecution as equalExecution3, ExecutionConflictError as ExecutionConflictError4, ExecutionStateError as ExecutionStateError4, settlementIdentifier as id4, settlementScope as settlementScope4 } from "@alma-harness/core";
+import { batchUsageMember, batchUsageQuery, batchUsageSettlement, bindBatchUsageReceipt, normalizeBatchUsage, normalizeBatchUsageRecord, normalizeGovernedCostReceipt as normalizeGovernedCostReceipt2 } from "@alma-harness/execution";
+import { inScope as inScope4, resolveRlsRole as resolveRlsRole4, resolveStatementTimeout as resolveStatementTimeout4 } from "@alma-harness/postgres";
+var select = `select u.*,b.input->'items'->(i.ordinal-1)->'execution' execution,c.settlement_payload,c.settlement_session_usd,c.settlement_day_usd,g.request,g.decisions
+ from alma_batch_usage u join alma_batch_items i on (i.org,i.uid,i.batch_key,i.item_id)=(u.org,u.uid,u.batch_key,u.item_id)
+ join alma_batch_submissions b on (b.org,b.uid,b.key)=(u.org,u.uid,u.batch_key)
+ left join alma_audit_cost c on (c.org,c.uid,c.id)=(u.org,u.uid,u.cost_id)
+ left join alma_governed_cost g on (g.org,g.uid,g.cost_id)=(c.org,c.uid,c.id)`;
+var receipt2 = (r) => normalizeGovernedCostReceipt2({ request: r.request, decisions: r.decisions, receipt: { settlement: r.settlement_payload, totals: { sessionUsd: r.settlement_session_usd, tenantDayUsd: r.settlement_day_usd } } });
+var record4 = (r) => normalizeBatchUsageRecord({ scope: { org: r.org, uid: r.uid }, batchKey: r.batch_key, input: r.input, execution: r.execution, receivedAt: r.received_at.toISOString(), ...r.cost_id ? { receipt: receipt2(r) } : {} });
+var PostgresBatchUsageStore = class {
+  constructor(pool, opts = {}) {
+    this.pool = pool;
+    this.#role = resolveRlsRole4(opts);
+    this.#timeout = resolveStatementTimeout4(opts);
+    this.#batches = new PostgresBatchSubmissionStore(pool, opts);
+  }
+  pool;
+  #role;
+  #timeout;
+  #batches;
+  async #scope(s, fn) {
+    try {
+      return await inScope4(this.pool, this.#role, s, fn, this.#timeout);
+    } catch (e) {
+      if (["23505", "23514", "23503"].includes(e.code ?? "")) throw new ExecutionConflictError4();
+      throw e;
+    }
+  }
+  async #read(c, s, k, i, lock = false) {
+    const args = [s.org, s.uid, k, i];
+    if (lock) await c.query("select id from alma_batch_usage where org=$1 and uid=$2 and batch_key=$3 and id=$4 for update", args);
+    return (await c.query(`${select} where u.org=$1 and u.uid=$2 and u.batch_key=$3 and u.id=$4`, args)).rows[0];
+  }
+  async append(scope, batchKey, value) {
+    const s = settlementScope4(scope), k = id4(batchKey), input = normalizeBatchUsage(value);
+    batchUsageMember(await this.#batches.get(s, k), input);
+    return this.#scope(s, async (c) => {
+      await c.query("insert into alma_batch_usage(org,uid,batch_key,id,item_id,input,received_at) values($1,$2,$3,$4,$5,$6::jsonb,clock_timestamp()) on conflict(org,uid,batch_key,id) do nothing", [s.org, s.uid, k, input.id, input.itemId, JSON.stringify(input)]);
+      const r = record4(await this.#read(c, s, k, input.id));
+      if (!equalExecution3(r.input, input)) throw new ExecutionConflictError4();
+      return r;
+    });
+  }
+  async get(scope, batchKey, identity) {
+    const s = settlementScope4(scope), k = id4(batchKey), i = id4(identity);
+    return this.#scope(s, async (c) => {
+      const r = await this.#read(c, s, k, i);
+      return r ? record4(r) : null;
+    });
+  }
+  async list(scope, batchKey, query) {
+    const s = settlementScope4(scope), k = id4(batchKey), q = batchUsageQuery(query);
+    return this.#scope(s, async (c) => (await c.query(`${select} where u.org=$1 and u.uid=$2 and u.batch_key=$3 and ($4::text is null or u.id>$4 collate "C") and (not $5::boolean or u.cost_id is null) order by u.id limit $6`, [s.org, s.uid, k, q.afterId ?? null, q.pendingOnly, q.limit])).rows.map(record4));
+  }
+  async recordSettlement(scope, batchKey, identity) {
+    const s = settlementScope4(scope), k = id4(batchKey), i = id4(identity);
+    return this.#scope(s, async (c) => {
+      const row = await this.#read(c, s, k, i, true);
+      if (!row) throw new ExecutionStateError4();
+      const r = record4(row);
+      if (r.receipt) return { status: "replayed", record: r };
+      if (!batchUsageSettlement(r)) return { status: "pending" };
+      const source = (await c.query(`select c.id,c.settlement_payload,c.settlement_session_usd,c.settlement_day_usd,g.request,g.decisions from alma_audit_cost c join alma_governed_cost g on (g.org,g.uid,g.cost_id)=(c.org,c.uid,c.id) where c.org=$1 and c.uid=$2 and c.settlement_id=$3 and c.settlement_governed`, [s.org, s.uid, r.execution.settlementId])).rows[0];
+      if (!source) return { status: "pending" };
+      bindBatchUsageReceipt(r, receipt2(source));
+      await c.query("update alma_batch_usage set cost_id=$5::uuid where org=$1 and uid=$2 and batch_key=$3 and id=$4", [s.org, s.uid, k, i, source.id]);
+      return { status: "applied", record: record4(await this.#read(c, s, k, i)) };
+    });
+  }
+};
+
+// src/batch-usage-schema.ts
+import { functionPathSql as functionPathSql6 } from "@alma-harness/postgres";
+import { assertRoleIdentifier as assertRoleIdentifier6, DEFAULT_RLS_ROLE as DEFAULT_RLS_ROLE5, governedCostSettlementStoreMigrationSql as governedCostSettlementStoreMigrationSql2, rlsPolicySql as rlsPolicySql5 } from "@alma-harness/postgres";
+
+// src/batch-pricing-schema.ts
+var batchPricingSql = `
+create or replace function alma_batch_price(e jsonb,u jsonb) returns double precision language plpgsql immutable as $price$
+declare price jsonb; rates jsonb; band jsonb; prompt double precision; best double precision;
+ searches double precision; hour_rate double precision; write_rate double precision; amount double precision;
+begin
+ select value into price from jsonb_array_elements(e->'prices') where value->'model'=e->'model' and value->>'serviceTier'='batch' limit 1;
+ if price is null then return null;end if;
+ prompt=(u->>'inputTokens')::float8+coalesce((u->>'cacheReadInputTokens')::float8,0)+coalesce((u->>'cacheWriteInputTokens')::float8,0);
+ rates=price;
+ for band in select value from jsonb_array_elements(coalesce(price->'bands','[]'::jsonb)) loop
+  if prompt>(band->>'aboveInputTokens')::float8 and (best is null or (band->>'aboveInputTokens')::float8>best) then rates=band;best=(band->>'aboveInputTokens')::float8;end if;
+ end loop;
+ searches=coalesce((u->>'webSearchRequests')::float8,0);
+ if searches>0 and not(price ? 'webSearchUsdPerRequest') then return null;end if;
+ hour_rate=coalesce((rates->>'cacheWrite1hUsdPerMTok')::float8,(price->>'cacheWrite1hUsdPerMTok')::float8);
+ if u->>'cacheWriteTtl'='1h' and coalesce((u->>'cacheWriteInputTokens')::float8,0)>0 then
+  if hour_rate is null then return null;end if;write_rate=hour_rate;
+ else write_rate=coalesce((rates->>'cacheWriteUsdPerMTok')::float8,(rates->>'inputUsdPerMTok')::float8);end if;
+ amount=((u->>'inputTokens')::float8/1000000::float8)*(rates->>'inputUsdPerMTok')::float8
+  +((u->>'outputTokens')::float8/1000000::float8)*(rates->>'outputUsdPerMTok')::float8
+  +(coalesce((u->>'cacheReadInputTokens')::float8,0)/1000000::float8)*coalesce((rates->>'cacheReadUsdPerMTok')::float8,(rates->>'inputUsdPerMTok')::float8)
+  +(coalesce((u->>'cacheWriteInputTokens')::float8,0)/1000000::float8)*write_rate
+  +searches*coalesce((price->>'webSearchUsdPerRequest')::float8,0);
+ if amount>=0 and amount<'Infinity'::float8 then return amount;end if;return null;
+exception when others then return null;
+end $price$;
+`;
+
+// src/batch-usage-schema.ts
+function batchUsageMigrationSql(role = DEFAULT_RLS_ROLE5) {
+  assertRoleIdentifier6(role);
+  return `${batchSubmissionMigrationSql(role)}${governedCostSettlementStoreMigrationSql2(role)}${batchPricingSql}
+create or replace function alma_batch_usage_shape(v jsonb) returns boolean language plpgsql immutable as $shape$
+declare e jsonb; u jsonb; field text; child jsonb;
+begin
+ if (jsonb_typeof(v)='object' and v ?& array['id','itemId','handle','evidence','outcome']
+  and (v-array['id','itemId','handle','evidence','outcome','providerRequestId'])='{}'::jsonb
+  and v->>'outcome' in ('succeeded','errored','cancelled','expired','unusable')) is not true then return false;end if;
+ foreach field in array array['id','itemId','providerRequestId'] loop
+  if (v ? field) and (jsonb_typeof(v->field)='string' and v->>field ~ '^[!-~]{1,200}$') is not true then return false;end if;
+ end loop;
+ e=v->'evidence';u=e->'usage';
+ if alma_execution_shape_v2(e,'evidence') is not true then return false;end if;
+ if e->>'status'='unknown' then return (e ? 'reason' and (e-'status'-'reason')='{}'::jsonb and e->>'reason' in ('missing','invalid','interrupted')) is true;end if;
+ if (e->>'status' in ('known','unpriced') and u ?& array['inputTokens','outputTokens']) is not true then return false;end if;
+ if e->>'status'='known' and ((e-'status'-'usage')<>'{}'::jsonb or u->>'serviceTier' is distinct from 'batch') then return false;end if;
+ if e->>'status'='unpriced' then
+  if (e ? 'issues' and jsonb_array_length(e->'issues') between 1 and 2 and not(e ? 'reason')) is not true then return false;end if;
+  for child in select value from jsonb_array_elements(e->'issues') loop if child not in ('"service_tier"'::jsonb,'"cache_ttl"'::jsonb) then return false;end if;end loop;
+  if e ? 'reportedServiceTier' and (e->>'reportedServiceTier' ~ '^[!-~]{1,200}$') is not true then return false;end if;
+ end if;
+ if u ? 'serviceTier' and u->>'serviceTier' not in ('batch','standard','priority','flex') then return false;end if;
+ if u ? 'cacheWriteTtl' and u->>'cacheWriteTtl' not in ('5m','1h') then return false;end if;
+ foreach field in array array['inputTokens','outputTokens','cacheReadInputTokens','cacheWriteInputTokens','reasoningTokens','webSearchRequests'] loop
+  if u ? field and ((u->>field)::numeric between 0 and 9007199254740991 and trunc((u->>field)::numeric)=(u->>field)::numeric) is not true then return false;end if;
+ end loop;
+ if e ? 'cacheWriteTokensByTtl' then
+  if (e->'cacheWriteTokensByTtl' ?& array['5m','1h']) is not true then return false;end if;
+  for child in select value from jsonb_each(e->'cacheWriteTokensByTtl') loop if ((child#>>'{}')::numeric between 0 and 9007199254740991 and trunc((child#>>'{}')::numeric)=(child#>>'{}')::numeric) is not true then return false;end if;end loop;
+ end if;return true;
+exception when others then return false;
+end $shape$;
+create table if not exists alma_batch_usage (
+ org text not null,uid text not null,batch_key text not null,id text collate "C" not null,item_id text not null,
+ input jsonb not null,received_at timestamptz not null,cost_id uuid,
+ primary key(org,uid,batch_key,id),
+ foreign key(org,uid,batch_key,item_id) references alma_batch_items(org,uid,batch_key,item_id),
+ foreign key(org,uid,cost_id) references alma_audit_cost(org,uid,id),
+ check((alma_batch_usage_shape(input) and input->>'id'=id and input->>'itemId'=item_id) is true)
+);
+create or replace function alma_batch_usage_validate() returns trigger language plpgsql as $validate$
+declare batch alma_batch_submissions%rowtype; e jsonb; source record; field text;
+begin
+ select * into batch from alma_batch_submissions where org=new.org and uid=new.uid and key=new.batch_key;
+ select batch.input->'items'->(ordinal-1)->'execution' into e from alma_batch_items where org=new.org and uid=new.uid and batch_key=new.batch_key and item_id=new.item_id;
+ if (batch.state in ('submitted','reconciliation_required') and batch.handle is not null and batch.handle=new.input->'handle' and e is not null) is not true then raise exception 'Invalid batch observation binding' using errcode='23514';end if;
+ if tg_op='INSERT' then
+  if new.cost_id is not null then raise exception 'Observe before adopting receipt' using errcode='23514';end if;
+  new.received_at=clock_timestamp();return new;
+ end if;
+ if (new.org,new.uid,new.batch_key,new.id,new.item_id,new.input,new.received_at) is distinct from (old.org,old.uid,old.batch_key,old.id,old.item_id,old.input,old.received_at)
+  or old.cost_id is not null or new.cost_id is null then raise exception 'Immutable batch observation' using errcode='23514';end if;
+ select c.settlement_payload payload,g.request into source from alma_audit_cost c join alma_governed_cost g on (g.org,g.uid,g.cost_id)=(c.org,c.uid,c.id)
+  where c.org=new.org and c.uid=new.uid and c.id=new.cost_id and c.settlement_governed;
+ if (source.payload is not null and new.input->'evidence'->>'status'='known' and source.payload->>'id'=e->>'settlementId'
+  and source.payload->'scope'=e->'scope' and source.payload->'model'=e->'model' and source.payload->>'at'=e->>'occurredAt'
+  and (source.payload->>'costUsd')::float8=alma_batch_price(e,new.input->'evidence'->'usage')
+  and source.payload->>'serviceTier'='batch' and source.payload->'usage'=new.input->'evidence'->'usage'
+  and source.payload->'consumers'=e->'governance'->'consumers'
+  and source.request->>'policyVersion'=e->>'policyVersion' and source.request->'caps'=e->'governance'->'caps'
+  and not(source.payload ? 'parentCallId')) is not true then raise exception 'Invalid batch financial association' using errcode='23514';end if;
+ if source.payload->'providerRequestId' is distinct from new.input->'providerRequestId' then raise exception 'Invalid provider reference' using errcode='23514';end if;
+ foreach field in array array['sessionId','operationId','attemptId','callId','priceVersion'] loop
+  if (source.payload->>field=e->>field) is not true then raise exception 'Invalid financial identity' using errcode='23514';end if;
+ end loop;return new;
+end $validate$;
+do $trigger$ begin
+ if not exists(select from pg_trigger where tgrelid='alma_batch_usage'::regclass and tgname='alma_batch_usage_validate') then
+  create trigger alma_batch_usage_validate before insert or update on alma_batch_usage for each row execute function alma_batch_usage_validate();
+ end if;
+end $trigger$;
+${rlsPolicySql5("alma_batch_usage")}
+grant select,insert,update on alma_batch_usage to ${role};
+${functionPathSql6("alma_batch_usage_shape(jsonb)", "alma_batch_usage_validate()")}
+`;
+}
+async function migrateBatchUsageStore(pool, opts = {}) {
+  await pool.query(batchUsageMigrationSql(opts.role));
+}
+
+// src/batch-accounting.ts
+import { ExecutionConflictError as ExecutionConflictError5, ExecutionStateError as ExecutionStateError5, settlementIdentifier as id5, settlementScope as settlementScope5 } from "@alma-harness/core";
+import { bindBatchAccounting, batchFinancialReceipt, batchFinancialWarnings, normalizeBatchFinancialReceipt, operationCallQuery as operationCallQuery3 } from "@alma-harness/execution";
+import { inScope as inScope5, resolveRlsRole as resolveRlsRole5, resolveStatementTimeout as resolveStatementTimeout5 } from "@alma-harness/postgres";
+var PostgresBatchAccountingStore = class {
+  constructor(pool, opts = {}) {
+    this.pool = pool;
+    this.#role = resolveRlsRole5(opts);
+    this.#timeout = resolveStatementTimeout5(opts);
+    this.#batches = new PostgresBatchSubmissionStore(pool, opts);
+    this.#usage = new PostgresBatchUsageStore(pool, opts);
+  }
+  pool;
+  #role;
+  #timeout;
+  #batches;
+  #usage;
+  async #scope(s, fn) {
+    try {
+      return await inScope5(this.pool, this.#role, s, fn, this.#timeout);
+    } catch (e) {
+      if (["23505", "23514", "23503"].includes(e.code ?? "")) throw new ExecutionConflictError5();
+      throw e;
+    }
+  }
+  async record(scope, batchKey, observationId) {
+    const s = settlementScope5(scope), k = id5(batchKey), i = id5(observationId), batch = await this.#batches.get(s, k);
+    if (!batch) throw new ExecutionStateError5();
+    const value = await this.#usage.get(s, k, i);
+    if (!value) return { status: "pending" };
+    const source = bindBatchAccounting(batch, value);
+    if (!source.receipt) return { status: "pending" };
+    return this.#scope(s, async (c) => {
+      const args = [s.org, s.uid, k];
+      await c.query("select key from alma_batch_submissions where org=$1 and uid=$2 and key=$3 for update", args);
+      const old = (await c.query("select receipt from alma_batch_financial_items where org=$1 and uid=$2 and batch_key=$3 and item_id=$4", [...args, source.input.itemId])).rows[0];
+      if (old) return { status: "replayed", receipt: normalizeBatchFinancialReceipt(old.receipt) };
+      const previous = (await c.query("select receipt from alma_batch_financial_items where org=$1 and uid=$2 and batch_key=$3 order by ordinal desc limit 1", args)).rows[0];
+      const warned = (await c.query("select cap from alma_batch_warnings where org=$1 and uid=$2 and batch_key=$3", args)).rows.map((r) => r.cap);
+      const now = (await c.query("select clock_timestamp() at")).rows[0].at.toISOString();
+      const receipt3 = batchFinancialReceipt(batch, source, previous ? normalizeBatchFinancialReceipt(previous.receipt) : void 0, warned, now);
+      await c.query("insert into alma_batch_financial_items(org,uid,batch_key,item_id,observation_id,ordinal,receipt) values($1,$2,$3,$4,$5,$6,$7::jsonb)", [...args, receipt3.itemId, i, receipt3.accountingOrdinal, JSON.stringify(receipt3)]);
+      return { status: "applied", receipt: receipt3 };
+    });
+  }
+  async get(scope, batchKey) {
+    const s = settlementScope5(scope), k = id5(batchKey), batch = await this.#batches.get(s, k);
+    if (!batch) return null;
+    return this.#scope(s, async (c) => {
+      const args = [s.org, s.uid, k], state = (await c.query("select state from alma_batch_submissions where org=$1 and uid=$2 and key=$3 for share", args)).rows[0].state;
+      const last = (await c.query("select receipt from alma_batch_financial_items where org=$1 and uid=$2 and batch_key=$3 order by ordinal desc limit 1", args)).rows[0];
+      const rows = (await c.query("select f.receipt,w.cap from alma_batch_warnings w join alma_batch_financial_items f on (f.org,f.uid,f.batch_key,f.item_id)=(w.org,w.uid,w.batch_key,w.item_id) where w.org=$1 and w.uid=$2 and w.batch_key=$3 order by f.ordinal,w.cap", args)).rows;
+      const warnings = rows.map((r) => {
+        const w = batchFinancialWarnings(s, r.receipt).find((w2) => w2.cap === r.cap);
+        if (!w) throw new ExecutionConflictError5();
+        return w;
+      });
+      const receipt3 = last ? normalizeBatchFinancialReceipt(last.receipt) : void 0;
+      return { batchId: batch.input.id, costUsd: receipt3?.currentUsd ?? 0, expectedItems: batch.input.items.length, accountedItems: receipt3?.accountingOrdinal ?? 0, batchState: state, warnings };
+    });
+  }
+  async list(scope, batchKey, query) {
+    const s = settlementScope5(scope), k = id5(batchKey), q = operationCallQuery3(query);
+    return this.#scope(s, async (c) => (await c.query("select receipt from alma_batch_financial_items where org=$1 and uid=$2 and batch_key=$3 and ordinal>$4 order by ordinal limit $5", [s.org, s.uid, k, q.afterOrdinal, q.limit])).rows.map((r) => normalizeBatchFinancialReceipt(r.receipt)));
+  }
+};
+
+// src/batch-accounting-schema.ts
+import { functionPathSql as functionPathSql7 } from "@alma-harness/postgres";
+import { assertRoleIdentifier as assertRoleIdentifier7, DEFAULT_RLS_ROLE as DEFAULT_RLS_ROLE6, rlsPolicySql as rlsPolicySql6 } from "@alma-harness/postgres";
+function batchAccountingMigrationSql(role = DEFAULT_RLS_ROLE6) {
+  assertRoleIdentifier7(role);
+  return `${batchUsageMigrationSql(role)}
+create table if not exists alma_batch_financial_items (
+ org text not null,uid text not null,batch_key text not null,item_id text not null,observation_id text not null,
+ ordinal int not null check(ordinal between 1 and 512),receipt jsonb not null,
+ primary key(org,uid,batch_key,item_id),unique(org,uid,batch_key,ordinal),
+ foreign key(org,uid,batch_key,item_id) references alma_batch_items(org,uid,batch_key,item_id),
+ foreign key(org,uid,batch_key,observation_id) references alma_batch_usage(org,uid,batch_key,id)
+);
+create table if not exists alma_batch_warnings (
+ org text not null,uid text not null,batch_key text not null,cap text not null check(cap in ('perTurnUsd','perSessionUsd','perTenantDayUsd')),item_id text not null,
+ primary key(org,uid,batch_key,cap),foreign key(org,uid,batch_key,item_id) references alma_batch_financial_items(org,uid,batch_key,item_id)
+);
+create or replace function alma_batch_financial_validate() returns trigger language plpgsql as $financial$
+declare batch alma_batch_submissions%rowtype; member alma_batch_items%rowtype; prior alma_batch_financial_items%rowtype;
+ source record; r jsonb; before_usd double precision; cost double precision; after_usd double precision; expected jsonb; warnings jsonb; field text;
+begin
+ select * into batch from alma_batch_submissions where org=new.org and uid=new.uid and key=new.batch_key for update;
+ select * into member from alma_batch_items where org=new.org and uid=new.uid and batch_key=new.batch_key and item_id=new.item_id;
+ select * into prior from alma_batch_financial_items where org=new.org and uid=new.uid and batch_key=new.batch_key order by ordinal desc limit 1;
+ select u.item_id,c.settlement_payload payload,g.decisions into source from alma_batch_usage u
+  join alma_audit_cost c on (c.org,c.uid,c.id)=(u.org,u.uid,u.cost_id) join alma_governed_cost g on (g.org,g.uid,g.cost_id)=(c.org,c.uid,c.id)
+  where u.org=new.org and u.uid=new.uid and u.batch_key=new.batch_key and u.id=new.observation_id;
+ r=new.receipt;before_usd=coalesce((prior.receipt->>'currentUsd')::float8,0);cost=(source.payload->>'costUsd')::float8;after_usd=before_usd+cost;
+ foreach field in array array['batchId','itemId','callId','settlementId','recordedAt'] loop
+  if jsonb_typeof(r->field) is distinct from 'string' then raise exception 'Invalid financial string' using errcode='23514';end if;
+ end loop;
+ foreach field in array array['accountingOrdinal','reservationOrdinal','costUsd','previousUsd','currentUsd'] loop
+  if jsonb_typeof(r->field) is distinct from 'number' then raise exception 'Invalid financial amount' using errcode='23514';end if;
+ end loop;
+ if (source.item_id=new.item_id and source.payload is not null and batch.id is not null
+  and jsonb_typeof(r)='object' and r ?& array['batchId','itemId','callId','settlementId','accountingOrdinal','reservationOrdinal','costUsd','previousUsd','currentUsd','decisions','newWarnings','recordedAt']
+  and (r-array['batchId','itemId','callId','settlementId','accountingOrdinal','reservationOrdinal','costUsd','previousUsd','currentUsd','decisions','newWarnings','recordedAt'])='{}'::jsonb
+  and r->>'batchId'=batch.id and r->>'itemId'=new.item_id and r->>'callId'=member.call_id and r->>'settlementId'=member.settlement_id
+  and new.ordinal=coalesce(prior.ordinal,0)+1 and (r->>'accountingOrdinal')::numeric=new.ordinal and (r->>'reservationOrdinal')::numeric=member.ordinal
+  and (r->>'previousUsd')::float8=before_usd and (r->>'costUsd')::float8=cost and (r->>'currentUsd')::float8=after_usd and after_usd<'Infinity'::float8
+  and to_char((r->>'recordedAt')::timestamptz at time zone 'UTC','YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')=r->>'recordedAt'
+  and isfinite((r->>'recordedAt')::timestamptz) and r->>'recordedAt' ~ '^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}[.][0-9]{3}Z$') is not true then raise exception 'Invalid batch financial binding' using errcode='23514';end if;
+ select coalesce(jsonb_agg(case when d->>'cap'='perTurnUsd' then d||jsonb_build_object('previousUsd',before_usd,'currentUsd',after_usd,'exceeded',after_usd>(d->>'thresholdUsd')::float8) else d end order by n),'[]'::jsonb) into expected from jsonb_array_elements(source.decisions) with ordinality as x(d,n);
+ if r->'decisions' is distinct from expected then raise exception 'Invalid batch financial decisions' using errcode='23514';end if;
+ select coalesce(jsonb_agg(d->>'cap' order by n),'[]'::jsonb) into warnings from jsonb_array_elements(expected) with ordinality as x(d,n)
+  where d->>'onExceeded'='warn' and (d->>'exceeded')::boolean and not exists(select from alma_batch_warnings w where w.org=new.org and w.uid=new.uid and w.batch_key=new.batch_key and w.cap=d->>'cap');
+ if r->'newWarnings' is distinct from warnings then raise exception 'Invalid batch warning receipt' using errcode='23514';end if;
+ return new;
+end $financial$;
+create or replace function alma_batch_financial_warn() returns trigger language plpgsql as $warn$
+begin
+ insert into alma_batch_warnings(org,uid,batch_key,cap,item_id) select new.org,new.uid,new.batch_key,value,new.item_id from jsonb_array_elements_text(new.receipt->'newWarnings');return new;
+end $warn$;
+create or replace function alma_batch_warning_validate() returns trigger language plpgsql as $warning$
+begin
+ if not exists(select from alma_batch_financial_items where org=new.org and uid=new.uid and batch_key=new.batch_key and item_id=new.item_id and receipt->'newWarnings' ? new.cap) then raise exception 'Invalid batch warning association' using errcode='23514';end if;return new;
+end $warning$;
+do $triggers$ begin
+ if not exists(select from pg_trigger where tgrelid='alma_batch_financial_items'::regclass and tgname='alma_batch_financial_validate') then
+  create trigger alma_batch_financial_validate before insert on alma_batch_financial_items for each row execute function alma_batch_financial_validate();
+  create trigger alma_batch_financial_warn after insert on alma_batch_financial_items for each row execute function alma_batch_financial_warn();
+ end if;
+ if not exists(select from pg_trigger where tgrelid='alma_batch_warnings'::regclass and tgname='alma_batch_warning_validate') then
+  create trigger alma_batch_warning_validate before insert on alma_batch_warnings for each row execute function alma_batch_warning_validate();
+ end if;
+end $triggers$;
+${rlsPolicySql6("alma_batch_financial_items")}${rlsPolicySql6("alma_batch_warnings")}
+grant select,insert on alma_batch_financial_items,alma_batch_warnings to ${role};
+${functionPathSql7("alma_batch_financial_validate()", "alma_batch_financial_warn()", "alma_batch_warning_validate()")}
+`;
+}
+async function migrateBatchAccountingStore(pool, opts = {}) {
+  await pool.query(batchAccountingMigrationSql(opts.role));
+}
+
+// src/index.ts
+var at = async (c) => (await c.query("select clock_timestamp() at")).rows[0].at.toISOString();
+var PostgresOperationTreeStore = class {
+  constructor(pool, opts = {}) {
+    this.pool = pool;
+    this.#role = resolveRlsRole6(opts);
+    this.#timeout = resolveStatementTimeout6(opts);
+  }
+  pool;
+  #role;
+  #timeout;
+  async #scope(scope, fn) {
+    try {
+      return await inScope6(this.pool, this.#role, scope, fn, this.#timeout);
+    } catch (e) {
+      const code = e.code;
+      if (code === "23505") throw new ExecutionConflictError6();
+      if (code === "23503" || code === "23514") throw new ExecutionStateError6();
+      throw e;
+    }
+  }
+  async #read(c, scope, key, lock = false) {
+    return (await c.query(`select ${ROOT}${lock ? ",token" : ""} from alma_operation_roots where org=$1 and uid=$2 and key=$3${lock ? " for update" : ""}`, [scope.org, scope.uid, key])).rows[0];
+  }
+  async claim(value) {
+    const i = normalizeOperationRoot3(value);
+    return this.#scope(i.scope, async (c) => {
+      let row = await this.#read(c, i.scope, i.key, true);
+      if (!row) {
+        checkOperationDeadline2(i, await at(c));
+        row = (await c.query(`insert into alma_operation_roots(org,uid,key,id,session_id,policy_version,caps,max_sensitivity,deadline_at,max_calls,status,token,created_at,updated_at,request)
+          values($1,$2,$3,$4,$5,$6,$7::jsonb,$8,$9::timestamptz,$10,'active',$11,clock_timestamp(),clock_timestamp(),$12::jsonb)
+          on conflict(org,uid,key) do nothing returning ${ROOT},token`, [i.scope.org, i.scope.uid, i.key, i.id, i.sessionId, i.policyVersion, JSON.stringify(i.caps), i.maxSensitivity, i.deadlineAt, i.maxCalls, crypto.randomUUID(), i.request ? JSON.stringify(i.request) : null])).rows[0];
+        if (row) {
+          checkOperationDeadline2(i, await at(c));
+          return { status: "claimed", record: record(row), fence: { scope: { ...i.scope }, key: i.key, id: i.id, token: row.token } };
+        }
+        row = await this.#read(c, i.scope, i.key, true);
+      }
+      if (!row || !equalExecution4(record(row).input, i)) throw new ExecutionConflictError6();
+      return { status: "existing", record: record(row) };
+    });
+  }
+  async #authorize(c, f, closing = false) {
+    const r = await this.#read(c, f.scope, f.key, true);
+    if (!r || r.id !== f.id || r.token !== f.token) throw new ExecutionStateError6();
+    if (closing && r.status === "closed") return r;
+    if (r.status !== "active" || r.deadline_at.toISOString() <= await at(c)) throw new ExecutionStateError6();
+    return r;
+  }
+  async reserve(value, request) {
+    const f = normalizeOperationFence(value), input = normalizeOperationCall2(request);
+    return this.#scope(f.scope, async (c) => {
+      const r = await this.#authorize(c, f);
+      checkOperationCall(record(r).input, input);
+      const old = (await c.query("select * from alma_operation_calls where org=$1 and uid=$2 and root_id=$3 and slot=$4", [f.scope.org, f.scope.uid, f.id, input.slot])).rows[0];
+      if (old) {
+        if (!equalExecution4(call(old).input, input)) throw new ExecutionConflictError6();
+        return call(old);
+      }
+      if (r.call_count >= r.max_calls) throw new ExecutionStateError6();
+      const e = input.execution;
+      const row = (await c.query(`insert into alma_operation_calls(org,uid,root_id,slot,ordinal,kind,parent_call_id,call_id,settlement_id,operation_key,input,reserved_at)
+        values($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,clock_timestamp()) returning *`, [f.scope.org, f.scope.uid, f.id, input.slot, r.call_count + 1, input.kind, input.parentCallId ?? null, e.callId, e.settlementId, e.operationKey, JSON.stringify(e)])).rows[0];
+      return call(row);
+    });
+  }
+  async close(value) {
+    const f = normalizeOperationFence(value);
+    return this.#scope(f.scope, async (c) => {
+      const row = await this.#authorize(c, f, true);
+      if (row.status === "closed") return record(row);
+      return record((await c.query(`update alma_operation_roots set status='closed',updated_at=clock_timestamp() where org=$1 and uid=$2 and key=$3 returning ${ROOT}`, [f.scope.org, f.scope.uid, f.key])).rows[0]);
+    });
+  }
+  async get(scope, identity) {
+    const s = settlementScope6(scope), k = id6(identity);
+    return this.#scope(s, async (c) => {
+      const row = await this.#read(c, s, k);
+      return row ? record(row) : null;
+    });
+  }
+  async listCalls(scope, identity, query) {
+    const s = settlementScope6(scope), k = id6(identity), q = operationCallQuery4(query);
+    return this.#scope(s, async (c) => (await c.query(`select c.* from alma_operation_calls c join alma_operation_roots r on (r.org,r.uid,r.id)=(c.org,c.uid,c.root_id)
+      where r.org=$1 and r.uid=$2 and r.key=$3 and c.ordinal>$4 order by c.ordinal limit $5`, [s.org, s.uid, k, q.afterOrdinal, q.limit])).rows.map(call));
+  }
+  async reconcileExpired(scope, opts = {}) {
+    const s = settlementScope6(scope), limit = settlementLimit2(opts.limit);
+    return this.#scope(s, async (c) => {
+      const rows = (await c.query(`select ${ROOT} from alma_operation_roots where org=$1 and uid=$2 and status='active' and deadline_at<=clock_timestamp() order by deadline_at,key limit $3 for update skip locked`, [s.org, s.uid, limit])).rows;
+      const results = [];
+      for (const r of rows) results.push(record((await c.query(`update alma_operation_roots set status='reconciliation_required',updated_at=clock_timestamp() where org=$1 and uid=$2 and key=$3 returning ${ROOT}`, [s.org, s.uid, r.key])).rows[0]));
+      return results;
+    });
+  }
+};
+export {
+  PostgresBatchAccountingStore,
+  PostgresBatchSubmissionStore,
+  PostgresBatchUsageStore,
+  PostgresOperationAccountingStore,
+  PostgresOperationSessionStore,
+  PostgresOperationTreeStore,
+  batchAccountingMigrationSql,
+  batchSubmissionMigrationSql,
+  batchUsageMigrationSql,
+  migrateBatchAccountingStore,
+  migrateBatchSubmissionStore,
+  migrateBatchUsageStore,
+  migrateOperationAccountingStore,
+  migrateOperationSessionStore,
+  migrateOperationTreeStore,
+  operationAccountingMigrationSql,
+  operationSessionMigrationSql,
+  operationTreeMigrationSql
+};
+//# sourceMappingURL=index.js.map