@opengeni/db 0.12.1 → 0.12.6

package/src/schema.ts

@@ -756,6 +756,8 @@ export const sessions = pgTable(
     // mapSession exposes those rows as `legacy` instead of guessing omitted vs
     // explicit [].
     toolPolicy: jsonb("tool_policy").$type<SessionToolPolicy>(),
+    // Optimistic-concurrency fence for durable session tool-policy writes.
+    toolPolicyVersion: integer("tool_policy_version").notNull().default(1),
     // The manager session that spawned this one via session_create. Set only
     // when the creating grant carried a worker-signed sessionId claim (a session
     // spawning a worker); null for direct API creates and scheduled-task runs.
@@ -1152,6 +1154,9 @@ export const documentBases = pgTable(
       table.workspaceId,
       table.createdAt,
     ),
+    defaultName: uniqueIndex("document_bases_workspace_default_name_uq")
+      .on(table.workspaceId)
+      .where(sql`lower(btrim(${table.name})) = 'default'`),
   }),
 );
 
@@ -1185,6 +1190,17 @@ export const documents = pgTable(
     sourceUpdatedAt: timestamp("source_updated_at", { withTimezone: true }),
     sourceVersion: text("source_version"),
     aclTags: jsonb("acl_tags").$type<string[]>().notNull().default([]),
+    // Per-document access controls. visibility 'private' restricts human reads to
+    // created_by (a grant subject id, not a uuid); agent_access=false hides the
+    // document from agent retrieval surfaces (docs MCP) while humans keep REST.
+    visibility: text("visibility").notNull().default("workspace"),
+    createdBy: text("created_by"),
+    agentAccess: boolean("agent_access").notNull().default(true),
+    // Auto-curation output (knowledge drops).
+    summary: text("summary"),
+    topics: jsonb("topics").$type<string[]>().notNull().default([]),
+    curationStatus: text("curation_status").notNull().default("none"),
+    curation: jsonb("curation").$type<Record<string, unknown>>(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -1207,6 +1223,27 @@ export const documents = pgTable(
       table.workspaceId,
       table.sourceExternalId,
     ),
+    curationStatus: index("documents_workspace_curation_status_idx").on(
+      table.workspaceId,
+      table.curationStatus,
+    ),
+    visibilityState: check(
+      "documents_visibility_chk",
+      sql`${table.visibility} in ('workspace', 'private')`,
+    ),
+    curationState: check(
+      "documents_curation_status_chk",
+      sql`${table.curationStatus} in ('none', 'pending', 'suggested', 'auto_filed', 'failed')`,
+    ),
+    privateCreator: check(
+      "documents_private_creator_chk",
+      sql`${table.visibility} <> 'private' or nullif(btrim(${table.createdBy}), '') is not null`,
+    ),
+    topicsArray: check("documents_topics_array_chk", sql`jsonb_typeof(${table.topics}) = 'array'`),
+    curationObject: check(
+      "documents_curation_object_chk",
+      sql`${table.curation} is null or jsonb_typeof(${table.curation}) = 'object'`,
+    ),
   }),
 );
 
@@ -1485,7 +1522,8 @@ export const sessionTurnAttempts = pgTable(
       "session_turn_attempts_outcome_check",
       sql`${table.outcome} is null or ${table.outcome} in (
         'completed', 'failed', 'cancelled', 'superseded', 'requires_action',
-        'interrupted_recoverable', 'lease_lost_recoverable', 'pre_cutover_closed'
+        'waiting_capacity', 'interrupted_recoverable', 'lease_lost_recoverable',
+        'pre_cutover_closed'
       )`,
     ),
     closedConsistent: check(
@@ -2014,12 +2052,13 @@ export const codexCapacityWaiters = pgTable(
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
     sessionId: uuid("session_id").notNull(),
-    goalId: uuid("goal_id").notNull(),
+    goalId: uuid("goal_id"),
     blockedTurnId: uuid("blocked_turn_id").notNull(),
+    blockedTurnGeneration: integer("blocked_turn_generation").notNull(),
     workflowId: text("workflow_id").notNull(),
     generation: integer("generation").notNull().default(1),
     status: text("status").notNull().default("waiting"), // waiting | resumed | superseded
-    goalVersion: integer("goal_version").notNull(),
+    goalVersion: integer("goal_version"),
     policyHash: text("policy_hash"),
     earliestResetAt: timestamp("earliest_reset_at", { withTimezone: true }),
     nextCheckAt: timestamp("next_check_at", { withTimezone: true }).notNull(),
@@ -2118,6 +2157,7 @@ export const sessionEvents = pgTable(
       .where(
         sql`${table.type} not in ('agent.message.delta', 'agent.reasoning.delta', 'sandbox.command.output.delta', 'terminal.pty.output.delta')`,
       ),
+    duplicateOfEvent: index("session_events_duplicate_of_event_idx").on(table.duplicateOfEventId),
     payloadBytes: check(
       "session_events_payload_bytes_check",
       sql`octet_length(${table.payload}::text) <= 65536`,
@@ -2499,6 +2539,9 @@ export const sandboxLeases = pgTable(
     reaperIdx: index("sandbox_leases_reaper_idx")
       .on(table.expiresAt)
       .where(sql`${table.liveness} in ('warming','warm','draining')`),
+    expiredDrainingInventory: index("sandbox_leases_expired_draining_inventory_idx")
+      .on(table.expiresAt, table.backend)
+      .where(sql`${table.liveness} = 'draining'`),
     workspaceGenerationValid: check(
       "sandbox_leases_workspace_generation_check",
       sql`${table.workspaceGeneration} >= 0`,
@@ -2736,6 +2779,19 @@ export const sandboxRetainedProcesses = pgTable(
     settlementReason: text("settlement_reason"),
     startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
     settledAt: timestamp("settled_at", { withTimezone: true }),
+    // Coordination state for bounded terminal-owner reconciliation. While a
+    // claim is live, reconcileAfter is its expiry; otherwise it is the next
+    // retry time. Becoming due only licenses an exact provider probe and is
+    // never exit/loss proof.
+    reconcileAfter: timestamp("reconcile_after", { withTimezone: true }).notNull().defaultNow(),
+    reconcileClaimId: uuid("reconcile_claim_id"),
+    reconcileClaimedAt: timestamp("reconcile_claimed_at", { withTimezone: true }),
+    reconcileAttempts: integer("reconcile_attempts").notNull().default(0),
+    lastReconcileOutcome: text("last_reconcile_outcome"),
+    reconcileProofOutcome: text("reconcile_proof_outcome", { enum: ["exited", "lost"] }),
+    reconcileProofExitCode: integer("reconcile_proof_exit_code"),
+    reconcileProofReason: text("reconcile_proof_reason"),
+    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", { withTimezone: true }),
   },
   (table) => ({
     workspaceAccount: foreignKey({
@@ -2788,6 +2844,12 @@ export const sandboxRetainedProcesses = pgTable(
     active: index("sandbox_retained_processes_active_idx")
       .on(table.workspaceId, table.sessionId, table.startedAt)
       .where(sql`${table.state} = 'active'`),
+    reconcileDue: index("sandbox_retained_processes_reconcile_due_idx")
+      .on(table.reconcileAfter, table.startedAt, table.id)
+      .where(sql`${table.state} = 'active'`),
+    activeInventory: index("sandbox_retained_processes_active_inventory_idx")
+      .on(table.ownerActorKind, table.workspaceId, table.ownerTurnId, table.ownerAttemptId)
+      .where(sql`${table.state} = 'active'`),
     identityValid: check(
       "sandbox_retained_processes_identity_check",
       sql`${table.leaseEpoch} >= 0
@@ -2824,6 +2886,41 @@ export const sandboxRetainedProcesses = pgTable(
       sql`${table.settlementReason} is null
         or octet_length(${table.settlementReason}) between 1 and 512`,
     ),
+    reconcileClaimValid: check(
+      "sandbox_retained_processes_reconcile_claim_check",
+      sql`(${table.reconcileClaimId} is null and ${table.reconcileClaimedAt} is null)
+        or (${table.reconcileClaimId} is not null and ${table.reconcileClaimedAt} is not null)`,
+    ),
+    reconcileAttemptsValid: check(
+      "sandbox_retained_processes_reconcile_attempts_check",
+      sql`${table.reconcileAttempts} >= 0`,
+    ),
+    reconcileOutcomeValid: check(
+      "sandbox_retained_processes_reconcile_outcome_check",
+      sql`${table.lastReconcileOutcome} is null
+        or octet_length(${table.lastReconcileOutcome}) between 1 and 64`,
+    ),
+    reconcileProofValid: check(
+      "sandbox_retained_processes_reconcile_proof_check",
+      sql`(
+          ${table.reconcileProofOutcome} is null
+          and ${table.reconcileProofExitCode} is null
+          and ${table.reconcileProofReason} is null
+          and ${table.reconcileProofObservedAt} is null
+        ) or (
+          ${table.reconcileProofOutcome} = 'exited'
+          and ${table.reconcileProofExitCode} is not null
+          and ${table.reconcileProofReason} = 'provider_exit_banner'
+          and ${table.reconcileProofObservedAt} is not null
+        ) or (
+          ${table.reconcileProofOutcome} = 'lost'
+          and ${table.reconcileProofExitCode} is null
+          and ${table.reconcileProofReason} in (
+            'provider_session_lost_banner', 'provider_instance_not_found'
+          )
+          and ${table.reconcileProofObservedAt} is not null
+        )`,
+    ),
   }),
 );
 
@@ -3410,10 +3507,17 @@ export const githubInstallations = pgTable(
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
     installationId: integer("installation_id").notNull(),
+    githubAccountId: bigint("github_account_id", { mode: "number" }),
     accountLogin: text("account_login"),
     accountType: text("account_type"),
     repositoryScope: text("repository_scope").notNull().default("all"),
     linkedBySubjectId: text("linked_by_subject_id"),
+    githubActorId: bigint("github_actor_id", { mode: "number" }),
+    githubActorLogin: text("github_actor_login"),
+    authorityKind: text("authority_kind"),
+    authorityCheckedAt: timestamp("authority_checked_at", { withTimezone: true }),
+    authorityExpiresAt: timestamp("authority_expires_at", { withTimezone: true }),
+    authorityNonce: text("authority_nonce"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -3428,6 +3532,55 @@ export const githubInstallations = pgTable(
       "github_installations_repository_scope_check",
       sql`${table.repositoryScope} in ('all', 'selected')`,
     ),
+    authorityKindCheck: check(
+      "github_installations_authority_kind_check",
+      sql`
+        (
+          ${table.githubAccountId} is null
+          and ${table.githubActorId} is null
+          and ${table.githubActorLogin} is null
+          and ${table.authorityKind} is null
+          and ${table.authorityCheckedAt} is null
+          and ${table.authorityExpiresAt} is null
+          and ${table.authorityNonce} is null
+        )
+        or (
+          ${table.githubAccountId} is not null
+          and ${table.githubAccountId} > 0
+          and ${table.githubActorId} is not null
+          and ${table.githubActorId} > 0
+          and ${table.githubActorLogin} is not null
+          and length(${table.githubActorLogin}) > 0
+          and ${table.accountLogin} is not null
+          and length(${table.accountLogin}) > 0
+          and ${table.accountType} is not null
+          and ${table.linkedBySubjectId} is not null
+          and length(${table.linkedBySubjectId}) > 0
+          and ${table.authorityKind} is not null
+          and ${table.authorityCheckedAt} is not null
+          and ${table.authorityExpiresAt} is not null
+          and ${table.authorityCheckedAt} < ${table.authorityExpiresAt}
+          and ${table.authorityExpiresAt} <= ${table.authorityCheckedAt} + interval '10 minutes'
+          and ${table.authorityNonce} is not null
+          and length(${table.authorityNonce}) > 0
+          and ${table.repositoryScope} = 'selected'
+          and (
+            (
+              ${table.authorityKind} = 'personal_owner'
+              and ${table.accountType} = 'User'
+              and ${table.githubActorId} = ${table.githubAccountId}
+            )
+            or (
+              ${table.authorityKind} = 'organization_owner'
+              and ${table.accountType} = 'Organization'
+            )
+          )
+        )
+      `,
+    ),
+    authorityNonce: uniqueIndex("github_installations_authority_nonce_uq")
+      .on(table.authorityNonce)
+      .where(sql`${table.authorityNonce} is not null`),
   }),
 );
 

package/src/session-control.ts

@@ -34,6 +34,7 @@ export type SessionTurnAttemptOutcome =
   | "cancelled"
   | "superseded"
   | "requires_action"
+  | "waiting_capacity"
   | "interrupted_recoverable"
   | "lease_lost_recoverable"
   | "pre_cutover_closed";

package/dist/chunk-BMFDXFPA.js

@@ -1,155 +0,0 @@
-// src/provision-roles.ts
-import postgres from "postgres";
-async function provisionRoles(adminConnection, options = {}) {
-  const schema = validateIdentifier("targetSchema", options.targetSchema ?? "public");
-  const rlsStrategy = options.rlsStrategy ?? "force";
-  const appRole = validateIdentifier(
-    "appRole",
-    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app")
-  );
-  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
-  const hostExportRole = validateIdentifier(
-    "hostExportRole",
-    options.hostExportRole ?? (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || "opengeni_host_exporter")
-  );
-  const hostExportPassword = options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;
-  const temporalRole = validateIdentifier(
-    "temporalRole",
-    options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal")
-  );
-  const temporalPassword = options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;
-  const temporalDatabases = (options.temporalDatabases ?? commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? "temporal,temporal_visibility")).map((name) => validateIdentifier("temporalDatabases", name));
-  const sql = postgres(adminConnection, { max: 1 });
-  try {
-    let provisionedAppRole = null;
-    if (rlsStrategy === "force") {
-      if (!appPassword) {
-        throw new Error(
-          "OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'"
-        );
-      }
-      await ensureLoginRole(sql, appRole, appPassword);
-      provisionedAppRole = appRole;
-    }
-    if (temporalPassword) {
-      await ensureLoginRole(sql, temporalRole, temporalPassword);
-      for (const database of temporalDatabases) {
-        await ensureDatabase(sql, database, temporalRole);
-        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);
-      }
-    }
-    if (hostExportPassword) {
-      await ensureLoginRole(sql, hostExportRole, hostExportPassword);
-      await grantHostExportRoleIfSchemaExists(sql, hostExportRole);
-    }
-    if (rlsStrategy === "force") {
-      await grantAppRoleIfSchemaExists(sql, appRole, schema);
-    }
-    return {
-      appRole: provisionedAppRole,
-      hostExportRole: hostExportPassword ? hostExportRole : null,
-      temporalRole: temporalPassword ? temporalRole : null,
-      temporalDatabases: temporalPassword ? temporalDatabases : [],
-      schema,
-      rlsStrategy
-    };
-  } finally {
-    await sql.end();
-  }
-}
-async function grantHostExportRoleIfSchemaExists(sql, role) {
-  await sql.unsafe(`
-DO $$
-BEGIN
-  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN
-    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});
-    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});
-    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});
-  END IF;
-END $$;
-`);
-}
-async function ensureLoginRole(sql, role, password) {
-  await sql.unsafe(`
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
-    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
-  ELSE
-    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
-  END IF;
-END $$;
-`);
-}
-async function ensureDatabase(sql, database, owner) {
-  const existing = await sql`
-    select exists(select 1 from pg_database where datname = ${database}) as exists
-  `;
-  if (!existing[0]?.exists) {
-    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);
-  }
-  await sql.unsafe(
-    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`
-  );
-}
-async function grantTemporalRoleInDatabase(adminConnection, database, role) {
-  const databaseUrl = databaseUrlFor(adminConnection, database);
-  const databaseSql = postgres(databaseUrl, { max: 1 });
-  try {
-    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);
-  } finally {
-    await databaseSql.end();
-  }
-}
-async function grantAppRoleIfSchemaExists(sql, role, schema) {
-  await sql.unsafe(`
-DO $$
-BEGIN
-  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN
-    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
-    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
-  END IF;
-  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN
-    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
-    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
-  END IF;
-END $$;
-`);
-}
-function commaSeparated(value) {
-  return value.split(",").map((item) => item.trim()).filter(Boolean);
-}
-function validateIdentifier(name, value) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
-    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);
-  }
-  return value;
-}
-function identifier(value) {
-  return `"${value.replace(/"/g, '""')}"`;
-}
-function literal(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-function databaseUrlFor(value, database) {
-  const url = new URL(value);
-  url.pathname = `/${database}`;
-  return url.toString();
-}
-if (import.meta.main) {
-  const adminUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_ADMIN_URL ?? process.env.OPENGENI_DATABASE_URL;
-  if (!adminUrl) {
-    throw new Error(
-      "OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required"
-    );
-  }
-  const result = await provisionRoles(adminUrl, {
-    ...process.env.OPENGENI_DB_SCHEMA?.trim() ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() } : {}
-  });
-  console.log(JSON.stringify(result, null, 2));
-}
-
-export {
-  provisionRoles
-};
-//# sourceMappingURL=chunk-BMFDXFPA.js.map

package/dist/chunk-BMFDXFPA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/provision-roles.ts"],"sourcesContent":["import postgres from \"postgres\";\nimport type { RlsStrategy } from \"./index\";\n\nexport type ProvisionResult = {\n  appRole: string | null;\n  hostExportRole: string | null;\n  temporalRole: string | null;\n  temporalDatabases: string[];\n  schema: string;\n  rlsStrategy: RlsStrategy;\n};\n\nexport type ProvisionRolesOptions = {\n  /**\n   * The schema OpenGeni's tables live in. The app-role GRANTs target this\n   * schema + `opengeni_private`. Defaults to `public` (standalone).\n   */\n  targetSchema?: string;\n  /**\n   * RLS posture (Step I). `\"force\"` (default) provisions the non-owner\n   * `opengeni_app` login role and GRANTs it table DML in the target schema —\n   * the role OpenGeni connects as under FORCE-RLS. `\"scoped\"` SKIPS the app-role\n   * provisioning entirely: the embedded host runs OpenGeni's queries over a role\n   * IT owns/manages (typically the schema owner), so OpenGeni neither creates\n   * nor grants the `opengeni_app` role. Temporal-role provisioning is unaffected\n   * by strategy.\n   */\n  rlsStrategy?: RlsStrategy;\n  appRole?: string;\n  appPassword?: string;\n  /**\n   * Optional cross-workspace projection role. It receives schema USAGE and\n   * EXECUTE only on the host-export API; it receives no table privileges.\n   * Provision it after the first migration run so the schema exists. The\n   * provisioner also registers same-owner default privileges for future\n   * host-export functions; shipped migrations preserve existing exporter ACLs\n   * when a migration-only upgrade adds a function.\n   */\n  hostExportRole?: string;\n  hostExportPassword?: string;\n  temporalRole?: string;\n  temporalPassword?: string;\n  temporalDatabases?: string[];\n};\n\n/**\n * SDK entry point (Step I): provision the OpenGeni database roles + grants over\n * a host-supplied admin connection. This is the named, parameterized form of the\n * historical env-driven `provision-roles` script (which still works as a CLI via\n * the `import.meta.main` block at the bottom — it just reads env into these\n * options).\n *\n * STANDALONE (default): `provisionRoles(adminConnection)` with no options →\n * `targetSchema: \"public\"`, `rlsStrategy: \"force\"`, reads `opengeni_app` creds\n * from env. Byte-for-byte the historical script behavior.\n *\n * EMBEDDED: `provisionRoles(adminConnection, { targetSchema, rlsStrategy })` lets\n * a host provision the app role over a dedicated schema (force) OR skip the\n * app role entirely and own the connection role itself (scoped).\n */\nexport async function provisionRoles(\n  adminConnection: string,\n  options: ProvisionRolesOptions = {},\n): Promise<ProvisionResult> {\n  const schema = validateIdentifier(\"targetSchema\", options.targetSchema ?? \"public\");\n  const rlsStrategy: RlsStrategy = options.rlsStrategy ?? \"force\";\n\n  const appRole = validateIdentifier(\n    \"appRole\",\n    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || \"opengeni_app\"),\n  );\n  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;\n  const hostExportRole = validateIdentifier(\n    \"hostExportRole\",\n    options.hostExportRole ??\n      (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || \"opengeni_host_exporter\"),\n  );\n  const hostExportPassword =\n    options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;\n  const temporalRole = validateIdentifier(\n    \"temporalRole\",\n    options.temporalRole ??\n      (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || \"opengeni_temporal\"),\n  );\n  const temporalPassword =\n    options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;\n  const temporalDatabases = (\n    options.temporalDatabases ??\n    commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? \"temporal,temporal_visibility\")\n  ).map((name) => validateIdentifier(\"temporalDatabases\", name));\n\n  const sql = postgres(adminConnection, { max: 1 });\n  try {\n    // FORCE strategy provisions the non-owner app role OpenGeni connects as.\n    // SCOPED strategy: the host owns the connection role; OpenGeni provisions no\n    // app role (skipped here), only the optional Temporal role.\n    let provisionedAppRole: string | null = null;\n    if (rlsStrategy === \"force\") {\n      if (!appPassword) {\n        throw new Error(\n          \"OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'\",\n        );\n      }\n      await ensureLoginRole(sql, appRole, appPassword);\n      provisionedAppRole = appRole;\n    }\n\n    if (temporalPassword) {\n      await ensureLoginRole(sql, temporalRole, temporalPassword);\n      for (const database of temporalDatabases) {\n        await ensureDatabase(sql, database, temporalRole);\n        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);\n      }\n    }\n\n    if (hostExportPassword) {\n      await ensureLoginRole(sql, hostExportRole, hostExportPassword);\n      await grantHostExportRoleIfSchemaExists(sql, hostExportRole);\n    }\n\n    if (rlsStrategy === \"force\") {\n      await grantAppRoleIfSchemaExists(sql, appRole, schema);\n    }\n\n    return {\n      appRole: provisionedAppRole,\n      hostExportRole: hostExportPassword ? hostExportRole : null,\n      temporalRole: temporalPassword ? temporalRole : null,\n      temporalDatabases: temporalPassword ? temporalDatabases : [],\n      schema,\n      rlsStrategy,\n    };\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * The exporter is intentionally separate from `opengeni_app`: its functions\n * project every workspace into a host-owned sink and therefore cannot be made\n * available to the tenant-scoped application role.\n */\nasync function grantHostExportRoleIfSchemaExists(sql: postgres.Sql, role: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureLoginRole(sql: postgres.Sql, role: string, password: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  ELSE\n    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureDatabase(sql: postgres.Sql, database: string, owner: string): Promise<void> {\n  const existing = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_database where datname = ${database}) as exists\n  `;\n  if (!existing[0]?.exists) {\n    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);\n  }\n  await sql.unsafe(\n    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`,\n  );\n}\n\nasync function grantTemporalRoleInDatabase(\n  adminConnection: string,\n  database: string,\n  role: string,\n): Promise<void> {\n  const databaseUrl = databaseUrlFor(adminConnection, database);\n  const databaseSql = postgres(databaseUrl, { max: 1 });\n  try {\n    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);\n  } finally {\n    await databaseSql.end();\n  }\n}\n\n/**\n * Grant the app role table DML in the OpenGeni data schema + EXECUTE on the\n * `opengeni_private` helper functions. Schema-parameterized (Step I): standalone\n * passes `public`; embedded passes the dedicated schema. The grants are guarded\n * on schema existence so provisioning before migrate is a safe no-op.\n */\nasync function grantAppRoleIfSchemaExists(\n  sql: postgres.Sql,\n  role: string,\n  schema: string,\n): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nfunction commaSeparated(value: string): string[] {\n  return value\n    .split(\",\")\n    .map((item) => item.trim())\n    .filter(Boolean);\n}\n\nfunction validateIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\nfunction identifier(value: string): string {\n  return `\"${value.replace(/\"/g, '\"\"')}\"`;\n}\n\nfunction literal(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`;\n}\n\nfunction databaseUrlFor(value: string, database: string): string {\n  const url = new URL(value);\n  url.pathname = `/${database}`;\n  return url.toString();\n}\n\n// CLI form (unchanged behavior): read env into the SDK options and run. This is\n// what `bun src/provision-roles.ts` / the `provision-roles` package script\n// invokes — standalone byte-for-byte the historical script (public schema,\n// force strategy, env-driven creds).\nif (import.meta.main) {\n  const adminUrl =\n    process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_ADMIN_URL ??\n    process.env.OPENGENI_DATABASE_URL;\n  if (!adminUrl) {\n    throw new Error(\n      \"OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required\",\n    );\n  }\n  const result = await provisionRoles(adminUrl, {\n    ...(process.env.OPENGENI_DB_SCHEMA?.trim()\n      ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() }\n      : {}),\n  });\n  console.log(JSON.stringify(result, null, 2));\n}\n"],"mappings":";AAAA,OAAO,cAAc;AA4DrB,eAAsB,eACpB,iBACA,UAAiC,CAAC,GACR;AAC1B,QAAM,SAAS,mBAAmB,gBAAgB,QAAQ,gBAAgB,QAAQ;AAClF,QAAM,cAA2B,QAAQ,eAAe;AAExD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,YAAY,QAAQ,IAAI,4BAA4B,KAAK,KAAK;AAAA,EACxE;AACA,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA,QAAQ,mBACL,QAAQ,IAAI,oCAAoC,KAAK,KAAK;AAAA,EAC/D;AACA,QAAM,qBACJ,QAAQ,sBAAsB,QAAQ,IAAI;AAC5C,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,QAAQ,iBACL,QAAQ,IAAI,iCAAiC,KAAK,KAAK;AAAA,EAC5D;AACA,QAAM,mBACJ,QAAQ,oBAAoB,QAAQ,IAAI;AAC1C,QAAM,qBACJ,QAAQ,qBACR,eAAe,QAAQ,IAAI,+BAA+B,8BAA8B,GACxF,IAAI,CAAC,SAAS,mBAAmB,qBAAqB,IAAI,CAAC;AAE7D,QAAM,MAAM,SAAS,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAChD,MAAI;AAIF,QAAI,qBAAoC;AACxC,QAAI,gBAAgB,SAAS;AAC3B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,gBAAgB,KAAK,SAAS,WAAW;AAC/C,2BAAqB;AAAA,IACvB;AAEA,QAAI,kBAAkB;AACpB,YAAM,gBAAgB,KAAK,cAAc,gBAAgB;AACzD,iBAAW,YAAY,mBAAmB;AACxC,cAAM,eAAe,KAAK,UAAU,YAAY;AAChD,cAAM,4BAA4B,iBAAiB,UAAU,YAAY;AAAA,MAC3E;AAAA,IACF;AAEA,QAAI,oBAAoB;AACtB,YAAM,gBAAgB,KAAK,gBAAgB,kBAAkB;AAC7D,YAAM,kCAAkC,KAAK,cAAc;AAAA,IAC7D;AAEA,QAAI,gBAAgB,SAAS;AAC3B,YAAM,2BAA2B,KAAK,SAAS,MAAM;AAAA,IACvD;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,gBAAgB,qBAAqB,iBAAiB;AAAA,MACtD,cAAc,mBAAmB,eAAe;AAAA,MAChD,mBAAmB,mBAAmB,oBAAoB,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAOA,eAAe,kCAAkC,KAAmB,MAA6B;AAC/F,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA;AAAA,yEAIsD,QAAQ,IAAI,CAAC;AAAA,4FACM,QAAQ,IAAI,CAAC;AAAA,iHACQ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAG7H;AACD;AAEA,eAAe,gBAAgB,KAAmB,MAAc,UAAiC;AAC/F,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,IAAI,CAAC;AAAA,yDACd,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA,wDAEpC,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA,CAG1F;AACD;AAEA,eAAe,eAAe,KAAmB,UAAkB,OAA8B;AAC/F,QAAM,WAAW,MAAM;AAAA,8DACqC,QAAQ;AAAA;AAEpE,MAAI,CAAC,SAAS,CAAC,GAAG,QAAQ;AACxB,UAAM,IAAI,OAAO,mBAAmB,WAAW,QAAQ,CAAC,UAAU,WAAW,KAAK,CAAC,EAAE;AAAA,EACvF;AACA,QAAM,IAAI;AAAA,IACR,oCAAoC,WAAW,QAAQ,CAAC,OAAO,WAAW,KAAK,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,4BACb,iBACA,UACA,MACe;AACf,QAAM,cAAc,eAAe,iBAAiB,QAAQ;AAC5D,QAAM,cAAc,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AACpD,MAAI;AACF,UAAM,YAAY,OAAO,2CAA2C,WAAW,IAAI,CAAC,EAAE;AAAA,EACxF,UAAE;AACA,UAAM,YAAY,IAAI;AAAA,EACxB;AACF;AAQA,eAAe,2BACb,KACA,MACA,QACe;AACf,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,MAAM,CAAC;AAAA,uDAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,8FACM,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,qEAG1D,QAAQ,IAAI,CAAC;AAAA,wFACM,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAGpG;AACD;AAEA,SAAS,eAAe,OAAyB;AAC/C,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACnB;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,6CAA6C,KAAK,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,QAAQ,OAAuB;AACtC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,eAAe,OAAe,UAA0B;AAC/D,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,WAAW,IAAI,QAAQ;AAC3B,SAAO,IAAI,SAAS;AACtB;AAMA,IAAI,YAAY,MAAM;AACpB,QAAM,WACJ,QAAQ,IAAI,oCACZ,QAAQ,IAAI,+BACZ,QAAQ,IAAI;AACd,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,UAAU;AAAA,IAC5C,GAAI,QAAQ,IAAI,oBAAoB,KAAK,IACrC,EAAE,cAAc,QAAQ,IAAI,mBAAmB,KAAK,EAAE,IACtD,CAAC;AAAA,EACP,CAAC;AACD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;","names":[]}