@burdenoff/be-sdk 2026.1005.1 → 2026.1006.1

package/README.md

@@ -204,3 +204,67 @@ PROPRIETARY - Copyright Burdenoff Consultancy Services Pvt. Ltd.
 ## Support
 
 For support, email contact@burdenoff.com or visit [https://burdenoff.com/support](https://burdenoff.com/support).
+
+## Shared DuckLake dataset contract (BOFF-8254)
+
+The DuckLake catalog PostgreSQL database owns `shared_lake_datasets` and
+`shared_lake_dataset_consumers` (migration in `prisma/lake-registry/`).
+`dataset_id` is the existing BigConsole sink UUID, `metadata_schema` is
+`dl_<UUID with underscores>`, and the S3 prefix stays
+`datasinks/<dataset_id>/`. BigConsole's service database continues to own the
+ingest watermark and dashboard payload behavior; it mirrors legacy metadata
+to this registry. Run its idempotent `scripts/backfill-shared-lake-registry.ts`
+after the catalog migration, then let normal writes keep it current.
+
+Legacy `payload_versions` and `payload_elements` are JSON dashboard data, not
+an operational TimeCampus contract. A product owner adds a typed table in the
+same catalog schema (or a new dataset), with non-null `workspace_id` and
+nullable `product_id`. A null `product_id` explicitly marks a row shared with
+all **approved** dataset consumers. Product-specific rows carry their product
+slug. Readers use both `workspace_id` and `(product_id = consumer OR
+product_id IS NULL)` in every query. Column names and types are versioned by
+`schema_version`; an incompatible change requires a new version/table and a
+staged consumer migration. A single designated owner writes each typed table;
+readers never write. Owners serialize commits and update
+`last_committed_version` only after the lake transaction succeeds. Add DuckLake
+product/date partitions only after file-size and query-profile evidence shows
+that pruning is useful; partitions are a performance choice, not an access
+control mechanism.
+
+The first TimeCampus GraphQL operation exposes only typed `time_entries`
+tables classified L1 or L2. Other approved datasets remain service-only until
+their fields and end-user RBAC are reviewed explicitly.
+
+Rollout for a TimeCampus grant:
+
+1. Apply `bun run lake:registry:migrate` against the catalog with
+   `DUCKLAKE_REGISTRY_MIGRATION_URL`. Backfill existing BigConsole sinks.
+2. Create the typed table and a representative fixture in alpha, validate
+   workspace/product columns and version, then call `registerTyped` with the
+   original sink ID/routing and `lifecycle: 'ready'`. BigConsole continues using
+   its legacy payload tables in the same schema.
+3. Add the dataset UUID to `timecampus_ducklake_dataset_ids.alpha` in
+   `tf-aws-cloud/roots/secrets`, review/apply the S3 policy through IaC, and
+   provision a separate static access key in the TimeCampus Secrets Manager
+   bundle. The TimeCampus catalog login must be a member of the
+   `boff_timecampus_lake_reader` role; put its read-only URL in
+   `DUCKLAKE_CATALOG_URL`. Add `DUCKLAKE_S3_BUCKET`,
+   `DUCKLAKE_S3_ACCESS_KEY_ID`, and `DUCKLAKE_S3_SECRET_ACCESS_KEY` to the same
+   bundle. The workload already imports its bundle through GitOps.
+4. Run `bun run lake:grant:timecampus` with the approved `LAKE_DATASET_ID` and
+   `LAKE_GRANT_ACTOR`. This grants catalog schema SELECT and activates the
+   product grant. The approved view prevents TimeCampus's catalog login from
+   reading the unfiltered registry tables. The IAM key can read only the
+   reviewed S3 prefix. Validate discovery, direct read, denied guessed ID, and
+   mixed-product rows with
+   `timecampus-doctor/wspace/modules/timecampus/scripts/test-timecampus.sh --test lake`
+   in alpha; then
+   repeat the reviewed grant and validation in prod.
+
+To adopt a second product, add its own catalog view and NOLOGIN reader role,
+per-dataset PostgreSQL schema grants, IAM principal/prefix policy, Secrets
+Manager bundle values, and service using `LakeDatasetRegistry` plus
+`AuthorizedLakeReader`. Grant revocation must use
+`LAKE_GRANT_ACTION=revoke bun run lake:grant:timecampus`, remove the dataset
+UUID from the Terraform S3 policy, and rotate credentials if a removed product
+previously held them. Do not share BigConsole's broad lake credentials.

package/dist/index.js

@@ -1,19 +1,19 @@
+export { sharing_exports as Sharing } from './chunk-DS3YMJ4X.js';
 export { TemporalClient, TemporalClientFactory, TemporalModule, TemporalWorker, TemporalWorkerFactory, TemporalWorkerManager } from './chunk-YNDJQRI3.js';
 import { ActivityModule, UsageModule, TrackerModule } from './chunk-NCC5UN3L.js';
 export { ActivityModule, TrackerModule, UsageModule } from './chunk-NCC5UN3L.js';
 export { NAME_MAX_LENGTH, NAME_MIN_LENGTH, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, validation_exports as Validation, lengthInCodePoints, validateName, validateUserFields, validateUsername } from './chunk-AHEXIONU.js';
+export { observability_exports as Observability } from './chunk-VAT66FJA.js';
 export { platform_exports as Platform } from './chunk-Z5BURBFZ.js';
 export { prisma_exports as Prisma } from './chunk-CVMQRWCB.js';
 export { PRODUCT_RENAMES, PRODUCT_RENAME_EMIT, PRODUCT_SLUG_ALIASES, product_alias_exports as ProductAlias, RENAME_CONCERNS, billingIdVariants, emitBillingId, emitName, emitProductSlug, emitQuotaKey, emitRbacResource, emitTemplateKey, isLegacyName, isSameBillingId, isSameGraphQLName, isSameName, isSameProductSlug, isSameQuotaKey, isSameRbacResource, isSameTemplateKey, nameVariants, normalizeBillingId, normalizeGraphQLName, normalizeProductSlug, normalizeQuotaKey, normalizeRbacResource, normalizeTemplateKey, productSlugVariants, quotaKeyVariants, rbacResourceVariants, readRenamedEnv, templateKeyVariants, toCurrentName, toLegacyName } from './chunk-OBBCR6WY.js';
 import { RBACModule } from './chunk-5JNHVKHG.js';
 export { RBACModule, createRBACDirective, createRBACDirectiveForLayer, createRBACDirectiveFromEnv } from './chunk-5JNHVKHG.js';
 import './chunk-FA5ROGTS.js';
-export { sharing_exports as Sharing } from './chunk-DS3YMJ4X.js';
 export { instrumentation_exports as Instrumentation } from './chunk-E5DTAGCA.js';
 export { middleware_exports as Middleware } from './chunk-ELU7VL3E.js';
 import { TenantNotificationsModule, NotificationsModule } from './chunk-INAZ3PKF.js';
 export { tenant_notifications_exports as Notifications, NotificationsModule } from './chunk-INAZ3PKF.js';
-export { observability_exports as Observability } from './chunk-VAT66FJA.js';
 export { export_exports as Export } from './chunk-RFXAHMY4.js';
 export { feature_flags_exports as FeatureFlags } from './chunk-UNASM5VJ.js';
 import { GraphModule } from './chunk-VVBA3LQV.js';

package/dist/lake/index.d.ts

@@ -0,0 +1,59 @@
+import { Pool } from 'pg';
+
+type DatasetLifecycle = 'provisioning' | 'ready' | 'archived';
+type DatasetRepresentation = 'legacy_payload' | 'typed_table';
+type DatasetClassification = 'L1_PUBLIC' | 'L2_INTERNAL' | 'L3_CONFIDENTIAL' | 'L4_REGULATED';
+interface LakeDataset {
+    datasetId: string;
+    workspaceId: string;
+    datasetKey: string;
+    ownerProduct: string;
+    sourceProduct: string;
+    metadataSchema: string;
+    dataPath: string;
+    representation: DatasetRepresentation;
+    typedTable: string | null;
+    rowProductColumn: string | null;
+    schemaVersion: number;
+    classification: DatasetClassification;
+    lifecycle: DatasetLifecycle;
+    lastCommittedVersion: number;
+}
+interface RegisterLakeDatasetInput extends Omit<LakeDataset, 'lifecycle' | 'lastCommittedVersion'> {
+    lifecycle?: DatasetLifecycle;
+    lastCommittedVersion?: number;
+}
+declare function validateLakeDatasetIdentity(dataset: Pick<LakeDataset, 'datasetId' | 'workspaceId' | 'datasetKey' | 'ownerProduct' | 'sourceProduct' | 'metadataSchema' | 'dataPath' | 'typedTable' | 'rowProductColumn' | 'representation'>): void;
+declare class LakeDatasetRegistry {
+    private readonly db;
+    private readonly approvedView;
+    constructor(db: Pool, approvedView?: 'shared_lake_timecampus_approved' | null);
+    private approvedSource;
+    private approvalPredicate;
+    private approvalCheck;
+    getApprovedById(workspaceId: string, productId: string, datasetId: string): Promise<LakeDataset | null>;
+    getApprovedByKey(workspaceId: string, productId: string, datasetKey: string): Promise<LakeDataset | null>;
+    listApproved(workspaceId: string, productId: string, limit?: number): Promise<LakeDataset[]>;
+    registerLegacy(input: RegisterLakeDatasetInput, actorId: string): Promise<void>;
+    registerTyped(input: RegisterLakeDatasetInput, actorId: string): Promise<void>;
+    grantConsumer(datasetId: string, productId: string, actorId: string): Promise<void>;
+}
+
+interface LakeReadExecutor {
+    queryReadOnly(dataset: LakeDataset, sql: string, parameters: readonly (string | number)[]): Promise<Record<string, unknown>[]>;
+}
+interface LakeReadPage {
+    datasetId: string;
+    schemaVersion: number;
+    lastCommittedVersion: number;
+    rows: Record<string, unknown>[];
+}
+declare class AuthorizedLakeReader {
+    private readonly registry;
+    private readonly executor;
+    private readonly productId;
+    constructor(registry: LakeDatasetRegistry, executor: LakeReadExecutor, productId: string);
+    readRows(workspaceId: string, datasetId: string, limit?: number, offset?: number): Promise<LakeReadPage | null>;
+}
+
+export { AuthorizedLakeReader, type DatasetClassification, type DatasetLifecycle, type DatasetRepresentation, type LakeDataset, LakeDatasetRegistry, type LakeReadExecutor, type LakeReadPage, type RegisterLakeDatasetInput, validateLakeDatasetIdentity };

package/dist/lake/index.js

@@ -0,0 +1,253 @@
+import { __name } from '../chunk-XE4OXN2W.js';
+
+// src/lake/dataset-registry.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var PRODUCT_RE = /^[a-z][a-z0-9-]{0,63}$/;
+var KEY_RE = /^[^\x00-\x1f\x7f]{1,100}$/;
+var TABLE_RE = /^[a-z][a-z0-9_]{0,62}$/;
+function validateLakeDatasetIdentity(dataset) {
+  if (!UUID_RE.test(dataset.datasetId) || !UUID_RE.test(dataset.workspaceId)) throw new Error("Invalid dataset identity");
+  if (!KEY_RE.test(dataset.datasetKey)) throw new Error("Invalid dataset key");
+  if (!PRODUCT_RE.test(dataset.ownerProduct) || !PRODUCT_RE.test(dataset.sourceProduct)) {
+    throw new Error("Invalid dataset product");
+  }
+  const expectedSchema = `dl_${dataset.datasetId.replaceAll("-", "_")}`;
+  if (dataset.metadataSchema !== expectedSchema) throw new Error("Dataset catalog schema does not match its ID");
+  const path = new URL(dataset.dataPath);
+  if (path.protocol !== "s3:" || !path.hostname || path.pathname !== `/datasinks/${dataset.datasetId}/`) {
+    throw new Error("Dataset S3 path does not match its ID");
+  }
+  if (dataset.representation === "typed_table") {
+    if (!dataset.typedTable || !TABLE_RE.test(dataset.typedTable)) throw new Error("Invalid typed table");
+    if (dataset.rowProductColumn !== "product_id") throw new Error("Typed shared tables must use product_id");
+  } else if (dataset.typedTable || dataset.rowProductColumn) {
+    throw new Error("Legacy payload datasets cannot declare a typed table");
+  }
+}
+__name(validateLakeDatasetIdentity, "validateLakeDatasetIdentity");
+function toDataset(row) {
+  const dataset = {
+    datasetId: String(row["dataset_id"]),
+    workspaceId: String(row["workspace_id"]),
+    datasetKey: String(row["dataset_key"]),
+    ownerProduct: String(row["owner_product"]),
+    sourceProduct: String(row["source_product"]),
+    metadataSchema: String(row["metadata_schema"]),
+    dataPath: String(row["data_path"]),
+    representation: row["representation"],
+    typedTable: row["typed_table"] === null ? null : String(row["typed_table"]),
+    rowProductColumn: row["row_product_column"] === null ? null : String(row["row_product_column"]),
+    schemaVersion: Number(row["schema_version"]),
+    classification: row["classification"],
+    lifecycle: row["lifecycle"],
+    lastCommittedVersion: Number(row["last_committed_version"])
+  };
+  validateLakeDatasetIdentity(dataset);
+  return dataset;
+}
+__name(toDataset, "toDataset");
+var LakeDatasetRegistry = class {
+  static {
+    __name(this, "LakeDatasetRegistry");
+  }
+  db;
+  approvedView;
+  constructor(db, approvedView = null) {
+    this.db = db;
+    this.approvedView = approvedView;
+  }
+  approvedSource() {
+    return this.approvedView ? `${this.approvedView} d` : "shared_lake_datasets d JOIN shared_lake_dataset_consumers c ON c.dataset_id = d.dataset_id";
+  }
+  approvalPredicate() {
+    return this.approvedView ? "d.product_id" : "c.product_id";
+  }
+  approvalCheck() {
+    return this.approvedView ? "" : "AND c.can_read = true";
+  }
+  async getApprovedById(workspaceId, productId, datasetId) {
+    if (!UUID_RE.test(workspaceId) || !UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) return null;
+    const result = await this.db.query(`SELECT d.* FROM ${this.approvedSource()}
+        WHERE d.workspace_id = $1::uuid AND d.dataset_id = $2::uuid
+          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`, [
+      workspaceId,
+      datasetId,
+      productId
+    ]);
+    return result.rows[0] ? toDataset(result.rows[0]) : null;
+  }
+  async getApprovedByKey(workspaceId, productId, datasetKey) {
+    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId) || !KEY_RE.test(datasetKey)) return null;
+    const result = await this.db.query(`SELECT d.* FROM ${this.approvedSource()}
+        WHERE d.workspace_id = $1::uuid AND d.dataset_key = $2
+          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`, [
+      workspaceId,
+      datasetKey,
+      productId
+    ]);
+    return result.rows[0] ? toDataset(result.rows[0]) : null;
+  }
+  async listApproved(workspaceId, productId, limit = 100) {
+    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId)) return [];
+    const result = await this.db.query(`SELECT d.* FROM ${this.approvedSource()}
+        WHERE d.workspace_id = $1::uuid AND ${this.approvalPredicate()} = $2
+          ${this.approvalCheck()} AND d.lifecycle = 'ready'
+        ORDER BY d.dataset_key ASC LIMIT $3`, [
+      workspaceId,
+      productId,
+      Math.min(Math.max(limit, 1), 1e3)
+    ]);
+    return result.rows.map((row) => toDataset(row));
+  }
+  /** BigConsole's legacy sink registration: stable datasetId=sinkId and same Parquet prefix. */
+  async registerLegacy(input, actorId) {
+    validateLakeDatasetIdentity(input);
+    if (input.representation !== "legacy_payload" || input.ownerProduct !== "bigconsole") {
+      throw new Error("Only BigConsole legacy sinks may use registerLegacy");
+    }
+    const client = await this.db.connect();
+    try {
+      await client.query("BEGIN");
+      const written = await client.query(`INSERT INTO shared_lake_datasets
+          (dataset_id, workspace_id, dataset_key, owner_product, source_product,
+           metadata_schema, data_path, representation, typed_table, row_product_column,
+           schema_version, classification, lifecycle, last_committed_version, created_by, updated_by)
+         VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$15)
+         ON CONFLICT (dataset_id) DO UPDATE SET
+           dataset_key=EXCLUDED.dataset_key, metadata_schema=EXCLUDED.metadata_schema,
+           data_path=EXCLUDED.data_path, classification=EXCLUDED.classification,
+           lifecycle=EXCLUDED.lifecycle,
+           last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),
+           updated_by=EXCLUDED.updated_by, updated_at=now()
+         WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id
+           AND shared_lake_datasets.owner_product=EXCLUDED.owner_product
+           AND shared_lake_datasets.representation='legacy_payload'
+         RETURNING dataset_id`, [
+        input.datasetId,
+        input.workspaceId,
+        input.datasetKey,
+        input.ownerProduct,
+        input.sourceProduct,
+        input.metadataSchema,
+        input.dataPath,
+        input.representation,
+        null,
+        null,
+        input.schemaVersion,
+        input.classification,
+        input.lifecycle ?? "ready",
+        input.lastCommittedVersion ?? 0,
+        actorId
+      ]);
+      if (written.rowCount !== 1) throw new Error("Dataset identity conflicts with another owner or workspace");
+      await client.query(`INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)
+         VALUES ($1::uuid, 'bigconsole', true, true, $2)
+         ON CONFLICT (dataset_id, product_id) DO NOTHING`, [
+        input.datasetId,
+        actorId
+      ]);
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  /** Operator-only registration after the typed table and its physical grants exist. */
+  async registerTyped(input, actorId) {
+    validateLakeDatasetIdentity(input);
+    if (input.representation !== "typed_table" || !input.typedTable) throw new Error("A typed table is required");
+    const result = await this.db.query(`INSERT INTO shared_lake_datasets
+        (dataset_id, workspace_id, dataset_key, owner_product, source_product, metadata_schema,
+         data_path, representation, typed_table, row_product_column, schema_version,
+         classification, lifecycle, last_committed_version, created_by, updated_by)
+       VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,'typed_table',$8,'product_id',$9,$10,$11,$12,$13,$13)
+       ON CONFLICT (dataset_id) DO UPDATE SET
+         representation='typed_table', typed_table=EXCLUDED.typed_table,
+         row_product_column='product_id', source_product=EXCLUDED.source_product,
+         schema_version=EXCLUDED.schema_version,
+         classification=EXCLUDED.classification, lifecycle=EXCLUDED.lifecycle,
+         last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),
+         updated_by=EXCLUDED.updated_by, updated_at=now()
+       WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id
+         AND shared_lake_datasets.owner_product=EXCLUDED.owner_product
+         AND shared_lake_datasets.dataset_key=EXCLUDED.dataset_key
+         AND shared_lake_datasets.metadata_schema=EXCLUDED.metadata_schema
+         AND shared_lake_datasets.data_path=EXCLUDED.data_path
+       RETURNING dataset_id`, [
+      input.datasetId,
+      input.workspaceId,
+      input.datasetKey,
+      input.ownerProduct,
+      input.sourceProduct,
+      input.metadataSchema,
+      input.dataPath,
+      input.typedTable,
+      input.schemaVersion,
+      input.classification,
+      input.lifecycle ?? "provisioning",
+      input.lastCommittedVersion ?? 0,
+      actorId
+    ]);
+    if (result.rowCount !== 1) throw new Error("Typed dataset identity conflicts with existing routing");
+  }
+  /** Catalog grant is activated only after PostgreSQL and S3 grants are applied. */
+  async grantConsumer(datasetId, productId, actorId) {
+    if (!UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) throw new Error("Invalid consumer grant");
+    const result = await this.db.query(`INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)
+       SELECT d.dataset_id, $2, true, false, $3 FROM shared_lake_datasets d
+        WHERE d.dataset_id=$1::uuid AND d.representation='typed_table' AND d.lifecycle='ready'
+       ON CONFLICT (dataset_id, product_id) DO UPDATE SET
+         can_read=true, can_write=false, granted_by=EXCLUDED.granted_by, updated_at=now()
+       RETURNING dataset_id`, [
+      datasetId,
+      productId,
+      actorId
+    ]);
+    if (result.rowCount !== 1) throw new Error("Only ready typed datasets may be shared");
+  }
+};
+
+// src/lake/authorized-reader.ts
+var AuthorizedLakeReader = class {
+  static {
+    __name(this, "AuthorizedLakeReader");
+  }
+  registry;
+  executor;
+  productId;
+  constructor(registry, executor, productId) {
+    this.registry = registry;
+    this.executor = executor;
+    this.productId = productId;
+  }
+  async readRows(workspaceId, datasetId, limit = 100, offset = 0) {
+    const dataset = await this.registry.getApprovedById(workspaceId, this.productId, datasetId);
+    if (!dataset) return null;
+    if (dataset.representation !== "typed_table" || !dataset.typedTable || dataset.rowProductColumn !== "product_id") {
+      throw new Error("Dataset does not have an approved typed table");
+    }
+    if (!Number.isInteger(limit) || limit < 1 || limit > 1e3 || !Number.isInteger(offset) || offset < 0 || offset > 1e4) {
+      throw new Error("Invalid lake page");
+    }
+    const rows = await this.executor.queryReadOnly(dataset, `SELECT * FROM lake.${dataset.typedTable}
+        WHERE workspace_id = ? AND (product_id = ? OR product_id IS NULL)
+        LIMIT ? OFFSET ?`, [
+      workspaceId,
+      this.productId,
+      limit,
+      offset
+    ]);
+    return {
+      datasetId: dataset.datasetId,
+      schemaVersion: dataset.schemaVersion,
+      lastCommittedVersion: dataset.lastCommittedVersion,
+      rows
+    };
+  }
+};
+
+export { AuthorizedLakeReader, LakeDatasetRegistry, validateLakeDatasetIdentity };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/lake/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lake/dataset-registry.ts","../../src/lake/authorized-reader.ts"],"names":["UUID_RE","PRODUCT_RE","KEY_RE","TABLE_RE","validateLakeDatasetIdentity","dataset","test","datasetId","workspaceId","Error","datasetKey","ownerProduct","sourceProduct","expectedSchema","replaceAll","metadataSchema","path","URL","dataPath","protocol","hostname","pathname","representation","typedTable","rowProductColumn","toDataset","row","String","schemaVersion","Number","classification","lifecycle","lastCommittedVersion","LakeDatasetRegistry","db","approvedView","approvedSource","approvalPredicate","approvalCheck","getApprovedById","productId","result","query","rows","getApprovedByKey","listApproved","limit","Math","min","max","map","registerLegacy","input","actorId","client","connect","written","rowCount","error","release","registerTyped","grantConsumer","AuthorizedLakeReader","registry","executor","readRows","offset","isInteger","queryReadOnly"],"mappings":";;;AA4BA,IAAMA,OAAAA,GAAU,iEAAA;AAChB,IAAMC,UAAAA,GAAa,wBAAA;AACnB,IAAMC,MAAAA,GAAS,2BAAA;AACf,IAAMC,QAAAA,GAAW,wBAAA;AAEV,SAASC,4BACdC,OAAAA,EAYC;AAED,EAAA,IAAI,CAACL,OAAAA,CAAQM,IAAAA,CAAKD,OAAAA,CAAQE,SAAS,CAAA,IAAK,CAACP,OAAAA,CAAQM,IAAAA,CAAKD,QAAQG,WAAW,CAAA,EACvE,MAAM,IAAIC,MAAM,0BAAA,CAAA;AAClB,EAAA,IAAI,CAACP,OAAOI,IAAAA,CAAKD,OAAAA,CAAQK,UAAU,CAAA,EAAG,MAAM,IAAID,KAAAA,CAAM,qBAAA,CAAA;AACtD,EAAA,IAAI,CAACR,UAAAA,CAAWK,IAAAA,CAAKD,OAAAA,CAAQM,YAAY,CAAA,IAAK,CAACV,UAAAA,CAAWK,IAAAA,CAAKD,OAAAA,CAAQO,aAAa,CAAA,EAAG;AACrF,IAAA,MAAM,IAAIH,MAAM,yBAAA,CAAA;AAClB,EAAA;AACA,EAAA,MAAMI,iBAAiB,CAAA,GAAA,EAAMR,OAAAA,CAAQE,UAAUO,UAAAA,CAAW,GAAA,EAAK,GAAA,CAAA,CAAA,CAAA;AAC/D,EAAA,IAAIT,QAAQU,cAAAA,KAAmBF,cAAAA,EAAgB,MAAM,IAAIJ,MAAM,8CAAA,CAAA;AAC/D,EAAA,MAAMO,IAAAA,GAAO,IAAIC,GAAAA,CAAIZ,OAAAA,CAAQa,QAAQ,CAAA;AACrC,EAAA,IAAIF,IAAAA,CAAKG,QAAAA,KAAa,KAAA,IAAS,CAACH,IAAAA,CAAKI,QAAAA,IAAYJ,IAAAA,CAAKK,QAAAA,KAAa,CAAA,WAAA,EAAchB,OAAAA,CAAQE,SAAS,CAAA,CAAA,CAAA,EAAK;AACrG,IAAA,MAAM,IAAIE,MAAM,uCAAA,CAAA;AAClB,EAAA;AACA,EAAA,IAAIJ,OAAAA,CAAQiB,mBAAmB,aAAA,EAAe;AAC5C,IAAA,IAAI,CAACjB,OAAAA,CAAQkB,UAAAA,IAAc,CAACpB,QAAAA,CAASG,IAAAA,CAAKD,OAAAA,CAAQkB,UAAU,CAAA,EAAG,MAAM,IAAId,KAAAA,CAAM,qBAAA,CAAA;AAC/E,IAAA,IAAIJ,QAAQmB,gBAAAA,KAAqB,YAAA,EAAc,MAAM,IAAIf,MAAM,yCAAA,CAAA;EACjE,CAAA,MAAA,IAAWJ,OAAAA,CAAQkB,UAAAA,IAAclB,OAAAA,CAAQmB,gBAAAA,EAAkB;AACzD,IAAA,MAAM,IAAIf,MAAM,sDAAA,CAAA;AAClB,EAAA;AACF;AAjCgBL,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AAmChB,SAASqB,UAAUC,GAAAA,EAA4B;AAC7C,EAAA,MAAMrB,OAAAA,GAAuB;IAC3BE,SAAAA,EAAWoB,MAAAA,CAAOD,GAAAA,CAAI,YAAA,CAAa,CAAA;IACnClB,WAAAA,EAAamB,MAAAA,CAAOD,GAAAA,CAAI,cAAA,CAAe,CAAA;IACvChB,UAAAA,EAAYiB,MAAAA,CAAOD,GAAAA,CAAI,aAAA,CAAc,CAAA;IACrCf,YAAAA,EAAcgB,MAAAA,CAAOD,GAAAA,CAAI,eAAA,CAAgB,CAAA;IACzCd,aAAAA,EAAee,MAAAA,CAAOD,GAAAA,CAAI,gBAAA,CAAiB,CAAA;IAC3CX,cAAAA,EAAgBY,MAAAA,CAAOD,GAAAA,CAAI,iBAAA,CAAkB,CAAA;IAC7CR,QAAAA,EAAUS,MAAAA,CAAOD,GAAAA,CAAI,WAAA,CAAY,CAAA;AACjCJ,IAAAA,cAAAA,EAAgBI,IAAI,gBAAA,CAAA;IACpBH,UAAAA,EAAYG,GAAAA,CAAI,aAAA,CAAA,KAAmB,IAAA,GAAO,OAAOC,MAAAA,CAAOD,GAAAA,CAAI,aAAA,CAAc,CAAA;IAC1EF,gBAAAA,EAAkBE,GAAAA,CAAI,oBAAA,CAAA,KAA0B,IAAA,GAAO,OAAOC,MAAAA,CAAOD,GAAAA,CAAI,oBAAA,CAAqB,CAAA;IAC9FE,aAAAA,EAAeC,MAAAA,CAAOH,GAAAA,CAAI,gBAAA,CAAiB,CAAA;AAC3CI,IAAAA,cAAAA,EAAgBJ,IAAI,gBAAA,CAAA;AACpBK,IAAAA,SAAAA,EAAWL,IAAI,WAAA,CAAA;IACfM,oBAAAA,EAAsBH,MAAAA,CAAOH,GAAAA,CAAI,wBAAA,CAAyB;AAC5D,GAAA;AACAtB,EAAAA,2BAAAA,CAA4BC,OAAAA,CAAAA;AAC5B,EAAA,OAAOA,OAAAA;AACT;AAnBSoB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAsBF,IAAMQ,sBAAN,MAAMA;EA9Db;;;;;EA+DE,WAAA,CACmBC,EAAAA,EACAC,eAAyD,IAAA,EAC1E;SAFiBD,EAAAA,GAAAA,EAAAA;SACAC,YAAAA,GAAAA,YAAAA;AAChB,EAAA;EAEKC,cAAAA,GAAyB;AAC/B,IAAA,OAAO,IAAA,CAAKD,YAAAA,GACR,CAAA,EAAG,IAAA,CAAKA,YAAY,CAAA,EAAA,CAAA,GACpB,4FAAA;AACN,EAAA;EAEQE,iBAAAA,GAA4B;AAClC,IAAA,OAAO,IAAA,CAAKF,eAAe,cAAA,GAAiB,cAAA;AAC9C,EAAA;EAEQG,aAAAA,GAAwB;AAC9B,IAAA,OAAO,IAAA,CAAKH,eAAe,EAAA,GAAK,uBAAA;AAClC,EAAA;EAEA,MAAMI,eAAAA,CAAgB/B,WAAAA,EAAqBgC,SAAAA,EAAmBjC,SAAAA,EAAgD;AAC5G,IAAA,IAAI,CAACP,OAAAA,CAAQM,IAAAA,CAAKE,WAAAA,KAAgB,CAACR,OAAAA,CAAQM,IAAAA,CAAKC,SAAAA,KAAc,CAACN,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,GAAY,OAAO,IAAA;AAClG,IAAA,MAAMC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,MAC3B,CAAA,gBAAA,EAAmB,IAAA,CAAKN,gBAAc;;AAE5B,cAAA,EAAA,IAAA,CAAKC,mBAAiB,CAAA,MAAA,EAAW,IAAA,CAAKC,aAAAA,EAAa,CAAA,0BAAA,CAAA,EAC7D;AAAC9B,MAAAA,WAAAA;AAAaD,MAAAA,SAAAA;AAAWiC,MAAAA;AAAU,KAAA,CAAA;AAErC,IAAA,OAAOC,MAAAA,CAAOE,KAAK,CAAA,CAAA,GAAKlB,UAAUgB,MAAAA,CAAOE,IAAAA,CAAK,CAAA,CAAE,CAAA,GAA+B,IAAA;AACjF,EAAA;EAEA,MAAMC,gBAAAA,CAAiBpC,WAAAA,EAAqBgC,SAAAA,EAAmB9B,UAAAA,EAAiD;AAC9G,IAAA,IAAI,CAACV,OAAAA,CAAQM,IAAAA,CAAKE,WAAAA,KAAgB,CAACP,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,KAAc,CAACtC,MAAAA,CAAOI,IAAAA,CAAKI,UAAAA,GAAa,OAAO,IAAA;AAClG,IAAA,MAAM+B,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,MAC3B,CAAA,gBAAA,EAAmB,IAAA,CAAKN,gBAAc;;AAE5B,cAAA,EAAA,IAAA,CAAKC,mBAAiB,CAAA,MAAA,EAAW,IAAA,CAAKC,aAAAA,EAAa,CAAA,0BAAA,CAAA,EAC7D;AAAC9B,MAAAA,WAAAA;AAAaE,MAAAA,UAAAA;AAAY8B,MAAAA;AAAU,KAAA,CAAA;AAEtC,IAAA,OAAOC,MAAAA,CAAOE,KAAK,CAAA,CAAA,GAAKlB,UAAUgB,MAAAA,CAAOE,IAAAA,CAAK,CAAA,CAAE,CAAA,GAA+B,IAAA;AACjF,EAAA;AAEA,EAAA,MAAME,YAAAA,CAAarC,WAAAA,EAAqBgC,SAAAA,EAAmBM,KAAAA,GAAQ,GAAA,EAA6B;AAC9F,IAAA,IAAI,CAAC9C,OAAAA,CAAQM,IAAAA,CAAKE,WAAAA,CAAAA,IAAgB,CAACP,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,CAAAA,EAAY,OAAO,EAAA;AACtE,IAAA,MAAMC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,MAC3B,CAAA,gBAAA,EAAmB,IAAA,CAAKN,gBAAc;AACE,4CAAA,EAAA,IAAA,CAAKC,mBAAiB,CAAA;AACxD,UAAA,EAAA,IAAA,CAAKC,eAAa,CAAA;AAExB,2CAAA,CAAA,EAAA;AAAC9B,MAAAA,WAAAA;AAAagC,MAAAA,SAAAA;AAAWO,MAAAA,IAAAA,CAAKC,IAAID,IAAAA,CAAKE,GAAAA,CAAIH,KAAAA,EAAO,CAAA,GAAI,GAAA;AAAM,KAAA,CAAA;AAE9D,IAAA,OAAOL,OAAOE,IAAAA,CAAKO,GAAAA,CAAI,CAACxB,GAAAA,KAAiCD,SAAAA,CAAUC,GAAAA,CAAAA,CAAAA;AACrE,EAAA;;EAGA,MAAMyB,cAAAA,CAAeC,OAAiCC,OAAAA,EAAgC;AACpFjD,IAAAA,2BAAAA,CAA4BgD,KAAAA,CAAAA;AAC5B,IAAA,IAAIA,KAAAA,CAAM9B,cAAAA,KAAmB,gBAAA,IAAoB8B,KAAAA,CAAMzC,iBAAiB,YAAA,EAAc;AACpF,MAAA,MAAM,IAAIF,MAAM,qDAAA,CAAA;AAClB,IAAA;AACA,IAAA,MAAM6C,MAAAA,GAAS,MAAM,IAAA,CAAKpB,EAAAA,CAAGqB,OAAAA,EAAO;AACpC,IAAA,IAAI;AACF,MAAA,MAAMD,MAAAA,CAAOZ,MAAM,OAAA,CAAA;AACnB,MAAA,MAAMc,OAAAA,GAAU,MAAMF,MAAAA,CAAOZ,KAAAA,CAC3B,CAAA;;;;;;;;;;;;;;AAeA,6BAAA,CAAA,EAAA;QACEU,KAAAA,CAAM7C,SAAAA;QACN6C,KAAAA,CAAM5C,WAAAA;QACN4C,KAAAA,CAAM1C,UAAAA;QACN0C,KAAAA,CAAMzC,YAAAA;QACNyC,KAAAA,CAAMxC,aAAAA;QACNwC,KAAAA,CAAMrC,cAAAA;QACNqC,KAAAA,CAAMlC,QAAAA;QACNkC,KAAAA,CAAM9B,cAAAA;AACN,QAAA,IAAA;AACA,QAAA,IAAA;QACA8B,KAAAA,CAAMxB,aAAAA;QACNwB,KAAAA,CAAMtB,cAAAA;AACNsB,QAAAA,KAAAA,CAAMrB,SAAAA,IAAa,OAAA;AACnBqB,QAAAA,KAAAA,CAAMpB,oBAAAA,IAAwB,CAAA;AAC9BqB,QAAAA;AACD,OAAA,CAAA;AAEH,MAAA,IAAIG,QAAQC,QAAAA,KAAa,CAAA,EAAG,MAAM,IAAIhD,MAAM,4DAAA,CAAA;AAC5C,MAAA,MAAM6C,OAAOZ,KAAAA,CACX,CAAA;;AAGA,wDAAA,CAAA,EAAA;QAACU,KAAAA,CAAM7C,SAAAA;AAAW8C,QAAAA;AAAQ,OAAA,CAAA;AAE5B,MAAA,MAAMC,MAAAA,CAAOZ,MAAM,QAAA,CAAA;AACrB,IAAA,CAAA,CAAA,OAASgB,KAAAA,EAAO;AACd,MAAA,MAAMJ,MAAAA,CAAOZ,MAAM,UAAA,CAAA;AACnB,MAAA,MAAMgB,KAAAA;IACR,CAAA,SAAA;AACEJ,MAAAA,MAAAA,CAAOK,OAAAA,EAAO;AAChB,IAAA;AACF,EAAA;;EAGA,MAAMC,aAAAA,CAAcR,OAAiCC,OAAAA,EAAgC;AACnFjD,IAAAA,2BAAAA,CAA4BgD,KAAAA,CAAAA;AAC5B,IAAA,IAAIA,KAAAA,CAAM9B,mBAAmB,aAAA,IAAiB,CAAC8B,MAAM7B,UAAAA,EAAY,MAAM,IAAId,KAAAA,CAAM,2BAAA,CAAA;AACjF,IAAA,MAAMgC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,KAAAA,CAC3B,CAAA;;;;;;;;;;;;;;;;;AAkBA,2BAAA,CAAA,EAAA;MACEU,KAAAA,CAAM7C,SAAAA;MACN6C,KAAAA,CAAM5C,WAAAA;MACN4C,KAAAA,CAAM1C,UAAAA;MACN0C,KAAAA,CAAMzC,YAAAA;MACNyC,KAAAA,CAAMxC,aAAAA;MACNwC,KAAAA,CAAMrC,cAAAA;MACNqC,KAAAA,CAAMlC,QAAAA;MACNkC,KAAAA,CAAM7B,UAAAA;MACN6B,KAAAA,CAAMxB,aAAAA;MACNwB,KAAAA,CAAMtB,cAAAA;AACNsB,MAAAA,KAAAA,CAAMrB,SAAAA,IAAa,cAAA;AACnBqB,MAAAA,KAAAA,CAAMpB,oBAAAA,IAAwB,CAAA;AAC9BqB,MAAAA;AACD,KAAA,CAAA;AAEH,IAAA,IAAIZ,OAAOgB,QAAAA,KAAa,CAAA,EAAG,MAAM,IAAIhD,MAAM,wDAAA,CAAA;AAC7C,EAAA;;EAGA,MAAMoD,aAAAA,CAActD,SAAAA,EAAmBiC,SAAAA,EAAmBa,OAAAA,EAAgC;AACxF,IAAA,IAAI,CAACrD,OAAAA,CAAQM,IAAAA,CAAKC,SAAAA,CAAAA,IAAc,CAACN,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,CAAAA,EAAY,MAAM,IAAI/B,MAAM,wBAAA,CAAA;AAC7E,IAAA,MAAMgC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,KAAAA,CAC3B,CAAA;;;;;AAMA,2BAAA,CAAA,EAAA;AAACnC,MAAAA,SAAAA;AAAWiC,MAAAA,SAAAA;AAAWa,MAAAA;AAAQ,KAAA,CAAA;AAEjC,IAAA,IAAIZ,OAAOgB,QAAAA,KAAa,CAAA,EAAG,MAAM,IAAIhD,MAAM,yCAAA,CAAA;AAC7C,EAAA;AACF;;;AC5OO,IAAMqD,uBAAN,MAAMA;EALb;;;;;;EAME,WAAA,CACmBC,QAAAA,EACAC,UACAxB,SAAAA,EACjB;SAHiBuB,QAAAA,GAAAA,QAAAA;SACAC,QAAAA,GAAAA,QAAAA;SACAxB,SAAAA,GAAAA,SAAAA;AAChB,EAAA;AAEH,EAAA,MAAMyB,SAASzD,WAAAA,EAAqBD,SAAAA,EAAmBuC,KAAAA,GAAQ,GAAA,EAAKoB,SAAS,CAAA,EAAiC;AAC5G,IAAA,MAAM7D,OAAAA,GAAU,MAAM,IAAA,CAAK0D,QAAAA,CAASxB,gBAAgB/B,WAAAA,EAAa,IAAA,CAAKgC,WAAWjC,SAAAA,CAAAA;AACjF,IAAA,IAAI,CAACF,SAAS,OAAO,IAAA;AACrB,IAAA,IAAIA,OAAAA,CAAQiB,mBAAmB,aAAA,IAAiB,CAACjB,QAAQkB,UAAAA,IAAclB,OAAAA,CAAQmB,qBAAqB,YAAA,EAAc;AAChH,MAAA,MAAM,IAAIf,MAAM,+CAAA,CAAA;AAClB,IAAA;AACA,IAAA,IACE,CAACoB,MAAAA,CAAOsC,SAAAA,CAAUrB,KAAAA,CAAAA,IAClBA,QAAQ,CAAA,IACRA,KAAAA,GAAQ,GAAA,IACR,CAACjB,OAAOsC,SAAAA,CAAUD,MAAAA,KAClBA,MAAAA,GAAS,CAAA,IACTA,SAAS,GAAA,EACT;AACA,MAAA,MAAM,IAAIzD,MAAM,mBAAA,CAAA;AAClB,IAAA;AACA,IAAA,MAAMkC,IAAAA,GAAO,MAAM,IAAA,CAAKqB,QAAAA,CAASI,cAC/B/D,OAAAA,EACA,CAAA,mBAAA,EAAsBA,QAAQkB,UAAU;;AAGxC,wBAAA,CAAA,EAAA;AAACf,MAAAA,WAAAA;MAAa,IAAA,CAAKgC,SAAAA;AAAWM,MAAAA,KAAAA;AAAOoB,MAAAA;AAAO,KAAA,CAAA;AAE9C,IAAA,OAAO;AACL3D,MAAAA,SAAAA,EAAWF,OAAAA,CAAQE,SAAAA;AACnBqB,MAAAA,aAAAA,EAAevB,OAAAA,CAAQuB,aAAAA;AACvBI,MAAAA,oBAAAA,EAAsB3B,OAAAA,CAAQ2B,oBAAAA;AAC9BW,MAAAA;AACF,KAAA;AACF,EAAA;AACF","file":"index.js","sourcesContent":["import type { Pool } from 'pg';\n\nexport type DatasetLifecycle = 'provisioning' | 'ready' | 'archived';\nexport type DatasetRepresentation = 'legacy_payload' | 'typed_table';\nexport type DatasetClassification = 'L1_PUBLIC' | 'L2_INTERNAL' | 'L3_CONFIDENTIAL' | 'L4_REGULATED';\n\nexport interface LakeDataset {\n  datasetId: string;\n  workspaceId: string;\n  datasetKey: string;\n  ownerProduct: string;\n  sourceProduct: string;\n  metadataSchema: string;\n  dataPath: string;\n  representation: DatasetRepresentation;\n  typedTable: string | null;\n  rowProductColumn: string | null;\n  schemaVersion: number;\n  classification: DatasetClassification;\n  lifecycle: DatasetLifecycle;\n  lastCommittedVersion: number;\n}\n\nexport interface RegisterLakeDatasetInput extends Omit<LakeDataset, 'lifecycle' | 'lastCommittedVersion'> {\n  lifecycle?: DatasetLifecycle;\n  lastCommittedVersion?: number;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst PRODUCT_RE = /^[a-z][a-z0-9-]{0,63}$/;\nconst KEY_RE = /^[^\\x00-\\x1f\\x7f]{1,100}$/;\nconst TABLE_RE = /^[a-z][a-z0-9_]{0,62}$/;\n\nexport function validateLakeDatasetIdentity(\n  dataset: Pick<\n    LakeDataset,\n    | 'datasetId'\n    | 'workspaceId'\n    | 'datasetKey'\n    | 'ownerProduct'\n    | 'sourceProduct'\n    | 'metadataSchema'\n    | 'dataPath'\n    | 'typedTable'\n    | 'rowProductColumn'\n    | 'representation'\n  >\n): void {\n  if (!UUID_RE.test(dataset.datasetId) || !UUID_RE.test(dataset.workspaceId))\n    throw new Error('Invalid dataset identity');\n  if (!KEY_RE.test(dataset.datasetKey)) throw new Error('Invalid dataset key');\n  if (!PRODUCT_RE.test(dataset.ownerProduct) || !PRODUCT_RE.test(dataset.sourceProduct)) {\n    throw new Error('Invalid dataset product');\n  }\n  const expectedSchema = `dl_${dataset.datasetId.replaceAll('-', '_')}`;\n  if (dataset.metadataSchema !== expectedSchema) throw new Error('Dataset catalog schema does not match its ID');\n  const path = new URL(dataset.dataPath);\n  if (path.protocol !== 's3:' || !path.hostname || path.pathname !== `/datasinks/${dataset.datasetId}/`) {\n    throw new Error('Dataset S3 path does not match its ID');\n  }\n  if (dataset.representation === 'typed_table') {\n    if (!dataset.typedTable || !TABLE_RE.test(dataset.typedTable)) throw new Error('Invalid typed table');\n    if (dataset.rowProductColumn !== 'product_id') throw new Error('Typed shared tables must use product_id');\n  } else if (dataset.typedTable || dataset.rowProductColumn) {\n    throw new Error('Legacy payload datasets cannot declare a typed table');\n  }\n}\n\nfunction toDataset(row: Record<string, unknown>): LakeDataset {\n  const dataset: LakeDataset = {\n    datasetId: String(row['dataset_id']),\n    workspaceId: String(row['workspace_id']),\n    datasetKey: String(row['dataset_key']),\n    ownerProduct: String(row['owner_product']),\n    sourceProduct: String(row['source_product']),\n    metadataSchema: String(row['metadata_schema']),\n    dataPath: String(row['data_path']),\n    representation: row['representation'] as DatasetRepresentation,\n    typedTable: row['typed_table'] === null ? null : String(row['typed_table']),\n    rowProductColumn: row['row_product_column'] === null ? null : String(row['row_product_column']),\n    schemaVersion: Number(row['schema_version']),\n    classification: row['classification'] as DatasetClassification,\n    lifecycle: row['lifecycle'] as DatasetLifecycle,\n    lastCommittedVersion: Number(row['last_committed_version']),\n  };\n  validateLakeDatasetIdentity(dataset);\n  return dataset;\n}\n\n/** Registry is the authorization source. DataSinkLakeDataset remains an ingest watermark only. */\nexport class LakeDatasetRegistry {\n  constructor(\n    private readonly db: Pool,\n    private readonly approvedView: 'shared_lake_timecampus_approved' | null = null\n  ) {}\n\n  private approvedSource(): string {\n    return this.approvedView\n      ? `${this.approvedView} d`\n      : 'shared_lake_datasets d JOIN shared_lake_dataset_consumers c ON c.dataset_id = d.dataset_id';\n  }\n\n  private approvalPredicate(): string {\n    return this.approvedView ? 'd.product_id' : 'c.product_id';\n  }\n\n  private approvalCheck(): string {\n    return this.approvedView ? '' : 'AND c.can_read = true';\n  }\n\n  async getApprovedById(workspaceId: string, productId: string, datasetId: string): Promise<LakeDataset | null> {\n    if (!UUID_RE.test(workspaceId) || !UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) return null;\n    const result = await this.db.query(\n      `SELECT d.* FROM ${this.approvedSource()}\n        WHERE d.workspace_id = $1::uuid AND d.dataset_id = $2::uuid\n          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`,\n      [workspaceId, datasetId, productId]\n    );\n    return result.rows[0] ? toDataset(result.rows[0] as Record<string, unknown>) : null;\n  }\n\n  async getApprovedByKey(workspaceId: string, productId: string, datasetKey: string): Promise<LakeDataset | null> {\n    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId) || !KEY_RE.test(datasetKey)) return null;\n    const result = await this.db.query(\n      `SELECT d.* FROM ${this.approvedSource()}\n        WHERE d.workspace_id = $1::uuid AND d.dataset_key = $2\n          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`,\n      [workspaceId, datasetKey, productId]\n    );\n    return result.rows[0] ? toDataset(result.rows[0] as Record<string, unknown>) : null;\n  }\n\n  async listApproved(workspaceId: string, productId: string, limit = 100): Promise<LakeDataset[]> {\n    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId)) return [];\n    const result = await this.db.query(\n      `SELECT d.* FROM ${this.approvedSource()}\n        WHERE d.workspace_id = $1::uuid AND ${this.approvalPredicate()} = $2\n          ${this.approvalCheck()} AND d.lifecycle = 'ready'\n        ORDER BY d.dataset_key ASC LIMIT $3`,\n      [workspaceId, productId, Math.min(Math.max(limit, 1), 1000)]\n    );\n    return result.rows.map((row: Record<string, unknown>) => toDataset(row));\n  }\n\n  /** BigConsole's legacy sink registration: stable datasetId=sinkId and same Parquet prefix. */\n  async registerLegacy(input: RegisterLakeDatasetInput, actorId: string): Promise<void> {\n    validateLakeDatasetIdentity(input);\n    if (input.representation !== 'legacy_payload' || input.ownerProduct !== 'bigconsole') {\n      throw new Error('Only BigConsole legacy sinks may use registerLegacy');\n    }\n    const client = await this.db.connect();\n    try {\n      await client.query('BEGIN');\n      const written = await client.query(\n        `INSERT INTO shared_lake_datasets\n          (dataset_id, workspace_id, dataset_key, owner_product, source_product,\n           metadata_schema, data_path, representation, typed_table, row_product_column,\n           schema_version, classification, lifecycle, last_committed_version, created_by, updated_by)\n         VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$15)\n         ON CONFLICT (dataset_id) DO UPDATE SET\n           dataset_key=EXCLUDED.dataset_key, metadata_schema=EXCLUDED.metadata_schema,\n           data_path=EXCLUDED.data_path, classification=EXCLUDED.classification,\n           lifecycle=EXCLUDED.lifecycle,\n           last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),\n           updated_by=EXCLUDED.updated_by, updated_at=now()\n         WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id\n           AND shared_lake_datasets.owner_product=EXCLUDED.owner_product\n           AND shared_lake_datasets.representation='legacy_payload'\n         RETURNING dataset_id`,\n        [\n          input.datasetId,\n          input.workspaceId,\n          input.datasetKey,\n          input.ownerProduct,\n          input.sourceProduct,\n          input.metadataSchema,\n          input.dataPath,\n          input.representation,\n          null,\n          null,\n          input.schemaVersion,\n          input.classification,\n          input.lifecycle ?? 'ready',\n          input.lastCommittedVersion ?? 0,\n          actorId,\n        ]\n      );\n      if (written.rowCount !== 1) throw new Error('Dataset identity conflicts with another owner or workspace');\n      await client.query(\n        `INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)\n         VALUES ($1::uuid, 'bigconsole', true, true, $2)\n         ON CONFLICT (dataset_id, product_id) DO NOTHING`,\n        [input.datasetId, actorId]\n      );\n      await client.query('COMMIT');\n    } catch (error) {\n      await client.query('ROLLBACK');\n      throw error;\n    } finally {\n      client.release();\n    }\n  }\n\n  /** Operator-only registration after the typed table and its physical grants exist. */\n  async registerTyped(input: RegisterLakeDatasetInput, actorId: string): Promise<void> {\n    validateLakeDatasetIdentity(input);\n    if (input.representation !== 'typed_table' || !input.typedTable) throw new Error('A typed table is required');\n    const result = await this.db.query(\n      `INSERT INTO shared_lake_datasets\n        (dataset_id, workspace_id, dataset_key, owner_product, source_product, metadata_schema,\n         data_path, representation, typed_table, row_product_column, schema_version,\n         classification, lifecycle, last_committed_version, created_by, updated_by)\n       VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,'typed_table',$8,'product_id',$9,$10,$11,$12,$13,$13)\n       ON CONFLICT (dataset_id) DO UPDATE SET\n         representation='typed_table', typed_table=EXCLUDED.typed_table,\n         row_product_column='product_id', source_product=EXCLUDED.source_product,\n         schema_version=EXCLUDED.schema_version,\n         classification=EXCLUDED.classification, lifecycle=EXCLUDED.lifecycle,\n         last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),\n         updated_by=EXCLUDED.updated_by, updated_at=now()\n       WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id\n         AND shared_lake_datasets.owner_product=EXCLUDED.owner_product\n         AND shared_lake_datasets.dataset_key=EXCLUDED.dataset_key\n         AND shared_lake_datasets.metadata_schema=EXCLUDED.metadata_schema\n         AND shared_lake_datasets.data_path=EXCLUDED.data_path\n       RETURNING dataset_id`,\n      [\n        input.datasetId,\n        input.workspaceId,\n        input.datasetKey,\n        input.ownerProduct,\n        input.sourceProduct,\n        input.metadataSchema,\n        input.dataPath,\n        input.typedTable,\n        input.schemaVersion,\n        input.classification,\n        input.lifecycle ?? 'provisioning',\n        input.lastCommittedVersion ?? 0,\n        actorId,\n      ]\n    );\n    if (result.rowCount !== 1) throw new Error('Typed dataset identity conflicts with existing routing');\n  }\n\n  /** Catalog grant is activated only after PostgreSQL and S3 grants are applied. */\n  async grantConsumer(datasetId: string, productId: string, actorId: string): Promise<void> {\n    if (!UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) throw new Error('Invalid consumer grant');\n    const result = await this.db.query(\n      `INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)\n       SELECT d.dataset_id, $2, true, false, $3 FROM shared_lake_datasets d\n        WHERE d.dataset_id=$1::uuid AND d.representation='typed_table' AND d.lifecycle='ready'\n       ON CONFLICT (dataset_id, product_id) DO UPDATE SET\n         can_read=true, can_write=false, granted_by=EXCLUDED.granted_by, updated_at=now()\n       RETURNING dataset_id`,\n      [datasetId, productId, actorId]\n    );\n    if (result.rowCount !== 1) throw new Error('Only ready typed datasets may be shared');\n  }\n}\n","import type { LakeDataset, LakeDatasetRegistry } from './dataset-registry.js';\n\n/** An adapter attaches and queries exactly one approved schema atomically. */\nexport interface LakeReadExecutor {\n  queryReadOnly(\n    dataset: LakeDataset,\n    sql: string,\n    parameters: readonly (string | number)[]\n  ): Promise<Record<string, unknown>[]>;\n}\n\nexport interface LakeReadPage {\n  datasetId: string;\n  schemaVersion: number;\n  lastCommittedVersion: number;\n  rows: Record<string, unknown>[];\n}\n\n/**\n * A typed dataset is safe to expose only after registry grant + workspace\n * checks. The row predicate is mandatory even when the dataset is shared.\n * `product_id IS NULL` denotes intentionally shared rows.\n */\nexport class AuthorizedLakeReader {\n  constructor(\n    private readonly registry: LakeDatasetRegistry,\n    private readonly executor: LakeReadExecutor,\n    private readonly productId: string\n  ) {}\n\n  async readRows(workspaceId: string, datasetId: string, limit = 100, offset = 0): Promise<LakeReadPage | null> {\n    const dataset = await this.registry.getApprovedById(workspaceId, this.productId, datasetId);\n    if (!dataset) return null;\n    if (dataset.representation !== 'typed_table' || !dataset.typedTable || dataset.rowProductColumn !== 'product_id') {\n      throw new Error('Dataset does not have an approved typed table');\n    }\n    if (\n      !Number.isInteger(limit) ||\n      limit < 1 ||\n      limit > 1000 ||\n      !Number.isInteger(offset) ||\n      offset < 0 ||\n      offset > 10000\n    ) {\n      throw new Error('Invalid lake page');\n    }\n    const rows = await this.executor.queryReadOnly(\n      dataset,\n      `SELECT * FROM lake.${dataset.typedTable}\n        WHERE workspace_id = ? AND (product_id = ? OR product_id IS NULL)\n        LIMIT ? OFFSET ?`,\n      [workspaceId, this.productId, limit, offset]\n    );\n    return {\n      datasetId: dataset.datasetId,\n      schemaVersion: dataset.schemaVersion,\n      lastCommittedVersion: dataset.lastCommittedVersion,\n      rows,\n    };\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/be-sdk",
-  "version": "2026.1005.1",
+  "version": "2026.1006.1",
   "description": "Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -71,13 +71,15 @@
     "LICENSE"
   ],
   "scripts": {
+    "lake:registry:migrate": "bunx prisma migrate deploy --config prisma.lake.config.ts",
+    "lake:grant:timecampus": "bun scripts/lake-grant-timecampus.ts",
     "deps:check": "bun scripts/deps-mode.ts check",
     "deps:npm": "bun scripts/deps-mode.ts npm",
     "deps:status": "bun scripts/deps-mode.ts status",
     "deps:workspace": "bun scripts/deps-mode.ts workspace",
     "dev": "tsx watch ./src/index.ts",
-    "build": "bash scripts/with-private-swc-cache.sh env NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts --format esm --dts --clean --shims && bun run pack:tgz",
-    "build:watch": "bash scripts/with-private-swc-cache.sh tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts --format esm --dts --watch --shims",
+    "build": "bash scripts/with-private-swc-cache.sh env NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts src/lake/index.ts --format esm --dts --clean --shims && bun run pack:tgz",
+    "build:watch": "bash scripts/with-private-swc-cache.sh tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts src/lake/index.ts --format esm --dts --watch --shims",
     "typecheck": "bash scripts/build-limits.sh tsc --noEmit",
     "lint": "eslint ./src",
     "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint; else bun run lint -- --cache --cache-location .eslintcache; fi",
@@ -234,6 +236,7 @@
     "access": "public"
   },
   "overrides": {
+    "@graphql-tools/utils": "12.0.3",
     "hono": "4.13.12",
     "valibot": "1.5.0",
     "protobufjs": "7.6.6",