@creatornader/agent-bridge 0.3.0 → 0.4.0

package/sql/migrations/019_endpoint_migration_same_successor.sql

@@ -0,0 +1,324 @@
+begin;
+
+select pg_advisory_xact_lock(1646705660);
+
+do $preflight$
+begin
+  if not agent_bridge.security_schema_ready() then
+    raise exception 'endpoint migration same-successor preflight requires security readiness';
+  elsif not agent_bridge.owner_control_plane_ready() then
+    raise exception 'endpoint migration same-successor preflight requires owner readiness';
+  elsif not agent_bridge.gateway_authority_ready() then
+    raise exception 'endpoint migration same-successor preflight requires gateway authority readiness';
+  elsif not agent_bridge.endpoint_migration_challenge_ready() then
+    raise exception 'endpoint migration same-successor preflight requires endpoint challenge readiness';
+  end if;
+end
+$preflight$;
+
+alter table agent_bridge.endpoint_migration_challenge_attestations
+  drop constraint endpoint_migration_challenge_attestation_name;
+alter table agent_bridge.endpoint_migration_challenge_attestations
+  add constraint endpoint_migration_challenge_attestation_name
+  check(name in ('endpoint-migration-v1','endpoint-migration-v2'));
+
+create or replace function agent_bridge.issue_endpoint_migration_challenge(
+  requested_expected_gateway_authority_id uuid,
+  requested_verifier_credential_id uuid,
+  requested_challenge text
+) returns table(
+  gateway_authority_id uuid,
+  issuer_credential_id uuid,
+  verifier_credential_id uuid,
+  expires_at timestamptz
+)
+language plpgsql security definer set search_path = '' as $$
+declare
+  authority agent_bridge.request_authorities%rowtype;
+  gateway_id uuid;
+  now_time timestamptz := clock_timestamp();
+  challenge_commitment char(64);
+  existing agent_bridge.endpoint_migration_challenges%rowtype;
+begin
+  if requested_challenge is null or requested_challenge !~ '^[0-9a-f]{64}$' then
+    raise exception using errcode='22023',message='endpoint migration challenge is invalid';
+  end if;
+  select * into authority from agent_bridge.active_request_authority();
+  if not found or authority.authorized_endpoint_migration_operation is distinct from 'issue_endpoint_migration_challenge' then
+    raise exception using errcode='42501',message='endpoint migration issue authorization is required';
+  end if;
+  select authority_id into strict gateway_id from agent_bridge.gateway_authority where singleton;
+  if requested_expected_gateway_authority_id is distinct from gateway_id then
+    raise exception using errcode='28000',message='expected gateway authority does not match';
+  end if;
+  if not agent_bridge.endpoint_migration_challenge_active_credential(
+    authority.credential_id,authority.workspace_id,authority.principal
+  ) or not agent_bridge.endpoint_migration_challenge_active_credential(
+    requested_verifier_credential_id,authority.workspace_id,authority.principal
+  ) or not (
+    authority.credential_id=requested_verifier_credential_id
+    or agent_bridge.endpoint_migration_challenge_direct_lineage(
+      authority.credential_id,requested_verifier_credential_id
+    )
+  ) then
+    raise exception using errcode='28000',message='endpoint migration verifier is not an active successor credential';
+  end if;
+  challenge_commitment := pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
+    'agent-bridge.endpoint-migration-challenge.v1:'||requested_challenge,'UTF8'
+  )),'hex')::character(64);
+  perform agent_bridge.cleanup_endpoint_migration_challenges();
+  select * into existing from agent_bridge.endpoint_migration_challenges
+  where challenge_hash=challenge_commitment for update;
+  if found then
+    if existing.authority_id=gateway_id
+      and existing.workspace_id=authority.workspace_id
+      and existing.principal=authority.principal
+      and existing.issuer_credential_id=authority.credential_id
+      and existing.verifier_credential_id=requested_verifier_credential_id
+      and existing.expires_at>now_time
+      and existing.consumed_at is null then
+      gateway_authority_id := existing.authority_id;
+      issuer_credential_id := existing.issuer_credential_id;
+      verifier_credential_id := existing.verifier_credential_id;
+      expires_at := existing.expires_at;
+      return next;
+      return;
+    end if;
+    raise exception using errcode='23505',message='endpoint migration challenge commitment conflicts with an existing challenge';
+  end if;
+  insert into agent_bridge.endpoint_migration_challenges(
+    challenge_hash,authority_id,workspace_id,principal,issuer_credential_id,verifier_credential_id,expires_at
+  ) values (
+    challenge_commitment,gateway_id,authority.workspace_id,authority.principal,
+    authority.credential_id,requested_verifier_credential_id,now_time+interval '60 seconds'
+  );
+  insert into agent_bridge.endpoint_migration_challenge_events(
+    request_id,event_type,outcome,authority_id,workspace_id,principal,issuer_credential_id,verifier_credential_id
+  ) values (
+    authority.request_id,'issued','succeeded',gateway_id,authority.workspace_id,authority.principal,
+    authority.credential_id,requested_verifier_credential_id
+  );
+  gateway_authority_id := gateway_id;
+  issuer_credential_id := authority.credential_id;
+  verifier_credential_id := requested_verifier_credential_id;
+  expires_at := now_time+interval '60 seconds';
+  return next;
+end
+$$;
+
+create or replace function agent_bridge.consume_endpoint_migration_challenge(
+  requested_expected_gateway_authority_id uuid,
+  requested_issuer_credential_id uuid,
+  requested_challenge text
+) returns table(
+  gateway_authority_id uuid,
+  issuer_credential_id uuid,
+  verifier_credential_id uuid,
+  expires_at timestamptz,
+  consumed boolean
+)
+language plpgsql security definer set search_path = '' as $$
+declare
+  authority agent_bridge.request_authorities%rowtype;
+  gateway_id uuid;
+  challenge agent_bridge.endpoint_migration_challenges%rowtype;
+  challenge_commitment char(64);
+begin
+  if requested_challenge is null or requested_challenge !~ '^[0-9a-f]{64}$' then
+    raise exception using errcode='22023',message='endpoint migration challenge is invalid';
+  end if;
+  select * into authority from agent_bridge.active_request_authority();
+  if not found or authority.authorized_endpoint_migration_operation is distinct from 'consume_endpoint_migration_challenge' then
+    raise exception using errcode='42501',message='endpoint migration consume authorization is required';
+  end if;
+  select authority_id into strict gateway_id from agent_bridge.gateway_authority where singleton;
+  if requested_expected_gateway_authority_id is distinct from gateway_id then
+    raise exception using errcode='28000',message='expected gateway authority does not match';
+  end if;
+  challenge_commitment := pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(
+    'agent-bridge.endpoint-migration-challenge.v1:'||requested_challenge,'UTF8'
+  )),'hex')::character(64);
+  select * into challenge from agent_bridge.endpoint_migration_challenges
+  where challenge_hash=challenge_commitment for update;
+  if not found then
+    gateway_authority_id := gateway_id;
+    issuer_credential_id := requested_issuer_credential_id;
+    verifier_credential_id := authority.credential_id;
+    expires_at := null;
+    consumed := false;
+    return next;
+    return;
+  end if;
+  gateway_authority_id := challenge.authority_id;
+  issuer_credential_id := challenge.issuer_credential_id;
+  verifier_credential_id := challenge.verifier_credential_id;
+  expires_at := challenge.expires_at;
+  consumed := false;
+  if challenge.authority_id is distinct from gateway_id
+    or challenge.authority_id is distinct from requested_expected_gateway_authority_id
+    or challenge.workspace_id is distinct from authority.workspace_id
+    or challenge.principal is distinct from authority.principal
+    or challenge.issuer_credential_id is distinct from requested_issuer_credential_id
+    or challenge.verifier_credential_id is distinct from authority.credential_id
+    or challenge.expires_at<=clock_timestamp()
+    or challenge.consumed_at is not null
+    or not agent_bridge.endpoint_migration_challenge_active_credential(
+      challenge.issuer_credential_id,challenge.workspace_id,challenge.principal
+    )
+    or not agent_bridge.endpoint_migration_challenge_active_credential(
+      authority.credential_id,authority.workspace_id,authority.principal
+    )
+    or not (
+      challenge.issuer_credential_id=authority.credential_id
+      or agent_bridge.endpoint_migration_challenge_direct_lineage(
+        challenge.issuer_credential_id,authority.credential_id
+      )
+    ) then
+    return next;
+    return;
+  end if;
+  update agent_bridge.endpoint_migration_challenges stored
+  set consumed_at=clock_timestamp(),consumed_credential_id=authority.credential_id
+  where stored.challenge_hash=challenge.challenge_hash and stored.consumed_at is null;
+  consumed := found;
+  if consumed then
+    insert into agent_bridge.endpoint_migration_challenge_events(
+      request_id,event_type,outcome,authority_id,workspace_id,principal,issuer_credential_id,verifier_credential_id
+    ) values (
+      authority.request_id,'consumed','succeeded',challenge.authority_id,
+      challenge.workspace_id,challenge.principal,challenge.issuer_credential_id,
+      challenge.verifier_credential_id
+    );
+  end if;
+  return next;
+end
+$$;
+
+create or replace function agent_bridge.endpoint_migration_challenge_ready()
+returns boolean language sql stable security definer set search_path = '' as $$
+  with names as (
+    select ('agent_bridge_runtime_'||substr(md5(current_database()),1,16))::name runtime_role
+  ) select
+    (select count(*)=1 from agent_bridge.endpoint_migration_challenge_attestations where name='endpoint-migration-v1')
+    and (select count(*)=1 and bool_and(catalog_definition=agent_bridge.endpoint_migration_challenge_catalog_definition())
+      from agent_bridge.endpoint_migration_challenge_attestations where name='endpoint-migration-v2')
+    and (select count(*)=1 from agent_bridge.gateway_authority where singleton)
+    and not exists(select 1 from pg_catalog.pg_class relation join pg_catalog.pg_namespace namespace on namespace.oid=relation.relnamespace
+      where namespace.nspname='agent_bridge' and relation.relname in (
+        'endpoint_migration_challenges','endpoint_migration_challenge_events','endpoint_migration_challenge_attestations'
+      ) and (relation.relrowsecurity or relation.relforcerowsecurity))
+    and not exists(select 1 from unnest(array[
+      'agent_bridge.endpoint_migration_challenges','agent_bridge.endpoint_migration_challenge_events',
+      'agent_bridge.endpoint_migration_challenge_attestations'
+    ]) relation_name cross join unnest(array['SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER']) privilege
+      where has_table_privilege('public',relation_name,privilege)
+        or has_table_privilege((select runtime_role from names),relation_name,privilege))
+    and not exists(select 1 from unnest(array[
+      'agent_bridge.endpoint_migration_challenges','agent_bridge.endpoint_migration_challenge_events',
+      'agent_bridge.endpoint_migration_challenge_attestations'
+    ]) relation_name cross join unnest(array['SELECT','INSERT','UPDATE','REFERENCES']) privilege
+      where has_any_column_privilege('public',relation_name,privilege)
+        or has_any_column_privilege((select runtime_role from names),relation_name,privilege))
+    and has_function_privilege((select runtime_role from names),
+      'agent_bridge.issue_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')
+    and has_function_privilege((select runtime_role from names),
+      'agent_bridge.consume_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')
+    and not has_function_privilege('public',
+      'agent_bridge.issue_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')
+    and not has_function_privilege('public',
+      'agent_bridge.consume_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')
+    and not exists(select 1 from pg_catalog.pg_proc procedure join pg_catalog.pg_namespace namespace on namespace.oid=procedure.pronamespace
+      where namespace.nspname='agent_bridge' and procedure.proname in (
+        'cleanup_endpoint_migration_challenges','endpoint_migration_challenge_catalog_definition',
+        'endpoint_migration_challenge_ready','guard_endpoint_migration_challenge',
+        'reject_endpoint_migration_challenge_truncate','reject_endpoint_migration_challenge_event_mutation',
+        'reject_endpoint_migration_challenge_attestation_mutation',
+        'endpoint_migration_challenge_active_credential','endpoint_migration_challenge_direct_lineage'
+      ) and has_function_privilege((select runtime_role from names),procedure.oid,'EXECUTE'))
+$$;
+
+create or replace function agent_bridge.owner_control_plane_ready()
+returns boolean language sql stable security definer set search_path = '' as $$
+  with names as (select
+    ('agent_bridge_control_owner_'||substr(md5(current_database()),1,16))::name owner_role,
+    ('agent_bridge_control_operator_'||substr(md5(current_database()),1,16))::name operator_role,
+    ('agent_bridge_control_auditor_'||substr(md5(current_database()),1,16))::name auditor_role,
+    (select pg_catalog.pg_get_userbyid(nspowner)::name from pg_catalog.pg_namespace where nspname='agent_bridge') schema_owner
+  ), latest_registry as (
+    select distinct on (event.member_role,event.control_role) event.member_role,event.control_role,event.action
+    from agent_bridge.control_membership_events event
+    order by event.member_role,event.control_role,event.sequence desc
+  ), active_registry as (
+    select member_role,control_role from latest_registry where action='register'
+  ), expected_memberships as (
+    select names.owner_role granted_role,names.schema_owner member_role,true admin_option from names
+    union all select names.operator_role,names.schema_owner,true from names
+    union all select names.auditor_role,names.schema_owner,true from names
+    union all select case registry.control_role when 'operator' then names.operator_role else names.auditor_role end,
+      registry.member_role,false from active_registry registry cross join names
+  ), actual_memberships as (
+    select granted.rolname::name granted_role,member.rolname::name member_role,membership.admin_option,
+      coalesce((to_jsonb(membership)->>'inherit_option')::boolean,true) inherit_option,
+      coalesce((to_jsonb(membership)->>'set_option')::boolean,true) set_option
+    from pg_catalog.pg_auth_members membership
+    join pg_catalog.pg_roles granted on granted.oid=membership.roleid
+    join pg_catalog.pg_roles member on member.oid=membership.member
+    where granted.rolname in ((select owner_role from names),(select operator_role from names),(select auditor_role from names))
+  ), authority_closure as (
+    select control_role.granted_role,candidate.rolname::name member_role
+    from names cross join lateral(values(names.owner_role),(names.operator_role),(names.auditor_role)) control_role(granted_role)
+    cross join pg_catalog.pg_roles candidate
+    where candidate.rolname not in(names.owner_role,names.operator_role,names.auditor_role)
+      and(not candidate.rolsuper or candidate.rolname=names.schema_owner)
+      and pg_catalog.pg_has_role(candidate.rolname,control_role.granted_role,'MEMBER')
+  ) select
+    current_setting('server_version_num')::integer/10000=any(array[15,16,17,18])
+    and(select count(*)=1 and bool_and(catalog_definition=agent_bridge.owner_control_attestation_definition())
+      from agent_bridge.owner_control_attestations where name='owner-control-v6')
+    and not exists(
+      (select granted_role,member_role,admin_option from actual_memberships except select granted_role,member_role,admin_option from expected_memberships)
+      union all(select granted_role,member_role,admin_option from expected_memberships except select granted_role,member_role,admin_option from actual_memberships)
+    )
+    and not exists(select 1 from actual_memberships where not inherit_option or not set_option)
+    and not exists(select 1 from active_registry registry left join pg_catalog.pg_roles role_record on role_record.rolname=registry.member_role
+      where role_record.oid is null or not role_record.rolcanlogin or role_record.rolsuper or role_record.rolcreaterole
+        or role_record.rolcreatedb or role_record.rolreplication or role_record.rolbypassrls)
+    and not exists(
+      (select granted_role,member_role from authority_closure except select granted_role,member_role from expected_memberships)
+      union all(select granted_role,member_role from expected_memberships except select granted_role,member_role from authority_closure)
+    )
+    and not exists(select 1 from active_registry registry join pg_catalog.pg_roles inherited on inherited.rolname<>registry.member_role
+      where pg_catalog.pg_has_role(registry.member_role,inherited.rolname,'MEMBER') and not exists(
+        select 1 from active_registry permitted cross join names where permitted.member_role=registry.member_role
+          and inherited.rolname=case permitted.control_role when 'operator' then names.operator_role else names.auditor_role end
+      ))
+    and not exists(select 1 from active_registry registry cross join pg_catalog.pg_roles candidate,names
+      where candidate.rolname not in(registry.member_role,names.schema_owner) and not candidate.rolsuper
+        and pg_catalog.pg_has_role(candidate.rolname,registry.member_role,'MEMBER'))
+$$;
+
+insert into agent_bridge.endpoint_migration_challenge_attestations(name,catalog_definition)
+values('endpoint-migration-v2',agent_bridge.endpoint_migration_challenge_catalog_definition());
+insert into agent_bridge.owner_control_attestations(name,catalog_definition)
+values('owner-control-v6',agent_bridge.owner_control_attestation_definition());
+
+do $final_readiness$
+begin
+  if not agent_bridge.security_schema_ready() then
+    raise exception 'endpoint migration same-successor final security readiness validation failed';
+  elsif not agent_bridge.owner_control_plane_ready() then
+    raise exception 'endpoint migration same-successor final owner readiness validation failed';
+  elsif not agent_bridge.gateway_authority_ready() then
+    raise exception 'endpoint migration same-successor final gateway authority readiness validation failed';
+  elsif not agent_bridge.endpoint_migration_challenge_ready() then
+    raise exception 'endpoint migration same-successor final endpoint readiness validation failed';
+  elsif not agent_bridge.portable_archive_ready() then
+    raise exception 'endpoint migration same-successor final portable archive readiness validation failed';
+  end if;
+end
+$final_readiness$;
+
+insert into agent_bridge.schema_migrations(version,name,checksum)
+values(19,'endpoint_migration_same_successor','__AGENT_BRIDGE_MIGRATION_CHECKSUM__');
+
+commit;

package/dist/chunk-45BZGB77.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/migrations.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readdir, readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { PgQueryable } from \"./postgres-bridge-store.js\";\n\nconst MIGRATION_NAME = /^(\\d+)_([a-z0-9_]+)\\.sql$/;\n// Native DR holds this database-local key with pg_advisory_lock. Migration and\n// Agent Bridge membership mutations take the shared transaction form.\nexport const NATIVE_DR_ADVISORY_LOCK_KEY = 1646705664;\nconst REQUIRED_COLUMNS = new Map([\n  [\"workspaces.id\", \"text\"],\n  [\"agents.id\", \"uuid\"],\n  [\"agents.workspace_id\", \"text\"],\n  [\"agents.principal\", \"text\"],\n  [\"credentials.id\", \"uuid\"],\n  [\"credentials.workspace_id\", \"text\"],\n  [\"credentials.agent_id\", \"uuid\"],\n  [\"credentials.token_hash\", \"bpchar\"],\n  [\"credentials.scopes\", \"_text\"],\n  [\"credentials.scope_set_name\", \"text\"],\n  [\"credentials.replaces_credential_id\", \"uuid\"],\n  [\"credentials.revoked_by\", \"text\"],\n  [\"credentials.revocation_reason\", \"text\"],\n  [\"credentials.expiry_grace_until\", \"timestamptz\"],\n  [\"credential_scope_sets.name\", \"text\"],\n  [\"credential_scope_sets.scopes\", \"_text\"],\n  [\"credential_scope_sets.created_at\", \"timestamptz\"],\n  [\"security_events.sequence\", \"int8\"],\n  [\"security_events.event_id\", \"uuid\"],\n  [\"security_events.event_type\", \"text\"],\n  [\"security_events.outcome\", \"text\"],\n  [\"security_events.reason_code\", \"text\"],\n  [\"security_events.workspace_id\", \"text\"],\n  [\"security_events.principal\", \"text\"],\n  [\"security_events.actor_principal\", \"text\"],\n  [\"security_events.credential_id\", \"uuid\"],\n  [\"security_events.related_credential_id\", \"uuid\"],\n  [\"security_events.operation_id\", \"text\"],\n  [\"security_events.request_id\", \"uuid\"],\n  [\"security_events.policy_id\", \"text\"],\n  [\"security_events.retry_after_seconds\", \"int4\"],\n  [\"security_events.created_at\", \"timestamptz\"],\n  [\"rate_limit_policies.policy_id\", \"text\"],\n  [\"rate_limit_policies.operation_id\", \"text\"],\n  [\"rate_limit_policies.capacity\", \"int4\"],\n  [\"rate_limit_policies.refill_per_second\", \"numeric\"],\n  [\"rate_limit_policies.enabled\", \"bool\"],\n  [\"rate_limit_buckets.credential_id\", \"uuid\"],\n  [\"rate_limit_buckets.policy_id\", \"text\"],\n  [\"rate_limit_buckets.tokens\", \"numeric\"],\n  [\"rate_limit_buckets.updated_at\", \"timestamptz\"],\n  [\"request_authorities.backend_pid\", \"int4\"],\n  [\"request_authorities.transaction_id\", \"xid8\"],\n  [\"request_authorities.request_id\", \"uuid\"],\n  [\"request_authorities.credential_id\", \"uuid\"],\n  [\"request_authorities.workspace_id\", \"text\"],\n  [\"request_authorities.principal\", \"text\"],\n  [\"request_authorities.scopes\", \"_text\"],\n  [\"request_authorities.opened_session_user\", \"name\"],\n  [\"row_isolation_attestations.name\", \"text\"],\n  [\"row_isolation_attestations.catalog_definition\", \"text\"],\n  [\"row_isolation_attestations.attested_at\", \"timestamptz\"],\n  [\"control_requests.request_id\", \"uuid\"],\n  [\"control_requests.operation\", \"text\"],\n  [\"control_requests.fingerprint\", \"bpchar\"],\n  [\"control_requests.actor\", \"name\"],\n  [\"control_requests.result\", \"jsonb\"],\n  [\"control_requests.created_at\", \"timestamptz\"],\n  [\"control_events.sequence\", \"int8\"],\n  [\"control_events.event_id\", \"uuid\"],\n  [\"control_events.request_id\", \"uuid\"],\n  [\"control_events.operation\", \"text\"],\n  [\"control_events.outcome\", \"text\"],\n  [\"control_events.actor\", \"name\"],\n  [\"control_events.workspace_id\", \"text\"],\n  [\"control_events.principal\", \"text\"],\n  [\"control_events.credential_id\", \"uuid\"],\n  [\"control_events.related_credential_id\", \"uuid\"],\n  [\"control_events.reason_code\", \"text\"],\n  [\"control_events.created_at\", \"timestamptz\"],\n  [\"owner_control_attestations.name\", \"text\"],\n  [\"owner_control_attestations.catalog_definition\", \"text\"],\n  [\"owner_control_attestations.attested_at\", \"timestamptz\"],\n  [\"control_membership_events.sequence\", \"int8\"],\n  [\"control_membership_events.request_id\", \"uuid\"],\n  [\"control_membership_events.action\", \"text\"],\n  [\"control_membership_events.member_role\", \"name\"],\n  [\"control_membership_events.control_role\", \"text\"],\n  [\"control_membership_events.actor\", \"name\"],\n  [\"control_membership_events.created_at\", \"timestamptz\"],\n  [\"archive_membership_events.sequence\", \"int8\"],\n  [\"archive_membership_events.request_id\", \"uuid\"],\n  [\"archive_membership_events.action\", \"text\"],\n  [\"archive_membership_events.member_role\", \"name\"],\n  [\"archive_membership_events.actor\", \"name\"],\n  [\"archive_membership_events.created_at\", \"timestamptz\"],\n  [\"archive_operations.sequence\", \"int8\"],\n  [\"archive_operations.request_id\", \"uuid\"],\n  [\"archive_operations.phase\", \"text\"],\n  [\"archive_operations.operation\", \"text\"],\n  [\"archive_operations.workspace\", \"text\"],\n  [\"archive_operations.client_verified_digest\", \"bpchar\"],\n  [\"archive_operations.message_count\", \"int8\"],\n  [\"archive_operations.receipt_count\", \"int8\"],\n  [\"archive_operations.message_inserted_count\", \"int8\"],\n  [\"archive_operations.receipt_inserted_count\", \"int8\"],\n  [\"archive_operations.server_content_binding\", \"bpchar\"],\n  [\"archive_operations.outcome\", \"text\"],\n  [\"archive_operations.failure_code\", \"text\"],\n  [\"archive_operations.published_at\", \"timestamptz\"],\n  [\"archive_operations.apply\", \"bool\"],\n  [\"archive_operations.actor\", \"name\"],\n  [\"archive_operations.created_at\", \"timestamptz\"],\n  [\"archive_operation_batches.sequence\", \"int8\"],\n  [\"archive_operation_batches.request_id\", \"uuid\"],\n  [\"archive_operation_batches.record_kind\", \"text\"],\n  [\"archive_operation_batches.batch_ordinal\", \"int8\"],\n  [\"archive_operation_batches.record_count\", \"int8\"],\n  [\"archive_operation_batches.batch_fingerprint\", \"bpchar\"],\n  [\"archive_operation_batches.chain_binding\", \"bpchar\"],\n  [\"archive_operation_batches.actor\", \"name\"],\n  [\"archive_operation_batches.created_at\", \"timestamptz\"],\n  [\"archive_import_records.sequence\", \"int8\"],\n  [\"archive_import_records.request_id\", \"uuid\"],\n  [\"archive_import_records.record_kind\", \"text\"],\n  [\"archive_import_records.record_key\", \"text\"],\n  [\"archive_import_records.batch_ordinal\", \"int8\"],\n  [\"archive_import_records.semantic_fingerprint\", \"bpchar\"],\n  [\"archive_import_records.inserted\", \"bool\"],\n  [\"archive_import_records.actor\", \"name\"],\n  [\"archive_import_records.created_at\", \"timestamptz\"],\n  [\"archive_transaction_authorizations.backend_pid\", \"int4\"],\n  [\"archive_transaction_authorizations.transaction_id\", \"text\"],\n  [\"archive_transaction_authorizations.request_id\", \"uuid\"],\n  [\"archive_transaction_authorizations.operation\", \"text\"],\n  [\"archive_transaction_authorizations.workspace\", \"text\"],\n  [\"archive_transaction_authorizations.client_verified_digest\", \"bpchar\"],\n  [\"archive_transaction_authorizations.actor\", \"name\"],\n  [\"archive_transaction_authorizations.messages_consumed\", \"bool\"],\n  [\"archive_transaction_authorizations.receipts_consumed\", \"bool\"],\n  [\"archive_transaction_authorizations.created_at\", \"timestamptz\"],\n  [\"portable_archive_attestations.name\", \"text\"],\n  [\"portable_archive_attestations.catalog_definition\", \"text\"],\n  [\"portable_archive_attestations.attested_at\", \"timestamptz\"],\n  [\"messages.sequence\", \"int8\"],\n  [\"messages.id\", \"uuid\"],\n  [\"messages.workspace\", \"text\"],\n  [\"messages.project\", \"text\"],\n  [\"messages.source\", \"text\"],\n  [\"messages.targets\", \"jsonb\"],\n  [\"messages.delivery_mode\", \"text\"],\n  [\"messages.delivery_max_attempts\", \"int4\"],\n  [\"messages.delivery_retry_base_delay_ms\", \"int4\"],\n  [\"messages.delivery_retry_max_delay_ms\", \"int4\"],\n  [\"messages.delivery_retry_jitter_ratio\", \"float8\"],\n  [\"messages.delivery_not_before\", \"timestamptz\"],\n  [\"receipts.workspace\", \"text\"],\n  [\"receipts.message_id\", \"uuid\"],\n  [\"receipts.principal\", \"text\"],\n  [\"deliveries.id\", \"uuid\"],\n  [\"deliveries.message_id\", \"uuid\"],\n  [\"deliveries.workspace\", \"text\"],\n  [\"deliveries.publisher\", \"text\"],\n  [\"deliveries.recipient\", \"text\"],\n  [\"deliveries.state\", \"text\"],\n  [\"deliveries.lease_token\", \"uuid\"],\n  [\"deliveries.created_at\", \"timestamptz\"],\n  [\"deliveries.priority_rank\", \"int2\"],\n  [\"deliveries.cycle_attempt\", \"int4\"],\n  [\"deliveries.requeue_count\", \"int4\"],\n  [\"deliveries.last_actor\", \"text\"],\n  [\"deliveries.last_action\", \"text\"],\n  [\"delivery_events.delivery_id\", \"uuid\"],\n  [\"delivery_events.publisher\", \"text\"],\n  [\"delivery_events.to_state\", \"text\"],\n  [\"delivery_events.cycle_attempt\", \"int4\"],\n  [\"delivery_events.requeue_count\", \"int4\"],\n  [\"delivery_events.actor\", \"text\"],\n  [\"delivery_events.action\", \"text\"],\n  [\"agent_instances.workspace\", \"text\"],\n  [\"agent_instances.instance\", \"text\"],\n  [\"agent_instances.capabilities\", \"jsonb\"],\n]);\n\nexport interface AppliedMigration {\n  version: number;\n  name: string;\n  checksum: string;\n}\n\nexport interface MigrationPlanEntry extends AppliedMigration {\n  source: string;\n}\n\nexport const REQUIRED_MIGRATIONS = [\n  { version: 1, name: \"schema_state\" },\n  { version: 2, name: \"workspaces_agents_credentials\" },\n  { version: 3, name: \"messages_receipts_deliveries\" },\n  { version: 4, name: \"message_query_indexes\" },\n  { version: 5, name: \"delivery_events_presence\" },\n  { version: 6, name: \"legacy_shared_context_import\" },\n  { version: 7, name: \"runtime_role\" },\n  { version: 8, name: \"message_projects\" },\n  { version: 9, name: \"mailbox_query_indexes\" },\n  { version: 10, name: \"publisher_delivery_policy\" },\n  { version: 11, name: \"credential_security\" },\n  { version: 12, name: \"request_authority\" },\n  { version: 13, name: \"row_isolation\" },\n  { version: 14, name: \"owner_control_plane\" },\n  { version: 15, name: \"portable_archives\" },\n  { version: 16, name: \"native_dr_fence\" },\n] as const;\n\nfunction withNativeDrSharedLock(source: string): string {\n  if (!/^begin;\\s/i.test(source)) {\n    throw new Error(\"migration must begin with an explicit transaction\");\n  }\n  return source.replace(\n    /^begin;\\s/i,\n    `begin;\\n\\nselect pg_advisory_xact_lock_shared(${NATIVE_DR_ADVISORY_LOCK_KEY});\\n\\n`,\n  );\n}\n\nfunction checksum(source: string): string {\n  return createHash(\"sha256\").update(source, \"utf8\").digest(\"hex\");\n}\n\nasync function recordedMigrations(db: PgQueryable): Promise<AppliedMigration[]> {\n  const exists = await db.query<{ table_name: string | null }>(\n    \"SELECT to_regclass('agent_bridge.schema_migrations')::text AS table_name\",\n  );\n  if (!exists.rows[0]?.table_name) return [];\n  const result = await db.query<{ version: number; name: string; checksum: string }>(\n    \"SELECT version, name, checksum FROM agent_bridge.schema_migrations ORDER BY version\",\n  );\n  return result.rows.map((row) => ({\n    version: Number(row.version),\n    name: row.name,\n    checksum: row.checksum,\n  }));\n}\n\nexport async function loadMigrationPlan(directory: string): Promise<MigrationPlanEntry[]> {\n  const files = (await readdir(directory))\n    .filter((file) => MIGRATION_NAME.test(file))\n    .sort((left, right) => left.localeCompare(right));\n  const expected = await Promise.all(files.map(async (file) => {\n    const match = file.match(MIGRATION_NAME)!;\n    const source = await readFile(join(directory, file), \"utf8\");\n    return { version: Number(match[1]), name: match[2], source, checksum: checksum(source) };\n  }));\n\n  if (\n    expected.length !== REQUIRED_MIGRATIONS.length ||\n    !expected.every(\n      (migration, index) =>\n        migration.version === REQUIRED_MIGRATIONS[index]?.version &&\n        migration.name === REQUIRED_MIGRATIONS[index]?.name,\n    )\n  ) {\n    throw new Error(\"migration directory does not match the required migration sequence\");\n  }\n  return expected;\n}\n\nexport async function migrationsReady(\n  db: PgQueryable,\n  expected: ReadonlyArray<Pick<MigrationPlanEntry, \"version\" | \"name\" | \"checksum\">>,\n): Promise<boolean> {\n  const applied = await recordedMigrations(db);\n  return expected.every(\n    (required, index) =>\n      applied[index]?.version === required.version &&\n      applied[index]?.name === required.name &&\n      applied[index]?.checksum === required.checksum,\n  ) && applied.length === expected.length;\n}\n\nexport async function rowIsolationReady(db: PgQueryable, allowPrivilegedCaller: boolean): Promise<boolean> {\n  const result = await db.query<{\n    rolesReady: boolean;\n    callerReady: boolean;\n    callerBypasses: boolean;\n    ownershipReady: boolean;\n    policiesReady: boolean;\n    functionsReady: boolean;\n    constraintsReady: boolean;\n    triggersReady: boolean;\n    grantsReady: boolean;\n    catalogReady: boolean;\n  }>(`WITH names AS (\n      SELECT\n        ('agent_bridge_runtime_' || substr(md5(current_database()),1,16))::name AS runtime_role,\n        ('agent_bridge_data_owner_' || substr(md5(current_database()),1,16))::name AS data_owner,\n        ('agent_bridge_context_reader_' || substr(md5(current_database()),1,16))::name AS context_reader,\n        ('agent_bridge_event_writer_' || substr(md5(current_database()),1,16))::name AS event_writer\n    ), required_roles(role_name) AS (\n      SELECT runtime_role FROM names UNION ALL SELECT data_owner FROM names\n      UNION ALL SELECT context_reader FROM names UNION ALL SELECT event_writer FROM names\n    ), domain_tables(table_name) AS (\n      VALUES ('messages'),('receipts'),('deliveries'),('delivery_events'),('agent_instances')\n    ), caller_role AS (\n      SELECT * FROM pg_roles WHERE rolname=current_user\n    ), expected_policies(table_name,policy_name,command_name,role_name,needs_workspace,needs_principal) AS (\n      SELECT 'messages','messages_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'messages','messages_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'messages','messages_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'receipts','receipts_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'receipts','receipts_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'receipts','receipts_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_update','w',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_writer_insert','a',event_writer::text,false,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_select','r',runtime_role::text,true,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_update','w',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_delete','d',runtime_role::text,true,true FROM names\n    ), actual_policies AS (\n      SELECT relation.relname AS table_name,policy.polname AS policy_name,\n        policy.polcmd AS command_name,policy.polpermissive,\n        ARRAY(SELECT role.rolname::text FROM unnest(policy.polroles) member(oid)\n          JOIN pg_roles role ON role.oid=member.oid ORDER BY role.rolname) AS role_names,\n        coalesce(pg_get_expr(policy.polqual,policy.polrelid),'') || ' ' ||\n          coalesce(pg_get_expr(policy.polwithcheck,policy.polrelid),'') AS expressions\n      FROM pg_policy policy\n      JOIN pg_class relation ON relation.oid=policy.polrelid\n      JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n      WHERE namespace.nspname='agent_bridge'\n        AND relation.relname IN (SELECT table_name FROM domain_tables)\n    )\n    SELECT\n      (SELECT count(*)=4 AND bool_and(\n          role.rolname=(required.role_name::text)\n          AND NOT role.rolcanlogin AND NOT role.rolsuper AND NOT role.rolcreatedb\n          AND NOT role.rolcreaterole AND NOT role.rolreplication AND NOT role.rolbypassrls\n        )\n       FROM required_roles required JOIN pg_roles role ON role.rolname=required.role_name::text) AS \"rolesReady\",\n      ((SELECT rolsuper OR rolbypassrls FROM caller_role) OR (\n        (SELECT rolcanlogin AND rolinherit AND NOT rolsuper AND NOT rolcreatedb\n           AND NOT rolcreaterole AND NOT rolreplication AND NOT rolbypassrls\n         FROM caller_role)\n        AND pg_has_role(current_user,(SELECT runtime_role FROM names),'MEMBER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_roles unexpected\n          WHERE unexpected.oid<>(SELECT oid FROM caller_role)\n            AND unexpected.rolname<>(SELECT runtime_role::text FROM names)\n            AND pg_has_role(current_user,unexpected.oid,'MEMBER')\n        )\n      )) AS \"callerReady\",\n      EXISTS (\n        SELECT 1 FROM pg_roles elevated\n        WHERE (elevated.rolsuper OR elevated.rolbypassrls)\n          AND pg_has_role(current_user,elevated.oid,'MEMBER')\n      ) AS \"callerBypasses\",\n      (SELECT count(*)=5 AND bool_and(\n          relation.relrowsecurity AND relation.relforcerowsecurity\n          AND owner.rolname=(SELECT data_owner::text FROM names)\n        )\n       FROM domain_tables required\n       JOIN pg_namespace namespace ON namespace.nspname='agent_bridge'\n       JOIN pg_class relation ON relation.relnamespace=namespace.oid AND relation.relname=required.table_name\n       JOIN pg_roles owner ON owner.oid=relation.relowner)\n        AND EXISTS (\n          SELECT 1 FROM pg_class attestation\n          JOIN pg_namespace namespace ON namespace.oid=attestation.relnamespace\n          WHERE namespace.nspname='agent_bridge'\n            AND attestation.relname='row_isolation_attestations'\n            AND attestation.relowner=namespace.nspowner\n        ) AS \"ownershipReady\",\n      ((SELECT count(*) FROM actual_policies)=18 AND NOT EXISTS (\n        SELECT 1 FROM expected_policies expected\n        LEFT JOIN actual_policies actual\n          ON actual.table_name=expected.table_name AND actual.policy_name=expected.policy_name\n        WHERE actual.policy_name IS NULL OR actual.command_name<>expected.command_name\n          OR NOT actual.polpermissive OR actual.role_names<>ARRAY[expected.role_name]\n          OR (expected.needs_workspace AND position('current_request_workspace' in actual.expressions)=0)\n          OR (expected.needs_principal AND position('current_request_principal' in actual.expressions)=0)\n          OR (NOT expected.needs_workspace AND NOT expected.needs_principal\n            AND position('true' in actual.expressions)=0)\n      )) AS \"policiesReady\",\n      (SELECT count(*)=4 AND bool_and(\n          procedure.proconfig @> ARRAY['search_path=\"\"']::text[]\n          AND CASE procedure.proname\n            WHEN 'record_delivery_event' THEN owner.rolname=(SELECT event_writer::text FROM names)\n              AND procedure.prosecdef AND procedure.provolatile='v'\n            WHEN 'row_isolation_catalog_definition' THEN\n              owner.oid=(SELECT relation.relowner FROM pg_class relation\n                JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n                WHERE namespace.nspname='agent_bridge'\n                  AND relation.relname='row_isolation_attestations')\n              AND NOT procedure.prosecdef AND procedure.provolatile='s'\n            ELSE owner.rolname=(SELECT context_reader::text FROM names)\n              AND procedure.prosecdef AND procedure.provolatile='s'\n          END\n        )\n       FROM pg_proc procedure\n       JOIN pg_namespace namespace ON namespace.oid=procedure.pronamespace\n       JOIN pg_roles owner ON owner.oid=procedure.proowner\n       WHERE namespace.nspname='agent_bridge'\n         AND procedure.proname IN (\n           'current_request_workspace','current_request_principal',\n           'record_delivery_event','row_isolation_catalog_definition'\n         ))\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_proc private_function\n          JOIN pg_namespace private_namespace ON private_namespace.oid=private_function.pronamespace\n          WHERE private_namespace.nspname='agent_bridge'\n            AND has_function_privilege('public',private_function.oid,'EXECUTE')\n        )\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.current_request_workspace()','EXECUTE')\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.current_request_principal()','EXECUTE')\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_catalog_definition()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_delivery_event()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.reject_delivery_identity_mutation()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.enforce_delivery_actor_role()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.reject_delivery_event_mutation()','EXECUTE')\n        AS \"functionsReady\",\n      ((SELECT count(*)=5 AND bool_and(constraint_record.convalidated)\n       FROM (VALUES\n          ('agent_bridge.messages'::regclass,'messages_workspace_id_source_unique'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_publisher_message_fk'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_event_identity_unique'),\n          ('agent_bridge.delivery_events'::regclass,'delivery_events_delivery_publisher_fk'),\n          ('agent_bridge.row_isolation_attestations'::regclass,'row_isolation_attestation_name')\n       ) required(relation_id,constraint_name)\n       JOIN pg_constraint constraint_record\n         ON constraint_record.conrelid=required.relation_id\n        AND constraint_record.conname=required.constraint_name)\n        AND (SELECT count(*)=2 AND bool_and(attribute.attnotnull)\n          FROM pg_attribute attribute\n          WHERE (attribute.attrelid,attribute.attname) IN (\n            ('agent_bridge.deliveries'::regclass,'publisher'),\n            ('agent_bridge.delivery_events'::regclass,'publisher')\n          ) AND attribute.attnum>0 AND NOT attribute.attisdropped)\n      ) AS \"constraintsReady\",\n      (SELECT count(*)=4 AND bool_and(trigger.tgenabled='O')\n       FROM (VALUES\n          ('agent_bridge.deliveries'::regclass,'deliveries_record_event'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_identity_immutable'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_actor_role'),\n          ('agent_bridge.delivery_events'::regclass,'delivery_events_append_only')\n       ) required(relation_id,trigger_name)\n       JOIN pg_trigger trigger ON trigger.tgrelid=required.relation_id\n        AND trigger.tgname=required.trigger_name AND NOT trigger.tgisinternal) AS \"triggersReady\",\n      (has_schema_privilege((SELECT runtime_role FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT runtime_role FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT data_owner FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT data_owner FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT context_reader FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT context_reader FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT event_writer FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT event_writer FROM names),'agent_bridge','CREATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','INSERT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','INSERT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','INSERT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','UPDATE')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events','SELECT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','INSERT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','UPDATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','DELETE')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','TRUNCATE,REFERENCES,TRIGGER')\n        AND has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.messages_sequence_seq','USAGE')\n        AND NOT has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.messages_sequence_seq','SELECT,UPDATE')\n        AND NOT has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events_sequence_seq','USAGE,SELECT,UPDATE')\n        AND has_table_privilege((SELECT context_reader FROM names),'agent_bridge.request_authorities','SELECT')\n        AND NOT has_table_privilege((SELECT context_reader FROM names),'agent_bridge.request_authorities','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events','INSERT')\n        AND NOT has_table_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events','SELECT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_class relation\n          JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n          WHERE namespace.nspname='agent_bridge' AND relation.relkind IN ('r','p','v','m','f')\n            AND (\n              (relation.relname<>'request_authorities' AND has_table_privilege(\n                (SELECT context_reader FROM names),relation.oid,\n                'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER'\n              ))\n              OR (relation.relname<>'delivery_events' AND has_table_privilege(\n                (SELECT event_writer FROM names),relation.oid,\n                'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER'\n              ))\n            )\n        )\n        AND has_sequence_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events_sequence_seq','USAGE')\n        AND NOT has_sequence_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events_sequence_seq','SELECT,UPDATE')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_class sequence\n          JOIN pg_namespace namespace ON namespace.oid=sequence.relnamespace\n          WHERE namespace.nspname='agent_bridge' AND sequence.relkind='S'\n            AND (\n              has_sequence_privilege((SELECT context_reader FROM names),sequence.oid,'USAGE,SELECT,UPDATE')\n              OR (sequence.relname<>'delivery_events_sequence_seq' AND has_sequence_privilege(\n                (SELECT event_writer FROM names),sequence.oid,'USAGE,SELECT,UPDATE'\n              ))\n            )\n        )\n        AND NOT has_sequence_privilege('public','agent_bridge.messages_sequence_seq','USAGE,SELECT,UPDATE')\n        AND NOT has_sequence_privilege('public','agent_bridge.delivery_events_sequence_seq','USAGE,SELECT,UPDATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_attestations','SELECT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_attestations','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT EXISTS (\n          SELECT 1\n          FROM unnest(ARRAY[\n            'agent_bridge.credentials','agent_bridge.agents',\n            'agent_bridge.workspaces','agent_bridge.request_authorities'\n          ]) protected_table(value)\n          CROSS JOIN unnest(ARRAY[\n            'SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER'\n          ]) requested_privilege(value)\n          WHERE has_table_privilege(\n            (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n          )\n        )\n        AND NOT EXISTS (\n          SELECT 1\n          FROM unnest(ARRAY[\n            'agent_bridge.credentials','agent_bridge.agents',\n            'agent_bridge.workspaces','agent_bridge.request_authorities'\n          ]) protected_table(value)\n          CROSS JOIN unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) requested_privilege(value)\n          WHERE has_any_column_privilege(\n            (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n          )\n        )\n        AND NOT has_table_privilege('public','agent_bridge.row_isolation_attestations','SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT data_owner FROM names),'MEMBER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT context_reader FROM names),'MEMBER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT event_writer FROM names),'MEMBER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_proc private_function\n          JOIN pg_namespace namespace ON namespace.oid=private_function.pronamespace\n          WHERE namespace.nspname='agent_bridge'\n            AND (\n              (NOT (private_function.proname IN ('current_request_workspace','current_request_principal')\n                    AND private_function.pronargs=0)\n                AND has_function_privilege((SELECT context_reader FROM names),private_function.oid,'EXECUTE'))\n              OR (NOT (private_function.proname='record_delivery_event' AND private_function.pronargs=0)\n                AND has_function_privilege((SELECT event_writer FROM names),private_function.oid,'EXECUTE'))\n            )\n        )\n      ) AS \"grantsReady\",\n      (SELECT count(*)=1 AND bool_and(\n          attestation.catalog_definition=agent_bridge.row_isolation_catalog_definition()\n        )\n       FROM agent_bridge.row_isolation_attestations attestation\n       WHERE attestation.name='domain-v1') AS \"catalogReady\"\n  `);\n  const row = result.rows[0];\n  const callerReady = row?.callerReady && (allowPrivilegedCaller || !row.callerBypasses);\n  return Boolean(\n    row?.rolesReady && callerReady && row.ownershipReady && row.policiesReady &&\n    row.functionsReady && row.constraintsReady && row.triggersReady && row.grantsReady && row.catalogReady\n  );\n}\n\nexport async function runtimeSchemaReady(\n  db: PgQueryable,\n  options: { allowPrivilegedCaller?: boolean } = {},\n): Promise<boolean> {\n  const columns = await db.query<{ table_name: string; column_name: string; udt_name: string }>(\n    `SELECT relation.relname AS table_name, attribute.attname AS column_name,\n       type.typname AS udt_name\n     FROM pg_catalog.pg_attribute attribute\n     JOIN pg_catalog.pg_class relation ON relation.oid=attribute.attrelid\n     JOIN pg_catalog.pg_namespace namespace ON namespace.oid=relation.relnamespace\n     JOIN pg_catalog.pg_type type ON type.oid=attribute.atttypid\n     WHERE namespace.nspname='agent_bridge'\n       AND attribute.attnum>0 AND NOT attribute.attisdropped`,\n  );\n  const actual = new Map(\n    columns.rows.map((row) => [`${row.table_name}.${row.column_name}`, row.udt_name]),\n  );\n  if ([...REQUIRED_COLUMNS].some(([name, type]) => actual.get(name) !== type)) return false;\n\n  const objects = await db.query<{ immutable: boolean; deliveryAudit: boolean; idempotency: boolean; claim: boolean; publisher: boolean; terminal: boolean; source: boolean; thread: boolean; created: boolean; presence: boolean; project: boolean; targets: boolean; scopeSets: boolean; securityEvents: boolean; ratePolicies: boolean; rateBuckets: boolean; replacement: boolean; rateCleanup: boolean; credentialSecurity: boolean; eventAppendOnly: boolean; scopeAudit: boolean; rateConsume: boolean; securityReady: boolean; requestAuthorities: boolean; authorityOpen: boolean; authorityClose: boolean; credentialDigestHidden: boolean; authorityRowsHidden: boolean; principalTablesHidden: boolean; authorityTablesLocked: boolean; authorityCatalog: boolean }>(\n    `WITH names AS (\n       SELECT ('agent_bridge_runtime_' || substr(md5(current_database()),1,16))::name AS runtime_role\n     ) SELECT\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid='agent_bridge.messages'::regclass\n           AND tgname='messages_immutable' AND NOT tgisinternal\n       ) AS immutable,\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid='agent_bridge.deliveries'::regclass\n           AND tgname='deliveries_record_event' AND NOT tgisinternal\n       ) AS \"deliveryAudit\",\n       to_regclass('agent_bridge.messages_idempotency') IS NOT NULL AS idempotency,\n       to_regclass('agent_bridge.deliveries_claim') IS NOT NULL AS claim,\n       to_regclass('agent_bridge.deliveries_publisher_lookup') IS NOT NULL AS publisher,\n       to_regclass('agent_bridge.deliveries_terminal_lookup') IS NOT NULL AS terminal,\n       to_regclass('agent_bridge.messages_source') IS NOT NULL AS source,\n       to_regclass('agent_bridge.messages_thread') IS NOT NULL AS thread,\n       to_regclass('agent_bridge.messages_created') IS NOT NULL AS created,\n       to_regclass('agent_bridge.messages_project') IS NOT NULL AS project,\n       to_regclass('agent_bridge.messages_targets_gin') IS NOT NULL AS targets,\n       to_regclass('agent_bridge.agent_instances_active') IS NOT NULL AS presence,\n       to_regclass('agent_bridge.credential_scope_sets') IS NOT NULL AS \"scopeSets\",\n       to_regclass('agent_bridge.security_events') IS NOT NULL AS \"securityEvents\",\n       to_regclass('agent_bridge.rate_limit_policies') IS NOT NULL AS \"ratePolicies\",\n       to_regclass('agent_bridge.rate_limit_buckets') IS NOT NULL AS \"rateBuckets\",\n       to_regclass('agent_bridge.credentials_replacement_lineage') IS NOT NULL AS replacement,\n       to_regclass('agent_bridge.rate_limit_buckets_cleanup') IS NOT NULL AS \"rateCleanup\",\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid=to_regclass('agent_bridge.credentials')\n           AND tgname='credentials_validate_security' AND NOT tgisinternal\n       ) AS \"credentialSecurity\",\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid=to_regclass('agent_bridge.security_events')\n           AND tgname='security_events_append_only' AND NOT tgisinternal\n       ) AS \"eventAppendOnly\",\n       to_regprocedure('agent_bridge.record_scope_denial(uuid,text,uuid)') IS NOT NULL AS \"scopeAudit\",\n       to_regprocedure('agent_bridge.consume_rate_limit(uuid,text,uuid)') IS NOT NULL AS \"rateConsume\",\n       to_regprocedure('agent_bridge.security_schema_ready()') IS NOT NULL AS \"securityReady\",\n       to_regclass('agent_bridge.request_authorities') IS NOT NULL AS \"requestAuthorities\",\n       to_regprocedure('agent_bridge.open_request_authority(uuid,text,uuid)') IS NOT NULL\n         AND to_regprocedure('agent_bridge.resolve_credential_hash(text)') IS NOT NULL AS \"authorityOpen\",\n       to_regprocedure('agent_bridge.close_request_authority()') IS NOT NULL AS \"authorityClose\",\n       NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.credentials','SELECT') AS \"credentialDigestHidden\",\n       NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.request_authorities','SELECT') AS \"authorityRowsHidden\",\n       (NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agents','SELECT')\n         AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.workspaces','SELECT')) AS \"principalTablesHidden\",\n       (\n         NOT EXISTS (\n           SELECT 1\n           FROM unnest(ARRAY[\n             'agent_bridge.credentials','agent_bridge.agents',\n             'agent_bridge.workspaces','agent_bridge.request_authorities'\n           ]) protected_table(value)\n           CROSS JOIN unnest(ARRAY[\n             'SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER'\n           ]) requested_privilege(value)\n           WHERE has_table_privilege(\n             (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n           )\n         )\n         AND NOT EXISTS (\n           SELECT 1\n           FROM unnest(ARRAY[\n             'agent_bridge.credentials','agent_bridge.agents',\n             'agent_bridge.workspaces','agent_bridge.request_authorities'\n           ]) protected_table(value)\n           CROSS JOIN unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) requested_privilege(value)\n           WHERE has_any_column_privilege(\n             (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n           )\n         )\n       ) AS \"authorityTablesLocked\",\n       (\n         has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.resolve_credential_hash(text)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.open_request_authority(uuid,text,uuid)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.close_request_authority()','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_scope_denial(uuid,text,uuid)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.consume_rate_limit(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.active_request_authority()','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.assert_active_request_credential(uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_scope_denial_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.consume_rate_limit_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.resolve_credential_hash(text)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.open_request_authority(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.close_request_authority()','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.record_scope_denial(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.consume_rate_limit(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.record_scope_denial_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.consume_rate_limit_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT EXISTS (\n           SELECT 1 FROM pg_proc procedure\n           JOIN pg_namespace namespace ON namespace.oid=procedure.pronamespace\n           WHERE namespace.nspname='agent_bridge'\n             AND procedure.proname IN (\n               'resolve_credential_hash','open_request_authority','active_request_authority',\n               'assert_active_request_credential','close_request_authority','record_scope_denial',\n               'consume_rate_limit','record_scope_denial_unbound_011','consume_rate_limit_unbound_011'\n             )\n             AND (\n               NOT procedure.prosecdef\n               OR procedure.proowner <> (SELECT nspowner FROM pg_namespace WHERE nspname='agent_bridge')\n               OR NOT coalesce(procedure.proconfig @> ARRAY['search_path=\"\"'],false)\n             )\n         )\n       ) AS \"authorityCatalog\"`,\n  );\n  const row = objects.rows[0];\n  if (!Boolean(\n    row?.immutable && row.deliveryAudit && row.idempotency && row.claim && row.publisher &&\n    row.terminal && row.source && row.thread && row.created && row.presence && row.project &&\n    row.targets && row.scopeSets && row.securityEvents && row.ratePolicies && row.rateBuckets &&\n    row.replacement && row.rateCleanup && row.credentialSecurity && row.eventAppendOnly &&\n    row.scopeAudit && row.rateConsume && row.securityReady && row.requestAuthorities &&\n    row.authorityOpen && row.authorityClose && row.credentialDigestHidden && row.authorityRowsHidden &&\n    row.principalTablesHidden && row.authorityTablesLocked && row.authorityCatalog\n  )) return false;\n  try {\n    const security = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.security_schema_ready() AS ready\",\n    );\n    const ownerControl = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.owner_control_plane_ready() AS ready\",\n    );\n    const portableArchive = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.portable_archive_ready() AS ready\",\n    );\n    return security.rows[0]?.ready === true && ownerControl.rows[0]?.ready === true &&\n      portableArchive.rows[0]?.ready === true && await rowIsolationReady(\n      db,\n      options.allowPrivilegedCaller === true,\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport async function runMigrations(\n  db: PgQueryable,\n  directory: string,\n): Promise<AppliedMigration[]> {\n  const expected = await loadMigrationPlan(directory);\n\n  for (const migration of expected) {\n    const applied = await recordedMigrations(db);\n    const recorded = applied.find((entry) => entry.version === migration.version);\n    if (recorded) {\n      if (recorded.name !== migration.name || recorded.checksum !== migration.checksum) {\n        throw new Error(`migration ${migration.version}_${migration.name} conflicts with schema state`);\n      }\n      continue;\n    }\n    await db.query(withNativeDrSharedLock(\n      migration.source.split(\"__AGENT_BRIDGE_MIGRATION_CHECKSUM__\").join(migration.checksum),\n    ));\n    const verified = (await recordedMigrations(db)).find(\n      (entry) => entry.version === migration.version,\n    );\n    if (verified?.name !== migration.name || verified.checksum !== migration.checksum) {\n      throw new Error(`migration ${migration.version}_${migration.name} was not recorded correctly`);\n    }\n  }\n\n  return recordedMigrations(db);\n}\n"],"mappings":";;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS,gBAAgB;AAClC,SAAS,YAAY;AAGrB,IAAM,iBAAiB;AAGhB,IAAM,8BAA8B;AAC3C,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B,CAAC,iBAAiB,MAAM;AAAA,EACxB,CAAC,aAAa,MAAM;AAAA,EACpB,CAAC,uBAAuB,MAAM;AAAA,EAC9B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,kBAAkB,MAAM;AAAA,EACzB,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,0BAA0B,QAAQ;AAAA,EACnC,CAAC,sBAAsB,OAAO;AAAA,EAC9B,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,kCAAkC,aAAa;AAAA,EAChD,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,gCAAgC,OAAO;AAAA,EACxC,CAAC,oCAAoC,aAAa;AAAA,EAClD,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,uCAAuC,MAAM;AAAA,EAC9C,CAAC,8BAA8B,aAAa;AAAA,EAC5C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,yCAAyC,SAAS;AAAA,EACnD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6BAA6B,SAAS;AAAA,EACvC,CAAC,iCAAiC,aAAa;AAAA,EAC/C,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,kCAAkC,MAAM;AAAA,EACzC,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,8BAA8B,OAAO;AAAA,EACtC,CAAC,2CAA2C,MAAM;AAAA,EAClD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,0CAA0C,aAAa;AAAA,EACxD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,gCAAgC,QAAQ;AAAA,EACzC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,2BAA2B,OAAO;AAAA,EACnC,CAAC,+BAA+B,aAAa;AAAA,EAC7C,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,6BAA6B,aAAa;AAAA,EAC3C,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,0CAA0C,aAAa;AAAA,EACxD,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,0CAA0C,MAAM;AAAA,EACjD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6CAA6C,QAAQ;AAAA,EACtD,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,6CAA6C,MAAM;AAAA,EACpD,CAAC,6CAA6C,MAAM;AAAA,EACpD,CAAC,6CAA6C,QAAQ;AAAA,EACtD,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,mCAAmC,aAAa;AAAA,EACjD,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,iCAAiC,aAAa;AAAA,EAC/C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,2CAA2C,MAAM;AAAA,EAClD,CAAC,0CAA0C,MAAM;AAAA,EACjD,CAAC,+CAA+C,QAAQ;AAAA,EACxD,CAAC,2CAA2C,QAAQ;AAAA,EACpD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,+CAA+C,QAAQ;AAAA,EACxD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,qCAAqC,aAAa;AAAA,EACnD,CAAC,kDAAkD,MAAM;AAAA,EACzD,CAAC,qDAAqD,MAAM;AAAA,EAC5D,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,6DAA6D,QAAQ;AAAA,EACtE,CAAC,4CAA4C,MAAM;AAAA,EACnD,CAAC,wDAAwD,MAAM;AAAA,EAC/D,CAAC,wDAAwD,MAAM;AAAA,EAC/D,CAAC,iDAAiD,aAAa;AAAA,EAC/D,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,oDAAoD,MAAM;AAAA,EAC3D,CAAC,6CAA6C,aAAa;AAAA,EAC3D,CAAC,qBAAqB,MAAM;AAAA,EAC5B,CAAC,eAAe,MAAM;AAAA,EACtB,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,mBAAmB,MAAM;AAAA,EAC1B,CAAC,oBAAoB,OAAO;AAAA,EAC5B,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,kCAAkC,MAAM;AAAA,EACzC,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,wCAAwC,QAAQ;AAAA,EACjD,CAAC,gCAAgC,aAAa;AAAA,EAC9C,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,uBAAuB,MAAM;AAAA,EAC9B,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,iBAAiB,MAAM;AAAA,EACxB,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,yBAAyB,aAAa;AAAA,EACvC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,OAAO;AAC1C,CAAC;AAYM,IAAM,sBAAsB;AAAA,EACjC,EAAE,SAAS,GAAG,MAAM,eAAe;AAAA,EACnC,EAAE,SAAS,GAAG,MAAM,gCAAgC;AAAA,EACpD,EAAE,SAAS,GAAG,MAAM,+BAA+B;AAAA,EACnD,EAAE,SAAS,GAAG,MAAM,wBAAwB;AAAA,EAC5C,EAAE,SAAS,GAAG,MAAM,2BAA2B;AAAA,EAC/C,EAAE,SAAS,GAAG,MAAM,+BAA+B;AAAA,EACnD,EAAE,SAAS,GAAG,MAAM,eAAe;AAAA,EACnC,EAAE,SAAS,GAAG,MAAM,mBAAmB;AAAA,EACvC,EAAE,SAAS,GAAG,MAAM,wBAAwB;AAAA,EAC5C,EAAE,SAAS,IAAI,MAAM,4BAA4B;AAAA,EACjD,EAAE,SAAS,IAAI,MAAM,sBAAsB;AAAA,EAC3C,EAAE,SAAS,IAAI,MAAM,oBAAoB;AAAA,EACzC,EAAE,SAAS,IAAI,MAAM,gBAAgB;AAAA,EACrC,EAAE,SAAS,IAAI,MAAM,sBAAsB;AAAA,EAC3C,EAAE,SAAS,IAAI,MAAM,oBAAoB;AAAA,EACzC,EAAE,SAAS,IAAI,MAAM,kBAAkB;AACzC;AAEA,SAAS,uBAAuB,QAAwB;AACtD,MAAI,CAAC,aAAa,KAAK,MAAM,GAAG;AAC9B,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA;AAAA,sCAAiD,2BAA2B;AAAA;AAAA;AAAA,EAC9E;AACF;AAEA,SAAS,SAAS,QAAwB;AACxC,SAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,MAAM,EAAE,OAAO,KAAK;AACjE;AAEA,eAAe,mBAAmB,IAA8C;AAC9E,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,KAAK,CAAC,GAAG,WAAY,QAAO,CAAC;AACzC,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,EACF;AACA,SAAO,OAAO,KAAK,IAAI,CAAC,SAAS;AAAA,IAC/B,SAAS,OAAO,IAAI,OAAO;AAAA,IAC3B,MAAM,IAAI;AAAA,IACV,UAAU,IAAI;AAAA,EAChB,EAAE;AACJ;AAEA,eAAsB,kBAAkB,WAAkD;AACxF,QAAM,SAAS,MAAM,QAAQ,SAAS,GACnC,OAAO,CAAC,SAAS,eAAe,KAAK,IAAI,CAAC,EAC1C,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAClD,QAAM,WAAW,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO,SAAS;AAC3D,UAAM,QAAQ,KAAK,MAAM,cAAc;AACvC,UAAM,SAAS,MAAM,SAAS,KAAK,WAAW,IAAI,GAAG,MAAM;AAC3D,WAAO,EAAE,SAAS,OAAO,MAAM,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,QAAQ,UAAU,SAAS,MAAM,EAAE;AAAA,EACzF,CAAC,CAAC;AAEF,MACE,SAAS,WAAW,oBAAoB,UACxC,CAAC,SAAS;AAAA,IACR,CAAC,WAAW,UACV,UAAU,YAAY,oBAAoB,KAAK,GAAG,WAClD,UAAU,SAAS,oBAAoB,KAAK,GAAG;AAAA,EACnD,GACA;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,gBACpB,IACA,UACkB;AAClB,QAAM,UAAU,MAAM,mBAAmB,EAAE;AAC3C,SAAO,SAAS;AAAA,IACd,CAAC,UAAU,UACT,QAAQ,KAAK,GAAG,YAAY,SAAS,WACrC,QAAQ,KAAK,GAAG,SAAS,SAAS,QAClC,QAAQ,KAAK,GAAG,aAAa,SAAS;AAAA,EAC1C,KAAK,QAAQ,WAAW,SAAS;AACnC;AAEA,eAAsB,kBAAkB,IAAiB,uBAAkD;AACzG,QAAM,SAAS,MAAM,GAAG,MAWrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GA6QF;AACD,QAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAM,cAAc,KAAK,gBAAgB,yBAAyB,CAAC,IAAI;AACvE,SAAO;AAAA,IACL,KAAK,cAAc,eAAe,IAAI,kBAAkB,IAAI,iBAC5D,IAAI,kBAAkB,IAAI,oBAAoB,IAAI,iBAAiB,IAAI,eAAe,IAAI;AAAA,EAC5F;AACF;AAEA,eAAsB,mBACpB,IACA,UAA+C,CAAC,GAC9B;AAClB,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQF;AACA,QAAM,SAAS,IAAI;AAAA,IACjB,QAAQ,KAAK,IAAI,CAACA,SAAQ,CAAC,GAAGA,KAAI,UAAU,IAAIA,KAAI,WAAW,IAAIA,KAAI,QAAQ,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,GAAG,gBAAgB,EAAE,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,IAAI,EAAG,QAAO;AAEpF,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6GF;AACA,QAAM,MAAM,QAAQ,KAAK,CAAC;AAC1B,MAAI,CAAC;AAAA,IACH,KAAK,aAAa,IAAI,iBAAiB,IAAI,eAAe,IAAI,SAAS,IAAI,aAC3E,IAAI,YAAY,IAAI,UAAU,IAAI,UAAU,IAAI,WAAW,IAAI,YAAY,IAAI,WAC/E,IAAI,WAAW,IAAI,aAAa,IAAI,kBAAkB,IAAI,gBAAgB,IAAI,eAC9E,IAAI,eAAe,IAAI,eAAe,IAAI,sBAAsB,IAAI,mBACpE,IAAI,cAAc,IAAI,eAAe,IAAI,iBAAiB,IAAI,sBAC9D,IAAI,iBAAiB,IAAI,kBAAkB,IAAI,0BAA0B,IAAI,uBAC7E,IAAI,yBAAyB,IAAI,yBAAyB,IAAI;AAAA,EAChE,EAAG,QAAO;AACV,MAAI;AACF,UAAM,WAAW,MAAM,GAAG;AAAA,MACxB;AAAA,IACF;AACA,UAAM,eAAe,MAAM,GAAG;AAAA,MAC5B;AAAA,IACF;AACA,UAAM,kBAAkB,MAAM,GAAG;AAAA,MAC/B;AAAA,IACF;AACA,WAAO,SAAS,KAAK,CAAC,GAAG,UAAU,QAAQ,aAAa,KAAK,CAAC,GAAG,UAAU,QACzE,gBAAgB,KAAK,CAAC,GAAG,UAAU,QAAQ,MAAM;AAAA,MACjD;AAAA,MACA,QAAQ,0BAA0B;AAAA,IACpC;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,cACpB,IACA,WAC6B;AAC7B,QAAM,WAAW,MAAM,kBAAkB,SAAS;AAElD,aAAW,aAAa,UAAU;AAChC,UAAM,UAAU,MAAM,mBAAmB,EAAE;AAC3C,UAAM,WAAW,QAAQ,KAAK,CAAC,UAAU,MAAM,YAAY,UAAU,OAAO;AAC5E,QAAI,UAAU;AACZ,UAAI,SAAS,SAAS,UAAU,QAAQ,SAAS,aAAa,UAAU,UAAU;AAChF,cAAM,IAAI,MAAM,aAAa,UAAU,OAAO,IAAI,UAAU,IAAI,8BAA8B;AAAA,MAChG;AACA;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,MACb,UAAU,OAAO,MAAM,qCAAqC,EAAE,KAAK,UAAU,QAAQ;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,mBAAmB,EAAE,GAAG;AAAA,MAC9C,CAAC,UAAU,MAAM,YAAY,UAAU;AAAA,IACzC;AACA,QAAI,UAAU,SAAS,UAAU,QAAQ,SAAS,aAAa,UAAU,UAAU;AACjF,YAAM,IAAI,MAAM,aAAa,UAAU,OAAO,IAAI,UAAU,IAAI,6BAA6B;AAAA,IAC/F;AAAA,EACF;AAEA,SAAO,mBAAmB,EAAE;AAC9B;","names":["row"]}