@opengeni/db 0.12.1 → 0.13.0

package/dist/chunk-ELMUCYZF.js

@@ -0,0 +1,906 @@
+// src/provision-roles.ts
+import postgres from "postgres";
+
+// src/runtime-posture.ts
+import { sql } from "drizzle-orm";
+var FORCE_RLS_TABLES = [
+  "agent_run_states",
+  "api_keys",
+  "audit_events",
+  "billing_customers",
+  "capability_catalog_items",
+  "capability_installations",
+  "codex_capacity_waiters",
+  "codex_credential_leases",
+  "codex_reset_redemption_attempts",
+  "codex_rotation_settings",
+  "codex_subscription_credentials",
+  "composer_drafts",
+  "connections",
+  "credit_ledger_entries",
+  "device_enrollment_requests",
+  "document_bases",
+  "document_chunks",
+  "documents",
+  "enrollments",
+  "file_uploads",
+  "files",
+  "github_installation_repositories",
+  "github_installations",
+  "host_export_config",
+  "host_export_consumers",
+  "host_export_cursor_state",
+  "host_export_dead_letters",
+  "host_export_outbox",
+  "import_batches",
+  "integration_oauth_state_nonces",
+  "knowledge_memories",
+  "machine_metrics_latest",
+  "machine_metrics_series",
+  "new_session_drafts",
+  "pack_installations",
+  "rig_changes",
+  "rig_versions",
+  "rigs",
+  "sandbox_lease_holders",
+  "sandbox_leases",
+  "sandbox_pty_sessions",
+  "sandbox_retained_processes",
+  "sandbox_session_envelopes",
+  "sandbox_workspace_mutation_admissions",
+  "sandboxes",
+  "scheduled_task_runs",
+  "scheduled_tasks",
+  "session_attempt_interruptions",
+  "session_command_receipts",
+  "session_events",
+  "session_goals",
+  "session_history_items",
+  "session_human_input_requests",
+  "session_list_snapshots",
+  "session_mcp_servers",
+  "session_pending_tool_calls",
+  "session_pins",
+  "session_recordings",
+  "session_spawn_denials",
+  "session_stream_acknowledgments",
+  "session_system_update_outbox",
+  "session_system_updates",
+  "session_turn_attempts",
+  "session_turns",
+  "session_workflow_wake_outbox",
+  "sessions",
+  "slack_bot_post_operations",
+  "social_connections",
+  "social_posts",
+  "usage_events",
+  "workspace_captures",
+  "workspace_control_events",
+  "workspace_inference_controls",
+  "workspace_instruction_policy_activation_events",
+  "workspace_instruction_policy_heads",
+  "workspace_instruction_policy_revisions",
+  "workspace_model_policies",
+  "workspace_packs",
+  "workspace_session_activity_revisions",
+  "workspace_variable_set_variables",
+  "workspace_variable_sets"
+];
+var NON_RLS_RUNTIME_TABLES = [
+  "auth_identities",
+  "auth_rate_limits",
+  "auth_sessions",
+  "auth_users",
+  "auth_verifications",
+  "integration_oauth_clients",
+  "managed_accounts",
+  "nested_agent_depth_configuration",
+  "stripe_webhook_events",
+  "workspace_memberships",
+  "workspaces"
+];
+var RUNTIME_FULL_DML_TABLES = [
+  "agent_run_states",
+  "api_keys",
+  "audit_events",
+  "auth_identities",
+  "auth_rate_limits",
+  "auth_sessions",
+  "auth_users",
+  "auth_verifications",
+  "billing_customers",
+  "capability_catalog_items",
+  "capability_installations",
+  "codex_capacity_waiters",
+  "codex_credential_leases",
+  "codex_reset_redemption_attempts",
+  "codex_rotation_settings",
+  "codex_subscription_credentials",
+  "composer_drafts",
+  "connections",
+  "credit_ledger_entries",
+  "device_enrollment_requests",
+  "document_bases",
+  "document_chunks",
+  "documents",
+  "enrollments",
+  "file_uploads",
+  "files",
+  "github_installation_repositories",
+  "github_installations",
+  "import_batches",
+  "integration_oauth_clients",
+  "integration_oauth_state_nonces",
+  "knowledge_memories",
+  "machine_metrics_latest",
+  "machine_metrics_series",
+  "managed_accounts",
+  "new_session_drafts",
+  "pack_installations",
+  "rig_changes",
+  "rig_versions",
+  "rigs",
+  "sandbox_lease_holders",
+  "sandbox_leases",
+  "sandbox_pty_sessions",
+  "sandbox_retained_processes",
+  "sandbox_session_envelopes",
+  "sandbox_workspace_mutation_admissions",
+  "sandboxes",
+  "scheduled_task_runs",
+  "scheduled_tasks",
+  "session_attempt_interruptions",
+  "session_command_receipts",
+  "session_events",
+  "session_goals",
+  "session_history_items",
+  "session_human_input_requests",
+  "session_list_snapshots",
+  "session_mcp_servers",
+  "session_pending_tool_calls",
+  "session_pins",
+  "session_recordings",
+  "session_stream_acknowledgments",
+  "session_system_update_outbox",
+  "session_system_updates",
+  "session_turn_attempts",
+  "session_turns",
+  "session_workflow_wake_outbox",
+  "sessions",
+  "slack_bot_post_operations",
+  "social_connections",
+  "social_posts",
+  "stripe_webhook_events",
+  "usage_events",
+  "workspace_captures",
+  "workspace_control_events",
+  "workspace_inference_controls",
+  "workspace_instruction_policy_heads",
+  "workspace_memberships",
+  "workspace_model_policies",
+  "workspace_packs",
+  "workspace_session_activity_revisions",
+  "workspace_variable_set_variables",
+  "workspace_variable_sets",
+  "workspaces"
+];
+var RUNTIME_READ_ONLY_TABLES = ["nested_agent_depth_configuration"];
+var RUNTIME_READ_INSERT_TABLES = [
+  "session_spawn_denials",
+  "workspace_instruction_policy_activation_events",
+  "workspace_instruction_policy_revisions"
+];
+var PROTECTED_NO_DIRECT_DML_TABLES = [
+  "host_export_config",
+  "host_export_consumers",
+  "host_export_cursor_state",
+  "host_export_dead_letters",
+  "host_export_outbox"
+];
+var FULL_DML_PRIVILEGES = ["SELECT", "INSERT", "UPDATE", "DELETE"];
+var RUNTIME_TABLE_PRIVILEGES = Object.freeze({
+  ...Object.fromEntries(RUNTIME_FULL_DML_TABLES.map((table) => [table, FULL_DML_PRIVILEGES])),
+  ...Object.fromEntries(RUNTIME_READ_ONLY_TABLES.map((table) => [table, ["SELECT"]])),
+  ...Object.fromEntries(
+    RUNTIME_READ_INSERT_TABLES.map((table) => [table, ["SELECT", "INSERT"]])
+  )
+});
+var RUNTIME_DML_TABLES = Object.freeze(
+  Object.keys(RUNTIME_TABLE_PRIVILEGES).sort((a, b) => a.localeCompare(b))
+);
+var RuntimeDatabasePostureError = class extends Error {
+  violations;
+  constructor(violations) {
+    super(`Runtime database posture check failed: ${violations.join("; ")}`);
+    this.name = "RuntimeDatabasePostureError";
+    this.violations = violations;
+  }
+};
+function resultRows(result) {
+  if (Array.isArray(result)) {
+    return result;
+  }
+  const rows = result?.rows;
+  if (Array.isArray(rows)) {
+    return rows;
+  }
+  throw new Error("Runtime database posture query returned an unsupported result shape");
+}
+function sorted(values) {
+  return [...values].sort((a, b) => a.localeCompare(b));
+}
+function difference(left, right) {
+  return sorted([...left].filter((value) => !right.has(value)));
+}
+async function inspectRuntimeDatabasePosture(db, options) {
+  const targetSchema = options.targetSchema?.trim() || "public";
+  return await db.transaction(
+    async (tx) => {
+      const identityRows = resultRows(
+        await tx.execute(sql`
+          select
+            current_user::text as current_user,
+            session_user::text as session_user,
+            pg_get_userbyid(d.datdba)::text as database_owner,
+            has_database_privilege(current_user, d.oid, 'CONNECT') as can_connect_database,
+            has_database_privilege(current_user, d.oid, 'CREATE') as can_create_in_database,
+            current_setting('row_security')::text as row_security,
+            r.rolcanlogin,
+            r.rolsuper,
+            r.rolinherit,
+            r.rolcreaterole,
+            r.rolcreatedb,
+            r.rolreplication,
+            r.rolbypassrls
+          from pg_roles r
+          join pg_database d on d.datname = current_database()
+          where r.rolname = current_user
+        `)
+      );
+      const identity = identityRows[0];
+      if (!identity) {
+        throw new Error("Runtime database posture could not resolve the current PostgreSQL role");
+      }
+      const mappedIdentity = {
+        currentUser: identity.current_user,
+        sessionUser: identity.session_user,
+        databaseOwner: identity.database_owner,
+        canConnectDatabase: identity.can_connect_database,
+        canCreateInDatabase: identity.can_create_in_database,
+        rowSecurity: identity.row_security,
+        canLogin: identity.rolcanlogin,
+        superuser: identity.rolsuper,
+        inherit: identity.rolinherit,
+        createRole: identity.rolcreaterole,
+        createDatabase: identity.rolcreatedb,
+        replication: identity.rolreplication,
+        bypassRls: identity.rolbypassrls
+      };
+      if (options.rlsStrategy === "scoped") {
+        return {
+          identity: mappedIdentity,
+          memberships: [],
+          schemas: [],
+          ownedSchemas: [],
+          ownedRelations: [],
+          tables: [],
+          privateRoutines: []
+        };
+      }
+      const memberships = resultRows(
+        await tx.execute(sql`
+          with recursive inherited_roles(oid, rolname) as (
+            select parent.oid, parent.rolname
+            from pg_auth_members membership
+            join pg_roles member on member.oid = membership.member
+            join pg_roles parent on parent.oid = membership.roleid
+            where member.rolname = current_user
+            union
+            select parent.oid, parent.rolname
+            from inherited_roles inherited
+            join pg_auth_members membership on membership.member = inherited.oid
+            join pg_roles parent on parent.oid = membership.roleid
+          )
+          select ('inherits:' || rolname)::text as relationship from inherited_roles
+          union
+          select ('member:' || member.rolname)::text as relationship
+          from pg_auth_members membership
+          join pg_roles parent on parent.oid = membership.roleid
+          join pg_roles member on member.oid = membership.member
+          where parent.rolname = current_user
+          order by relationship
+        `)
+      ).map((row) => row.relationship);
+      const schemas = resultRows(
+        await tx.execute(sql`
+          select
+            n.nspname::text as name,
+            pg_get_userbyid(n.nspowner)::text as owner,
+            has_schema_privilege(current_user, n.oid, 'USAGE') as usage,
+            has_schema_privilege(current_user, n.oid, 'CREATE') as create
+          from pg_namespace n
+          where n.nspname in (${targetSchema}, 'opengeni_private')
+          order by n.nspname
+        `)
+      );
+      const ownedSchemas = resultRows(
+        await tx.execute(sql`
+          select n.nspname::text as name
+          from pg_namespace n
+          join pg_roles r on r.oid = n.nspowner
+          where r.rolname = current_user
+            and n.nspname <> 'information_schema'
+            and n.nspname !~ '^pg_'
+          order by n.nspname
+        `)
+      ).map((row) => row.name);
+      const ownedRelations = resultRows(
+        await tx.execute(sql`
+          select (n.nspname || '.' || c.relname)::text as name
+          from pg_class c
+          join pg_namespace n on n.oid = c.relnamespace
+          join pg_roles r on r.oid = c.relowner
+          where r.rolname = current_user
+            and c.relkind in ('r', 'p', 'S', 'v', 'm', 'f')
+            and n.nspname <> 'information_schema'
+            and n.nspname !~ '^pg_'
+          order by n.nspname, c.relname
+        `)
+      ).map((row) => row.name);
+      const tables = resultRows(
+        await tx.execute(sql`
+          select
+            c.relname::text as name,
+            pg_get_userbyid(c.relowner)::text as owner,
+            c.relrowsecurity as rls_enabled,
+            c.relforcerowsecurity as rls_forced,
+            row_security_active(c.oid) as rls_active,
+            (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,
+            has_table_privilege(current_user, c.oid, 'SELECT') as can_select,
+            has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,
+            has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,
+            has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,
+            has_table_privilege(current_user, c.oid, 'TRUNCATE') as can_truncate,
+            has_table_privilege(current_user, c.oid, 'REFERENCES') as can_references,
+            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger
+          from pg_class c
+          join pg_namespace n on n.oid = c.relnamespace
+          where n.nspname = ${targetSchema}
+            and c.relkind in ('r', 'p')
+          order by c.relname
+        `)
+      ).map((row) => ({
+        name: row.name,
+        owner: row.owner,
+        rlsEnabled: row.rls_enabled,
+        rlsForced: row.rls_forced,
+        rlsActive: row.rls_active,
+        policyCount: row.policy_count,
+        select: row.can_select,
+        insert: row.can_insert,
+        update: row.can_update,
+        delete: row.can_delete,
+        truncate: row.can_truncate,
+        references: row.can_references,
+        trigger: row.can_trigger
+      }));
+      const privateRoutines = resultRows(
+        await tx.execute(sql`
+          select
+            (p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')')::text as name,
+            pg_get_userbyid(p.proowner)::text as owner,
+            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+          where n.nspname = 'opengeni_private'
+            and p.prokind in ('f', 'p')
+          order by p.proname, pg_get_function_identity_arguments(p.oid)
+        `)
+      ).map((row) => ({ name: row.name, owner: row.owner, execute: row.can_execute }));
+      return {
+        identity: mappedIdentity,
+        memberships,
+        schemas,
+        ownedSchemas,
+        ownedRelations,
+        tables,
+        privateRoutines
+      };
+    },
+    { isolationLevel: "repeatable read", accessMode: "read only" }
+  );
+}
+function evaluateRuntimeDatabasePosture(posture, options) {
+  const violations = [];
+  const identity = posture.identity;
+  if (!identity.currentUser || !identity.sessionUser) {
+    violations.push("database identity is empty");
+  }
+  if (identity.currentUser !== identity.sessionUser) {
+    violations.push(
+      `current_user ${identity.currentUser} does not match session_user ${identity.sessionUser}`
+    );
+  }
+  if (!identity.canConnectDatabase) {
+    violations.push("runtime role lacks CONNECT on the current database");
+  }
+  if (options.rlsStrategy === "scoped") {
+    return violations;
+  }
+  const expectedRole = options.expectedRole?.trim() || "opengeni_app";
+  const targetSchema = options.targetSchema?.trim() || "public";
+  const protectedTables = new Set(options.protectedTables ?? FORCE_RLS_TABLES);
+  const tablePrivileges = options.tablePrivileges ?? RUNTIME_TABLE_PRIVILEGES;
+  const directRuntimeTables = new Set(Object.keys(tablePrivileges));
+  const protectedNoDirectDmlTables = new Set(
+    options.protectedNoDirectDmlTables ?? (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES)
+  );
+  if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {
+    violations.push(
+      `runtime identity must be ${expectedRole} (current_user=${identity.currentUser}, session_user=${identity.sessionUser})`
+    );
+  }
+  if (!identity.canLogin) violations.push("runtime role is not LOGIN");
+  if (identity.superuser) violations.push("runtime role is SUPERUSER");
+  if (identity.bypassRls) violations.push("runtime role has BYPASSRLS");
+  if (identity.createRole) violations.push("runtime role has CREATEROLE");
+  if (identity.createDatabase) violations.push("runtime role has CREATEDB");
+  if (identity.replication) violations.push("runtime role has REPLICATION");
+  if (identity.inherit) violations.push("runtime role must be NOINHERIT");
+  if (identity.databaseOwner === expectedRole) violations.push("runtime role owns the database");
+  if (identity.canCreateInDatabase) {
+    violations.push("runtime role has CREATE on the current database");
+  }
+  if (identity.rowSecurity.toLowerCase() !== "on") {
+    violations.push(`row_security is ${identity.rowSecurity}, expected on`);
+  }
+  if (posture.memberships.length > 0) {
+    violations.push(`runtime role has memberships: ${sorted(posture.memberships).join(", ")}`);
+  }
+  if (posture.ownedSchemas.length > 0) {
+    violations.push(`runtime role owns schemas: ${sorted(posture.ownedSchemas).join(", ")}`);
+  }
+  if (posture.ownedRelations.length > 0) {
+    violations.push(`runtime role owns relations: ${sorted(posture.ownedRelations).join(", ")}`);
+  }
+  for (const schemaName of /* @__PURE__ */ new Set([targetSchema, "opengeni_private"])) {
+    const schema = posture.schemas.find((candidate) => candidate.name === schemaName);
+    if (!schema) {
+      violations.push(`required schema ${schemaName} is missing`);
+      continue;
+    }
+    if (schema.owner === expectedRole) {
+      violations.push(`runtime role owns schema ${schemaName}`);
+    }
+    if (!schema.usage) violations.push(`runtime role lacks USAGE on schema ${schemaName}`);
+    if (schema.create) violations.push(`runtime role has CREATE on schema ${schemaName}`);
+  }
+  const tableByName = new Map(posture.tables.map((table) => [table.name, table]));
+  const actualRlsTables = new Set(
+    posture.tables.filter((table) => table.rlsEnabled).map((table) => table.name)
+  );
+  const classifiedProtectedTables = /* @__PURE__ */ new Set([
+    ...directRuntimeTables,
+    ...protectedNoDirectDmlTables
+  ]);
+  const unclassifiedProtectedTables = difference(protectedTables, classifiedProtectedTables);
+  if (unclassifiedProtectedTables.length > 0) {
+    violations.push(
+      `protected tables lack an explicit privilege class: ${unclassifiedProtectedTables.join(", ")}`
+    );
+  }
+  const protectedNoDirectDmlOverlap = difference(
+    protectedNoDirectDmlTables,
+    new Set([...protectedNoDirectDmlTables].filter((table) => !directRuntimeTables.has(table)))
+  );
+  if (protectedNoDirectDmlOverlap.length > 0) {
+    violations.push(
+      `protected no-direct-DML tables also declare runtime privileges: ${protectedNoDirectDmlOverlap.join(", ")}`
+    );
+  }
+  const nonProtectedNoDirectDmlTables = difference(protectedNoDirectDmlTables, protectedTables);
+  if (nonProtectedNoDirectDmlTables.length > 0) {
+    violations.push(
+      `no-direct-DML tables are absent from the protected contract: ${nonProtectedNoDirectDmlTables.join(", ")}`
+    );
+  }
+  const catalogTables = new Set(tableByName.keys());
+  const missingRuntimeTables = difference(directRuntimeTables, catalogTables);
+  if (missingRuntimeTables.length > 0) {
+    violations.push(`runtime privilege tables are missing: ${missingRuntimeTables.join(", ")}`);
+  }
+  const missingTables = difference(protectedTables, catalogTables);
+  if (missingTables.length > 0) {
+    violations.push(`protected tables are missing: ${missingTables.join(", ")}`);
+  }
+  const undeclaredRlsTables = difference(actualRlsTables, protectedTables);
+  if (undeclaredRlsTables.length > 0) {
+    violations.push(
+      `RLS tables are absent from the declared contract: ${undeclaredRlsTables.join(", ")}`
+    );
+  }
+  for (const table of posture.tables) {
+    const privileges = [
+      ["SELECT", table.select],
+      ["INSERT", table.insert],
+      ["UPDATE", table.update],
+      ["DELETE", table.delete],
+      ["TRUNCATE", table.truncate],
+      ["REFERENCES", table.references],
+      ["TRIGGER", table.trigger]
+    ];
+    const expectedPrivileges = new Set(tablePrivileges[table.name] ?? []);
+    if (table.owner === expectedRole) {
+      violations.push(`runtime role owns table ${table.name}`);
+    }
+    const missingPrivileges = privileges.filter(([privilege, granted]) => expectedPrivileges.has(privilege) && !granted).map(([privilege]) => privilege);
+    if (missingPrivileges.length > 0) {
+      violations.push(
+        `table ${table.name} lacks required runtime privileges: ${missingPrivileges.join(", ")}`
+      );
+    }
+    const excessPrivileges = privileges.filter(([privilege, granted]) => !expectedPrivileges.has(privilege) && granted).map(([privilege]) => privilege);
+    if (excessPrivileges.length > 0) {
+      violations.push(
+        `table ${table.name} grants excess runtime privileges: ${excessPrivileges.join(", ")}`
+      );
+    }
+  }
+  for (const tableName of protectedTables) {
+    const table = tableByName.get(tableName);
+    if (!table) continue;
+    if (!table.rlsEnabled) violations.push(`table ${tableName} does not ENABLE RLS`);
+    if (!table.rlsForced) violations.push(`table ${tableName} does not FORCE RLS`);
+    if (!table.rlsActive) violations.push(`table ${tableName} has inactive RLS for runtime role`);
+    if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);
+  }
+  if (posture.privateRoutines.length === 0) {
+    violations.push("opengeni_private has no helper routines");
+  }
+  for (const routine of posture.privateRoutines) {
+    if (routine.owner === expectedRole) {
+      violations.push(`runtime role owns private routine ${routine.name}`);
+    }
+    if (!routine.execute) {
+      violations.push(`runtime role lacks EXECUTE on private routine ${routine.name}`);
+    }
+  }
+  return violations;
+}
+async function assertRuntimeDatabasePosture(db, options) {
+  const posture = await inspectRuntimeDatabasePosture(db, options);
+  const violations = evaluateRuntimeDatabasePosture(posture, options);
+  if (violations.length > 0) {
+    throw new RuntimeDatabasePostureError(violations);
+  }
+  return posture;
+}
+function runtimeDatabaseReadyCheck(db, options) {
+  return async () => {
+    await assertRuntimeDatabasePosture(db, options);
+  };
+}
+
+// src/provision-roles.ts
+async function provisionRoles(adminConnection, options = {}) {
+  const schema = validateIdentifier("targetSchema", options.targetSchema ?? "public");
+  const rlsStrategy = options.rlsStrategy ?? "force";
+  const appRole = validateIdentifier(
+    "appRole",
+    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app")
+  );
+  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
+  const hostExportRole = validateIdentifier(
+    "hostExportRole",
+    options.hostExportRole ?? (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || "opengeni_host_exporter")
+  );
+  const hostExportPassword = options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;
+  const temporalRole = validateIdentifier(
+    "temporalRole",
+    options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal")
+  );
+  const temporalPassword = options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;
+  const temporalDatabases = (options.temporalDatabases ?? commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? "temporal,temporal_visibility")).map((name) => validateIdentifier("temporalDatabases", name));
+  const sql2 = postgres(adminConnection, { max: 1 });
+  try {
+    let provisionedAppRole = null;
+    if (rlsStrategy === "force") {
+      if (!appPassword) {
+        throw new Error(
+          "OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'"
+        );
+      }
+      await assertAppRoleSafeToNormalize(sql2, appRole);
+      await ensureRestrictedAppLoginRole(sql2, appRole, appPassword);
+      provisionedAppRole = appRole;
+    }
+    if (temporalPassword) {
+      await ensureLoginRole(sql2, temporalRole, temporalPassword);
+      for (const database of temporalDatabases) {
+        await ensureDatabase(sql2, database, temporalRole);
+        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);
+      }
+    }
+    if (hostExportPassword) {
+      await ensureLoginRole(sql2, hostExportRole, hostExportPassword);
+      await grantHostExportRoleIfSchemaExists(sql2, hostExportRole);
+    }
+    if (rlsStrategy === "force") {
+      await grantAppRoleIfSchemaExists(sql2, appRole, schema);
+    }
+    return {
+      appRole: provisionedAppRole,
+      hostExportRole: hostExportPassword ? hostExportRole : null,
+      temporalRole: temporalPassword ? temporalRole : null,
+      temporalDatabases: temporalPassword ? temporalDatabases : [],
+      schema,
+      rlsStrategy
+    };
+  } finally {
+    await sql2.end();
+  }
+}
+async function grantHostExportRoleIfSchemaExists(sql2, role) {
+  await sql2.unsafe(`
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});
+    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});
+    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});
+  END IF;
+END $$;
+`);
+}
+async function ensureLoginRole(sql2, role, password) {
+  await sql2.unsafe(`
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
+    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
+  ELSE
+    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
+  END IF;
+END $$;
+`);
+}
+async function ensureRestrictedAppLoginRole(sql2, role, password) {
+  await sql2.unsafe(`
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
+    EXECUTE format(
+      'CREATE ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
+  ELSE
+    EXECUTE format(
+      'ALTER ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
+  END IF;
+END $$;
+`);
+}
+async function assertAppRoleSafeToNormalize(sql2, role) {
+  const exists = await sql2`
+    select exists(select 1 from pg_roles where rolname = ${role}) as exists
+  `;
+  if (!exists[0]?.exists) {
+    return;
+  }
+  const memberships = await sql2`
+    select ('inherits:' || parent.rolname)::text as relationship
+    from pg_auth_members membership
+    join pg_roles member on member.oid = membership.member
+    join pg_roles parent on parent.oid = membership.roleid
+    where member.rolname = ${role}
+    union all
+    select ('member:' || member.rolname)::text as relationship
+    from pg_auth_members membership
+    join pg_roles member on member.oid = membership.member
+    join pg_roles parent on parent.oid = membership.roleid
+    where parent.rolname = ${role}
+    order by relationship
+  `;
+  if (memberships.length > 0) {
+    throw new Error(
+      `Refusing to normalize app role ${role}: remove role relationships first (${memberships.map((row) => row.relationship).join(", ")})`
+    );
+  }
+  const ownedObjects = await sql2`
+    select ('database:' || d.datname)::text as object_name
+    from pg_database d
+    join pg_roles owner on owner.oid = d.datdba
+    where owner.rolname = ${role}
+    union all
+    select ('schema:' || n.nspname)::text as object_name
+    from pg_namespace n
+    join pg_roles owner on owner.oid = n.nspowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    union all
+    select ('relation:' || n.nspname || '.' || c.relname)::text as object_name
+    from pg_class c
+    join pg_namespace n on n.oid = c.relnamespace
+    join pg_roles owner on owner.oid = c.relowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    union all
+    select (
+      'routine:' || n.nspname || '.' || p.proname || '(' ||
+      pg_get_function_identity_arguments(p.oid) || ')'
+    )::text as object_name
+    from pg_proc p
+    join pg_namespace n on n.oid = p.pronamespace
+    join pg_roles owner on owner.oid = p.proowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    order by object_name
+  `;
+  if (ownedObjects.length > 0) {
+    throw new Error(
+      `Refusing to normalize app role ${role}: transfer owned objects first (${ownedObjects.map((row) => row.object_name).join(", ")})`
+    );
+  }
+}
+async function ensureDatabase(sql2, database, owner) {
+  const existing = await sql2`
+    select exists(select 1 from pg_database where datname = ${database}) as exists
+  `;
+  if (!existing[0]?.exists) {
+    await sql2.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);
+  }
+  await sql2.unsafe(
+    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`
+  );
+}
+async function grantTemporalRoleInDatabase(adminConnection, database, role) {
+  const databaseUrl = databaseUrlFor(adminConnection, database);
+  const databaseSql = postgres(databaseUrl, { max: 1 });
+  try {
+    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);
+  } finally {
+    await databaseSql.end();
+  }
+}
+async function grantAppRoleIfSchemaExists(sql2, role, schema) {
+  const runtimeFullDmlTables = `ARRAY[${RUNTIME_FULL_DML_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadOnlyTables = `ARRAY[${RUNTIME_READ_ONLY_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(", ")}]`;
+  await sql2.unsafe(`
+DO $$
+DECLARE
+  owner_role text := current_user;
+  runtime_table text;
+BEGIN
+  EXECUTE format('REVOKE CREATE ON DATABASE %I FROM %I', current_database(), ${literal(role)});
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format('REVOKE CREATE ON SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format('REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
+    FOREACH runtime_table IN ARRAY ${runtimeFullDmlTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadOnlyTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadInsertTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    -- Migration 0110 creates this target-schema-local SECURITY DEFINER
+    -- capability before opengeni_app may exist. Re-converge its exact EXECUTE
+    -- grant here so the supported migrate-then-provision order is equivalent to
+    -- provisioning the role before that migration.
+    IF to_regprocedure(
+      format('%I.lock_nested_agent_depth_configuration()', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.lock_nested_agent_depth_configuration() TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',
+      owner_role,
+      ${literal(schema)},
+      ${literal(role)}
+    );
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I GRANT USAGE, SELECT ON SEQUENCES TO %I',
+      owner_role,
+      ${literal(schema)},
+      ${literal(role)}
+    );
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});
+    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private GRANT EXECUTE ON FUNCTIONS TO %I',
+      owner_role,
+      ${literal(role)}
+    );
+  END IF;
+END $$;
+`);
+}
+function commaSeparated(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function validateIdentifier(name, value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);
+  }
+  return value;
+}
+function identifier(value) {
+  return `"${value.replace(/"/g, '""')}"`;
+}
+function literal(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function databaseUrlFor(value, database) {
+  const url = new URL(value);
+  url.pathname = `/${database}`;
+  return url.toString();
+}
+if (import.meta.main) {
+  const adminUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_ADMIN_URL ?? process.env.OPENGENI_DATABASE_URL;
+  if (!adminUrl) {
+    throw new Error(
+      "OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required"
+    );
+  }
+  const result = await provisionRoles(adminUrl, {
+    ...process.env.OPENGENI_DB_SCHEMA?.trim() ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() } : {}
+  });
+  console.log(JSON.stringify(result, null, 2));
+}
+
+export {
+  FORCE_RLS_TABLES,
+  NON_RLS_RUNTIME_TABLES,
+  RUNTIME_FULL_DML_TABLES,
+  RUNTIME_READ_ONLY_TABLES,
+  RUNTIME_READ_INSERT_TABLES,
+  PROTECTED_NO_DIRECT_DML_TABLES,
+  RUNTIME_TABLE_PRIVILEGES,
+  RUNTIME_DML_TABLES,
+  RuntimeDatabasePostureError,
+  inspectRuntimeDatabasePosture,
+  evaluateRuntimeDatabasePosture,
+  assertRuntimeDatabasePosture,
+  runtimeDatabaseReadyCheck,
+  provisionRoles
+};
+//# sourceMappingURL=chunk-ELMUCYZF.js.map