@burdenoff/be-sdk 2026.1005.1 → 2026.1008.1

package/dist/index.d.ts

@@ -24,7 +24,7 @@ export { i as Cache } from './index-Cx5I3ydM.js';
 export { i as Middleware } from './index-DSOpj8DI.js';
 export { i as Observability } from './index-4gKQKZ2B.js';
 export { i as GraphQL } from './index-joONjwLt.js';
-export { i as Prisma } from './index-Daj7nq9V.js';
+export { i as Prisma } from './index-Dl8EAdYu.js';
 export { i as Utils } from './index-PaojfSdd.js';
 export { i as I18n, I as I18nCapableContext, T as Translator, c as createTranslator, g as getLanguage, a as getLocale, h as hasI18n, t } from './index-D4l1u8VR.js';
 export { i as Export } from './index-B4ciT3OZ.js';
@@ -34,20 +34,20 @@ export { i as Instrumentation } from './index-Dvv6irk0.js';
 export { i as Layer } from './index-BCUkR8sC.js';
 export { i as Crypto } from './index-e_18DzAg.js';
 export { i as Gateway } from './index-Dy6neH2G.js';
-export { i as FeatureFlags } from './index-Drvw0QPe.js';
+export { i as FeatureFlags } from './index-Rc5EphmY.js';
 export { i as Captcha, R as RecaptchaVerifyOptions, a as RecaptchaVerifyResult, b as isCaptchaEnabled, v as verifyCaptcha, c as verifyCaptchaIfEnabled } from './index-B70b5mYS.js';
 export { i as Platform } from './index-PJZzGd8r.js';
 export { N as NAME_MAX_LENGTH, a as NAME_MIN_LENGTH, b as NameErrorCode, c as NameValidationResult, U as USERNAME_MAX_LENGTH, d as USERNAME_MIN_LENGTH, e as UserFieldError, f as UserFieldKey, g as UserFieldsValidationResult, h as UsernameErrorCode, i as UsernameValidationResult, V as ValidatedUserFields, j as Validation, l as lengthInCodePoints, v as validateName, k as validateUserFields, m as validateUsername } from './index-B2jIInhp.js';
 export { E as EmitGeneration, P as PRODUCT_RENAMES, a as PRODUCT_RENAME_EMIT, b as PRODUCT_SLUG_ALIASES, i as ProductAlias, c as ProductRename, R as RENAME_CONCERNS, d as RenameConcern, e as billingIdVariants, f as emitBillingId, g as emitName, h as emitProductSlug, j as emitQuotaKey, k as emitRbacResource, l as emitTemplateKey, m as isLegacyName, n as isSameBillingId, o as isSameGraphQLName, p as isSameName, q as isSameProductSlug, r as isSameQuotaKey, s as isSameRbacResource, t as isSameTemplateKey, u as nameVariants, v as normalizeBillingId, w as normalizeGraphQLName, x as normalizeProductSlug, y as normalizeQuotaKey, z as normalizeRbacResource, A as normalizeTemplateKey, B as productSlugVariants, C as quotaKeyVariants, D as rbacResourceVariants, F as readRenamedEnv, G as templateKeyVariants, H as toCurrentName, I as toLegacyName } from './index-BuAj5nXg.js';
 export { C as CircuitBreakerConfig, h as DEFAULT_CIRCUIT_BREAKER_CONFIG, i as DEFAULT_GATEWAY_RETRY_CONFIG, D as DEFAULT_GATEWAY_ROUTING, b as DEFAULT_LAYER_RESOURCES, c as DEFAULT_LAYER_STREAMS, f as GatewayRequestHeaders, g as GatewayRetryConfig, G as GatewayRoutingConfig, L as LayerConfig, a as LayerFullConfig, d as LayerGatewayConfig, e as LayerResourceUrls, S as ServiceLayer } from './layer-GNAVXBMf.js';
 export { S as ShutdownDisposable, d as disposeAll, g as getRegisteredDisposableCount, r as registerDisposable, u as unregisterDisposable } from './shutdown-registry-CW9LryO8.js';
-import './types-Biv0uaJk.js';
+import './types-C-6m9NoG.js';
 import 'graphql';
 import 'graphql-yoga';
 import './client-CCXpAZ2r.js';
 import '@prisma/adapter-pg';
 import 'pg';
-import './workspace-extension-DlxYz3P4.js';
+import './workspace-extension-DiNiTLa3.js';
 import './types-C8TbSdEj.js';
 import 'graphql-request';
 import '@envelop/core';

package/dist/index.js

@@ -1,19 +1,19 @@
+export { sharing_exports as Sharing } from './chunk-DS3YMJ4X.js';
 export { TemporalClient, TemporalClientFactory, TemporalModule, TemporalWorker, TemporalWorkerFactory, TemporalWorkerManager } from './chunk-YNDJQRI3.js';
 import { ActivityModule, UsageModule, TrackerModule } from './chunk-NCC5UN3L.js';
 export { ActivityModule, TrackerModule, UsageModule } from './chunk-NCC5UN3L.js';
 export { NAME_MAX_LENGTH, NAME_MIN_LENGTH, USERNAME_MAX_LENGTH, USERNAME_MIN_LENGTH, validation_exports as Validation, lengthInCodePoints, validateName, validateUserFields, validateUsername } from './chunk-AHEXIONU.js';
+export { observability_exports as Observability } from './chunk-VAT66FJA.js';
 export { platform_exports as Platform } from './chunk-Z5BURBFZ.js';
-export { prisma_exports as Prisma } from './chunk-CVMQRWCB.js';
+export { prisma_exports as Prisma } from './chunk-EOHPDXXW.js';
 export { PRODUCT_RENAMES, PRODUCT_RENAME_EMIT, PRODUCT_SLUG_ALIASES, product_alias_exports as ProductAlias, RENAME_CONCERNS, billingIdVariants, emitBillingId, emitName, emitProductSlug, emitQuotaKey, emitRbacResource, emitTemplateKey, isLegacyName, isSameBillingId, isSameGraphQLName, isSameName, isSameProductSlug, isSameQuotaKey, isSameRbacResource, isSameTemplateKey, nameVariants, normalizeBillingId, normalizeGraphQLName, normalizeProductSlug, normalizeQuotaKey, normalizeRbacResource, normalizeTemplateKey, productSlugVariants, quotaKeyVariants, rbacResourceVariants, readRenamedEnv, templateKeyVariants, toCurrentName, toLegacyName } from './chunk-OBBCR6WY.js';
 import { RBACModule } from './chunk-5JNHVKHG.js';
 export { RBACModule, createRBACDirective, createRBACDirectiveForLayer, createRBACDirectiveFromEnv } from './chunk-5JNHVKHG.js';
-import './chunk-FA5ROGTS.js';
-export { sharing_exports as Sharing } from './chunk-DS3YMJ4X.js';
+import './chunk-CYY4VIRK.js';
 export { instrumentation_exports as Instrumentation } from './chunk-E5DTAGCA.js';
 export { middleware_exports as Middleware } from './chunk-ELU7VL3E.js';
 import { TenantNotificationsModule, NotificationsModule } from './chunk-INAZ3PKF.js';
 export { tenant_notifications_exports as Notifications, NotificationsModule } from './chunk-INAZ3PKF.js';
-export { observability_exports as Observability } from './chunk-VAT66FJA.js';
 export { export_exports as Export } from './chunk-RFXAHMY4.js';
 export { feature_flags_exports as FeatureFlags } from './chunk-UNASM5VJ.js';
 import { GraphModule } from './chunk-VVBA3LQV.js';

package/dist/lake/index.d.ts

@@ -0,0 +1,59 @@
+import { Pool } from 'pg';
+
+type DatasetLifecycle = 'provisioning' | 'ready' | 'archived';
+type DatasetRepresentation = 'legacy_payload' | 'typed_table';
+type DatasetClassification = 'L1_PUBLIC' | 'L2_INTERNAL' | 'L3_CONFIDENTIAL' | 'L4_REGULATED';
+interface LakeDataset {
+    datasetId: string;
+    workspaceId: string;
+    datasetKey: string;
+    ownerProduct: string;
+    sourceProduct: string;
+    metadataSchema: string;
+    dataPath: string;
+    representation: DatasetRepresentation;
+    typedTable: string | null;
+    rowProductColumn: string | null;
+    schemaVersion: number;
+    classification: DatasetClassification;
+    lifecycle: DatasetLifecycle;
+    lastCommittedVersion: number;
+}
+interface RegisterLakeDatasetInput extends Omit<LakeDataset, 'lifecycle' | 'lastCommittedVersion'> {
+    lifecycle?: DatasetLifecycle;
+    lastCommittedVersion?: number;
+}
+declare function validateLakeDatasetIdentity(dataset: Pick<LakeDataset, 'datasetId' | 'workspaceId' | 'datasetKey' | 'ownerProduct' | 'sourceProduct' | 'metadataSchema' | 'dataPath' | 'typedTable' | 'rowProductColumn' | 'representation'>): void;
+declare class LakeDatasetRegistry {
+    private readonly db;
+    private readonly approvedView;
+    constructor(db: Pool, approvedView?: 'shared_lake_timecampus_approved' | null);
+    private approvedSource;
+    private approvalPredicate;
+    private approvalCheck;
+    getApprovedById(workspaceId: string, productId: string, datasetId: string): Promise<LakeDataset | null>;
+    getApprovedByKey(workspaceId: string, productId: string, datasetKey: string): Promise<LakeDataset | null>;
+    listApproved(workspaceId: string, productId: string, limit?: number): Promise<LakeDataset[]>;
+    registerLegacy(input: RegisterLakeDatasetInput, actorId: string): Promise<void>;
+    registerTyped(input: RegisterLakeDatasetInput, actorId: string): Promise<void>;
+    grantConsumer(datasetId: string, productId: string, actorId: string): Promise<void>;
+}
+
+interface LakeReadExecutor {
+    queryReadOnly(dataset: LakeDataset, sql: string, parameters: readonly (string | number)[]): Promise<Record<string, unknown>[]>;
+}
+interface LakeReadPage {
+    datasetId: string;
+    schemaVersion: number;
+    lastCommittedVersion: number;
+    rows: Record<string, unknown>[];
+}
+declare class AuthorizedLakeReader {
+    private readonly registry;
+    private readonly executor;
+    private readonly productId;
+    constructor(registry: LakeDatasetRegistry, executor: LakeReadExecutor, productId: string);
+    readRows(workspaceId: string, datasetId: string, limit?: number, offset?: number): Promise<LakeReadPage | null>;
+}
+
+export { AuthorizedLakeReader, type DatasetClassification, type DatasetLifecycle, type DatasetRepresentation, type LakeDataset, LakeDatasetRegistry, type LakeReadExecutor, type LakeReadPage, type RegisterLakeDatasetInput, validateLakeDatasetIdentity };

package/dist/lake/index.js

@@ -0,0 +1,253 @@
+import { __name } from '../chunk-XE4OXN2W.js';
+
+// src/lake/dataset-registry.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var PRODUCT_RE = /^[a-z][a-z0-9-]{0,63}$/;
+var KEY_RE = /^[^\x00-\x1f\x7f]{1,100}$/;
+var TABLE_RE = /^[a-z][a-z0-9_]{0,62}$/;
+function validateLakeDatasetIdentity(dataset) {
+  if (!UUID_RE.test(dataset.datasetId) || !UUID_RE.test(dataset.workspaceId)) throw new Error("Invalid dataset identity");
+  if (!KEY_RE.test(dataset.datasetKey)) throw new Error("Invalid dataset key");
+  if (!PRODUCT_RE.test(dataset.ownerProduct) || !PRODUCT_RE.test(dataset.sourceProduct)) {
+    throw new Error("Invalid dataset product");
+  }
+  const expectedSchema = `dl_${dataset.datasetId.replaceAll("-", "_")}`;
+  if (dataset.metadataSchema !== expectedSchema) throw new Error("Dataset catalog schema does not match its ID");
+  const path = new URL(dataset.dataPath);
+  if (path.protocol !== "s3:" || !path.hostname || path.pathname !== `/datasinks/${dataset.datasetId}/`) {
+    throw new Error("Dataset S3 path does not match its ID");
+  }
+  if (dataset.representation === "typed_table") {
+    if (!dataset.typedTable || !TABLE_RE.test(dataset.typedTable)) throw new Error("Invalid typed table");
+    if (dataset.rowProductColumn !== "product_id") throw new Error("Typed shared tables must use product_id");
+  } else if (dataset.typedTable || dataset.rowProductColumn) {
+    throw new Error("Legacy payload datasets cannot declare a typed table");
+  }
+}
+__name(validateLakeDatasetIdentity, "validateLakeDatasetIdentity");
+function toDataset(row) {
+  const dataset = {
+    datasetId: String(row["dataset_id"]),
+    workspaceId: String(row["workspace_id"]),
+    datasetKey: String(row["dataset_key"]),
+    ownerProduct: String(row["owner_product"]),
+    sourceProduct: String(row["source_product"]),
+    metadataSchema: String(row["metadata_schema"]),
+    dataPath: String(row["data_path"]),
+    representation: row["representation"],
+    typedTable: row["typed_table"] === null ? null : String(row["typed_table"]),
+    rowProductColumn: row["row_product_column"] === null ? null : String(row["row_product_column"]),
+    schemaVersion: Number(row["schema_version"]),
+    classification: row["classification"],
+    lifecycle: row["lifecycle"],
+    lastCommittedVersion: Number(row["last_committed_version"])
+  };
+  validateLakeDatasetIdentity(dataset);
+  return dataset;
+}
+__name(toDataset, "toDataset");
+var LakeDatasetRegistry = class {
+  static {
+    __name(this, "LakeDatasetRegistry");
+  }
+  db;
+  approvedView;
+  constructor(db, approvedView = null) {
+    this.db = db;
+    this.approvedView = approvedView;
+  }
+  approvedSource() {
+    return this.approvedView ? `${this.approvedView} d` : "shared_lake_datasets d JOIN shared_lake_dataset_consumers c ON c.dataset_id = d.dataset_id";
+  }
+  approvalPredicate() {
+    return this.approvedView ? "d.product_id" : "c.product_id";
+  }
+  approvalCheck() {
+    return this.approvedView ? "" : "AND c.can_read = true";
+  }
+  async getApprovedById(workspaceId, productId, datasetId) {
+    if (!UUID_RE.test(workspaceId) || !UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) return null;
+    const result = await this.db.query(`SELECT d.* FROM ${this.approvedSource()}
+        WHERE d.workspace_id = $1::uuid AND d.dataset_id = $2::uuid
+          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`, [
+      workspaceId,
+      datasetId,
+      productId
+    ]);
+    return result.rows[0] ? toDataset(result.rows[0]) : null;
+  }
+  async getApprovedByKey(workspaceId, productId, datasetKey) {
+    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId) || !KEY_RE.test(datasetKey)) return null;
+    const result = await this.db.query(`SELECT d.* FROM ${this.approvedSource()}
+        WHERE d.workspace_id = $1::uuid AND d.dataset_key = $2
+          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`, [
+      workspaceId,
+      datasetKey,
+      productId
+    ]);
+    return result.rows[0] ? toDataset(result.rows[0]) : null;
+  }
+  async listApproved(workspaceId, productId, limit = 100) {
+    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId)) return [];
+    const result = await this.db.query(`SELECT d.* FROM ${this.approvedSource()}
+        WHERE d.workspace_id = $1::uuid AND ${this.approvalPredicate()} = $2
+          ${this.approvalCheck()} AND d.lifecycle = 'ready'
+        ORDER BY d.dataset_key ASC LIMIT $3`, [
+      workspaceId,
+      productId,
+      Math.min(Math.max(limit, 1), 1e3)
+    ]);
+    return result.rows.map((row) => toDataset(row));
+  }
+  /** BigConsole's legacy sink registration: stable datasetId=sinkId and same Parquet prefix. */
+  async registerLegacy(input, actorId) {
+    validateLakeDatasetIdentity(input);
+    if (input.representation !== "legacy_payload" || input.ownerProduct !== "bigconsole") {
+      throw new Error("Only BigConsole legacy sinks may use registerLegacy");
+    }
+    const client = await this.db.connect();
+    try {
+      await client.query("BEGIN");
+      const written = await client.query(`INSERT INTO shared_lake_datasets
+          (dataset_id, workspace_id, dataset_key, owner_product, source_product,
+           metadata_schema, data_path, representation, typed_table, row_product_column,
+           schema_version, classification, lifecycle, last_committed_version, created_by, updated_by)
+         VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$15)
+         ON CONFLICT (dataset_id) DO UPDATE SET
+           dataset_key=EXCLUDED.dataset_key, metadata_schema=EXCLUDED.metadata_schema,
+           data_path=EXCLUDED.data_path, classification=EXCLUDED.classification,
+           lifecycle=EXCLUDED.lifecycle,
+           last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),
+           updated_by=EXCLUDED.updated_by, updated_at=now()
+         WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id
+           AND shared_lake_datasets.owner_product=EXCLUDED.owner_product
+           AND shared_lake_datasets.representation='legacy_payload'
+         RETURNING dataset_id`, [
+        input.datasetId,
+        input.workspaceId,
+        input.datasetKey,
+        input.ownerProduct,
+        input.sourceProduct,
+        input.metadataSchema,
+        input.dataPath,
+        input.representation,
+        null,
+        null,
+        input.schemaVersion,
+        input.classification,
+        input.lifecycle ?? "ready",
+        input.lastCommittedVersion ?? 0,
+        actorId
+      ]);
+      if (written.rowCount !== 1) throw new Error("Dataset identity conflicts with another owner or workspace");
+      await client.query(`INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)
+         VALUES ($1::uuid, 'bigconsole', true, true, $2)
+         ON CONFLICT (dataset_id, product_id) DO NOTHING`, [
+        input.datasetId,
+        actorId
+      ]);
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  /** Operator-only registration after the typed table and its physical grants exist. */
+  async registerTyped(input, actorId) {
+    validateLakeDatasetIdentity(input);
+    if (input.representation !== "typed_table" || !input.typedTable) throw new Error("A typed table is required");
+    const result = await this.db.query(`INSERT INTO shared_lake_datasets
+        (dataset_id, workspace_id, dataset_key, owner_product, source_product, metadata_schema,
+         data_path, representation, typed_table, row_product_column, schema_version,
+         classification, lifecycle, last_committed_version, created_by, updated_by)
+       VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,'typed_table',$8,'product_id',$9,$10,$11,$12,$13,$13)
+       ON CONFLICT (dataset_id) DO UPDATE SET
+         representation='typed_table', typed_table=EXCLUDED.typed_table,
+         row_product_column='product_id', source_product=EXCLUDED.source_product,
+         schema_version=EXCLUDED.schema_version,
+         classification=EXCLUDED.classification, lifecycle=EXCLUDED.lifecycle,
+         last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),
+         updated_by=EXCLUDED.updated_by, updated_at=now()
+       WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id
+         AND shared_lake_datasets.owner_product=EXCLUDED.owner_product
+         AND shared_lake_datasets.dataset_key=EXCLUDED.dataset_key
+         AND shared_lake_datasets.metadata_schema=EXCLUDED.metadata_schema
+         AND shared_lake_datasets.data_path=EXCLUDED.data_path
+       RETURNING dataset_id`, [
+      input.datasetId,
+      input.workspaceId,
+      input.datasetKey,
+      input.ownerProduct,
+      input.sourceProduct,
+      input.metadataSchema,
+      input.dataPath,
+      input.typedTable,
+      input.schemaVersion,
+      input.classification,
+      input.lifecycle ?? "provisioning",
+      input.lastCommittedVersion ?? 0,
+      actorId
+    ]);
+    if (result.rowCount !== 1) throw new Error("Typed dataset identity conflicts with existing routing");
+  }
+  /** Catalog grant is activated only after PostgreSQL and S3 grants are applied. */
+  async grantConsumer(datasetId, productId, actorId) {
+    if (!UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) throw new Error("Invalid consumer grant");
+    const result = await this.db.query(`INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)
+       SELECT d.dataset_id, $2, true, false, $3 FROM shared_lake_datasets d
+        WHERE d.dataset_id=$1::uuid AND d.representation='typed_table' AND d.lifecycle='ready'
+       ON CONFLICT (dataset_id, product_id) DO UPDATE SET
+         can_read=true, can_write=false, granted_by=EXCLUDED.granted_by, updated_at=now()
+       RETURNING dataset_id`, [
+      datasetId,
+      productId,
+      actorId
+    ]);
+    if (result.rowCount !== 1) throw new Error("Only ready typed datasets may be shared");
+  }
+};
+
+// src/lake/authorized-reader.ts
+var AuthorizedLakeReader = class {
+  static {
+    __name(this, "AuthorizedLakeReader");
+  }
+  registry;
+  executor;
+  productId;
+  constructor(registry, executor, productId) {
+    this.registry = registry;
+    this.executor = executor;
+    this.productId = productId;
+  }
+  async readRows(workspaceId, datasetId, limit = 100, offset = 0) {
+    const dataset = await this.registry.getApprovedById(workspaceId, this.productId, datasetId);
+    if (!dataset) return null;
+    if (dataset.representation !== "typed_table" || !dataset.typedTable || dataset.rowProductColumn !== "product_id") {
+      throw new Error("Dataset does not have an approved typed table");
+    }
+    if (!Number.isInteger(limit) || limit < 1 || limit > 1e3 || !Number.isInteger(offset) || offset < 0 || offset > 1e4) {
+      throw new Error("Invalid lake page");
+    }
+    const rows = await this.executor.queryReadOnly(dataset, `SELECT * FROM lake.${dataset.typedTable}
+        WHERE workspace_id = ? AND (product_id = ? OR product_id IS NULL)
+        LIMIT ? OFFSET ?`, [
+      workspaceId,
+      this.productId,
+      limit,
+      offset
+    ]);
+    return {
+      datasetId: dataset.datasetId,
+      schemaVersion: dataset.schemaVersion,
+      lastCommittedVersion: dataset.lastCommittedVersion,
+      rows
+    };
+  }
+};
+
+export { AuthorizedLakeReader, LakeDatasetRegistry, validateLakeDatasetIdentity };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/lake/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lake/dataset-registry.ts","../../src/lake/authorized-reader.ts"],"names":["UUID_RE","PRODUCT_RE","KEY_RE","TABLE_RE","validateLakeDatasetIdentity","dataset","test","datasetId","workspaceId","Error","datasetKey","ownerProduct","sourceProduct","expectedSchema","replaceAll","metadataSchema","path","URL","dataPath","protocol","hostname","pathname","representation","typedTable","rowProductColumn","toDataset","row","String","schemaVersion","Number","classification","lifecycle","lastCommittedVersion","LakeDatasetRegistry","db","approvedView","approvedSource","approvalPredicate","approvalCheck","getApprovedById","productId","result","query","rows","getApprovedByKey","listApproved","limit","Math","min","max","map","registerLegacy","input","actorId","client","connect","written","rowCount","error","release","registerTyped","grantConsumer","AuthorizedLakeReader","registry","executor","readRows","offset","isInteger","queryReadOnly"],"mappings":";;;AA4BA,IAAMA,OAAAA,GAAU,iEAAA;AAChB,IAAMC,UAAAA,GAAa,wBAAA;AACnB,IAAMC,MAAAA,GAAS,2BAAA;AACf,IAAMC,QAAAA,GAAW,wBAAA;AAEV,SAASC,4BACdC,OAAAA,EAYC;AAED,EAAA,IAAI,CAACL,OAAAA,CAAQM,IAAAA,CAAKD,OAAAA,CAAQE,SAAS,CAAA,IAAK,CAACP,OAAAA,CAAQM,IAAAA,CAAKD,QAAQG,WAAW,CAAA,EACvE,MAAM,IAAIC,MAAM,0BAAA,CAAA;AAClB,EAAA,IAAI,CAACP,OAAOI,IAAAA,CAAKD,OAAAA,CAAQK,UAAU,CAAA,EAAG,MAAM,IAAID,KAAAA,CAAM,qBAAA,CAAA;AACtD,EAAA,IAAI,CAACR,UAAAA,CAAWK,IAAAA,CAAKD,OAAAA,CAAQM,YAAY,CAAA,IAAK,CAACV,UAAAA,CAAWK,IAAAA,CAAKD,OAAAA,CAAQO,aAAa,CAAA,EAAG;AACrF,IAAA,MAAM,IAAIH,MAAM,yBAAA,CAAA;AAClB,EAAA;AACA,EAAA,MAAMI,iBAAiB,CAAA,GAAA,EAAMR,OAAAA,CAAQE,UAAUO,UAAAA,CAAW,GAAA,EAAK,GAAA,CAAA,CAAA,CAAA;AAC/D,EAAA,IAAIT,QAAQU,cAAAA,KAAmBF,cAAAA,EAAgB,MAAM,IAAIJ,MAAM,8CAAA,CAAA;AAC/D,EAAA,MAAMO,IAAAA,GAAO,IAAIC,GAAAA,CAAIZ,OAAAA,CAAQa,QAAQ,CAAA;AACrC,EAAA,IAAIF,IAAAA,CAAKG,QAAAA,KAAa,KAAA,IAAS,CAACH,IAAAA,CAAKI,QAAAA,IAAYJ,IAAAA,CAAKK,QAAAA,KAAa,CAAA,WAAA,EAAchB,OAAAA,CAAQE,SAAS,CAAA,CAAA,CAAA,EAAK;AACrG,IAAA,MAAM,IAAIE,MAAM,uCAAA,CAAA;AAClB,EAAA;AACA,EAAA,IAAIJ,OAAAA,CAAQiB,mBAAmB,aAAA,EAAe;AAC5C,IAAA,IAAI,CAACjB,OAAAA,CAAQkB,UAAAA,IAAc,CAACpB,QAAAA,CAASG,IAAAA,CAAKD,OAAAA,CAAQkB,UAAU,CAAA,EAAG,MAAM,IAAId,KAAAA,CAAM,qBAAA,CAAA;AAC/E,IAAA,IAAIJ,QAAQmB,gBAAAA,KAAqB,YAAA,EAAc,MAAM,IAAIf,MAAM,yCAAA,CAAA;EACjE,CAAA,MAAA,IAAWJ,OAAAA,CAAQkB,UAAAA,IAAclB,OAAAA,CAAQmB,gBAAAA,EAAkB;AACzD,IAAA,MAAM,IAAIf,MAAM,sDAAA,CAAA;AAClB,EAAA;AACF;AAjCgBL,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AAmChB,SAASqB,UAAUC,GAAAA,EAA4B;AAC7C,EAAA,MAAMrB,OAAAA,GAAuB;IAC3BE,SAAAA,EAAWoB,MAAAA,CAAOD,GAAAA,CAAI,YAAA,CAAa,CAAA;IACnClB,WAAAA,EAAamB,MAAAA,CAAOD,GAAAA,CAAI,cAAA,CAAe,CAAA;IACvChB,UAAAA,EAAYiB,MAAAA,CAAOD,GAAAA,CAAI,aAAA,CAAc,CAAA;IACrCf,YAAAA,EAAcgB,MAAAA,CAAOD,GAAAA,CAAI,eAAA,CAAgB,CAAA;IACzCd,aAAAA,EAAee,MAAAA,CAAOD,GAAAA,CAAI,gBAAA,CAAiB,CAAA;IAC3CX,cAAAA,EAAgBY,MAAAA,CAAOD,GAAAA,CAAI,iBAAA,CAAkB,CAAA;IAC7CR,QAAAA,EAAUS,MAAAA,CAAOD,GAAAA,CAAI,WAAA,CAAY,CAAA;AACjCJ,IAAAA,cAAAA,EAAgBI,IAAI,gBAAA,CAAA;IACpBH,UAAAA,EAAYG,GAAAA,CAAI,aAAA,CAAA,KAAmB,IAAA,GAAO,OAAOC,MAAAA,CAAOD,GAAAA,CAAI,aAAA,CAAc,CAAA;IAC1EF,gBAAAA,EAAkBE,GAAAA,CAAI,oBAAA,CAAA,KAA0B,IAAA,GAAO,OAAOC,MAAAA,CAAOD,GAAAA,CAAI,oBAAA,CAAqB,CAAA;IAC9FE,aAAAA,EAAeC,MAAAA,CAAOH,GAAAA,CAAI,gBAAA,CAAiB,CAAA;AAC3CI,IAAAA,cAAAA,EAAgBJ,IAAI,gBAAA,CAAA;AACpBK,IAAAA,SAAAA,EAAWL,IAAI,WAAA,CAAA;IACfM,oBAAAA,EAAsBH,MAAAA,CAAOH,GAAAA,CAAI,wBAAA,CAAyB;AAC5D,GAAA;AACAtB,EAAAA,2BAAAA,CAA4BC,OAAAA,CAAAA;AAC5B,EAAA,OAAOA,OAAAA;AACT;AAnBSoB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAsBF,IAAMQ,sBAAN,MAAMA;EA9Db;;;;;EA+DE,WAAA,CACmBC,EAAAA,EACAC,eAAyD,IAAA,EAC1E;SAFiBD,EAAAA,GAAAA,EAAAA;SACAC,YAAAA,GAAAA,YAAAA;AAChB,EAAA;EAEKC,cAAAA,GAAyB;AAC/B,IAAA,OAAO,IAAA,CAAKD,YAAAA,GACR,CAAA,EAAG,IAAA,CAAKA,YAAY,CAAA,EAAA,CAAA,GACpB,4FAAA;AACN,EAAA;EAEQE,iBAAAA,GAA4B;AAClC,IAAA,OAAO,IAAA,CAAKF,eAAe,cAAA,GAAiB,cAAA;AAC9C,EAAA;EAEQG,aAAAA,GAAwB;AAC9B,IAAA,OAAO,IAAA,CAAKH,eAAe,EAAA,GAAK,uBAAA;AAClC,EAAA;EAEA,MAAMI,eAAAA,CAAgB/B,WAAAA,EAAqBgC,SAAAA,EAAmBjC,SAAAA,EAAgD;AAC5G,IAAA,IAAI,CAACP,OAAAA,CAAQM,IAAAA,CAAKE,WAAAA,KAAgB,CAACR,OAAAA,CAAQM,IAAAA,CAAKC,SAAAA,KAAc,CAACN,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,GAAY,OAAO,IAAA;AAClG,IAAA,MAAMC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,MAC3B,CAAA,gBAAA,EAAmB,IAAA,CAAKN,gBAAc;;AAE5B,cAAA,EAAA,IAAA,CAAKC,mBAAiB,CAAA,MAAA,EAAW,IAAA,CAAKC,aAAAA,EAAa,CAAA,0BAAA,CAAA,EAC7D;AAAC9B,MAAAA,WAAAA;AAAaD,MAAAA,SAAAA;AAAWiC,MAAAA;AAAU,KAAA,CAAA;AAErC,IAAA,OAAOC,MAAAA,CAAOE,KAAK,CAAA,CAAA,GAAKlB,UAAUgB,MAAAA,CAAOE,IAAAA,CAAK,CAAA,CAAE,CAAA,GAA+B,IAAA;AACjF,EAAA;EAEA,MAAMC,gBAAAA,CAAiBpC,WAAAA,EAAqBgC,SAAAA,EAAmB9B,UAAAA,EAAiD;AAC9G,IAAA,IAAI,CAACV,OAAAA,CAAQM,IAAAA,CAAKE,WAAAA,KAAgB,CAACP,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,KAAc,CAACtC,MAAAA,CAAOI,IAAAA,CAAKI,UAAAA,GAAa,OAAO,IAAA;AAClG,IAAA,MAAM+B,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,MAC3B,CAAA,gBAAA,EAAmB,IAAA,CAAKN,gBAAc;;AAE5B,cAAA,EAAA,IAAA,CAAKC,mBAAiB,CAAA,MAAA,EAAW,IAAA,CAAKC,aAAAA,EAAa,CAAA,0BAAA,CAAA,EAC7D;AAAC9B,MAAAA,WAAAA;AAAaE,MAAAA,UAAAA;AAAY8B,MAAAA;AAAU,KAAA,CAAA;AAEtC,IAAA,OAAOC,MAAAA,CAAOE,KAAK,CAAA,CAAA,GAAKlB,UAAUgB,MAAAA,CAAOE,IAAAA,CAAK,CAAA,CAAE,CAAA,GAA+B,IAAA;AACjF,EAAA;AAEA,EAAA,MAAME,YAAAA,CAAarC,WAAAA,EAAqBgC,SAAAA,EAAmBM,KAAAA,GAAQ,GAAA,EAA6B;AAC9F,IAAA,IAAI,CAAC9C,OAAAA,CAAQM,IAAAA,CAAKE,WAAAA,CAAAA,IAAgB,CAACP,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,CAAAA,EAAY,OAAO,EAAA;AACtE,IAAA,MAAMC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,MAC3B,CAAA,gBAAA,EAAmB,IAAA,CAAKN,gBAAc;AACE,4CAAA,EAAA,IAAA,CAAKC,mBAAiB,CAAA;AACxD,UAAA,EAAA,IAAA,CAAKC,eAAa,CAAA;AAExB,2CAAA,CAAA,EAAA;AAAC9B,MAAAA,WAAAA;AAAagC,MAAAA,SAAAA;AAAWO,MAAAA,IAAAA,CAAKC,IAAID,IAAAA,CAAKE,GAAAA,CAAIH,KAAAA,EAAO,CAAA,GAAI,GAAA;AAAM,KAAA,CAAA;AAE9D,IAAA,OAAOL,OAAOE,IAAAA,CAAKO,GAAAA,CAAI,CAACxB,GAAAA,KAAiCD,SAAAA,CAAUC,GAAAA,CAAAA,CAAAA;AACrE,EAAA;;EAGA,MAAMyB,cAAAA,CAAeC,OAAiCC,OAAAA,EAAgC;AACpFjD,IAAAA,2BAAAA,CAA4BgD,KAAAA,CAAAA;AAC5B,IAAA,IAAIA,KAAAA,CAAM9B,cAAAA,KAAmB,gBAAA,IAAoB8B,KAAAA,CAAMzC,iBAAiB,YAAA,EAAc;AACpF,MAAA,MAAM,IAAIF,MAAM,qDAAA,CAAA;AAClB,IAAA;AACA,IAAA,MAAM6C,MAAAA,GAAS,MAAM,IAAA,CAAKpB,EAAAA,CAAGqB,OAAAA,EAAO;AACpC,IAAA,IAAI;AACF,MAAA,MAAMD,MAAAA,CAAOZ,MAAM,OAAA,CAAA;AACnB,MAAA,MAAMc,OAAAA,GAAU,MAAMF,MAAAA,CAAOZ,KAAAA,CAC3B,CAAA;;;;;;;;;;;;;;AAeA,6BAAA,CAAA,EAAA;QACEU,KAAAA,CAAM7C,SAAAA;QACN6C,KAAAA,CAAM5C,WAAAA;QACN4C,KAAAA,CAAM1C,UAAAA;QACN0C,KAAAA,CAAMzC,YAAAA;QACNyC,KAAAA,CAAMxC,aAAAA;QACNwC,KAAAA,CAAMrC,cAAAA;QACNqC,KAAAA,CAAMlC,QAAAA;QACNkC,KAAAA,CAAM9B,cAAAA;AACN,QAAA,IAAA;AACA,QAAA,IAAA;QACA8B,KAAAA,CAAMxB,aAAAA;QACNwB,KAAAA,CAAMtB,cAAAA;AACNsB,QAAAA,KAAAA,CAAMrB,SAAAA,IAAa,OAAA;AACnBqB,QAAAA,KAAAA,CAAMpB,oBAAAA,IAAwB,CAAA;AAC9BqB,QAAAA;AACD,OAAA,CAAA;AAEH,MAAA,IAAIG,QAAQC,QAAAA,KAAa,CAAA,EAAG,MAAM,IAAIhD,MAAM,4DAAA,CAAA;AAC5C,MAAA,MAAM6C,OAAOZ,KAAAA,CACX,CAAA;;AAGA,wDAAA,CAAA,EAAA;QAACU,KAAAA,CAAM7C,SAAAA;AAAW8C,QAAAA;AAAQ,OAAA,CAAA;AAE5B,MAAA,MAAMC,MAAAA,CAAOZ,MAAM,QAAA,CAAA;AACrB,IAAA,CAAA,CAAA,OAASgB,KAAAA,EAAO;AACd,MAAA,MAAMJ,MAAAA,CAAOZ,MAAM,UAAA,CAAA;AACnB,MAAA,MAAMgB,KAAAA;IACR,CAAA,SAAA;AACEJ,MAAAA,MAAAA,CAAOK,OAAAA,EAAO;AAChB,IAAA;AACF,EAAA;;EAGA,MAAMC,aAAAA,CAAcR,OAAiCC,OAAAA,EAAgC;AACnFjD,IAAAA,2BAAAA,CAA4BgD,KAAAA,CAAAA;AAC5B,IAAA,IAAIA,KAAAA,CAAM9B,mBAAmB,aAAA,IAAiB,CAAC8B,MAAM7B,UAAAA,EAAY,MAAM,IAAId,KAAAA,CAAM,2BAAA,CAAA;AACjF,IAAA,MAAMgC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,KAAAA,CAC3B,CAAA;;;;;;;;;;;;;;;;;AAkBA,2BAAA,CAAA,EAAA;MACEU,KAAAA,CAAM7C,SAAAA;MACN6C,KAAAA,CAAM5C,WAAAA;MACN4C,KAAAA,CAAM1C,UAAAA;MACN0C,KAAAA,CAAMzC,YAAAA;MACNyC,KAAAA,CAAMxC,aAAAA;MACNwC,KAAAA,CAAMrC,cAAAA;MACNqC,KAAAA,CAAMlC,QAAAA;MACNkC,KAAAA,CAAM7B,UAAAA;MACN6B,KAAAA,CAAMxB,aAAAA;MACNwB,KAAAA,CAAMtB,cAAAA;AACNsB,MAAAA,KAAAA,CAAMrB,SAAAA,IAAa,cAAA;AACnBqB,MAAAA,KAAAA,CAAMpB,oBAAAA,IAAwB,CAAA;AAC9BqB,MAAAA;AACD,KAAA,CAAA;AAEH,IAAA,IAAIZ,OAAOgB,QAAAA,KAAa,CAAA,EAAG,MAAM,IAAIhD,MAAM,wDAAA,CAAA;AAC7C,EAAA;;EAGA,MAAMoD,aAAAA,CAActD,SAAAA,EAAmBiC,SAAAA,EAAmBa,OAAAA,EAAgC;AACxF,IAAA,IAAI,CAACrD,OAAAA,CAAQM,IAAAA,CAAKC,SAAAA,CAAAA,IAAc,CAACN,UAAAA,CAAWK,IAAAA,CAAKkC,SAAAA,CAAAA,EAAY,MAAM,IAAI/B,MAAM,wBAAA,CAAA;AAC7E,IAAA,MAAMgC,MAAAA,GAAS,MAAM,IAAA,CAAKP,EAAAA,CAAGQ,KAAAA,CAC3B,CAAA;;;;;AAMA,2BAAA,CAAA,EAAA;AAACnC,MAAAA,SAAAA;AAAWiC,MAAAA,SAAAA;AAAWa,MAAAA;AAAQ,KAAA,CAAA;AAEjC,IAAA,IAAIZ,OAAOgB,QAAAA,KAAa,CAAA,EAAG,MAAM,IAAIhD,MAAM,yCAAA,CAAA;AAC7C,EAAA;AACF;;;AC5OO,IAAMqD,uBAAN,MAAMA;EALb;;;;;;EAME,WAAA,CACmBC,QAAAA,EACAC,UACAxB,SAAAA,EACjB;SAHiBuB,QAAAA,GAAAA,QAAAA;SACAC,QAAAA,GAAAA,QAAAA;SACAxB,SAAAA,GAAAA,SAAAA;AAChB,EAAA;AAEH,EAAA,MAAMyB,SAASzD,WAAAA,EAAqBD,SAAAA,EAAmBuC,KAAAA,GAAQ,GAAA,EAAKoB,SAAS,CAAA,EAAiC;AAC5G,IAAA,MAAM7D,OAAAA,GAAU,MAAM,IAAA,CAAK0D,QAAAA,CAASxB,gBAAgB/B,WAAAA,EAAa,IAAA,CAAKgC,WAAWjC,SAAAA,CAAAA;AACjF,IAAA,IAAI,CAACF,SAAS,OAAO,IAAA;AACrB,IAAA,IAAIA,OAAAA,CAAQiB,mBAAmB,aAAA,IAAiB,CAACjB,QAAQkB,UAAAA,IAAclB,OAAAA,CAAQmB,qBAAqB,YAAA,EAAc;AAChH,MAAA,MAAM,IAAIf,MAAM,+CAAA,CAAA;AAClB,IAAA;AACA,IAAA,IACE,CAACoB,MAAAA,CAAOsC,SAAAA,CAAUrB,KAAAA,CAAAA,IAClBA,QAAQ,CAAA,IACRA,KAAAA,GAAQ,GAAA,IACR,CAACjB,OAAOsC,SAAAA,CAAUD,MAAAA,KAClBA,MAAAA,GAAS,CAAA,IACTA,SAAS,GAAA,EACT;AACA,MAAA,MAAM,IAAIzD,MAAM,mBAAA,CAAA;AAClB,IAAA;AACA,IAAA,MAAMkC,IAAAA,GAAO,MAAM,IAAA,CAAKqB,QAAAA,CAASI,cAC/B/D,OAAAA,EACA,CAAA,mBAAA,EAAsBA,QAAQkB,UAAU;;AAGxC,wBAAA,CAAA,EAAA;AAACf,MAAAA,WAAAA;MAAa,IAAA,CAAKgC,SAAAA;AAAWM,MAAAA,KAAAA;AAAOoB,MAAAA;AAAO,KAAA,CAAA;AAE9C,IAAA,OAAO;AACL3D,MAAAA,SAAAA,EAAWF,OAAAA,CAAQE,SAAAA;AACnBqB,MAAAA,aAAAA,EAAevB,OAAAA,CAAQuB,aAAAA;AACvBI,MAAAA,oBAAAA,EAAsB3B,OAAAA,CAAQ2B,oBAAAA;AAC9BW,MAAAA;AACF,KAAA;AACF,EAAA;AACF","file":"index.js","sourcesContent":["import type { Pool } from 'pg';\n\nexport type DatasetLifecycle = 'provisioning' | 'ready' | 'archived';\nexport type DatasetRepresentation = 'legacy_payload' | 'typed_table';\nexport type DatasetClassification = 'L1_PUBLIC' | 'L2_INTERNAL' | 'L3_CONFIDENTIAL' | 'L4_REGULATED';\n\nexport interface LakeDataset {\n  datasetId: string;\n  workspaceId: string;\n  datasetKey: string;\n  ownerProduct: string;\n  sourceProduct: string;\n  metadataSchema: string;\n  dataPath: string;\n  representation: DatasetRepresentation;\n  typedTable: string | null;\n  rowProductColumn: string | null;\n  schemaVersion: number;\n  classification: DatasetClassification;\n  lifecycle: DatasetLifecycle;\n  lastCommittedVersion: number;\n}\n\nexport interface RegisterLakeDatasetInput extends Omit<LakeDataset, 'lifecycle' | 'lastCommittedVersion'> {\n  lifecycle?: DatasetLifecycle;\n  lastCommittedVersion?: number;\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst PRODUCT_RE = /^[a-z][a-z0-9-]{0,63}$/;\nconst KEY_RE = /^[^\\x00-\\x1f\\x7f]{1,100}$/;\nconst TABLE_RE = /^[a-z][a-z0-9_]{0,62}$/;\n\nexport function validateLakeDatasetIdentity(\n  dataset: Pick<\n    LakeDataset,\n    | 'datasetId'\n    | 'workspaceId'\n    | 'datasetKey'\n    | 'ownerProduct'\n    | 'sourceProduct'\n    | 'metadataSchema'\n    | 'dataPath'\n    | 'typedTable'\n    | 'rowProductColumn'\n    | 'representation'\n  >\n): void {\n  if (!UUID_RE.test(dataset.datasetId) || !UUID_RE.test(dataset.workspaceId))\n    throw new Error('Invalid dataset identity');\n  if (!KEY_RE.test(dataset.datasetKey)) throw new Error('Invalid dataset key');\n  if (!PRODUCT_RE.test(dataset.ownerProduct) || !PRODUCT_RE.test(dataset.sourceProduct)) {\n    throw new Error('Invalid dataset product');\n  }\n  const expectedSchema = `dl_${dataset.datasetId.replaceAll('-', '_')}`;\n  if (dataset.metadataSchema !== expectedSchema) throw new Error('Dataset catalog schema does not match its ID');\n  const path = new URL(dataset.dataPath);\n  if (path.protocol !== 's3:' || !path.hostname || path.pathname !== `/datasinks/${dataset.datasetId}/`) {\n    throw new Error('Dataset S3 path does not match its ID');\n  }\n  if (dataset.representation === 'typed_table') {\n    if (!dataset.typedTable || !TABLE_RE.test(dataset.typedTable)) throw new Error('Invalid typed table');\n    if (dataset.rowProductColumn !== 'product_id') throw new Error('Typed shared tables must use product_id');\n  } else if (dataset.typedTable || dataset.rowProductColumn) {\n    throw new Error('Legacy payload datasets cannot declare a typed table');\n  }\n}\n\nfunction toDataset(row: Record<string, unknown>): LakeDataset {\n  const dataset: LakeDataset = {\n    datasetId: String(row['dataset_id']),\n    workspaceId: String(row['workspace_id']),\n    datasetKey: String(row['dataset_key']),\n    ownerProduct: String(row['owner_product']),\n    sourceProduct: String(row['source_product']),\n    metadataSchema: String(row['metadata_schema']),\n    dataPath: String(row['data_path']),\n    representation: row['representation'] as DatasetRepresentation,\n    typedTable: row['typed_table'] === null ? null : String(row['typed_table']),\n    rowProductColumn: row['row_product_column'] === null ? null : String(row['row_product_column']),\n    schemaVersion: Number(row['schema_version']),\n    classification: row['classification'] as DatasetClassification,\n    lifecycle: row['lifecycle'] as DatasetLifecycle,\n    lastCommittedVersion: Number(row['last_committed_version']),\n  };\n  validateLakeDatasetIdentity(dataset);\n  return dataset;\n}\n\n/** Registry is the authorization source. DataSinkLakeDataset remains an ingest watermark only. */\nexport class LakeDatasetRegistry {\n  constructor(\n    private readonly db: Pool,\n    private readonly approvedView: 'shared_lake_timecampus_approved' | null = null\n  ) {}\n\n  private approvedSource(): string {\n    return this.approvedView\n      ? `${this.approvedView} d`\n      : 'shared_lake_datasets d JOIN shared_lake_dataset_consumers c ON c.dataset_id = d.dataset_id';\n  }\n\n  private approvalPredicate(): string {\n    return this.approvedView ? 'd.product_id' : 'c.product_id';\n  }\n\n  private approvalCheck(): string {\n    return this.approvedView ? '' : 'AND c.can_read = true';\n  }\n\n  async getApprovedById(workspaceId: string, productId: string, datasetId: string): Promise<LakeDataset | null> {\n    if (!UUID_RE.test(workspaceId) || !UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) return null;\n    const result = await this.db.query(\n      `SELECT d.* FROM ${this.approvedSource()}\n        WHERE d.workspace_id = $1::uuid AND d.dataset_id = $2::uuid\n          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`,\n      [workspaceId, datasetId, productId]\n    );\n    return result.rows[0] ? toDataset(result.rows[0] as Record<string, unknown>) : null;\n  }\n\n  async getApprovedByKey(workspaceId: string, productId: string, datasetKey: string): Promise<LakeDataset | null> {\n    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId) || !KEY_RE.test(datasetKey)) return null;\n    const result = await this.db.query(\n      `SELECT d.* FROM ${this.approvedSource()}\n        WHERE d.workspace_id = $1::uuid AND d.dataset_key = $2\n          AND ${this.approvalPredicate()} = $3 ${this.approvalCheck()} AND d.lifecycle = 'ready'`,\n      [workspaceId, datasetKey, productId]\n    );\n    return result.rows[0] ? toDataset(result.rows[0] as Record<string, unknown>) : null;\n  }\n\n  async listApproved(workspaceId: string, productId: string, limit = 100): Promise<LakeDataset[]> {\n    if (!UUID_RE.test(workspaceId) || !PRODUCT_RE.test(productId)) return [];\n    const result = await this.db.query(\n      `SELECT d.* FROM ${this.approvedSource()}\n        WHERE d.workspace_id = $1::uuid AND ${this.approvalPredicate()} = $2\n          ${this.approvalCheck()} AND d.lifecycle = 'ready'\n        ORDER BY d.dataset_key ASC LIMIT $3`,\n      [workspaceId, productId, Math.min(Math.max(limit, 1), 1000)]\n    );\n    return result.rows.map((row: Record<string, unknown>) => toDataset(row));\n  }\n\n  /** BigConsole's legacy sink registration: stable datasetId=sinkId and same Parquet prefix. */\n  async registerLegacy(input: RegisterLakeDatasetInput, actorId: string): Promise<void> {\n    validateLakeDatasetIdentity(input);\n    if (input.representation !== 'legacy_payload' || input.ownerProduct !== 'bigconsole') {\n      throw new Error('Only BigConsole legacy sinks may use registerLegacy');\n    }\n    const client = await this.db.connect();\n    try {\n      await client.query('BEGIN');\n      const written = await client.query(\n        `INSERT INTO shared_lake_datasets\n          (dataset_id, workspace_id, dataset_key, owner_product, source_product,\n           metadata_schema, data_path, representation, typed_table, row_product_column,\n           schema_version, classification, lifecycle, last_committed_version, created_by, updated_by)\n         VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$15)\n         ON CONFLICT (dataset_id) DO UPDATE SET\n           dataset_key=EXCLUDED.dataset_key, metadata_schema=EXCLUDED.metadata_schema,\n           data_path=EXCLUDED.data_path, classification=EXCLUDED.classification,\n           lifecycle=EXCLUDED.lifecycle,\n           last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),\n           updated_by=EXCLUDED.updated_by, updated_at=now()\n         WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id\n           AND shared_lake_datasets.owner_product=EXCLUDED.owner_product\n           AND shared_lake_datasets.representation='legacy_payload'\n         RETURNING dataset_id`,\n        [\n          input.datasetId,\n          input.workspaceId,\n          input.datasetKey,\n          input.ownerProduct,\n          input.sourceProduct,\n          input.metadataSchema,\n          input.dataPath,\n          input.representation,\n          null,\n          null,\n          input.schemaVersion,\n          input.classification,\n          input.lifecycle ?? 'ready',\n          input.lastCommittedVersion ?? 0,\n          actorId,\n        ]\n      );\n      if (written.rowCount !== 1) throw new Error('Dataset identity conflicts with another owner or workspace');\n      await client.query(\n        `INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)\n         VALUES ($1::uuid, 'bigconsole', true, true, $2)\n         ON CONFLICT (dataset_id, product_id) DO NOTHING`,\n        [input.datasetId, actorId]\n      );\n      await client.query('COMMIT');\n    } catch (error) {\n      await client.query('ROLLBACK');\n      throw error;\n    } finally {\n      client.release();\n    }\n  }\n\n  /** Operator-only registration after the typed table and its physical grants exist. */\n  async registerTyped(input: RegisterLakeDatasetInput, actorId: string): Promise<void> {\n    validateLakeDatasetIdentity(input);\n    if (input.representation !== 'typed_table' || !input.typedTable) throw new Error('A typed table is required');\n    const result = await this.db.query(\n      `INSERT INTO shared_lake_datasets\n        (dataset_id, workspace_id, dataset_key, owner_product, source_product, metadata_schema,\n         data_path, representation, typed_table, row_product_column, schema_version,\n         classification, lifecycle, last_committed_version, created_by, updated_by)\n       VALUES ($1::uuid,$2::uuid,$3,$4,$5,$6,$7,'typed_table',$8,'product_id',$9,$10,$11,$12,$13,$13)\n       ON CONFLICT (dataset_id) DO UPDATE SET\n         representation='typed_table', typed_table=EXCLUDED.typed_table,\n         row_product_column='product_id', source_product=EXCLUDED.source_product,\n         schema_version=EXCLUDED.schema_version,\n         classification=EXCLUDED.classification, lifecycle=EXCLUDED.lifecycle,\n         last_committed_version=GREATEST(shared_lake_datasets.last_committed_version, EXCLUDED.last_committed_version),\n         updated_by=EXCLUDED.updated_by, updated_at=now()\n       WHERE shared_lake_datasets.workspace_id=EXCLUDED.workspace_id\n         AND shared_lake_datasets.owner_product=EXCLUDED.owner_product\n         AND shared_lake_datasets.dataset_key=EXCLUDED.dataset_key\n         AND shared_lake_datasets.metadata_schema=EXCLUDED.metadata_schema\n         AND shared_lake_datasets.data_path=EXCLUDED.data_path\n       RETURNING dataset_id`,\n      [\n        input.datasetId,\n        input.workspaceId,\n        input.datasetKey,\n        input.ownerProduct,\n        input.sourceProduct,\n        input.metadataSchema,\n        input.dataPath,\n        input.typedTable,\n        input.schemaVersion,\n        input.classification,\n        input.lifecycle ?? 'provisioning',\n        input.lastCommittedVersion ?? 0,\n        actorId,\n      ]\n    );\n    if (result.rowCount !== 1) throw new Error('Typed dataset identity conflicts with existing routing');\n  }\n\n  /** Catalog grant is activated only after PostgreSQL and S3 grants are applied. */\n  async grantConsumer(datasetId: string, productId: string, actorId: string): Promise<void> {\n    if (!UUID_RE.test(datasetId) || !PRODUCT_RE.test(productId)) throw new Error('Invalid consumer grant');\n    const result = await this.db.query(\n      `INSERT INTO shared_lake_dataset_consumers (dataset_id, product_id, can_read, can_write, granted_by)\n       SELECT d.dataset_id, $2, true, false, $3 FROM shared_lake_datasets d\n        WHERE d.dataset_id=$1::uuid AND d.representation='typed_table' AND d.lifecycle='ready'\n       ON CONFLICT (dataset_id, product_id) DO UPDATE SET\n         can_read=true, can_write=false, granted_by=EXCLUDED.granted_by, updated_at=now()\n       RETURNING dataset_id`,\n      [datasetId, productId, actorId]\n    );\n    if (result.rowCount !== 1) throw new Error('Only ready typed datasets may be shared');\n  }\n}\n","import type { LakeDataset, LakeDatasetRegistry } from './dataset-registry.js';\n\n/** An adapter attaches and queries exactly one approved schema atomically. */\nexport interface LakeReadExecutor {\n  queryReadOnly(\n    dataset: LakeDataset,\n    sql: string,\n    parameters: readonly (string | number)[]\n  ): Promise<Record<string, unknown>[]>;\n}\n\nexport interface LakeReadPage {\n  datasetId: string;\n  schemaVersion: number;\n  lastCommittedVersion: number;\n  rows: Record<string, unknown>[];\n}\n\n/**\n * A typed dataset is safe to expose only after registry grant + workspace\n * checks. The row predicate is mandatory even when the dataset is shared.\n * `product_id IS NULL` denotes intentionally shared rows.\n */\nexport class AuthorizedLakeReader {\n  constructor(\n    private readonly registry: LakeDatasetRegistry,\n    private readonly executor: LakeReadExecutor,\n    private readonly productId: string\n  ) {}\n\n  async readRows(workspaceId: string, datasetId: string, limit = 100, offset = 0): Promise<LakeReadPage | null> {\n    const dataset = await this.registry.getApprovedById(workspaceId, this.productId, datasetId);\n    if (!dataset) return null;\n    if (dataset.representation !== 'typed_table' || !dataset.typedTable || dataset.rowProductColumn !== 'product_id') {\n      throw new Error('Dataset does not have an approved typed table');\n    }\n    if (\n      !Number.isInteger(limit) ||\n      limit < 1 ||\n      limit > 1000 ||\n      !Number.isInteger(offset) ||\n      offset < 0 ||\n      offset > 10000\n    ) {\n      throw new Error('Invalid lake page');\n    }\n    const rows = await this.executor.queryReadOnly(\n      dataset,\n      `SELECT * FROM lake.${dataset.typedTable}\n        WHERE workspace_id = ? AND (product_id = ? OR product_id IS NULL)\n        LIMIT ? OFFSET ?`,\n      [workspaceId, this.productId, limit, offset]\n    );\n    return {\n      datasetId: dataset.datasetId,\n      schemaVersion: dataset.schemaVersion,\n      lastCommittedVersion: dataset.lastCommittedVersion,\n      rows,\n    };\n  }\n}\n"]}

package/dist/prisma/index.d.ts

@@ -1,6 +1,6 @@
-export { C as ContextFilterInput, a as ContextWhereCondition, D as DatabaseClient, b as DatabaseClientConfig, F as FieldExtractionOptions, c as FieldExtractionResult, I as InputJsonValue, J as JsonValue, M as ModelFieldsMap, O as OperationContext, P as PoolTuningEnv, d as PrismaJsonFilter, e as buildContextWhereClause, f as buildContextWhereConditions, g as checkDatabaseHealth, h as contextMatches, j as createContextFromSDK, k as createDatabaseClient, l as createDatabaseClientFromEnv, m as extractFieldsFromModel, n as getAllModelNames, o as getDatabaseManager, p as getDatabaseProductName, q as getDatabaseStats, r as getDatabaseVersion, s as getDb, t as getModelFields, u as hasModel, v as initializeDatabase, w as initializeDatabaseWithConfig, x as isDatabaseInitialized, y as loadGeneratedFields, z as mergeContext, A as parseContext, B as resetDatabaseManager, E as resolvePoolTuningFromEnv, G as testConnection, H as toContextJson } from '../index-Daj7nq9V.js';
+export { C as ContextFilterInput, a as ContextWhereCondition, D as DatabaseClient, b as DatabaseClientConfig, F as FieldExtractionOptions, c as FieldExtractionResult, I as InputJsonValue, J as JsonValue, M as ModelFieldsMap, O as OperationContext, P as PoolTuningEnv, d as PrismaJsonFilter, e as buildContextWhereClause, f as buildContextWhereConditions, g as checkDatabaseHealth, h as contextMatches, j as createContextFromSDK, k as createDatabaseClient, l as createDatabaseClientFromEnv, m as extractFieldsFromModel, n as getAllModelNames, o as getDatabaseManager, p as getDatabaseProductName, q as getDatabaseStats, r as getDatabaseVersion, s as getDb, t as getModelFields, u as hasModel, v as initializeDatabase, w as initializeDatabaseWithConfig, x as isDatabaseInitialized, y as loadGeneratedFields, z as mergeContext, A as parseContext, B as resetDatabaseManager, E as resolvePoolTuningFromEnv, G as testConnection, H as toContextJson } from '../index-Dl8EAdYu.js';
 export { C as ConnectionState, d as DatabaseHealth, D as DatabaseReturnType, P as PrismaClientBase, c as PrismaClientConfig, a as PrismaClientConstructorOptions, b as PrismaClientWrapper, e as PrismaEvent, f as PrismaLogDefinition, g as PrismaLogEvent, h as PrismaLogLevel, i as PrismaQueryEvent, j as PrismaTransactionOptions, k as configurePrismaLogging, l as createConnectionPool, m as createPrismaAdapter, n as createPrismaClient, o as ensureServiceApplicationName, p as installAcquireRetry, q as isTransientAcquireError } from '../client-CCXpAZ2r.js';
-export { a as WorkspaceContext, W as WorkspaceExtensionConfig, b as addWorkspaceExtension, d as defaultWorkspaceExtensionConfig, g as getWorkspaceContext, i as injectCreateFields, c as injectWhereWorkspaceId, m as maybeSetRlsGuc, e as maybeTagConnection, r as runOperationWithRlsGuc, s as setWorkspaceContext, w as withWorkspaceContext, f as withWorkspaceContextSync } from '../workspace-extension-DlxYz3P4.js';
+export { C as CallerTransaction, P as PrismaQueryInternalParams, R as RawPrismaForCallerTransaction, T as TransactionContextStatement, a as WorkspaceContext, W as WorkspaceExtensionConfig, b as addWorkspaceExtension, c as buildTransactionContextStatement, d as defaultWorkspaceExtensionConfig, g as getCallerTransaction, e as getWorkspaceContext, i as injectCreateFields, f as injectWhereWorkspaceId, m as maybeSetRlsGuc, h as maybeTagConnection, r as resetCallerTransactionStateForTests, j as runOperationInCallerTransaction, k as runOperationWithRlsGuc, s as setWorkspaceContext, w as withWorkspaceContext, l as withWorkspaceContextSync } from '../workspace-extension-DiNiTLa3.js';
 import '../prisma-extension-krXnYnrN.js';
 import '@prisma/adapter-pg';
 import 'pg';

package/dist/prisma/index.js

@@ -1,6 +1,6 @@
-export { buildContextWhereClause, buildContextWhereConditions, checkDatabaseHealth, contextMatches, createContextFromSDK, createDatabaseClient, createDatabaseClientFromEnv, extractFieldsFromModel, getAllModelNames, getDatabaseManager, getDatabaseProductName, getDatabaseStats, getDatabaseVersion, getDb, getModelFields, hasModel, initializeDatabase, initializeDatabaseWithConfig, isDatabaseInitialized, loadGeneratedFields, mergeContext, parseContext, resetDatabaseManager, resolvePoolTuningFromEnv, testConnection, toContextJson } from '../chunk-CVMQRWCB.js';
+export { buildContextWhereClause, buildContextWhereConditions, checkDatabaseHealth, contextMatches, createContextFromSDK, createDatabaseClient, createDatabaseClientFromEnv, extractFieldsFromModel, getAllModelNames, getDatabaseManager, getDatabaseProductName, getDatabaseStats, getDatabaseVersion, getDb, getModelFields, hasModel, initializeDatabase, initializeDatabaseWithConfig, isDatabaseInitialized, loadGeneratedFields, mergeContext, parseContext, resetDatabaseManager, resolvePoolTuningFromEnv, testConnection, toContextJson } from '../chunk-EOHPDXXW.js';
 import '../chunk-OBBCR6WY.js';
-export { addWorkspaceExtension, defaultWorkspaceExtensionConfig, getWorkspaceContext, injectCreateFields, injectWhereWorkspaceId, maybeSetRlsGuc, maybeTagConnection, runOperationWithRlsGuc, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync } from '../chunk-FA5ROGTS.js';
+export { addWorkspaceExtension, buildTransactionContextStatement, defaultWorkspaceExtensionConfig, getCallerTransaction, getWorkspaceContext, injectCreateFields, injectWhereWorkspaceId, maybeSetRlsGuc, maybeTagConnection, resetCallerTransactionStateForTests, runOperationInCallerTransaction, runOperationWithRlsGuc, setWorkspaceContext, withWorkspaceContext, withWorkspaceContextSync } from '../chunk-CYY4VIRK.js';
 export { PrismaClientWrapper, configurePrismaLogging, createConnectionPool, createPrismaAdapter, createPrismaClient, ensureServiceApplicationName, installAcquireRetry, isTransientAcquireError } from '../chunk-L5TDUAFN.js';
 import '../chunk-3AEU6G6V.js';
 import '../chunk-MLBNB5DB.js';

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { W as WorkspaceSecret, I as IActor, J as JWTPayload, S as ServerDefinition, a as ServerInstance, b as ITenant, G as GraphQLContext, Y as YogaPlugin } from '../types-Biv0uaJk.js';
-export { A as ActorProvenance, C as ConsentContext, E as ElysiaApp, c as IContextFilterInput, d as IOperationContext, e as IOrganization, f as IProduct, g as IProject, h as ITracking, i as IWorkspace, M as ModuleGraphConfig, P as PrismaClientConstructor, R as RESTEndpoint, j as ServerConfig, k as ServerI18nConfig, l as ServerInfo, V as VerifiedDelegationContext, m as WspaceGraphQLContext } from '../types-Biv0uaJk.js';
+import { W as WorkspaceSecret, I as IActor, J as JWTPayload, S as ServerDefinition, a as ServerInstance, b as ITenant, G as GraphQLContext, Y as YogaPlugin } from '../types-C-6m9NoG.js';
+export { A as ActorProvenance, C as ConsentContext, E as ElysiaApp, c as IContextFilterInput, d as IOperationContext, e as IOrganization, f as IProduct, g as IProject, h as ITracking, i as IWorkspace, M as ModuleGraphConfig, P as PrismaClientConstructor, R as RESTEndpoint, j as ServerConfig, k as ServerI18nConfig, l as ServerInfo, V as VerifiedDelegationContext, m as WspaceGraphQLContext } from '../types-C-6m9NoG.js';
 import * as jose from 'jose';
 import { VerifyOptions } from 'jsonwebtoken';
 import { I as I18n } from '../i18n-DrdPTann.js';
@@ -7,7 +7,7 @@ import { GraphQLError } from 'graphql';
 export { I as I18nContext, L as LocaleCode } from '../types-C8TbSdEj.js';
 export { P as PrismaClientBase } from '../client-CCXpAZ2r.js';
 import 'graphql-yoga';
-import '../workspace-extension-DlxYz3P4.js';
+import '../workspace-extension-DiNiTLa3.js';
 import '@prisma/adapter-pg';
 import 'pg';
 

package/dist/server/index.js

@@ -1,7 +1,7 @@
 import { createHumanReadableErrorPlugin, formatHttpError, normalizeGraphQLResponse, createHttpErrorResponse } from '../chunk-6GL4SLU7.js';
 export { UserFacingGraphQLError, createHttpErrorResponse, createHumanReadableErrorPlugin, createWorkspaceGuardPlugin, formatHttpError, normalizeError, normalizeExecutionResultErrors, normalizeGraphQLResponse, normalizeGraphQLResponsePayload, toUserFacingGraphQLError } from '../chunk-6GL4SLU7.js';
 import { getWorkspaceQuotaRegistry } from '../chunk-WTEHAVBX.js';
-import { setWorkspaceContext } from '../chunk-FA5ROGTS.js';
+import { setWorkspaceContext } from '../chunk-CYY4VIRK.js';
 import { I18n } from '../chunk-EBDHIL7V.js';
 import { getMetricsRegistry } from '../chunk-AWPNRV3L.js';
 import { ContextManager } from '../chunk-RZOFS2BQ.js';

package/dist/{types-Biv0uaJk.d.ts → types-C-6m9NoG.d.ts}

@@ -1,7 +1,7 @@
 import { GraphQLSchema } from 'graphql';
 import { PubSub } from 'graphql-yoga';
 import { P as PrismaClientBase, a as PrismaClientConstructorOptions } from './client-CCXpAZ2r.js';
-import { W as WorkspaceExtensionConfig } from './workspace-extension-DlxYz3P4.js';
+import { W as WorkspaceExtensionConfig } from './workspace-extension-DiNiTLa3.js';
 import { I as I18nContext, L as LocaleCode } from './types-C8TbSdEj.js';
 
 type ActorProvenance = 'direct_human' | 'delegated' | 'non_human' | 'unknown';

package/dist/{workspace-extension-DlxYz3P4.d.ts → workspace-extension-DiNiTLa3.d.ts}

@@ -46,6 +46,34 @@ type RawPrismaForRlsTransaction = {
     $transaction: <TResult>(fn: (tx: PrismaTxForRlsGuc) => Promise<TResult>) => Promise<TResult>;
 };
 declare function runOperationWithRlsGuc<TResult>(rootClient: RawPrismaForRlsTransaction, wsCtx: WorkspaceContext, model: string, operation: string, args: unknown): Promise<TResult>;
+interface PrismaQueryInternalParams {
+    transaction?: unknown;
+}
+type CallerTransaction = {
+    kind: 'itx';
+    id: string;
+    descriptor: object;
+} | {
+    kind: 'batch';
+};
+declare function getCallerTransaction(internalParams: PrismaQueryInternalParams | undefined): CallerTransaction | undefined;
+interface TransactionContextStatement {
+    sql: string;
+    params: string[];
+    key: string;
+}
+declare function buildTransactionContextStatement(wsCtx: WorkspaceContext, config: Pick<Required<WorkspaceExtensionConfig>, 'enableRlsGucTagging' | 'enableApplicationNameTagging'>): TransactionContextStatement | undefined;
+type PendingRawStatement = PromiseLike<number> & {
+    requestTransaction?: (transaction: object) => PromiseLike<unknown>;
+};
+type RawPrismaForCallerTransaction = {
+    $executeRawUnsafe: (query: string, ...values: unknown[]) => PendingRawStatement;
+};
+declare function runOperationInCallerTransaction<TResult>(rawPrisma: RawPrismaForCallerTransaction, transaction: {
+    id: string;
+    descriptor: object;
+}, wsCtx: WorkspaceContext, config: Pick<Required<WorkspaceExtensionConfig>, 'enableRlsGucTagging' | 'enableApplicationNameTagging'>, run: () => Promise<TResult>): Promise<TResult>;
+declare function resetCallerTransactionStateForTests(): void;
 declare function addWorkspaceExtension<T>(baseClient: T, config?: WorkspaceExtensionConfig): T;
 
-export { type WorkspaceExtensionConfig as W, type WorkspaceContext as a, addWorkspaceExtension as b, injectWhereWorkspaceId as c, defaultWorkspaceExtensionConfig as d, maybeTagConnection as e, withWorkspaceContextSync as f, getWorkspaceContext as g, injectCreateFields as i, maybeSetRlsGuc as m, runOperationWithRlsGuc as r, setWorkspaceContext as s, withWorkspaceContext as w };
+export { type CallerTransaction as C, type PrismaQueryInternalParams as P, type RawPrismaForCallerTransaction as R, type TransactionContextStatement as T, type WorkspaceExtensionConfig as W, type WorkspaceContext as a, addWorkspaceExtension as b, buildTransactionContextStatement as c, defaultWorkspaceExtensionConfig as d, getWorkspaceContext as e, injectWhereWorkspaceId as f, getCallerTransaction as g, maybeTagConnection as h, injectCreateFields as i, runOperationInCallerTransaction as j, runOperationWithRlsGuc as k, withWorkspaceContextSync as l, maybeSetRlsGuc as m, resetCallerTransactionStateForTests as r, setWorkspaceContext as s, withWorkspaceContext as w };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/be-sdk",
-  "version": "2026.1005.1",
+  "version": "2026.1008.1",
   "description": "Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -71,13 +71,15 @@
     "LICENSE"
   ],
   "scripts": {
+    "lake:registry:migrate": "bunx prisma migrate deploy --config prisma.lake.config.ts",
+    "lake:grant:timecampus": "bun scripts/lake-grant-timecampus.ts",
     "deps:check": "bun scripts/deps-mode.ts check",
     "deps:npm": "bun scripts/deps-mode.ts npm",
     "deps:status": "bun scripts/deps-mode.ts status",
     "deps:workspace": "bun scripts/deps-mode.ts workspace",
     "dev": "tsx watch ./src/index.ts",
-    "build": "bash scripts/with-private-swc-cache.sh env NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts --format esm --dts --clean --shims && bun run pack:tgz",
-    "build:watch": "bash scripts/with-private-swc-cache.sh tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts --format esm --dts --watch --shims",
+    "build": "bash scripts/with-private-swc-cache.sh env NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts src/lake/index.ts --format esm --dts --clean --shims && bun run pack:tgz",
+    "build:watch": "bash scripts/with-private-swc-cache.sh tsup src/index.ts src/init/index.ts src/logger/index.ts src/cache/index.ts src/database/index.ts src/event-queue/index.ts src/lifecycle/index.ts src/graph/index.ts src/middleware/index.ts src/observability/index.ts src/graphql/index.ts src/graphql/services/index.ts src/prisma/index.ts src/utils/index.ts src/notifications/index.ts src/tracker/index.ts src/export/index.ts src/dataloader/index.ts src/prisma/generator/index.ts src/server/index.ts src/i18n/index.ts src/instrumentation/index.ts src/rbac/index.ts src/temporal/index.ts src/client/internal-client.ts src/layer/index.ts src/gateway/index.ts src/gateway/security/index.ts src/crypto/index.ts src/feature-flags/index.ts src/telemetry/index.ts src/auth/index.ts src/captcha/index.ts src/metrics/index.ts src/platform/index.ts src/resource-caps/index.ts src/sharding/index.ts src/sharing/index.ts src/validation/index.ts src/product-alias/index.ts src/lake/index.ts --format esm --dts --watch --shims",
     "typecheck": "bash scripts/build-limits.sh tsc --noEmit",
     "lint": "eslint ./src",
     "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint; else bun run lint -- --cache --cache-location .eslintcache; fi",
@@ -87,6 +89,7 @@
     "test": "bun test 2>/dev/null || echo 'No tests found or tests passed'",
     "test:watch": "bun test --watch",
     "test:coverage": "bun test --coverage",
+    "test:live-pg": "bunx prisma generate --schema tests/live-pg/rls-transactions/schema.prisma && bun test tests/live-pg",
     "test:ci": "if ls src/**/*.test.ts 1>/dev/null 2>&1; then bun test; else echo 'No test files found, skipping'; fi",
     "audit": "bun audit",
     "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run format:check && bun run lint:sanity && bun run typecheck && bun run build && bun run test:ci && bun run audit'",
@@ -234,6 +237,7 @@
     "access": "public"
   },
   "overrides": {
+    "@graphql-tools/utils": "12.0.3",
     "hono": "4.13.12",
     "valibot": "1.5.0",
     "protobufjs": "7.6.6",