@hasna/infinity 0.1.0

package/dist/self-hosted-migrate.js

@@ -0,0 +1,2064 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/persistence/self-hosted-migrate-main.ts
+var {SQL } = globalThis.Bun;
+
+// src/authority/mutation-journal.ts
+import {
+  createPublicKey,
+  generateKeyPairSync,
+  sign as signDetached,
+  verify as verifyDetached
+} from "crypto";
+
+// src/core/errors.ts
+class InfinityError extends Error {
+  code;
+  status;
+  retryable;
+  details;
+  constructor(code, message, options = {}) {
+    super(message, { cause: options.cause });
+    this.name = "InfinityError";
+    this.code = code;
+    this.status = options.status ?? 400;
+    this.retryable = options.retryable ?? false;
+    this.details = Object.freeze({ ...options.details ?? {} });
+  }
+}
+
+// src/core/validation.ts
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function closedObject(value, label, required, optional = []) {
+  if (!isPlainObject(value))
+    throw invalid(`${label} must be an object`);
+  const allowed = new Set([...required, ...optional]);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key))
+      throw invalid(`${label} contains an unknown field`);
+  }
+  for (const key of required) {
+    if (!Object.hasOwn(value, key))
+      throw invalid(`${label}.${key} is required`);
+  }
+  return value;
+}
+function stringValue(value, label, options = {}) {
+  if (typeof value !== "string")
+    throw invalid(`${label} must be a string`);
+  if (value.normalize("NFC") !== value)
+    throw invalid(`${label} must use NFC normalization`);
+  if (value.length < (options.min ?? 1))
+    throw invalid(`${label} is too short`);
+  if (value.length > (options.max ?? 256))
+    throw invalid(`${label} is too long`);
+  if (options.pattern && !options.pattern.test(value))
+    throw invalid(`${label} has an invalid format`);
+  return value;
+}
+var IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9:_-]*$/;
+var DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+var CREDENTIAL_CARRIER_PATTERN_SOURCE = "^(?:[sS][kK]-[A-Za-z0-9]|[gG][hH][pPoOuUsSrR]_|[gG][iI][tT][hH][uU][bB]_[pP][aA][tT]_|[xX][oO][xX][bBaApPrRsS]-|[aA][kKsS][iI][aA][0-9A-Za-z]|[aA][iI][zZ][aA]|[nN][pP][mM]_|[xX][aA][iI]-|[cC][tT][xX]7[sS][kK]-)";
+var CREDENTIAL_CARRIER_PATTERN = new RegExp(CREDENTIAL_CARRIER_PATTERN_SOURCE);
+function identifier(value, label) {
+  const parsed = stringValue(value, label, { max: 96, pattern: IDENTIFIER_PATTERN });
+  if (CREDENTIAL_CARRIER_PATTERN.test(parsed)) {
+    throw invalid(`${label} resembles credential material and is not a valid public identifier`);
+  }
+  if (parsed.length > 48 && /^[A-Za-z0-9]+$/.test(parsed)) {
+    throw invalid(`${label} is an unstructured high-entropy secret-carrier candidate`);
+  }
+  return parsed;
+}
+function digest(value, label) {
+  return stringValue(value, label, { min: 71, max: 71, pattern: DIGEST_PATTERN });
+}
+function positiveInteger(value, label, maximum = Number.MAX_SAFE_INTEGER) {
+  if (!Number.isSafeInteger(value) || value <= 0 || value > maximum) {
+    throw invalid(`${label} must be a positive safe integer`);
+  }
+  return value;
+}
+function enumValue(value, label, values) {
+  if (typeof value !== "string" || !values.includes(value)) {
+    throw invalid(`${label} must be one of ${values.join(", ")}`);
+  }
+  return value;
+}
+var RFC3339_MILLIS = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function timestamp(value, label) {
+  const parsed = stringValue(value, label, { min: 24, max: 24, pattern: RFC3339_MILLIS });
+  const millis = Date.parse(parsed);
+  if (!Number.isFinite(millis) || new Date(millis).toISOString() !== parsed) {
+    throw invalid(`${label} must be a canonical UTC timestamp`);
+  }
+  return parsed;
+}
+function invalid(message) {
+  return new InfinityError("invalid_input", message, { status: 2 });
+}
+function deepFreeze(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const nested of Object.values(value))
+      deepFreeze(nested);
+  }
+  return value;
+}
+
+// src/core/int64.ts
+var INT64_MAX = 9223372036854775807n;
+function positiveInt64(value, label) {
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value) || value <= 0)
+      throw invalid(`${label} must be a positive signed 64-bit integer`);
+    return value;
+  }
+  if (typeof value === "bigint" && value > 0n && value <= INT64_MAX) {
+    return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value;
+  }
+  throw invalid(`${label} must be a positive signed 64-bit integer`);
+}
+function nonnegativeInt64(value, label) {
+  if (typeof value === "number") {
+    if (!Number.isSafeInteger(value) || value < 0)
+      throw invalid(`${label} must be a nonnegative signed 64-bit integer`);
+    return value;
+  }
+  if (typeof value === "bigint" && value >= 0n && value <= INT64_MAX) {
+    return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value;
+  }
+  throw invalid(`${label} must be a nonnegative signed 64-bit integer`);
+}
+function incrementInt64(value, label) {
+  const incremented = BigInt(value) + 1n;
+  if (incremented > INT64_MAX)
+    throw invalid(`${label} reached signed 64-bit exhaustion`);
+  return incremented <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(incremented) : incremented;
+}
+function int64Equal(left, right) {
+  return BigInt(left) === BigInt(right);
+}
+
+// src/core/strict-json.ts
+import { createHash } from "crypto";
+var strictDocuments = new WeakSet;
+var strictDocumentDigests = new WeakMap;
+
+class StrictJsonParser {
+  source;
+  index = 0;
+  constructor(source) {
+    this.source = source;
+  }
+  parse() {
+    this.skipWhitespace();
+    const value = this.parseValue();
+    this.skipWhitespace();
+    if (this.index !== this.source.length)
+      throw invalid(`JSON has trailing data at byte ${this.index}`);
+    if (value !== null && typeof value === "object")
+      strictDocumentDigests.set(value, digestCanonical(value));
+    return value;
+  }
+  parseValue() {
+    this.skipWhitespace();
+    const char = this.source[this.index];
+    if (char === "{")
+      return this.parseObject();
+    if (char === "[")
+      return this.parseArray();
+    if (char === '"')
+      return this.parseString();
+    if (char === "t")
+      return this.parseLiteral("true", true);
+    if (char === "f")
+      return this.parseLiteral("false", false);
+    if (char === "n")
+      return this.parseLiteral("null", null);
+    if (char === "-" || char !== undefined && char >= "0" && char <= "9")
+      return this.parseNumber();
+    throw invalid(`invalid JSON value at byte ${this.index}`);
+  }
+  parseObject() {
+    this.index += 1;
+    const result = Object.create(null);
+    const seen = new Set;
+    this.skipWhitespace();
+    if (this.source[this.index] === "}") {
+      this.index += 1;
+      strictDocuments.add(result);
+      strictDocumentDigests.set(result, digestCanonical(result));
+      return result;
+    }
+    while (true) {
+      this.skipWhitespace();
+      if (this.source[this.index] !== '"')
+        throw invalid(`object key expected at byte ${this.index}`);
+      const key = this.parseString();
+      if (seen.has(key))
+        throw invalid("duplicate JSON key");
+      seen.add(key);
+      this.skipWhitespace();
+      if (this.source[this.index] !== ":")
+        throw invalid(`':' expected after object key at byte ${this.index}`);
+      this.index += 1;
+      result[key] = this.parseValue();
+      this.skipWhitespace();
+      const delimiter = this.source[this.index];
+      if (delimiter === "}") {
+        this.index += 1;
+        strictDocuments.add(result);
+        strictDocumentDigests.set(result, digestCanonical(result));
+        return result;
+      }
+      if (delimiter !== ",")
+        throw invalid(`',' or '}' expected at byte ${this.index}`);
+      this.index += 1;
+    }
+  }
+  parseArray() {
+    this.index += 1;
+    const result = [];
+    this.skipWhitespace();
+    if (this.source[this.index] === "]") {
+      this.index += 1;
+      strictDocuments.add(result);
+      strictDocumentDigests.set(result, digestCanonical(result));
+      return result;
+    }
+    while (true) {
+      result.push(this.parseValue());
+      this.skipWhitespace();
+      const delimiter = this.source[this.index];
+      if (delimiter === "]") {
+        this.index += 1;
+        strictDocuments.add(result);
+        strictDocumentDigests.set(result, digestCanonical(result));
+        return result;
+      }
+      if (delimiter !== ",")
+        throw invalid(`',' or ']' expected at byte ${this.index}`);
+      this.index += 1;
+    }
+  }
+  parseString() {
+    const start = this.index;
+    this.index += 1;
+    let escaped = false;
+    while (this.index < this.source.length) {
+      const char = this.source[this.index];
+      if (escaped) {
+        escaped = false;
+        this.index += 1;
+        continue;
+      }
+      if (char === "\\") {
+        escaped = true;
+        this.index += 1;
+        continue;
+      }
+      if (char === '"') {
+        this.index += 1;
+        let value;
+        try {
+          value = JSON.parse(this.source.slice(start, this.index));
+        } catch (error) {
+          throw invalid(`invalid JSON string at byte ${start}`);
+        }
+        if (value.normalize("NFC") !== value)
+          throw invalid(`JSON strings must use NFC normalization at byte ${start}`);
+        if (hasUnpairedSurrogate(value))
+          throw invalid(`JSON strings must not contain unpaired surrogates at byte ${start}`);
+        return value;
+      }
+      if (char !== undefined && char.charCodeAt(0) < 32)
+        throw invalid(`control character in JSON string at byte ${this.index}`);
+      this.index += 1;
+    }
+    throw invalid(`unterminated JSON string at byte ${start}`);
+  }
+  parseNumber() {
+    const rest = this.source.slice(this.index);
+    const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(rest);
+    if (!match)
+      throw invalid(`invalid JSON number at byte ${this.index}`);
+    const token = match[0];
+    this.index += token.length;
+    if (!/[.eE]/.test(token)) {
+      if (token === "-0")
+        throw invalid("negative zero is not canonical JSON");
+      const integer = BigInt(token);
+      if (integer >= BigInt(Number.MIN_SAFE_INTEGER) && integer <= BigInt(Number.MAX_SAFE_INTEGER))
+        return Number(integer);
+      return integer;
+    }
+    const value = Number(token);
+    if (!Number.isFinite(value))
+      throw invalid(`JSON number must be finite at byte ${this.index - token.length}`);
+    if (Object.is(value, -0))
+      throw invalid("negative zero is not canonical JSON");
+    const significand = token.split(/[eE]/, 1)[0] ?? token;
+    if (value === 0 && /[1-9]/.test(significand))
+      throw invalid("JSON number underflow would lose information");
+    if (JSON.stringify(value) !== token)
+      throw invalid("JSON number is non-canonical or loses information");
+    return value;
+  }
+  parseLiteral(token, value) {
+    if (!this.source.startsWith(token, this.index))
+      throw invalid(`invalid JSON literal at byte ${this.index}`);
+    this.index += token.length;
+    return value;
+  }
+  skipWhitespace() {
+    while (this.index < this.source.length && /[\t\n\r ]/.test(this.source[this.index] ?? ""))
+      this.index += 1;
+  }
+}
+function parseStrictJson(source) {
+  return new StrictJsonParser(source).parse();
+}
+function canonicalJson(value) {
+  if (value === null)
+    return "null";
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "string") {
+    if (value.normalize("NFC") !== value)
+      throw invalid("canonical JSON strings must use NFC normalization");
+    if (hasUnpairedSurrogate(value))
+      throw invalid("canonical JSON strings must not contain unpaired surrogates");
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || Object.is(value, -0))
+      throw invalid("canonical JSON numbers must be finite and not negative zero");
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+      throw invalid("canonical JSON integer Numbers must be safe integers; use bigint for exact wider values");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "bigint")
+    return value.toString(10);
+  if (Array.isArray(value)) {
+    for (let index = 0;index < value.length; index += 1) {
+      if (!Object.hasOwn(value, index))
+        throw invalid("canonical JSON arrays must not be sparse");
+    }
+    return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
+  }
+  if (!isPlainObject(value))
+    throw invalid("canonical JSON accepts only JSON-compatible values");
+  const entries = Object.keys(value).sort().map((key) => {
+    if (key.normalize("NFC") !== key)
+      throw invalid("canonical JSON keys must use NFC normalization");
+    if (hasUnpairedSurrogate(key))
+      throw invalid("canonical JSON keys must not contain unpaired surrogates");
+    const nested = value[key];
+    if (nested === undefined)
+      throw invalid("canonical JSON object contains an undefined field");
+    return `${JSON.stringify(key)}:${canonicalJson(nested)}`;
+  });
+  return `{${entries.join(",")}}`;
+}
+function hasUnpairedSurrogate(value) {
+  for (let index = 0;index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343))
+        return true;
+      index += 1;
+    } else if (unit >= 56320 && unit <= 57343) {
+      return true;
+    }
+  }
+  return false;
+}
+function digestCanonical(value) {
+  return `sha256:${createHash("sha256").update(canonicalJson(value), "utf8").digest("hex")}`;
+}
+
+// src/authority/mutation-journal.ts
+var AUTHORITY_MUTATION_ENVELOPE_SCHEMA_VERSION = "infinity.authority-mutation-reconstruction/v1";
+var AUTHORITY_MUTATION_ANCHOR_SCHEMA_VERSION = "infinity.authority-mutation-journal-anchor/v1";
+var AUTHORITY_MUTATION_ACK_SCHEMA_VERSION = "infinity.authority-mutation-journal-ack/v1";
+var AUTHORITY_MUTATION_RANGE_SCHEMA_VERSION = "infinity.authority-mutation-journal-range/v1";
+var AUTHORITY_MUTATION_PROTECTION_SCHEMA_VERSION = "infinity.authority-mutation-journal-protection/v1";
+var MAXIMUM_ENVELOPE_BYTES = 16 * 1024 * 1024;
+var MAXIMUM_CHANGES = 1e5;
+class Ed25519AuthorityMutationJournalVerifier {
+  signerPrincipal;
+  signingKeyId;
+  publicKey;
+  verificationKeyDigest;
+  constructor(signerPrincipal, signingKeyId, publicKey, publicKeySpki) {
+    this.signerPrincipal = signerPrincipal;
+    this.signingKeyId = signingKeyId;
+    this.publicKey = publicKey;
+    this.verificationKeyDigest = digestCanonical({
+      algorithm: "Ed25519",
+      public_key_spki: publicKeySpki
+    });
+  }
+  static fromSpki(signerPrincipal, signingKeyId, publicKeySpki) {
+    const principal = identifier(signerPrincipal, "authority_mutation_journal.signer_principal");
+    const keyId = identifier(signingKeyId, "authority_mutation_journal.signing_key_id");
+    const encoded = stringValue(publicKeySpki, "authority_mutation_journal.public_key_spki", {
+      min: 40,
+      max: 256,
+      pattern: /^[A-Za-z0-9_-]+$/
+    });
+    let key;
+    try {
+      key = createPublicKey({ key: Buffer.from(encoded, "base64url"), format: "der", type: "spki" });
+    } catch (error) {
+      throw new InfinityError("invalid_input", "authority mutation journal public key is invalid", { cause: error });
+    }
+    if (key.asymmetricKeyType !== "ed25519")
+      throw new InfinityError("invalid_input", "authority mutation journal key must be Ed25519");
+    return new Ed25519AuthorityMutationJournalVerifier(principal, keyId, key, encoded);
+  }
+  verifyAnchor(value) {
+    const input = closedObject(value, "authority_mutation_anchor", [
+      "anchor_schema_version",
+      "journal_sequence",
+      "prior_frontier_digest",
+      "record_digest",
+      "frontier_digest",
+      "signer_principal",
+      "signing_key_id",
+      "signature",
+      "record"
+    ]);
+    const record = parseAuthorityMutationEnvelope(input.record);
+    const parsed = {
+      anchor_schema_version: enumValue(input.anchor_schema_version, "authority_mutation_anchor.anchor_schema_version", [AUTHORITY_MUTATION_ANCHOR_SCHEMA_VERSION]),
+      journal_sequence: positiveInt64(input.journal_sequence, "authority_mutation_anchor.journal_sequence"),
+      prior_frontier_digest: nullableDigest(input.prior_frontier_digest, "authority_mutation_anchor.prior_frontier_digest"),
+      record_digest: digest(input.record_digest, "authority_mutation_anchor.record_digest"),
+      frontier_digest: digest(input.frontier_digest, "authority_mutation_anchor.frontier_digest"),
+      signer_principal: identifier(input.signer_principal, "authority_mutation_anchor.signer_principal"),
+      signing_key_id: identifier(input.signing_key_id, "authority_mutation_anchor.signing_key_id"),
+      signature: stringValue(input.signature, "authority_mutation_anchor.signature", { min: 80, max: 128, pattern: /^[A-Za-z0-9_-]+$/ }),
+      record
+    };
+    if (parsed.signer_principal !== this.signerPrincipal || parsed.signing_key_id !== this.signingKeyId) {
+      throw new InfinityError("integrity_failure", "authority mutation journal signer is not trusted");
+    }
+    if (!int64Equal(parsed.journal_sequence, record.commit_sequence)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal sequence differs from commit sequence");
+    }
+    if (parsed.record_digest !== digestCanonical(record)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal record digest mismatch");
+    }
+    const unsigned = unsignedAnchor(parsed);
+    if (parsed.frontier_digest !== digestCanonical(unsigned)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal frontier digest mismatch");
+    }
+    if (!verifySignature(this.publicKey, canonicalJson({ ...unsigned, frontier_digest: parsed.frontier_digest }), parsed.signature)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal anchor signature is invalid");
+    }
+    return deepFreeze(parsed);
+  }
+  verifyAcknowledgement(value) {
+    const input = closedObject(value, "authority_mutation_ack", [
+      "ack_schema_version",
+      "acknowledged_through",
+      "frontier_digest",
+      "journal_id",
+      "protection_digest",
+      "restore_domain_id",
+      "encrypted_at_rest",
+      "signer_principal",
+      "signing_key_id",
+      "signature"
+    ]);
+    const parsed = {
+      ack_schema_version: enumValue(input.ack_schema_version, "authority_mutation_ack.ack_schema_version", [AUTHORITY_MUTATION_ACK_SCHEMA_VERSION]),
+      acknowledged_through: positiveInt64(input.acknowledged_through, "authority_mutation_ack.acknowledged_through"),
+      frontier_digest: digest(input.frontier_digest, "authority_mutation_ack.frontier_digest"),
+      journal_id: identifier(input.journal_id, "authority_mutation_ack.journal_id"),
+      protection_digest: digest(input.protection_digest, "authority_mutation_ack.protection_digest"),
+      restore_domain_id: identifier(input.restore_domain_id, "authority_mutation_ack.restore_domain_id"),
+      encrypted_at_rest: input.encrypted_at_rest === true ? true : (() => {
+        throw new InfinityError("integrity_failure", "authority mutation journal acknowledgement is not encrypted-at-rest bound");
+      })(),
+      signer_principal: identifier(input.signer_principal, "authority_mutation_ack.signer_principal"),
+      signing_key_id: identifier(input.signing_key_id, "authority_mutation_ack.signing_key_id"),
+      signature: stringValue(input.signature, "authority_mutation_ack.signature", { min: 80, max: 128, pattern: /^[A-Za-z0-9_-]+$/ })
+    };
+    if (parsed.signer_principal !== this.signerPrincipal || parsed.signing_key_id !== this.signingKeyId) {
+      throw new InfinityError("integrity_failure", "authority mutation journal acknowledgement signer is not trusted");
+    }
+    if (!verifySignature(this.publicKey, canonicalJson(unsignedAcknowledgement(parsed)), parsed.signature)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal acknowledgement signature is invalid");
+    }
+    return deepFreeze(parsed);
+  }
+  verifyAppendReceipt(value) {
+    const input = closedObject(value, "authority_mutation_append_receipt", ["anchor", "ack"]);
+    const anchor = this.verifyAnchor(input.anchor);
+    const ack = this.verifyAcknowledgement(input.ack);
+    if (!int64Equal(anchor.journal_sequence, ack.acknowledged_through) || anchor.frontier_digest !== ack.frontier_digest) {
+      throw new InfinityError("integrity_failure", "authority mutation acknowledgement does not bind its anchor");
+    }
+    return deepFreeze({ anchor, ack });
+  }
+  verifyRange(value) {
+    const input = closedObject(value, "authority_mutation_range", [
+      "range_schema_version",
+      "from_sequence",
+      "through_sequence",
+      "prior_frontier_digest",
+      "receipts",
+      "head",
+      "journal_id",
+      "protection_digest",
+      "signer_principal",
+      "signing_key_id",
+      "signature"
+    ]);
+    if (!Array.isArray(input.receipts) || input.receipts.length > 1000) {
+      throw new InfinityError("invalid_input", "authority mutation journal range receipts must be a bounded array");
+    }
+    const fromSequence = positiveInt64(input.from_sequence, "authority_mutation_range.from_sequence");
+    const receipts = input.receipts.map((receipt) => this.verifyAppendReceipt(receipt));
+    const head = input.head === null ? null : this.verifyAcknowledgement(input.head);
+    const parsed = {
+      range_schema_version: enumValue(input.range_schema_version, "authority_mutation_range.range_schema_version", [AUTHORITY_MUTATION_RANGE_SCHEMA_VERSION]),
+      from_sequence: fromSequence,
+      through_sequence: nonnegativeInt64(input.through_sequence, "authority_mutation_range.through_sequence"),
+      prior_frontier_digest: nullableDigest(input.prior_frontier_digest, "authority_mutation_range.prior_frontier_digest"),
+      receipts,
+      head,
+      journal_id: identifier(input.journal_id, "authority_mutation_range.journal_id"),
+      protection_digest: digest(input.protection_digest, "authority_mutation_range.protection_digest"),
+      signer_principal: identifier(input.signer_principal, "authority_mutation_range.signer_principal"),
+      signing_key_id: identifier(input.signing_key_id, "authority_mutation_range.signing_key_id"),
+      signature: stringValue(input.signature, "authority_mutation_range.signature", { min: 80, max: 128, pattern: /^[A-Za-z0-9_-]+$/ })
+    };
+    if (parsed.signer_principal !== this.signerPrincipal || parsed.signing_key_id !== this.signingKeyId) {
+      throw new InfinityError("integrity_failure", "authority mutation journal range signer is not trusted");
+    }
+    if (head && (head.journal_id !== parsed.journal_id || head.protection_digest !== parsed.protection_digest)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal range protection differs from its signed head");
+    }
+    if (receipts.some((receipt) => receipt.ack.journal_id !== parsed.journal_id || receipt.ack.protection_digest !== parsed.protection_digest)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal range members differ from its protection binding");
+    }
+    let expected = fromSequence;
+    let prior = parsed.prior_frontier_digest;
+    for (const receipt of receipts) {
+      if (!int64Equal(receipt.anchor.journal_sequence, expected) || receipt.anchor.prior_frontier_digest !== prior) {
+        throw new InfinityError("integrity_failure", "authority mutation journal signed range is not contiguous");
+      }
+      prior = receipt.anchor.frontier_digest;
+      expected = incrementInt64(expected, "authority_mutation_range.sequence");
+    }
+    const expectedThrough = receipts.length === 0 ? BigInt(fromSequence) - 1n : receipts.at(-1).anchor.journal_sequence;
+    if (!int64Equal(parsed.through_sequence, expectedThrough)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal range through sequence differs from its members");
+    }
+    if (head) {
+      if (BigInt(head.acknowledged_through) < BigInt(parsed.through_sequence) || int64Equal(head.acknowledged_through, parsed.through_sequence) && head.frontier_digest !== prior) {
+        throw new InfinityError("integrity_failure", "authority mutation journal range head does not cover its members");
+      }
+    } else if (!int64Equal(parsed.through_sequence, 0)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal nonempty range lacks a signed head");
+    }
+    if (!verifySignature(this.publicKey, canonicalJson(unsignedRange(parsed)), parsed.signature)) {
+      throw new InfinityError("integrity_failure", "authority mutation journal range signature is invalid");
+    }
+    return deepFreeze(parsed);
+  }
+}
+
+class InMemoryAuthorityMutationJournal {
+  signer;
+  verifier;
+  receipts = new Map;
+  frontier = 0;
+  frontierDigest = null;
+  available = true;
+  protection;
+  constructor(signer, protection) {
+    this.signer = signer;
+    const unsignedProtection = {
+      protection_schema_version: AUTHORITY_MUTATION_PROTECTION_SCHEMA_VERSION,
+      journal_id: identifier(digestCanonical({
+        kind: "transient-authority-mutation-journal",
+        signer_principal: signer.signerPrincipal,
+        signing_key_id: signer.signingKeyId
+      }), "authority_mutation_journal.journal_id"),
+      restore_domain_id: identifier(protection.restore_domain_id, "authority_mutation_journal.restore_domain_id"),
+      encrypted_at_rest: protection.encrypted_at_rest,
+      durability: "transient",
+      signer_principal: signer.signerPrincipal,
+      signing_key_id: signer.signingKeyId
+    };
+    this.protection = deepFreeze({
+      ...unsignedProtection,
+      protection_digest: authorityMutationJournalProtectionDigest(unsignedProtection)
+    });
+    if (!this.protection.encrypted_at_rest)
+      throw new InfinityError("capability_denied", "authority mutation journal must be encrypted at rest", { status: 503 });
+    this.verifier = Ed25519AuthorityMutationJournalVerifier.fromSpki(signer.signerPrincipal, signer.signingKeyId, signer.publicKeySpki());
+  }
+  setAvailable(available) {
+    this.available = available;
+  }
+  describe() {
+    return this.journalProtection();
+  }
+  journalProtection() {
+    return this.protection;
+  }
+  append(value) {
+    this.requireAvailable();
+    const envelope = parseAuthorityMutationEnvelope(value);
+    const key = BigInt(envelope.commit_sequence).toString(10);
+    const prior = this.receipts.get(key);
+    if (prior) {
+      this.verifyStoredReceipt(prior);
+      if (canonicalJson(prior.anchor.record) !== canonicalJson(envelope)) {
+        throw new InfinityError("integrity_failure", "authority mutation journal sequence has conflicting immutable bytes");
+      }
+      return prior;
+    }
+    this.verifyContiguousFrontier();
+    const expected = incrementInt64(this.frontier, "authority_mutation_journal.frontier");
+    if (!int64Equal(envelope.commit_sequence, expected)) {
+      throw new InfinityError("state_conflict", "authority mutation journal append must extend the contiguous frontier", { status: 409 });
+    }
+    const recordDigest = digestCanonical(envelope);
+    const unsigned = {
+      anchor_schema_version: AUTHORITY_MUTATION_ANCHOR_SCHEMA_VERSION,
+      journal_sequence: expected,
+      prior_frontier_digest: this.frontierDigest,
+      record_digest: recordDigest,
+      signer_principal: this.signer.signerPrincipal,
+      signing_key_id: this.signer.signingKeyId
+    };
+    const frontierDigest = digestCanonical(unsigned);
+    const anchor = {
+      ...unsigned,
+      frontier_digest: frontierDigest,
+      signature: this.signer.sign(canonicalJson({ ...unsigned, frontier_digest: frontierDigest })),
+      record: envelope
+    };
+    const protection = this.journalProtection();
+    const unsignedAck = {
+      ack_schema_version: AUTHORITY_MUTATION_ACK_SCHEMA_VERSION,
+      acknowledged_through: expected,
+      frontier_digest: frontierDigest,
+      journal_id: protection.journal_id,
+      protection_digest: protection.protection_digest,
+      restore_domain_id: protection.restore_domain_id,
+      encrypted_at_rest: true,
+      signer_principal: this.signer.signerPrincipal,
+      signing_key_id: this.signer.signingKeyId
+    };
+    const ack = {
+      ...unsignedAck,
+      signature: this.signer.sign(canonicalJson(unsignedAck))
+    };
+    const receipt = this.verifier.verifyAppendReceipt({ anchor, ack });
+    this.receipts.set(key, receipt);
+    this.frontier = expected;
+    this.frontierDigest = frontierDigest;
+    return receipt;
+  }
+  readRange(fromSequenceInput, limitInput) {
+    this.requireAvailable();
+    const fromSequence = positiveInt64(fromSequenceInput, "authority_mutation_journal.from_sequence");
+    const limit = positiveInteger(limitInput, "authority_mutation_journal.range_limit", 1000);
+    this.verifyContiguousFrontier();
+    const receipts = [];
+    let sequence = fromSequence;
+    while (receipts.length < limit && BigInt(sequence) <= BigInt(this.frontier)) {
+      const receipt = this.receipts.get(BigInt(sequence).toString(10));
+      if (!receipt)
+        throw new InfinityError("integrity_failure", "authority mutation journal range contains a gap");
+      receipts.push(this.verifyStoredReceipt(receipt));
+      sequence = incrementInt64(sequence, "authority_mutation_journal.range_sequence");
+    }
+    const priorSequence = BigInt(fromSequence) - 1n;
+    const priorFrontier = priorSequence === 0n ? null : this.receipts.get(priorSequence.toString())?.anchor.frontier_digest ?? null;
+    if (priorSequence > 0n && priorFrontier === null)
+      throw new InfinityError("integrity_failure", "authority mutation journal range predecessor is missing");
+    const protection = this.journalProtection();
+    const unsigned = {
+      range_schema_version: AUTHORITY_MUTATION_RANGE_SCHEMA_VERSION,
+      from_sequence: fromSequence,
+      through_sequence: receipts.length === 0 ? priorSequence : receipts.at(-1).anchor.journal_sequence,
+      prior_frontier_digest: priorFrontier,
+      receipts,
+      head: this.head(),
+      journal_id: protection.journal_id,
+      protection_digest: protection.protection_digest,
+      signer_principal: this.signer.signerPrincipal,
+      signing_key_id: this.signer.signingKeyId
+    };
+    return this.verifier.verifyRange({
+      ...unsigned,
+      signature: this.signer.sign(canonicalJson(unsigned))
+    });
+  }
+  head() {
+    this.requireAvailable();
+    if (int64Equal(this.frontier, 0))
+      return null;
+    return this.receipts.get(BigInt(this.frontier).toString(10))?.ack ?? null;
+  }
+  verifyStoredReceipt(value) {
+    const verified = this.verifier.verifyAppendReceipt(value);
+    const stored = this.receipts.get(BigInt(verified.anchor.journal_sequence).toString(10));
+    if (!stored || canonicalJson(stored) !== canonicalJson(verified)) {
+      throw new InfinityError("integrity_failure", "authority mutation receipt is not a stored external journal member");
+    }
+    return stored;
+  }
+  verifyAppendReceipt(value) {
+    return this.verifier.verifyAppendReceipt(value);
+  }
+  verifyAcknowledgement(value) {
+    return this.verifier.verifyAcknowledgement(value);
+  }
+  verifyRange(value) {
+    return this.verifier.verifyRange(value);
+  }
+  verifyContiguousFrontier() {
+    let expected = 1;
+    let prior = null;
+    for (const receipt of this.receipts.values()) {
+      const verified = this.verifier.verifyAppendReceipt(receipt);
+      if (!int64Equal(verified.anchor.journal_sequence, expected) || verified.anchor.prior_frontier_digest !== prior) {
+        throw new InfinityError("integrity_failure", "authority mutation journal signed frontier contains a gap or is not contiguous");
+      }
+      prior = verified.anchor.frontier_digest;
+      expected = incrementInt64(expected, "authority_mutation_journal.frontier");
+    }
+    if (!int64Equal(this.frontier, BigInt(expected) - 1n) || this.frontierDigest !== prior) {
+      throw new InfinityError("integrity_failure", "authority mutation journal head differs from its signed members");
+    }
+  }
+  requireAvailable() {
+    if (!this.available)
+      throw new InfinityError("state_conflict", "external authority mutation journal is unavailable", { status: 503, retryable: true });
+  }
+}
+function parseAuthorityMutationEnvelope(value) {
+  const input = closedObject(value, "authority_mutation_envelope", [
+    "schema_version",
+    "storage_schema_version",
+    "authority_epoch",
+    "commit_sequence",
+    "operation_id",
+    "operation_digest",
+    "command",
+    "actor_principal",
+    "database_time",
+    "changes"
+  ]);
+  if (!Array.isArray(input.changes) || input.changes.length === 0 || input.changes.length > MAXIMUM_CHANGES) {
+    throw new InfinityError("invalid_input", "authority mutation envelope changes must be a bounded nonempty array");
+  }
+  const changes = input.changes.map((value2, index) => {
+    const change = closedObject(value2, `authority_mutation_envelope.changes[${index}]`, [
+      "change_ordinal",
+      "table_name",
+      "mutation_kind",
+      "row_digest",
+      "row"
+    ]);
+    const ordinal = positiveInteger(change.change_ordinal, `authority_mutation_envelope.changes[${index}].change_ordinal`, MAXIMUM_CHANGES);
+    if (ordinal !== index + 1)
+      throw new InfinityError("invalid_input", "authority mutation change ordinals must be contiguous");
+    if (!isPlainObject(change.row))
+      throw new InfinityError("invalid_input", "authority mutation row image must be an object");
+    canonicalJson(change.row);
+    const rowDigest = digest(change.row_digest, `authority_mutation_envelope.changes[${index}].row_digest`);
+    if (rowDigest !== digestCanonical(change.row))
+      throw new InfinityError("integrity_failure", "authority mutation row image digest mismatch");
+    return deepFreeze({
+      change_ordinal: ordinal,
+      table_name: stringValue(change.table_name, `authority_mutation_envelope.changes[${index}].table_name`, {
+        max: 80,
+        pattern: /^[a-z][a-z0-9_]*$/
+      }),
+      mutation_kind: enumValue(change.mutation_kind, `authority_mutation_envelope.changes[${index}].mutation_kind`, ["INSERT", "UPDATE", "DELETE"]),
+      row_digest: rowDigest,
+      row: deepFreeze({ ...change.row })
+    });
+  });
+  const parsed = {
+    schema_version: enumValue(input.schema_version, "authority_mutation_envelope.schema_version", [AUTHORITY_MUTATION_ENVELOPE_SCHEMA_VERSION]),
+    storage_schema_version: stringValue(input.storage_schema_version, "authority_mutation_envelope.storage_schema_version", {
+      max: 120,
+      pattern: /^[a-z][a-z0-9._/-]*$/
+    }),
+    authority_epoch: positiveInt64(input.authority_epoch, "authority_mutation_envelope.authority_epoch"),
+    commit_sequence: positiveInt64(input.commit_sequence, "authority_mutation_envelope.commit_sequence"),
+    operation_id: identifier(input.operation_id, "authority_mutation_envelope.operation_id"),
+    operation_digest: digest(input.operation_digest, "authority_mutation_envelope.operation_digest"),
+    command: stringValue(input.command, "authority_mutation_envelope.command", { max: 80, pattern: /^[a-z][a-z0-9._-]*$/ }),
+    actor_principal: identifier(input.actor_principal, "authority_mutation_envelope.actor_principal"),
+    database_time: timestamp(input.database_time, "authority_mutation_envelope.database_time"),
+    changes
+  };
+  if (Buffer.byteLength(canonicalJson(parsed), "utf8") > MAXIMUM_ENVELOPE_BYTES) {
+    throw new InfinityError("invalid_input", "authority mutation envelope exceeds the byte limit");
+  }
+  return deepFreeze(parsed);
+}
+function authorityMutationJournalProtectionDigest(protection) {
+  return digestCanonical({
+    protection_schema_version: protection.protection_schema_version,
+    journal_id: protection.journal_id,
+    restore_domain_id: protection.restore_domain_id,
+    encrypted_at_rest: protection.encrypted_at_rest,
+    durability: protection.durability,
+    signer_principal: protection.signer_principal,
+    signing_key_id: protection.signing_key_id
+  });
+}
+function unsignedAnchor(anchor) {
+  return {
+    anchor_schema_version: anchor.anchor_schema_version,
+    journal_sequence: anchor.journal_sequence,
+    prior_frontier_digest: anchor.prior_frontier_digest,
+    record_digest: anchor.record_digest,
+    signer_principal: anchor.signer_principal,
+    signing_key_id: anchor.signing_key_id
+  };
+}
+function unsignedAcknowledgement(ack) {
+  return {
+    ack_schema_version: ack.ack_schema_version,
+    acknowledged_through: ack.acknowledged_through,
+    frontier_digest: ack.frontier_digest,
+    journal_id: ack.journal_id,
+    protection_digest: ack.protection_digest,
+    restore_domain_id: ack.restore_domain_id,
+    encrypted_at_rest: ack.encrypted_at_rest,
+    signer_principal: ack.signer_principal,
+    signing_key_id: ack.signing_key_id
+  };
+}
+function unsignedRange(range) {
+  return {
+    range_schema_version: range.range_schema_version,
+    from_sequence: range.from_sequence,
+    through_sequence: range.through_sequence,
+    prior_frontier_digest: range.prior_frontier_digest,
+    receipts: range.receipts,
+    head: range.head,
+    journal_id: range.journal_id,
+    protection_digest: range.protection_digest,
+    signer_principal: range.signer_principal,
+    signing_key_id: range.signing_key_id
+  };
+}
+function nullableDigest(value, label) {
+  return value === null ? null : digest(value, label);
+}
+function verifySignature(publicKey, payload, signature) {
+  if (!/^[A-Za-z0-9_-]{80,128}$/.test(signature))
+    return false;
+  try {
+    return verifyDetached(null, Buffer.from(payload, "utf8"), publicKey, Buffer.from(signature, "base64url"));
+  } catch {
+    return false;
+  }
+}
+
+// src/persistence/postgres-external-mutation-journal.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, parse } from "path";
+import { fileURLToPath } from "url";
+
+// src/persistence/postgres-mutation-journal.ts
+async function runSerializableAcknowledgement(operation, attempts = 5) {
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    try {
+      return await operation();
+    } catch (error) {
+      lastError = error;
+      if (!isRetryableSerializationFailure(error) || attempt === attempts)
+        throw error;
+    }
+  }
+  throw lastError;
+}
+function isRetryableSerializationFailure(error) {
+  if (!error || typeof error !== "object")
+    return false;
+  const candidate = error;
+  const state = typeof candidate.errno === "string" ? candidate.errno : typeof candidate.code === "string" ? candidate.code : typeof candidate.sqlState === "string" ? candidate.sqlState : undefined;
+  return state === "40001" || state === "40P01" || isRetryableSerializationFailure(candidate.cause);
+}
+
+// src/persistence/postgres-external-mutation-journal.ts
+var MAX_STARTUP_RECEIPTS = 1e4;
+var POSTGRES_EXTERNAL_MUTATION_JOURNAL_MIGRATION_MANIFEST = Object.freeze({
+  "0001_external_authority_mutation_journal.sql": "sha256:ead2509a00dc767b855711be54f7480eaa09e0928cd16b1b86dc5a79b57c9b52"
+});
+
+class PostgresExternalMutationJournal {
+  sql;
+  signer;
+  verifier;
+  protection;
+  configuredJournalId;
+  clusterSystemIdentifier;
+  databaseName;
+  verificationKeyDigest;
+  constructor(sql, signer, verifier, protection, configuredJournalId, clusterSystemIdentifier, databaseName, verificationKeyDigest) {
+    this.sql = sql;
+    this.signer = signer;
+    this.verifier = verifier;
+    this.protection = protection;
+    this.configuredJournalId = configuredJournalId;
+    this.clusterSystemIdentifier = clusterSystemIdentifier;
+    this.databaseName = databaseName;
+    this.verificationKeyDigest = verificationKeyDigest;
+  }
+  static async open(sql, options, allowInitialize = false) {
+    if (options.encryptedAtRest !== true) {
+      throw new InfinityError("capability_denied", "external mutation journal requires an explicit encrypted-at-rest deployment assertion", { status: 503 });
+    }
+    if (options.requiredRole !== undefined) {
+      await assertExternalJournalSessionRole(sql, options.requiredRole);
+    }
+    if (options.signer.signerPrincipal !== options.verifier.signerPrincipal || options.signer.signingKeyId !== options.verifier.signingKeyId) {
+      throw new InfinityError("integrity_failure", "external mutation journal signer and verifier identity differ");
+    }
+    if (!(options.verifier instanceof Ed25519AuthorityMutationJournalVerifier)) {
+      throw new InfinityError("capability_denied", "external PostgreSQL mutation journal requires a verifier with internally derived Ed25519 key material", { status: 503 });
+    }
+    const configuredJournalId = identifier(options.journalId, "external_mutation_journal.configured_journal_id");
+    const restoreDomainId = identifier(options.restoreDomainId, "external_mutation_journal.restore_domain_id");
+    const verificationKeyDigest = digest(options.verifier.verificationKeyDigest, "external_mutation_journal.verification_key_digest");
+    const databaseIdentity = await postgresDatabaseIdentity(sql);
+    const unsignedProtection = {
+      protection_schema_version: AUTHORITY_MUTATION_PROTECTION_SCHEMA_VERSION,
+      journal_id: identifier(digestCanonical({
+        kind: "postgres-external-authority-mutation-journal/v1",
+        configured_journal_id: configuredJournalId,
+        cluster_system_identifier: databaseIdentity.system_identifier,
+        database_name: databaseIdentity.database_name,
+        verification_key_digest: verificationKeyDigest,
+        restore_domain_id: restoreDomainId
+      }), "external_mutation_journal.journal_id"),
+      restore_domain_id: restoreDomainId,
+      encrypted_at_rest: true,
+      durability: "durable",
+      signer_principal: identifier(options.signer.signerPrincipal, "external_mutation_journal.signer_principal"),
+      signing_key_id: identifier(options.signer.signingKeyId, "external_mutation_journal.signing_key_id")
+    };
+    const protection = deepFreeze({
+      ...unsignedProtection,
+      protection_digest: authorityMutationJournalProtectionDigest(unsignedProtection)
+    });
+    const journal = new PostgresExternalMutationJournal(sql, options.signer, options.verifier, protection, configuredJournalId, databaseIdentity.system_identifier, databaseIdentity.database_name, verificationKeyDigest);
+    journal.assertSignerPossession();
+    await journal.initialize(allowInitialize);
+    return journal;
+  }
+  describe() {
+    return this.protection;
+  }
+  async append(value) {
+    const envelope = parseAuthorityMutationEnvelope(value);
+    return runSerializableAcknowledgement(() => this.sql.begin("isolation level serializable", async (tx) => {
+      await tx`SELECT pg_advisory_xact_lock(hashtextextended('infinity.external-authority-mutation-journal.append', 0))`;
+      const store = await this.lockAndVerifyStore(tx);
+      await this.assertFastFrontier(tx, store);
+      const sequence = BigInt(envelope.commit_sequence);
+      const existing = await tx`
+          SELECT journal_sequence, prior_frontier_digest, record_digest, frontier_digest,
+            envelope_record, envelope_digest, acknowledgement_digest, receipt_digest, receipt_record
+          FROM infinity_external_journal.receipts WHERE journal_sequence = ${sequence}
+        `;
+      if (existing[0]) {
+        const receipt2 = await this.verifyPhysicalReceipt(tx, existing[0]);
+        if (canonicalJson(receipt2.anchor.record) !== canonicalJson(envelope)) {
+          throw new InfinityError("integrity_failure", "external authority mutation journal sequence has conflicting immutable bytes");
+        }
+        return receipt2;
+      }
+      const headSequence = dbNonnegativeBigint(store.head_sequence, "external journal head sequence");
+      if (sequence !== headSequence + 1n) {
+        throw new InfinityError("state_conflict", "external authority mutation journal append must extend the contiguous frontier", { status: 409 });
+      }
+      const receipt = this.signReceipt(envelope, store.head_frontier_digest);
+      const envelopeRecord = canonicalJson(receipt.anchor.record);
+      const receiptRecord = canonicalJson(receipt);
+      await tx`
+          SELECT infinity_external_journal.append_receipt(
+            ${sequence}, ${receipt.anchor.prior_frontier_digest}, ${receipt.anchor.record_digest},
+            ${receipt.anchor.frontier_digest}, ${envelopeRecord}, ${digestCanonical(receipt.anchor.record)},
+            ${digestCanonical(receipt.ack)}, ${digestCanonical(receipt)}, ${receiptRecord}
+          )
+        `;
+      return receipt;
+    }));
+  }
+  async readRange(fromSequenceInput, limitInput) {
+    const fromSequence = positiveInt64(fromSequenceInput, "external_mutation_journal.from_sequence");
+    const limit = positiveInteger(limitInput, "external_mutation_journal.range_limit", 1000);
+    return this.sql.begin("isolation level repeatable read", async (tx) => {
+      const store = await this.readAndVerifyStore(tx);
+      await this.assertFastFrontier(tx, store);
+      const rows = await tx`
+        SELECT journal_sequence, prior_frontier_digest, record_digest, frontier_digest,
+          envelope_record, envelope_digest, acknowledgement_digest, receipt_digest, receipt_record
+        FROM infinity_external_journal.receipts
+        WHERE journal_sequence >= ${BigInt(fromSequence)}
+        ORDER BY journal_sequence ASC LIMIT ${limit}
+      `;
+      const receipts = [];
+      let expected = BigInt(fromSequence);
+      for (const row of rows) {
+        if (dbPositiveBigint(row.journal_sequence, "external journal receipt sequence") !== expected) {
+          throw new InfinityError("integrity_failure", "external authority mutation journal range contains a gap");
+        }
+        receipts.push(await this.verifyPhysicalReceipt(tx, row));
+        expected += 1n;
+      }
+      const priorSequence = BigInt(fromSequence) - 1n;
+      const priorFrontier = priorSequence === 0n ? null : (await tx`
+            SELECT frontier_digest FROM infinity_external_journal.receipts
+            WHERE journal_sequence = ${priorSequence}
+          `)[0]?.frontier_digest ?? null;
+      if (priorSequence > 0n && priorFrontier === null) {
+        throw new InfinityError("integrity_failure", "external authority mutation journal range predecessor is missing");
+      }
+      let chainPrior = priorFrontier;
+      for (const receipt of receipts) {
+        if (receipt.anchor.prior_frontier_digest !== chainPrior) {
+          throw new InfinityError("integrity_failure", "external authority mutation journal signed range is not contiguous");
+        }
+        chainPrior = receipt.anchor.frontier_digest;
+      }
+      const head = await this.headFromStore(tx, store);
+      const unsigned = {
+        range_schema_version: AUTHORITY_MUTATION_RANGE_SCHEMA_VERSION,
+        from_sequence: fromSequence,
+        through_sequence: receipts.length === 0 ? priorSequence : receipts.at(-1).anchor.journal_sequence,
+        prior_frontier_digest: priorFrontier,
+        receipts,
+        head,
+        journal_id: this.protection.journal_id,
+        protection_digest: this.protection.protection_digest,
+        signer_principal: this.signer.signerPrincipal,
+        signing_key_id: this.signer.signingKeyId
+      };
+      return this.verifier.verifyRange({
+        ...unsigned,
+        signature: this.signer.sign(canonicalJson(unsigned))
+      });
+    });
+  }
+  async head() {
+    return this.sql.begin("isolation level repeatable read", async (tx) => {
+      const store = await this.readAndVerifyStore(tx);
+      await this.assertFastFrontier(tx, store);
+      return this.headFromStore(tx, store);
+    });
+  }
+  async initialize(allowInitialize) {
+    await runSerializableAcknowledgement(() => this.sql.begin("isolation level serializable", async (tx) => {
+      await tx`SELECT pg_advisory_xact_lock(hashtextextended('infinity.external-authority-mutation-journal.initialize', 0))`;
+      const existing = await this.readStore(tx, allowInitialize);
+      if (!existing) {
+        if (!allowInitialize) {
+          throw new InfinityError("integrity_failure", "external authority mutation journal protection must be initialized by the migration authority");
+        }
+        const rows = await tx`
+            SELECT count(*) AS count FROM infinity_external_journal.receipts
+          `;
+        if (dbNonnegativeBigint(rows[0]?.count, "external journal receipt count") !== 0n) {
+          throw new InfinityError("integrity_failure", "external authority mutation journal receipts exist without protection metadata");
+        }
+        const protectionRecord = canonicalJson(this.protection);
+        await tx`
+            INSERT INTO infinity_external_journal.store
+              (singleton, protection_schema_version, configured_journal_id, journal_id,
+               cluster_system_identifier, database_name, restore_domain_id,
+               encrypted_at_rest, durability, signer_principal, signing_key_id,
+               verification_key_digest,
+               protection_digest, protection_record, head_sequence, head_frontier_digest)
+            VALUES (true, ${this.protection.protection_schema_version}, ${this.configuredJournalId},
+              ${this.protection.journal_id}, ${this.clusterSystemIdentifier}, ${this.databaseName},
+              ${this.protection.restore_domain_id}, true, 'durable', ${this.protection.signer_principal},
+              ${this.protection.signing_key_id}, ${this.verificationKeyDigest},
+              ${this.protection.protection_digest}, ${protectionRecord}, 0, NULL)
+          `;
+      } else {
+        this.verifyStore(existing);
+      }
+    }));
+    await this.sql.begin("isolation level repeatable read", async (tx) => {
+      const store = await this.readAndVerifyStore(tx);
+      const rows = await tx`
+        SELECT journal_sequence, prior_frontier_digest, record_digest, frontier_digest,
+          envelope_record, envelope_digest, acknowledgement_digest, receipt_digest, receipt_record
+        FROM infinity_external_journal.receipts ORDER BY journal_sequence ASC
+        LIMIT ${MAX_STARTUP_RECEIPTS + 1}
+      `;
+      if (rows.length > MAX_STARTUP_RECEIPTS) {
+        throw new InfinityError("state_conflict", "external authority mutation journal exceeds the bounded startup verification limit", { status: 503 });
+      }
+      let expected = 1n;
+      let prior = null;
+      for (const row of rows) {
+        if (dbPositiveBigint(row.journal_sequence, "external journal receipt sequence") !== expected || row.prior_frontier_digest !== prior) {
+          throw new InfinityError("integrity_failure", "external authority mutation journal has a gap or invalid predecessor");
+        }
+        const receipt = await this.verifyPhysicalReceipt(tx, row);
+        prior = receipt.anchor.frontier_digest;
+        expected += 1n;
+      }
+      const headSequence = dbNonnegativeBigint(store.head_sequence, "external journal head sequence");
+      if (headSequence !== expected - 1n || store.head_frontier_digest !== prior) {
+        throw new InfinityError("integrity_failure", "external authority mutation journal metadata is rewound or differs from its signed frontier");
+      }
+    });
+  }
+  signReceipt(envelope, priorFrontierDigest) {
+    const recordDigest = digestCanonical(envelope);
+    const unsignedAnchor2 = {
+      anchor_schema_version: AUTHORITY_MUTATION_ANCHOR_SCHEMA_VERSION,
+      journal_sequence: envelope.commit_sequence,
+      prior_frontier_digest: priorFrontierDigest,
+      record_digest: recordDigest,
+      signer_principal: this.signer.signerPrincipal,
+      signing_key_id: this.signer.signingKeyId
+    };
+    const frontierDigest = digestCanonical(unsignedAnchor2);
+    const anchor = {
+      ...unsignedAnchor2,
+      frontier_digest: frontierDigest,
+      signature: this.signer.sign(canonicalJson({ ...unsignedAnchor2, frontier_digest: frontierDigest })),
+      record: envelope
+    };
+    const unsignedAcknowledgement2 = {
+      ack_schema_version: AUTHORITY_MUTATION_ACK_SCHEMA_VERSION,
+      acknowledged_through: envelope.commit_sequence,
+      frontier_digest: frontierDigest,
+      journal_id: this.protection.journal_id,
+      protection_digest: this.protection.protection_digest,
+      restore_domain_id: this.protection.restore_domain_id,
+      encrypted_at_rest: true,
+      signer_principal: this.signer.signerPrincipal,
+      signing_key_id: this.signer.signingKeyId
+    };
+    return this.verifier.verifyAppendReceipt({
+      anchor,
+      ack: {
+        ...unsignedAcknowledgement2,
+        signature: this.signer.sign(canonicalJson(unsignedAcknowledgement2))
+      }
+    });
+  }
+  assertSignerPossession() {
+    const row = {
+      journal_id: this.protection.journal_id,
+      protection_digest: this.protection.protection_digest,
+      restore_domain_id: this.protection.restore_domain_id
+    };
+    const envelope = parseAuthorityMutationEnvelope({
+      schema_version: "infinity.authority-mutation-reconstruction/v1",
+      storage_schema_version: "infinity.external-mutation-journal-key-possession/v1",
+      authority_epoch: 1,
+      commit_sequence: 1,
+      operation_id: "external-journal-key-possession",
+      operation_digest: digestCanonical({
+        purpose: "external-journal-key-possession",
+        protection_digest: this.protection.protection_digest
+      }),
+      command: "external-journal.key-possession",
+      actor_principal: this.protection.signer_principal,
+      database_time: "2000-01-01T00:00:00.000Z",
+      changes: [{
+        change_ordinal: 1,
+        table_name: "journal_protection",
+        mutation_kind: "INSERT",
+        row_digest: digestCanonical(row),
+        row
+      }]
+    });
+    try {
+      this.signReceipt(envelope, null);
+    } catch (error) {
+      throw new InfinityError("integrity_failure", "external mutation journal signer cannot prove possession of the verifier key", { cause: error });
+    }
+  }
+  async verifyPhysicalReceipt(tx, row) {
+    const parsed = parseStrictJson(row.receipt_record);
+    const receipt = this.verifier.verifyAppendReceipt(parsed);
+    const sequence = dbPositiveBigint(row.journal_sequence, "external journal receipt sequence");
+    if (BigInt(receipt.anchor.journal_sequence) !== sequence || row.prior_frontier_digest !== receipt.anchor.prior_frontier_digest || row.record_digest !== receipt.anchor.record_digest || row.frontier_digest !== receipt.anchor.frontier_digest || row.envelope_record !== canonicalJson(receipt.anchor.record) || row.envelope_digest !== digestCanonical(receipt.anchor.record) || row.acknowledgement_digest !== digestCanonical(receipt.ack) || row.receipt_digest !== digestCanonical(receipt) || row.receipt_record !== canonicalJson(receipt) || receipt.ack.journal_id !== this.protection.journal_id || receipt.ack.restore_domain_id !== this.protection.restore_domain_id || receipt.ack.protection_digest !== this.protection.protection_digest) {
+      throw new InfinityError("integrity_failure", "external authority mutation journal physical row differs from its signed receipt");
+    }
+    const predecessor = sequence === 1n ? null : (await tx`
+          SELECT frontier_digest FROM infinity_external_journal.receipts
+          WHERE journal_sequence = ${sequence - 1n}
+        `)[0]?.frontier_digest ?? null;
+    if (receipt.anchor.prior_frontier_digest !== predecessor) {
+      throw new InfinityError("integrity_failure", "external authority mutation journal signed predecessor is missing or differs");
+    }
+    return receipt;
+  }
+  async headFromStore(tx, store) {
+    const sequence = dbNonnegativeBigint(store.head_sequence, "external journal head sequence");
+    if (sequence === 0n)
+      return null;
+    const rows = await tx`
+      SELECT journal_sequence, prior_frontier_digest, record_digest, frontier_digest,
+        envelope_record, envelope_digest, acknowledgement_digest, receipt_digest, receipt_record
+      FROM infinity_external_journal.receipts WHERE journal_sequence = ${sequence}
+    `;
+    const row = rows[0];
+    if (!row)
+      throw new InfinityError("integrity_failure", "external authority mutation journal head receipt is missing");
+    const receipt = await this.verifyPhysicalReceipt(tx, row);
+    if (receipt.anchor.frontier_digest !== store.head_frontier_digest) {
+      throw new InfinityError("integrity_failure", "external authority mutation journal head digest differs");
+    }
+    return receipt.ack;
+  }
+  async assertFastFrontier(tx, store) {
+    const rows = await tx`
+      SELECT count(*) AS count, min(journal_sequence) AS minimum, max(journal_sequence) AS maximum
+      FROM infinity_external_journal.receipts
+    `;
+    const summary = rows[0];
+    const count = dbNonnegativeBigint(summary?.count, "external journal receipt count");
+    const head = dbNonnegativeBigint(store.head_sequence, "external journal head sequence");
+    if (count !== head || head === 0n && (summary?.minimum !== null || summary?.maximum !== null) || head > 0n && (dbPositiveBigint(summary?.minimum, "external journal minimum") !== 1n || dbPositiveBigint(summary?.maximum, "external journal maximum") !== head)) {
+      throw new InfinityError("integrity_failure", "external authority mutation journal physical frontier has a gap or rewind");
+    }
+  }
+  async lockAndVerifyStore(tx) {
+    const store = await this.readStore(tx, false);
+    if (!store)
+      throw new InfinityError("integrity_failure", "external authority mutation journal protection metadata is missing");
+    this.verifyStore(store);
+    return store;
+  }
+  async readAndVerifyStore(tx) {
+    const store = await this.readStore(tx, false);
+    if (!store)
+      throw new InfinityError("integrity_failure", "external authority mutation journal protection metadata is missing");
+    this.verifyStore(store);
+    return store;
+  }
+  async readStore(tx, forUpdate) {
+    const query = `SELECT protection_schema_version, configured_journal_id, journal_id,
+      cluster_system_identifier, database_name, restore_domain_id,
+      encrypted_at_rest, durability, signer_principal, signing_key_id,
+      verification_key_digest,
+      protection_digest, protection_record, head_sequence, head_frontier_digest
+      FROM infinity_external_journal.store WHERE singleton${forUpdate ? " FOR UPDATE" : ""}`;
+    return (await tx.unsafe(query))[0];
+  }
+  verifyStore(store) {
+    if (store.protection_schema_version !== this.protection.protection_schema_version || store.configured_journal_id !== this.configuredJournalId || store.journal_id !== this.protection.journal_id || store.cluster_system_identifier !== this.clusterSystemIdentifier || store.database_name !== this.databaseName || store.restore_domain_id !== this.protection.restore_domain_id || store.encrypted_at_rest !== true || store.durability !== "durable" || store.signer_principal !== this.protection.signer_principal || store.signing_key_id !== this.protection.signing_key_id || store.verification_key_digest !== this.verificationKeyDigest || store.protection_digest !== this.protection.protection_digest || store.protection_record !== canonicalJson(this.protection)) {
+      throw new InfinityError("integrity_failure", "external authority mutation journal protection identity differs");
+    }
+  }
+}
+async function initializePostgresExternalMutationJournalStore(primarySql, journalSql, options) {
+  await assertPostgresExternalMutationJournalDatabaseSeparated(primarySql, journalSql);
+  const journal = await PostgresExternalMutationJournal.open(journalSql, options, true);
+  return journal.describe();
+}
+async function applyPostgresExternalMutationJournalMigrations(sql, directory) {
+  const migrationDirectory = directory ?? packagedExternalJournalMigrationDirectory(import.meta.url);
+  const paths = [];
+  for await (const path of new Bun.Glob("*.sql").scan({ cwd: migrationDirectory, absolute: true, onlyFiles: true })) {
+    paths.push(path);
+  }
+  paths.sort((left, right) => left.localeCompare(right));
+  const names = paths.map((path) => path.slice(path.lastIndexOf("/") + 1));
+  if (JSON.stringify(names) !== JSON.stringify(Object.keys(POSTGRES_EXTERNAL_MUTATION_JOURNAL_MIGRATION_MANIFEST).sort())) {
+    throw new InfinityError("integrity_failure", "external mutation journal migrations differ from the compiled immutable manifest");
+  }
+  return sql.begin(async (tx) => {
+    await tx.unsafe(`
+      CREATE SCHEMA IF NOT EXISTS infinity_external_journal;
+      REVOKE ALL ON SCHEMA infinity_external_journal FROM PUBLIC;
+      CREATE TABLE IF NOT EXISTS infinity_external_journal.schema_migrations (
+        migration_name text PRIMARY KEY,
+        checksum text NOT NULL CHECK (checksum ~ '^sha256:[0-9a-f]{64}$'),
+        applied_at timestamptz NOT NULL
+      );
+      REVOKE ALL ON infinity_external_journal.schema_migrations FROM PUBLIC;
+    `).simple();
+    await tx`SELECT pg_advisory_xact_lock(hashtextextended('infinity.external-journal.schema.migrations', 0))`;
+    const applied = [];
+    const alreadyApplied = [];
+    for (const path of paths) {
+      const name = path.slice(path.lastIndexOf("/") + 1);
+      const source = await Bun.file(path).text();
+      const checksum = rawSha256(source);
+      const expected = POSTGRES_EXTERNAL_MUTATION_JOURNAL_MIGRATION_MANIFEST[name];
+      if (checksum !== expected) {
+        throw new InfinityError("integrity_failure", `external mutation journal migration bytes differ: ${name}`);
+      }
+      const existing = await tx`
+        SELECT checksum FROM infinity_external_journal.schema_migrations WHERE migration_name = ${name}
+      `;
+      if (existing[0]) {
+        if (existing[0].checksum !== checksum) {
+          throw new InfinityError("integrity_failure", `applied external mutation journal migration checksum differs: ${name}`);
+        }
+        alreadyApplied.push(name);
+        continue;
+      }
+      await tx.unsafe(source).simple();
+      await tx`
+        INSERT INTO infinity_external_journal.schema_migrations (migration_name, checksum, applied_at)
+        VALUES (${name}, ${checksum}, clock_timestamp())
+      `;
+      applied.push(name);
+    }
+    return { applied, alreadyApplied };
+  });
+}
+async function configurePostgresExternalMutationJournalRole(sql, roleName = "infinity_external_journal_runtime") {
+  if (!/^[a-z][a-z0-9_]{0,62}$/.test(roleName)) {
+    throw new InfinityError("invalid_input", "external mutation journal role is not canonical");
+  }
+  const role = quotePostgresIdentifier(roleName);
+  const databaseRows = await sql`
+    SELECT current_user, database.datname AS database_name, owner.rolname AS database_owner
+    FROM pg_database database
+    JOIN pg_roles owner ON owner.oid = database.datdba
+    WHERE database.datname = current_database()
+  `;
+  const database = databaseRows[0];
+  if (!database || database.database_owner !== database.current_user) {
+    throw new InfinityError("capability_denied", "external mutation journal migration role must own the current database", { status: 503 });
+  }
+  if (roleName === database.current_user || roleName === database.database_owner) {
+    throw new InfinityError("capability_denied", "external mutation journal runtime role must be distinct from the database owner and migration role", { status: 503 });
+  }
+  const found = await sql`
+    SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${roleName}) AS present
+  `;
+  if (!found[0]?.present)
+    await sql.unsafe(`CREATE ROLE ${role} NOLOGIN`);
+  await sql.unsafe(`ALTER ROLE ${role} NOSUPERUSER NOCREATEDB NOCREATEROLE NOLOGIN NOREPLICATION NOBYPASSRLS`);
+  const parentMemberships = await sql`
+    SELECT parent.rolname AS role_name
+    FROM pg_auth_members membership
+    JOIN pg_roles child ON child.oid = membership.member
+    JOIN pg_roles parent ON parent.oid = membership.roleid
+    WHERE child.rolname = ${roleName}
+  `;
+  if (parentMemberships.length > 0) {
+    throw new InfinityError("capability_denied", "external mutation journal runtime role has a privilege-escalating parent membership", { status: 503 });
+  }
+  const databaseOwnerMembership = await sql`
+    SELECT pg_has_role(${roleName}, 'pg_database_owner', 'MEMBER') AS member,
+      pg_has_role(${roleName}, 'pg_database_owner', 'SET') AS settable
+  `;
+  if (databaseOwnerMembership[0]?.member || databaseOwnerMembership[0]?.settable) {
+    throw new InfinityError("capability_denied", "external mutation journal runtime role must not own the database or inherit pg_database_owner", { status: 503 });
+  }
+  await sql.begin(async (tx) => {
+    const databaseIdentifier = quotePostgresIdentifier(database.database_name);
+    await tx.unsafe(`REVOKE CREATE, TEMPORARY ON DATABASE ${databaseIdentifier} FROM PUBLIC`);
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON DATABASE ${databaseIdentifier} FROM ${role}`);
+    await tx.unsafe(`GRANT CONNECT ON DATABASE ${databaseIdentifier} TO ${role}`);
+    await tx.unsafe(`REVOKE ALL ON SCHEMA infinity_external_journal FROM ${role}`);
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA infinity_external_journal FROM ${role}`);
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA infinity_external_journal FROM ${role}`);
+    await tx.unsafe(`GRANT USAGE ON SCHEMA infinity_external_journal TO ${role}`);
+    await tx.unsafe(`GRANT SELECT ON infinity_external_journal.store, infinity_external_journal.receipts TO ${role}`);
+    await tx.unsafe(`GRANT EXECUTE ON FUNCTION infinity_external_journal.append_receipt(
+      bigint, text, text, text, text, text, text, text, text) TO ${role}`);
+    await tx.unsafe(`REVOKE CREATE ON SCHEMA infinity_external_journal FROM ${role}`);
+    await tx.unsafe(`REVOKE DELETE, TRUNCATE, REFERENCES, TRIGGER
+      ON ALL TABLES IN SCHEMA infinity_external_journal FROM ${role}`);
+  });
+}
+async function assertExternalJournalSessionRole(sql, requiredRole) {
+  if (!/^[a-z][a-z0-9_]{0,62}$/.test(requiredRole)) {
+    throw new InfinityError("invalid_input", "external mutation journal required role is not canonical");
+  }
+  const roles = await sql`
+    SELECT session_user, current_user,
+      pg_has_role(session_user, ${requiredRole}, 'MEMBER') AS required,
+      role.rolsuper, role.rolcreatedb, role.rolcreaterole,
+      role.rolreplication, role.rolbypassrls
+    FROM pg_roles role WHERE role.rolname = session_user
+  `;
+  const role = roles[0];
+  if (!role?.required || role.current_user !== role.session_user || role.rolsuper || role.rolcreatedb || role.rolcreaterole || role.rolreplication || role.rolbypassrls) {
+    throw new InfinityError("capability_denied", "external mutation journal database session is not exclusively least-privilege bound", { status: 503 });
+  }
+  const requiredRoleState = await sql`
+    SELECT rolcanlogin, rolsuper, rolcreatedb, rolcreaterole, rolreplication, rolbypassrls
+    FROM pg_roles WHERE rolname = ${requiredRole}
+  `;
+  const required = requiredRoleState[0];
+  if (!required || required.rolcanlogin || required.rolsuper || required.rolcreatedb || required.rolcreaterole || required.rolreplication || required.rolbypassrls) {
+    throw new InfinityError("capability_denied", "external mutation journal required role is not a narrow NOLOGIN role", { status: 503 });
+  }
+  const databaseOwnership = await sql`
+    SELECT owner.rolname AS database_owner, session_user,
+      pg_has_role(session_user, 'pg_database_owner', 'MEMBER') AS session_owner_member,
+      pg_has_role(session_user, 'pg_database_owner', 'SET') AS session_owner_settable,
+      pg_has_role(${requiredRole}, 'pg_database_owner', 'MEMBER') AS required_owner_member,
+      pg_has_role(${requiredRole}, 'pg_database_owner', 'SET') AS required_owner_settable
+    FROM pg_database database
+    JOIN pg_roles owner ON owner.oid = database.datdba
+    WHERE database.datname = current_database()
+  `;
+  const ownership = databaseOwnership[0];
+  if (!ownership || ownership.database_owner === ownership.session_user || ownership.database_owner === requiredRole || ownership.session_owner_member || ownership.session_owner_settable || ownership.required_owner_member || ownership.required_owner_settable) {
+    throw new InfinityError("capability_denied", "external mutation journal session or required role must not own the database or inherit pg_database_owner", { status: 503 });
+  }
+  const memberships = await sql`
+    SELECT parent.rolname AS role_name, membership.inherit_option,
+      membership.set_option, membership.admin_option
+    FROM pg_auth_members membership
+    JOIN pg_roles member ON member.oid = membership.member
+    JOIN pg_roles parent ON parent.oid = membership.roleid
+    WHERE member.rolname = session_user
+    ORDER BY parent.rolname
+  `;
+  if (memberships.length !== 1 || memberships[0]?.role_name !== requiredRole || memberships[0].inherit_option !== true || memberships[0].set_option !== false || memberships[0].admin_option !== false) {
+    throw new InfinityError("capability_denied", "external mutation journal login role membership graph is not exact or permits SET ROLE", { status: 503 });
+  }
+  const requiredParents = await sql`
+    SELECT parent.rolname AS role_name
+    FROM pg_auth_members membership
+    JOIN pg_roles member ON member.oid = membership.member
+    JOIN pg_roles parent ON parent.oid = membership.roleid
+    WHERE member.rolname = ${requiredRole}
+  `;
+  if (requiredParents.length > 0) {
+    throw new InfinityError("capability_denied", "external mutation journal required role has transitive parent memberships", { status: 503 });
+  }
+  const databasePrivileges = await sql`
+    SELECT has_database_privilege(session_user, current_database(), 'CONNECT') AS can_connect,
+      has_database_privilege(session_user, current_database(), 'CREATE') AS can_create,
+      has_database_privilege(session_user, current_database(), 'TEMPORARY') AS can_temporary
+  `;
+  if (!databasePrivileges[0]?.can_connect || databasePrivileges[0].can_create || databasePrivileges[0].can_temporary) {
+    throw new InfinityError("capability_denied", "external mutation journal database privileges are contaminated", { status: 503 });
+  }
+  const privileges = await sql`
+    SELECT
+      has_schema_privilege(session_user, 'infinity_external_journal', 'USAGE') AS schema_usage,
+      has_schema_privilege(session_user, 'infinity_external_journal', 'CREATE') AS schema_create,
+      has_table_privilege(session_user, 'infinity_external_journal.store', 'SELECT') AS store_select,
+      has_table_privilege(session_user, 'infinity_external_journal.store', 'INSERT') AS store_insert,
+      has_table_privilege(session_user, 'infinity_external_journal.store', 'DELETE') AS store_delete,
+      has_table_privilege(session_user, 'infinity_external_journal.store', 'TRUNCATE') AS store_truncate,
+      has_table_privilege(session_user, 'infinity_external_journal.store', 'REFERENCES') AS store_references,
+      has_table_privilege(session_user, 'infinity_external_journal.store', 'TRIGGER') AS store_trigger,
+      has_table_privilege(session_user, 'infinity_external_journal.receipts', 'SELECT') AS receipts_select,
+      has_table_privilege(session_user, 'infinity_external_journal.receipts', 'INSERT') AS receipts_insert,
+      has_table_privilege(session_user, 'infinity_external_journal.receipts', 'UPDATE') AS receipts_update,
+      has_table_privilege(session_user, 'infinity_external_journal.receipts', 'DELETE') AS receipts_delete,
+      has_table_privilege(session_user, 'infinity_external_journal.receipts', 'TRUNCATE') AS receipts_truncate,
+      has_table_privilege(session_user, 'infinity_external_journal.receipts', 'REFERENCES') AS receipts_references,
+      has_table_privilege(session_user, 'infinity_external_journal.receipts', 'TRIGGER') AS receipts_trigger,
+      has_table_privilege(session_user, 'infinity_external_journal.schema_migrations', 'SELECT') AS migrations_select,
+      has_function_privilege(session_user,
+        'infinity_external_journal.append_receipt(bigint,text,text,text,text,text,text,text,text)',
+        'EXECUTE') AS append_execute,
+      has_column_privilege(session_user, 'infinity_external_journal.store', 'head_sequence', 'UPDATE')
+        AND has_column_privilege(session_user, 'infinity_external_journal.store', 'head_frontier_digest', 'UPDATE') AS head_update,
+      has_column_privilege(session_user, 'infinity_external_journal.store', 'journal_id', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'singleton', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'protection_schema_version', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'configured_journal_id', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'cluster_system_identifier', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'database_name', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'restore_domain_id', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'encrypted_at_rest', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'durability', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'signer_principal', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'signing_key_id', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'verification_key_digest', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'protection_digest', 'UPDATE')
+        OR has_column_privilege(session_user, 'infinity_external_journal.store', 'protection_record', 'UPDATE')
+        AS identity_update
+  `;
+  const value = privileges[0];
+  if (!value?.schema_usage || value.schema_create || !value.store_select || value.store_insert || value.store_delete || value.store_truncate || value.store_references || value.store_trigger || !value.receipts_select || value.receipts_insert || value.receipts_update || value.receipts_delete || value.receipts_truncate || value.receipts_references || value.receipts_trigger || value.migrations_select || !value.append_execute || value.head_update || value.identity_update) {
+    throw new InfinityError("capability_denied", "external mutation journal database session privileges are contaminated", { status: 503 });
+  }
+}
+async function assertPostgresExternalMutationJournalDatabaseSeparated(primarySql, journalSql) {
+  if (primarySql === journalSql) {
+    throw new InfinityError("capability_denied", "primary authority and external mutation journal require separate SQL pools and databases", { status: 503 });
+  }
+  const [primary, journal] = await Promise.all([
+    postgresDatabaseIdentity(primarySql),
+    postgresDatabaseIdentity(journalSql)
+  ]);
+  if (primary.database_name === journal.database_name && primary.server_address === journal.server_address && primary.server_port === journal.server_port) {
+    throw new InfinityError("capability_denied", "primary authority and external mutation journal must use separate PostgreSQL databases", { status: 503 });
+  }
+  if (primary.system_identifier === journal.system_identifier) {
+    throw new InfinityError("capability_denied", "primary authority and external mutation journal must use independently durable PostgreSQL clusters", { status: 503 });
+  }
+}
+async function postgresDatabaseIdentity(sql) {
+  const rows = await sql`
+    SELECT current_database() AS database_name,
+      COALESCE(inet_server_addr()::text, 'local') AS server_address,
+      COALESCE(inet_server_port(), 0)::integer AS server_port,
+      system_identifier::text AS system_identifier
+    FROM pg_control_system()
+  `;
+  const row = rows[0];
+  if (!row)
+    throw new InfinityError("integrity_failure", "PostgreSQL database identity is unavailable");
+  return {
+    database_name: row.database_name,
+    server_address: row.server_address ?? "local",
+    server_port: row.server_port ?? 0,
+    system_identifier: String(row.system_identifier)
+  };
+}
+function packagedExternalJournalMigrationDirectory(moduleUrl) {
+  let candidate = dirname(fileURLToPath(moduleUrl));
+  const filesystemRoot = parse(candidate).root;
+  while (candidate !== filesystemRoot) {
+    const packagePath = join(candidate, "package.json");
+    const migrationsPath = join(candidate, "migrations", "external-journal");
+    if (existsSync(packagePath) && existsSync(migrationsPath)) {
+      try {
+        const packageManifest = JSON.parse(readFileSync(packagePath, "utf8"));
+        if (packageManifest.name === "@hasna/infinity")
+          return migrationsPath;
+      } catch {
+        throw new InfinityError("integrity_failure", "Infinity package manifest cannot locate external journal migrations");
+      }
+    }
+    candidate = dirname(candidate);
+  }
+  throw new InfinityError("invalid_input", "no external mutation journal PostgreSQL migrations were found");
+}
+function rawSha256(source) {
+  return `sha256:${new Bun.CryptoHasher("sha256").update(source).digest("hex")}`;
+}
+function quotePostgresIdentifier(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function dbPositiveBigint(value, label) {
+  return BigInt(positiveInt64(typeof value === "string" ? BigInt(value) : value, label));
+}
+function dbNonnegativeBigint(value, label) {
+  if (typeof value === "bigint") {
+    if (value < 0n || value > 9223372036854775807n) {
+      throw new InfinityError("integrity_failure", `${label} is outside the supported range`);
+    }
+    return value;
+  }
+  if (typeof value === "string" && /^\d+$/.test(value)) {
+    const parsed = BigInt(value);
+    if (parsed > 9223372036854775807n) {
+      throw new InfinityError("integrity_failure", `${label} exceeds the supported range`);
+    }
+    return parsed;
+  }
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    throw new InfinityError("integrity_failure", `${label} is invalid`);
+  }
+  return BigInt(value);
+}
+
+// src/persistence/migrations.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, join as join2, parse as parse2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var DEFAULT_POSTGRES_ROLES = {
+  runtimeRole: "infinity_runtime",
+  reconcilerRole: "infinity_reconciler",
+  journalAckerRole: "infinity_journal_acker"
+};
+var POSTGRES_MIGRATION_MANIFEST = Object.freeze({
+  "0001_authority.sql": "sha256:bfcff16873cf8664ee46aeea581f9f4d212bac05cf3bbc1817dc495434f7f1d6",
+  "0002_effect_step_global_owner.sql": "sha256:3342801f79c4cf6321bbeaa3928cf7a0d4a3e9a391505274e88931c48eb4632d",
+  "0003_effect_journal_observed_head.sql": "sha256:0cf5388c8665f9727df4f1f7430761086bd2fa03d0e1e2aaddecda9ca7790aba",
+  "0004_authority_mutation_journal_binding.sql": "sha256:ddeb4d190016536f61ea55e3e0c36a5fa28211af5ed2c9a41c752ce3b1a857d0",
+  "20260710_checkpoint_broker_v1.sql": "sha256:3e250bee6358188cf30acb2ab14f31edfdf94c2b73502793b91a7caaf28c3d8f",
+  "20260711_checkpoint_trust_v2.sql": "sha256:5165e08ae32b671838a2ee9349b35cf7007afade70ec19694ad27334bdaac065",
+  "20260711_verifier_cleanup_v2.sql": "sha256:fe06ed0ec0bde18310321e7cce19c885f127e550ac1ea365b159be4effb71e79",
+  "20260711_accounts_operation_v1.sql": "sha256:7d9caa3aa9fbbdab501e81b363ec5258b006a86572211eccb563b000d52d3a62",
+  "20260711_z_accounts_claim_authority_v2.sql": "sha256:1da1ace609a4813472f2637d61b435cf372bd9d0f66694b3c502e17da3b9de38",
+  "20260711_zz_sandbox_dispatch_authority_v1.sql": "sha256:543bb2c9b392c98c2069c437616e3d7d0fbf1d02cb8d1f6e09f1bad83238e69f",
+  "20260712_sandbox_dispatch_authority_v2.sql": "sha256:c93b5b31d4f94549018300c94a568a4b8b5a403f28bf04d6177d14726518b3e3"
+});
+async function applyPostgresMigrations(sql, directory) {
+  const migrationDirectory = directory ?? packagedMigrationDirectory(import.meta.url);
+  const paths = [];
+  for await (const path of new Bun.Glob("*.sql").scan({ cwd: migrationDirectory, absolute: true, onlyFiles: true })) {
+    paths.push(path);
+  }
+  paths.sort((left, right) => left.localeCompare(right));
+  if (paths.length === 0)
+    throw new InfinityError("invalid_input", "no PostgreSQL migrations were found");
+  const names = paths.map((path) => path.slice(path.lastIndexOf("/") + 1));
+  if (canonicalStringArray(names) !== canonicalStringArray(Object.keys(POSTGRES_MIGRATION_MANIFEST))) {
+    throw new InfinityError("integrity_failure", "PostgreSQL migration files differ from the compiled immutable manifest");
+  }
+  return sql.begin(async (tx) => {
+    await tx.unsafe(`
+      CREATE SCHEMA IF NOT EXISTS infinity;
+      CREATE TABLE IF NOT EXISTS infinity.schema_migrations (
+        migration_name text PRIMARY KEY,
+        checksum text NOT NULL CHECK (checksum ~ '^sha256:[0-9a-f]{64}$'),
+        applied_at timestamptz NOT NULL
+      );
+    `).simple();
+    await tx`SELECT pg_advisory_xact_lock(hashtextextended('infinity.schema.migrations', 0))`;
+    const applied = [];
+    const alreadyApplied = [];
+    for (const path of paths) {
+      const name = path.slice(path.lastIndexOf("/") + 1);
+      if (!/^(?:\d{4}|\d{8})_[a-z0-9_]+\.sql$/.test(name)) {
+        throw new InfinityError("invalid_input", "migration filename is not canonical");
+      }
+      const source = await Bun.file(path).text();
+      const checksum = rawSha2562(source);
+      const compiledChecksum = POSTGRES_MIGRATION_MANIFEST[name];
+      if (checksum !== compiledChecksum) {
+        throw new InfinityError("integrity_failure", `migration bytes differ from compiled manifest: ${name}`);
+      }
+      const existing = await tx`
+        SELECT checksum FROM infinity.schema_migrations WHERE migration_name = ${name}
+      `;
+      if (existing.length > 0) {
+        if (existing[0].checksum !== checksum) {
+          throw new InfinityError("integrity_failure", `applied migration checksum differs: ${name}`);
+        }
+        alreadyApplied.push(name);
+        continue;
+      }
+      await tx.unsafe(source).simple();
+      await tx`
+        INSERT INTO infinity.schema_migrations (migration_name, checksum, applied_at)
+        VALUES (${name}, ${checksum}, clock_timestamp())
+      `;
+      applied.push(name);
+    }
+    return { applied, alreadyApplied };
+  });
+}
+function packagedMigrationDirectory(moduleUrl) {
+  let candidate = dirname2(fileURLToPath2(moduleUrl));
+  const filesystemRoot = parse2(candidate).root;
+  while (candidate !== filesystemRoot) {
+    const packagePath = join2(candidate, "package.json");
+    const migrationsPath = join2(candidate, "migrations");
+    if (existsSync2(packagePath) && existsSync2(migrationsPath)) {
+      try {
+        const packageManifest = JSON.parse(readFileSync2(packagePath, "utf8"));
+        if (packageManifest.name === "@hasna/infinity")
+          return migrationsPath;
+      } catch {
+        throw new InfinityError("integrity_failure", "Infinity package manifest cannot locate PostgreSQL migrations");
+      }
+    }
+    candidate = dirname2(candidate);
+  }
+  throw new InfinityError("invalid_input", "no PostgreSQL migrations were found");
+}
+async function configurePostgresRoles(sql, roles = DEFAULT_POSTGRES_ROLES) {
+  const runtimeRole = sqlIdentifier(roles.runtimeRole, "runtime role");
+  const reconcilerRole = sqlIdentifier(roles.reconcilerRole, "reconciler role");
+  const journalAckerRole = sqlIdentifier(roles.journalAckerRole, "journal acker role");
+  if (new Set([runtimeRole, reconcilerRole, journalAckerRole]).size !== 3) {
+    throw new InfinityError("invalid_input", "runtime, reconciler, and journal acker roles must differ");
+  }
+  const session = await sql`
+    SELECT current_user, database.datname AS database_name, owner.rolname AS database_owner
+    FROM pg_database database
+    JOIN pg_roles owner ON owner.oid = database.datdba
+    WHERE database.datname = current_database()
+  `;
+  const database = session[0];
+  if ([runtimeRole, reconcilerRole, journalAckerRole].includes(database?.current_user ?? "")) {
+    throw new InfinityError("capability_denied", "migration session must be distinct from authority service roles", { status: 403 });
+  }
+  if (!database || database.database_owner !== database.current_user) {
+    throw new InfinityError("capability_denied", "Infinity migration role must be the dedicated owner of the current database", { status: 503 });
+  }
+  for (const role of [runtimeRole, reconcilerRole, journalAckerRole]) {
+    const found = await sql`SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${role}) AS present`;
+    if (!found[0]?.present)
+      await sql.unsafe(`CREATE ROLE ${quoteIdentifier(role)} NOLOGIN`);
+    await sql.unsafe(`ALTER ROLE ${quoteIdentifier(role)} NOSUPERUSER NOCREATEDB NOCREATEROLE NOLOGIN NOREPLICATION NOBYPASSRLS`);
+    const parentMemberships = await sql`
+      SELECT parent.rolname AS role_name
+      FROM pg_auth_members membership
+      JOIN pg_roles child ON child.oid = membership.member
+      JOIN pg_roles parent ON parent.oid = membership.roleid
+      WHERE child.rolname = ${role}
+    `;
+    if (parentMemberships.length > 0) {
+      throw new InfinityError("capability_denied", `Infinity authority role ${role} has a privilege-escalating parent membership`, { status: 503 });
+    }
+    const databaseOwnerMembership = await sql`
+      SELECT pg_has_role(${role}, 'pg_database_owner', 'MEMBER') AS member,
+        pg_has_role(${role}, 'pg_database_owner', 'SET') AS settable
+    `;
+    if (databaseOwnerMembership[0]?.member || databaseOwnerMembership[0]?.settable) {
+      throw new InfinityError("capability_denied", `Infinity authority role ${role} must not inherit or SET pg_database_owner`, { status: 503 });
+    }
+  }
+  const runtime = quoteIdentifier(runtimeRole);
+  const reconciler = quoteIdentifier(reconcilerRole);
+  const journalAcker = quoteIdentifier(journalAckerRole);
+  await sql.begin(async (tx) => {
+    const databaseIdentifier = quoteIdentifier(database.database_name);
+    await tx.unsafe(`REVOKE CREATE, TEMPORARY ON DATABASE ${databaseIdentifier} FROM PUBLIC`);
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON DATABASE ${databaseIdentifier} FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`GRANT CONNECT ON DATABASE ${databaseIdentifier} TO ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe("REVOKE ALL ON SCHEMA infinity FROM PUBLIC");
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`GRANT USAGE ON SCHEMA infinity TO ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`GRANT SELECT ON ALL TABLES IN SCHEMA infinity TO ${runtime}, ${reconciler}`);
+    await tx.unsafe(`GRANT SELECT ON infinity.authority_runtime_meta, infinity.authority_mutation_envelopes,
+      infinity.authority_mutation_acknowledgements, infinity.authority_mutation_journal_binding,
+      infinity.outbox TO ${journalAcker}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.run_specs, infinity.runs, infinity.attempts,
+      infinity.attempt_lease_grants, infinity.attempt_lease_events, infinity.queue_entries,
+      infinity.admission_keys, infinity.idempotency_records, infinity.events, infinity.budget_reservations,
+      infinity.event_stream_heads, infinity.outbox, infinity.external_operations,
+      infinity.authority_mutation_envelopes, infinity.accounts_resource_authority,
+      infinity.accounts_operation_signer_pin, infinity.accounts_serialization_domains,
+      infinity.accounts_serialization_frontier_heads, infinity.accounts_model_call_operations,
+      infinity.accounts_model_effect_journal, infinity.sandbox_dispatch_accounts_consume_evidence,
+      infinity.sandbox_dispatch_authorizations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE ON infinity.runs, infinity.attempts, infinity.queue_entries,
+      infinity.event_stream_heads, infinity.external_operations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (head_sequence, head_digest, pin_digest, pin_record, updated_at)
+      ON infinity.accounts_operation_signer_pin TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (state, updated_at)
+      ON infinity.accounts_resource_authority TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (active_model_operation_id, revision, state_digest, state_record, updated_at)
+      ON infinity.accounts_serialization_domains TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (state, consume_receipt_digest, use_id, projection_digest, projection_record, updated_at)
+      ON infinity.accounts_model_call_operations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (state, consume_operation_id, consume_idempotency_key, consume_request_digest,
+       effect_claim_digest, canonical_intent_digest, dispatch_use_id, consumption_receipt_digest,
+       consumption_receipt_record, consumed_at, provider_contact_expires_at, updated_at)
+      ON infinity.sandbox_dispatch_authorizations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (next_queue_sequence, next_commit_sequence, budget_reserved_units, budget_charged_units, budget_released_units)
+      ON infinity.authority_runtime_meta TO ${runtime}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.effect_operation_steps, infinity.effect_journal_records,
+      infinity.effect_journal_observed_head TO ${reconciler}`);
+    await tx.unsafe(`GRANT UPDATE ON infinity.effect_journal_frontier,
+      infinity.effect_journal_observed_head TO ${reconciler}`);
+    await tx.unsafe(`GRANT UPDATE (state, lease_owner, lease_expires_at) ON infinity.outbox TO ${reconciler}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.authority_mutation_acknowledgements TO ${journalAcker}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.authority_mutation_journal_binding TO ${journalAcker}`);
+    await tx.unsafe(`GRANT UPDATE (journal_acknowledged_through)
+      ON infinity.authority_runtime_meta TO ${journalAcker}`);
+    await tx.unsafe(`GRANT UPDATE (state) ON infinity.outbox TO ${journalAcker}`);
+    await tx.unsafe(`REVOKE CREATE ON SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`REVOKE DELETE, TRUNCATE, REFERENCES, TRIGGER ON ALL TABLES IN SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`REVOKE ALL ON FUNCTION infinity.capture_authority_mutation_change(),
+      infinity.validate_authority_mutation_envelope(), infinity.validate_authority_mutation_acknowledgement(),
+      infinity.validate_authority_ack_frontier_update(), infinity.validate_outbox_write(),
+      infinity.validate_effect_journal_observed_head_update(),
+      infinity.validate_accounts_operation_signer_pin_update(),
+      infinity.validate_accounts_resource_authority_update(),
+      infinity.validate_sandbox_dispatch_authorization_update()
+      FROM PUBLIC, ${runtime}, ${reconciler}, ${journalAcker}`);
+  });
+}
+function rawSha2562(source) {
+  const value = new Bun.CryptoHasher("sha256").update(source).digest("hex");
+  return `sha256:${value}`;
+}
+function sqlIdentifier(value, label) {
+  if (!/^[a-z][a-z0-9_]{0,62}$/.test(value))
+    throw new InfinityError("invalid_input", `${label} is not a canonical PostgreSQL identifier`);
+  return value;
+}
+function quoteIdentifier(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function canonicalStringArray(values) {
+  return JSON.stringify([...values].sort((left, right) => left.localeCompare(right)));
+}
+
+// src/runtime/config.ts
+import {
+  createPrivateKey,
+  createPublicKey as createPublicKey2,
+  sign as signDetached2,
+  verify as verifyDetached2
+} from "crypto";
+import { closeSync, constants, fstatSync, openSync, readFileSync as readFileSync3 } from "fs";
+import { isAbsolute } from "path";
+var DIRECT_SECRET_VARIABLES = [
+  "INFINITY_OPERATOR_TOKEN",
+  "INFINITY_RUNTIME_DATABASE_URL",
+  "INFINITY_RECONCILER_DATABASE_URL",
+  "INFINITY_JOURNAL_ACKER_DATABASE_URL",
+  "INFINITY_EXTERNAL_JOURNAL_DATABASE_URL",
+  "INFINITY_MUTATION_SIGNING_KEY",
+  "INFINITY_EFFECT_SIGNING_KEY",
+  "INFINITY_MIGRATOR_DATABASE_URL",
+  "INFINITY_EXTERNAL_JOURNAL_MIGRATOR_DATABASE_URL",
+  "INFINITY_PROVIDER_ACTIVATION_MANIFEST"
+];
+function loadSelfHostedMigrationConfig(environment) {
+  for (const variable of DIRECT_SECRET_VARIABLES) {
+    if (environment[variable] !== undefined) {
+      throw new InfinityError("invalid_input", `${variable} is forbidden; configure its file reference instead`);
+    }
+  }
+  const primaryMigratorDatabaseUrlFile = secretFile(environment, "INFINITY_MIGRATOR_DATABASE_URL_FILE");
+  const externalJournalMigratorDatabaseUrlFile = secretFile(environment, "INFINITY_EXTERNAL_JOURNAL_MIGRATOR_DATABASE_URL_FILE");
+  const mutationSigningKeyFile = secretFile(environment, "INFINITY_MUTATION_SIGNING_KEY_FILE");
+  if (new Set([
+    primaryMigratorDatabaseUrlFile,
+    externalJournalMigratorDatabaseUrlFile,
+    mutationSigningKeyFile
+  ]).size !== 3) {
+    throw new InfinityError("invalid_input", "self-hosted migration secret file references must be distinct");
+  }
+  return deepFreeze({
+    primaryMigratorDatabaseUrlFile,
+    externalJournalMigratorDatabaseUrlFile,
+    mutationSigningKeyFile,
+    externalJournalId: identifier(required(environment, "INFINITY_EXTERNAL_JOURNAL_ID"), "external journal ID"),
+    externalJournalRestoreDomainId: identifier(required(environment, "INFINITY_EXTERNAL_JOURNAL_RESTORE_DOMAIN_ID"), "external journal restore domain"),
+    mutationSignerPrincipal: identifier(required(environment, "INFINITY_MUTATION_SIGNER_PRINCIPAL"), "mutation signer principal"),
+    mutationSigningKeyId: identifier(required(environment, "INFINITY_MUTATION_SIGNING_KEY_ID"), "mutation signing key ID"),
+    runtimeRole: role(environment.INFINITY_RUNTIME_ROLE ?? "infinity_runtime", "runtime role"),
+    reconcilerRole: role(environment.INFINITY_RECONCILER_ROLE ?? "infinity_reconciler", "reconciler role"),
+    journalAckerRole: role(environment.INFINITY_JOURNAL_ACKER_ROLE ?? "infinity_journal_acker", "journal acker role"),
+    externalJournalRole: role(environment.INFINITY_EXTERNAL_JOURNAL_ROLE ?? "infinity_external_journal_runtime", "external journal role")
+  });
+}
+class FileEd25519Signer {
+  signerPrincipal;
+  signingKeyId;
+  privateKey;
+  publicKey;
+  constructor(signerPrincipal, signingKeyId, privateKey, publicKey) {
+    this.signerPrincipal = signerPrincipal;
+    this.signingKeyId = signingKeyId;
+    this.privateKey = privateKey;
+    this.publicKey = publicKey;
+  }
+  static open(path, principalInput, keyIdInput) {
+    assertOwnerOnlySecretFile(path, "Ed25519 signing key file");
+    const bytes = readOwnerOnlySecretFile(path, "Ed25519 signing key file");
+    try {
+      let privateKey;
+      try {
+        privateKey = createPrivateKey(bytes);
+      } catch {
+        throw new InfinityError("invalid_input", "Ed25519 signing key file is invalid");
+      }
+      if (privateKey.asymmetricKeyType !== "ed25519") {
+        throw new InfinityError("invalid_input", "signing key must be Ed25519");
+      }
+      return new FileEd25519Signer(identifier(principalInput, "signer principal"), identifier(keyIdInput, "signing key ID"), privateKey, createPublicKey2(privateKey));
+    } finally {
+      bytes.fill(0);
+    }
+  }
+  publicKeySpki() {
+    return this.publicKey.export({ type: "spki", format: "der" }).toString("base64url");
+  }
+  sign(payload) {
+    return signDetached2(null, Buffer.from(payload, "utf8"), this.privateKey).toString("base64url");
+  }
+  verify(payload, signature) {
+    if (!/^[A-Za-z0-9_-]{80,128}$/.test(signature))
+      return false;
+    try {
+      return verifyDetached2(null, Buffer.from(payload, "utf8"), this.publicKey, Buffer.from(signature, "base64url"));
+    } catch {
+      return false;
+    }
+  }
+}
+function assertOwnerOnlySecretFile(path, label) {
+  if (!isAbsolute(path))
+    throw new InfinityError("invalid_input", `${label} path must be absolute`);
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  } catch {
+    throw new InfinityError("invalid_input", `${label} is unavailable`);
+  }
+  try {
+    assertOwnerOnlyDescriptor(descriptor, label);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+function readOwnerOnlySecretFile(path, label) {
+  if (!isAbsolute(path))
+    throw new InfinityError("invalid_input", `${label} path must be absolute`);
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  } catch {
+    throw new InfinityError("invalid_input", `${label} is unavailable`);
+  }
+  try {
+    assertOwnerOnlyDescriptor(descriptor, label);
+    return readFileSync3(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+function readPostgresUrlFile(path, label) {
+  assertOwnerOnlySecretFile(path, label);
+  const bytes = readOwnerOnlySecretFile(path, label);
+  try {
+    let value;
+    try {
+      value = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      throw new InfinityError("invalid_input", `${label} must contain valid UTF-8`);
+    }
+    if (value.endsWith(`
+`))
+      value = value.slice(0, -1);
+    if (value.endsWith("\r"))
+      value = value.slice(0, -1);
+    if (value.includes(`
+`) || value.includes("\r")) {
+      throw new InfinityError("invalid_input", `${label} must contain one PostgreSQL URL`);
+    }
+    let url;
+    try {
+      url = new URL(value);
+    } catch {
+      throw new InfinityError("invalid_input", `${label} must contain a PostgreSQL URL`);
+    }
+    if (url.protocol !== "postgresql:" && url.protocol !== "postgres:") {
+      throw new InfinityError("invalid_input", `${label} must contain a PostgreSQL URL`);
+    }
+    if (!url.hostname || !url.pathname || url.pathname === "/") {
+      throw new InfinityError("invalid_input", `${label} PostgreSQL URL is incomplete`);
+    }
+    if (!isDatabaseLoopback(url.hostname) && url.searchParams.get("sslmode") !== "verify-full") {
+      throw new InfinityError("capability_denied", `${label} must require sslmode=verify-full for a non-loopback PostgreSQL endpoint`, { status: 503 });
+    }
+    return value;
+  } finally {
+    bytes.fill(0);
+  }
+}
+function secretFile(environment, variable) {
+  const path = required(environment, variable);
+  assertOwnerOnlySecretFile(path, variable);
+  return path;
+}
+function assertOwnerOnlyDescriptor(descriptor, label) {
+  const state = fstatSync(descriptor);
+  const effectiveUserId = process.geteuid?.();
+  if (!state.isFile())
+    throw new InfinityError("invalid_input", `${label} must be a regular file`);
+  if (state.size <= 0 || state.size > 65536) {
+    throw new InfinityError("invalid_input", `${label} size is outside the accepted bound`);
+  }
+  if (effectiveUserId === undefined || (state.mode & 63) !== 0 || state.uid !== effectiveUserId) {
+    throw new InfinityError("capability_denied", `${label} must be owner-only`, { status: 503 });
+  }
+}
+function required(environment, variable) {
+  const value = environment[variable];
+  if (value === undefined || value.length === 0)
+    throw new InfinityError("invalid_input", `${variable} is required`);
+  return value;
+}
+function role(value, label) {
+  if (!/^[a-z][a-z0-9_]{0,62}$/.test(value))
+    throw new InfinityError("invalid_input", `${label} is invalid`);
+  return value;
+}
+function isDatabaseLoopback(value) {
+  return value === "localhost" || value === "::1" || value === "[::1]" || value.startsWith("127.");
+}
+
+// src/persistence/self-hosted-migrate-main.ts
+async function runSelfHostedMigrations(environment = process.env) {
+  const config = loadSelfHostedMigrationConfig(environment);
+  const primarySql = new SQL(readPostgresUrlFile(config.primaryMigratorDatabaseUrlFile, "primary migrator database URL file"), { max: 1, connectionTimeout: 5 });
+  const externalSql = new SQL(readPostgresUrlFile(config.externalJournalMigratorDatabaseUrlFile, "external journal migrator database URL file"), { max: 1, connectionTimeout: 5 });
+  try {
+    const primary = await applyPostgresMigrations(primarySql);
+    await configurePostgresRoles(primarySql, {
+      runtimeRole: config.runtimeRole,
+      reconcilerRole: config.reconcilerRole,
+      journalAckerRole: config.journalAckerRole
+    });
+    const external = await applyPostgresExternalMutationJournalMigrations(externalSql);
+    await configurePostgresExternalMutationJournalRole(externalSql, config.externalJournalRole);
+    const signer = FileEd25519Signer.open(config.mutationSigningKeyFile, config.mutationSignerPrincipal, config.mutationSigningKeyId);
+    const verifier = Ed25519AuthorityMutationJournalVerifier.fromSpki(signer.signerPrincipal, signer.signingKeyId, signer.publicKeySpki());
+    const protection = await initializePostgresExternalMutationJournalStore(primarySql, externalSql, {
+      signer,
+      verifier,
+      journalId: config.externalJournalId,
+      restoreDomainId: config.externalJournalRestoreDomainId,
+      encryptedAtRest: true
+    });
+    process.stdout.write(`${canonicalJson({
+      ok: true,
+      primary,
+      external,
+      external_journal_protection_sha256: protection.protection_digest
+    })}
+`);
+  } finally {
+    await Promise.allSettled([
+      primarySql.close({ timeout: 1 }),
+      externalSql.close({ timeout: 1 })
+    ]);
+  }
+}
+if (import.meta.main) {
+  try {
+    await runSelfHostedMigrations();
+  } catch (error) {
+    process.stderr.write(`${canonicalJson({
+      event: "self_hosted_migration_failed",
+      error_class: error instanceof Error ? error.name : "UnknownError"
+    })}
+`);
+    process.exitCode = 1;
+  }
+}
+export {
+  runSelfHostedMigrations
+};