@opengeni/db 0.28.1 → 0.31.1

package/dist/{chunk-DBS5HPEW.js → chunk-YHZXQ7HP.js}

@@ -89,20 +89,85 @@ function classifyRoleRelationships(rows) {
 }
 
 // src/runtime-posture.ts
+var ARTIFACT_OUTBOX_CAPABILITY_ROUTINES = [
+  "claim_editable_artifact_live_outbox(text, integer, integer, name)",
+  "mark_editable_artifact_live_outbox_published(text, text, integer, name)",
+  "renew_editable_artifact_live_outbox(text, text, integer, integer, name)",
+  "retry_editable_artifact_live_outbox(text, text, integer, integer, text, name)",
+  "dead_letter_editable_artifact_live_outbox(text, text, integer, text, name)",
+  "release_editable_artifact_live_outbox(text, text, integer, name)"
+];
+var ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES = [
+  "claim_editable_artifact_materializations(text, integer, integer, name)",
+  "renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name)",
+  "succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamp with time zone, name)",
+  "fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name)"
+];
+var ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES = [
+  "put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamp with time zone, timestamp with time zone, name)",
+  "consume_editable_artifact_live_ticket(text, name)",
+  "cleanup_expired_editable_artifact_live_tickets(integer, name)"
+];
+var ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES = [
+  "resolve_editable_artifact_ticket_data_schema(name)"
+];
+var ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES = [
+  "authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name)"
+];
+var DEDICATED_ARTIFACT_CAPABILITY_ROUTINES = /* @__PURE__ */ new Set([
+  ...ARTIFACT_OUTBOX_CAPABILITY_ROUTINES,
+  ...ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES,
+  ...ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES
+]);
+var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE = "knowledge_source_sync_lock_authority(uuid, uuid, uuid)";
+var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [
+  "knowledge_sources",
+  "knowledge_source_objects"
+];
+var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
+  KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE
+];
 var FORCE_RLS_TABLES = [
   "agent_run_states",
   "api_keys",
+  "attached_browser_devices",
+  "attached_browser_inventories",
   "audit_events",
+  "auth_runs",
   "billing_customers",
+  "browser_identities",
+  "browser_revision_components",
+  "browser_revisions",
+  "browser_session_associations",
+  "browser_sessions",
+  "browser_state_artifacts",
+  "capability_api_facets",
   "capability_catalog_items",
+  "capability_component_owners",
+  "capability_facet_installations",
+  "capability_facets",
   "capability_installations",
+  "capability_integration_facets",
+  "capability_mcp_facets",
+  "capability_operations",
+  "capability_plugin_installations",
+  "capability_plugin_versions",
+  "capability_plugins",
+  "capability_skill_facets",
+  "capability_skill_files",
   "codex_apps_settings",
   "codex_capacity_waiters",
   "codex_credential_leases",
   "codex_reset_redemption_attempts",
   "codex_rotation_settings",
   "codex_subscription_credentials",
+  "company_profile_activation_events",
+  "company_profile_heads",
+  "company_profile_revisions",
+  "company_profile_snapshots",
   "composer_drafts",
+  "computer_session_associations",
+  "computer_sessions",
   "connection_disconnect_operations",
   "connections",
   "connector_action_policies",
@@ -112,9 +177,27 @@ var FORCE_RLS_TABLES = [
   "document_bases",
   "document_chunks",
   "documents",
+  "editable_artifact_blob_refs",
+  "editable_artifact_idempotency_receipts",
+  "editable_artifact_live_outbox",
+  "editable_artifact_live_tickets",
+  "editable_artifact_materialization_jobs",
+  "editable_artifact_materialization_results",
+  "editable_artifact_operations",
+  "editable_artifact_replica_leases",
+  "editable_artifact_scope_authorization_heads",
+  "editable_artifact_sequence_checkpoints",
+  "editable_artifact_session_links",
+  "editable_artifact_snapshots",
+  "editable_artifact_transactions",
+  "editable_artifact_undo_claims",
+  "editable_artifact_versions",
+  "editable_artifacts",
   "enrollments",
   "file_uploads",
   "files",
+  "generated_image_artifacts",
+  "generated_video_artifacts",
   "github_installation_repositories",
   "github_installations",
   "host_export_config",
@@ -122,8 +205,17 @@ var FORCE_RLS_TABLES = [
   "host_export_cursor_state",
   "host_export_dead_letters",
   "host_export_outbox",
+  "image_generation_operations",
   "import_batches",
+  "integration_feature_binding_owners",
+  "integration_feature_bindings",
+  "integration_feature_facets",
   "integration_oauth_state_nonces",
+  "integration_spec_revisions",
+  "integration_tools",
+  "interaction_interventions",
+  "interaction_operations",
+  "interaction_resource_operations",
   "knowledge_change_proposals",
   "knowledge_claim_evidence",
   "knowledge_claim_relations",
@@ -141,17 +233,29 @@ var FORCE_RLS_TABLES = [
   "knowledge_providers",
   "knowledge_source_acl_versions",
   "knowledge_source_objects",
+  "knowledge_source_sync_index_obligations",
+  "knowledge_source_sync_item_outcomes",
+  "knowledge_source_sync_object_observations",
+  "knowledge_source_sync_states",
+  "knowledge_source_sync_wakes",
   "knowledge_sources",
   "knowledge_sync_runs",
   "machine_metrics_latest",
   "machine_metrics_series",
+  "machine_removal_operations",
+  "memory_slack_publication_configurations",
+  "memory_slack_publication_receipts",
+  "memory_slack_publications",
   "model_call_facts",
+  "network_routes",
   "new_session_drafts",
+  "pack_installation_components",
   "pack_installations",
   "preference_registry_events",
   "preference_registry_preferences",
   "preference_registry_revisions",
   "preference_registry_snapshots",
+  "retained_screenshot_artifacts",
   "rig_changes",
   "rig_versions",
   "rigs",
@@ -165,7 +269,9 @@ var FORCE_RLS_TABLES = [
   "sandboxes",
   "scheduled_task_runs",
   "scheduled_tasks",
+  "session_attempt_codemode_calls",
   "session_attempt_interruptions",
+  "session_attempt_tool_catalogs",
   "session_command_receipts",
   "session_events",
   "session_goals",
@@ -188,19 +294,26 @@ var FORCE_RLS_TABLES = [
   "session_turns",
   "session_workflow_wake_outbox",
   "sessions",
+  "site_auth_connections",
   "slack_bot_delete_operations",
   "slack_bot_post_operations",
   "slack_bot_user_links",
+  "slack_installation_bindings",
   "slack_interaction_inbox",
   "slack_interaction_progress_deliveries",
   "slack_interactions",
+  "slack_user_link_access_request_operations",
+  "slack_user_link_access_requests",
   "social_connections",
   "social_posts",
+  "temporal_schedule_cleanup_outbox",
   "transcription_recording_chunks",
   "transcription_recording_objects",
   "transcription_recording_segments",
   "transcription_recordings",
   "usage_events",
+  "video_generation_operations",
+  "video_generation_references",
   "workspace_artifact_events",
   "workspace_artifact_versions",
   "workspace_artifacts",
@@ -212,11 +325,19 @@ var FORCE_RLS_TABLES = [
   "workspace_instruction_policy_onboarding_proposals",
   "workspace_instruction_policy_revisions",
   "workspace_instruction_policy_snapshots",
+  "workspace_interaction_revisions",
+  "workspace_learning_policy_activation_events",
+  "workspace_learning_policy_heads",
+  "workspace_learning_policy_revisions",
+  "workspace_learning_policy_snapshots",
   "workspace_model_policies",
   "workspace_packs",
+  "workspace_screenshot_quotas",
   "workspace_session_activity_revisions",
   "workspace_variable_set_variables",
-  "workspace_variable_sets"
+  "workspace_variable_sets",
+  "workspace_video_generation_policies",
+  "workspace_video_generation_quotas"
 ];
 var NON_RLS_RUNTIME_TABLES = [
   "auth_identities",
@@ -241,8 +362,13 @@ var RUNTIME_FULL_DML_TABLES = [
   "auth_users",
   "auth_verifications",
   "billing_customers",
+  "browser_session_associations",
   "capability_catalog_items",
+  "capability_component_owners",
+  "capability_facet_installations",
   "capability_installations",
+  "capability_operations",
+  "capability_plugin_installations",
   "codex_apps_settings",
   "codex_capacity_waiters",
   "codex_credential_leases",
@@ -250,6 +376,7 @@ var RUNTIME_FULL_DML_TABLES = [
   "codex_rotation_settings",
   "codex_subscription_credentials",
   "composer_drafts",
+  "computer_session_associations",
   "connection_disconnect_operations",
   "connections",
   "connector_action_policies",
@@ -259,21 +386,38 @@ var RUNTIME_FULL_DML_TABLES = [
   "document_bases",
   "document_chunks",
   "documents",
+  "editable_artifact_replica_leases",
   "enrollments",
   "file_uploads",
   "files",
+  "generated_image_artifacts",
+  "generated_video_artifacts",
   "github_installation_repositories",
   "github_installations",
+  "image_generation_operations",
   "import_batches",
+  "integration_feature_binding_owners",
+  "integration_feature_bindings",
   "integration_oauth_clients",
   "integration_oauth_state_nonces",
   "knowledge_memories",
+  "knowledge_source_sync_index_obligations",
+  "knowledge_source_sync_item_outcomes",
+  "knowledge_source_sync_object_observations",
+  "knowledge_source_sync_states",
+  "knowledge_source_sync_wakes",
   "machine_metrics_latest",
   "machine_metrics_series",
+  "machine_removal_operations",
   "managed_accounts",
+  "memory_slack_publication_configurations",
+  "memory_slack_publication_receipts",
+  "memory_slack_publications",
   "model_call_facts",
   "new_session_drafts",
+  "pack_installation_components",
   "pack_installations",
+  "retained_screenshot_artifacts",
   "rig_changes",
   "rig_versions",
   "rigs",
@@ -323,6 +467,8 @@ var RUNTIME_FULL_DML_TABLES = [
   "transcription_recording_segments",
   "transcription_recordings",
   "usage_events",
+  "video_generation_operations",
+  "video_generation_references",
   "workspace_artifacts",
   "workspace_captures",
   "workspace_control_events",
@@ -331,21 +477,45 @@ var RUNTIME_FULL_DML_TABLES = [
   "workspace_memberships",
   "workspace_model_policies",
   "workspace_packs",
-  "workspace_session_activity_revisions",
+  "workspace_screenshot_quotas",
   "workspace_variable_set_variables",
   "workspace_variable_sets",
+  "workspace_video_generation_policies",
+  "workspace_video_generation_quotas",
   "workspaces"
 ];
 var RUNTIME_READ_ONLY_TABLES = [
+  "company_profile_activation_events",
+  "company_profile_heads",
+  "company_profile_snapshots",
   "knowledge_lifecycle_events",
   "knowledge_memory_lifecycle_events",
   "knowledge_memory_relationships",
   "nested_agent_depth_configuration",
   "preference_registry_events",
   "preference_registry_snapshots",
-  "workspace_instruction_policy_snapshots"
+  "slack_installation_bindings",
+  "workspace_instruction_policy_snapshots",
+  "workspace_learning_policy_activation_events",
+  "workspace_learning_policy_heads",
+  "workspace_learning_policy_snapshots"
 ];
+var RUNTIME_READ_UPDATE_TABLES = ["workspace_session_activity_revisions"];
 var RUNTIME_READ_INSERT_TABLES = [
+  "browser_revision_components",
+  "browser_revisions",
+  "company_profile_revisions",
+  "editable_artifact_blob_refs",
+  "editable_artifact_idempotency_receipts",
+  "editable_artifact_live_outbox",
+  "editable_artifact_materialization_jobs",
+  "editable_artifact_materialization_results",
+  "editable_artifact_operations",
+  "editable_artifact_sequence_checkpoints",
+  "editable_artifact_snapshots",
+  "editable_artifact_transactions",
+  "editable_artifact_undo_claims",
+  "editable_artifact_versions",
   "knowledge_change_proposals",
   "knowledge_claim_evidence",
   "knowledge_claim_relations",
@@ -363,14 +533,50 @@ var RUNTIME_READ_INSERT_TABLES = [
   "knowledge_sync_runs",
   "preference_registry_preferences",
   "preference_registry_revisions",
+  "session_attempt_tool_catalogs",
   "session_spawn_denials",
+  "slack_user_link_access_request_operations",
+  "temporal_schedule_cleanup_outbox",
   "workspace_artifact_events",
   "workspace_artifact_versions",
   "workspace_instruction_policy_activation_events",
   "workspace_instruction_policy_onboarding_proposals",
-  "workspace_instruction_policy_revisions"
+  "workspace_instruction_policy_revisions",
+  "workspace_learning_policy_revisions"
+];
+var RUNTIME_READ_INSERT_UPDATE_TABLES = [
+  "attached_browser_devices",
+  "attached_browser_inventories",
+  "auth_runs",
+  "browser_identities",
+  "browser_sessions",
+  "browser_state_artifacts",
+  "capability_api_facets",
+  "capability_facets",
+  "capability_integration_facets",
+  "capability_mcp_facets",
+  "capability_plugin_versions",
+  "capability_plugins",
+  "capability_skill_facets",
+  "capability_skill_files",
+  "computer_sessions",
+  "editable_artifact_session_links",
+  "editable_artifacts",
+  "integration_feature_facets",
+  "integration_spec_revisions",
+  "integration_tools",
+  "interaction_interventions",
+  "interaction_operations",
+  "interaction_resource_operations",
+  "network_routes",
+  "session_attempt_codemode_calls",
+  "site_auth_connections",
+  "slack_user_link_access_requests",
+  "workspace_interaction_revisions"
 ];
 var PROTECTED_NO_DIRECT_DML_TABLES = [
+  "editable_artifact_live_tickets",
+  "editable_artifact_scope_authorization_heads",
   "host_export_config",
   "host_export_consumers",
   "host_export_cursor_state",
@@ -381,8 +587,17 @@ var FULL_DML_PRIVILEGES = ["SELECT", "INSERT", "UPDATE", "DELETE"];
 var RUNTIME_TABLE_PRIVILEGES = Object.freeze({
   ...Object.fromEntries(RUNTIME_FULL_DML_TABLES.map((table) => [table, FULL_DML_PRIVILEGES])),
   ...Object.fromEntries(RUNTIME_READ_ONLY_TABLES.map((table) => [table, ["SELECT"]])),
+  ...Object.fromEntries(
+    RUNTIME_READ_UPDATE_TABLES.map((table) => [table, ["SELECT", "UPDATE"]])
+  ),
   ...Object.fromEntries(
     RUNTIME_READ_INSERT_TABLES.map((table) => [table, ["SELECT", "INSERT"]])
+  ),
+  ...Object.fromEntries(
+    RUNTIME_READ_INSERT_UPDATE_TABLES.map((table) => [
+      table,
+      ["SELECT", "INSERT", "UPDATE"]
+    ])
   )
 });
 var RUNTIME_DML_TABLES = Object.freeze(
@@ -464,6 +679,7 @@ async function inspectRuntimeDatabasePosture(db, options) {
           ownedSchemas: [],
           ownedRelations: [],
           tables: [],
+          targetRoutines: [],
           privateRoutines: []
         };
       }
@@ -516,6 +732,16 @@ async function inspectRuntimeDatabasePosture(db, options) {
             c.relforcerowsecurity as rls_forced,
             row_security_active(c.oid) as rls_active,
             (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,
+            exists(
+              select 1 from pg_policy policy
+              where policy.polrelid = c.oid
+                and policy.polname = 'editable_artifact_outbox_dispatcher'
+            ) as artifact_outbox_dispatcher_policy,
+            exists(
+              select 1 from pg_policy policy
+              where policy.polrelid = c.oid
+                and policy.polname = 'editable_artifact_materializer_owner'
+            ) as artifact_materializer_policy,
             has_table_privilege(current_user, c.oid, 'SELECT') as can_select,
             has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,
             has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,
@@ -536,6 +762,8 @@ async function inspectRuntimeDatabasePosture(db, options) {
         rlsForced: row.rls_forced,
         rlsActive: row.rls_active,
         policyCount: row.policy_count,
+        artifactOutboxDispatcherPolicy: row.artifact_outbox_dispatcher_policy,
+        artifactMaterializerPolicy: row.artifact_materializer_policy,
         select: row.can_select,
         insert: row.can_insert,
         update: row.can_update,
@@ -544,22 +772,55 @@ async function inspectRuntimeDatabasePosture(db, options) {
         references: row.can_references,
         trigger: row.can_trigger
       }));
+      const targetRoutines = resultRows(
+        await tx.execute(sql`
+          select
+            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,
+            pg_get_userbyid(p.proowner)::text as owner,
+            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,
+            exists (
+              select 1
+              from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl
+              where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'
+            ) as public_execute,
+            p.prosecdef as security_definer
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+          where p.oid = to_regprocedure(
+            format(
+              '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',
+              ${targetSchema}::text
+            )
+          )
+            and n.nspname = ${targetSchema}
+            and p.prokind in ('f', 'p')
+          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)
+        `)
+      ).map((row) => ({
+        name: row.name,
+        owner: row.owner,
+        execute: row.can_execute,
+        publicExecute: row.public_execute,
+        securityDefiner: row.security_definer
+      }));
       const privateRoutines = resultRows(
         await tx.execute(sql`
           select
-            (p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')')::text as name,
+            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,
             pg_get_userbyid(p.proowner)::text as owner,
-            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute
+            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,
+            p.prosecdef as security_definer
           from pg_proc p
           join pg_namespace n on n.oid = p.pronamespace
           where n.nspname = 'opengeni_private'
             and p.prokind in ('f', 'p')
-          order by p.proname, pg_get_function_identity_arguments(p.oid)
+          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)
         `)
       ).map((row) => ({
         name: row.name,
         owner: row.owner,
-        execute: row.can_execute
+        execute: row.can_execute,
+        securityDefiner: row.security_definer
       }));
       return {
         identity: mappedIdentity,
@@ -568,6 +829,7 @@ async function inspectRuntimeDatabasePosture(db, options) {
         ownedSchemas,
         ownedRelations,
         tables,
+        targetRoutines,
         privateRoutines
       };
     },
@@ -718,6 +980,217 @@ function evaluateRuntimeDatabasePosture(posture, options) {
     if (!table.rlsActive) violations.push(`table ${tableName} has inactive RLS for runtime role`);
     if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);
   }
+  const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;
+  for (const expectedRoutine of RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES) {
+    const matches = posture.targetRoutines.filter((routine2) => routine2.name === expectedRoutine);
+    if (matches.length !== 1) {
+      violations.push(
+        `target-schema runtime capability ${expectedRoutine} is missing or ambiguous`
+      );
+      continue;
+    }
+    const routine = matches[0];
+    if (!routine.securityDefiner) {
+      violations.push(`target-schema runtime capability ${routine.name} is not SECURITY DEFINER`);
+    }
+    if (routine.name === KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE) {
+      const missingAuthorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (targetSchemaOwner && routine.owner !== targetSchemaOwner) {
+      violations.push(
+        `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match schema owner ${targetSchemaOwner}`
+      );
+    }
+    if (!routine.execute) {
+      violations.push(`runtime role lacks target-schema capability ${routine.name}`);
+    }
+    if (routine.publicExecute) {
+      violations.push(`PUBLIC has forbidden target-schema capability ${routine.name}`);
+    }
+  }
+  const artifactOutbox = tableByName.get("editable_artifact_live_outbox");
+  if (artifactOutbox) {
+    if (!artifactOutbox.artifactOutboxDispatcherPolicy) {
+      violations.push("table editable_artifact_live_outbox lacks its owner dispatcher RLS policy");
+    }
+    for (const expectedRoutine of ARTIFACT_OUTBOX_CAPABILITY_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
+      if (matches.length !== 1) {
+        violations.push(`artifact outbox capability ${expectedRoutine} is missing or ambiguous`);
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(`artifact outbox capability ${routine.name} is not SECURITY DEFINER`);
+      }
+      if (routine.owner !== artifactOutbox.owner) {
+        violations.push(
+          `artifact outbox capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactOutbox.owner}`
+        );
+      }
+      if (routine.execute) {
+        violations.push(
+          `generic runtime role has forbidden global artifact outbox capability ${routine.name}`
+        );
+      }
+    }
+  }
+  const artifactMaterializationJobs = tableByName.get("editable_artifact_materialization_jobs");
+  if (artifactMaterializationJobs) {
+    for (const tableName of [
+      "editable_artifact_materialization_jobs",
+      "editable_artifact_materialization_results",
+      "editable_artifact_blob_refs",
+      "editable_artifact_sequence_checkpoints",
+      "editable_artifact_versions",
+      "editable_artifact_idempotency_receipts"
+    ]) {
+      const table = tableByName.get(tableName);
+      if (table && !table.artifactMaterializerPolicy) {
+        violations.push(`table ${tableName} lacks its owner materializer RLS policy`);
+      }
+    }
+    for (const expectedRoutine of ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
+      if (matches.length !== 1) {
+        violations.push(
+          `artifact materializer capability ${expectedRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(`artifact materializer capability ${routine.name} is not SECURITY DEFINER`);
+      }
+      if (routine.owner !== artifactMaterializationJobs.owner) {
+        violations.push(
+          `artifact materializer capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactMaterializationJobs.owner}`
+        );
+      }
+      if (routine.execute) {
+        violations.push(
+          `generic runtime role has forbidden global artifact materializer capability ${routine.name}`
+        );
+      }
+    }
+  }
+  const artifactAuthority = tableByName.get("editable_artifacts");
+  if (artifactAuthority) {
+    const matches = posture.privateRoutines.filter(
+      (routine) => routine.name.startsWith("advance_editable_artifact_authorization_revision(")
+    );
+    if (matches.length !== 1) {
+      violations.push(
+        "editable artifact authorization revision capability is missing or ambiguous"
+      );
+    } else {
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(
+          `editable artifact authorization revision capability ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (routine.owner !== artifactAuthority.owner) {
+        violations.push(
+          `editable artifact authorization revision capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`
+        );
+      }
+    }
+    for (const expectedRoutine of ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES) {
+      const capabilityMatches = posture.privateRoutines.filter(
+        (routine2) => routine2.name === expectedRoutine
+      );
+      if (capabilityMatches.length !== 1) {
+        violations.push(
+          `editable artifact authorization capability ${expectedRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = capabilityMatches[0];
+      if (!routine.securityDefiner) {
+        violations.push(
+          `editable artifact authorization capability ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (routine.owner !== artifactAuthority.owner) {
+        violations.push(
+          `editable artifact authorization capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(
+          `runtime role lacks editable artifact authorization capability ${routine.name}`
+        );
+      }
+    }
+  }
+  const artifactLiveTickets = tableByName.get("editable_artifact_live_tickets");
+  if (artifactLiveTickets) {
+    for (const expectedRoutine of ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
+      if (matches.length !== 1) {
+        violations.push(
+          `artifact live ticket capability ${expectedRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(`artifact live ticket capability ${routine.name} is not SECURITY DEFINER`);
+      }
+      if (routine.owner !== artifactLiveTickets.owner) {
+        violations.push(
+          `artifact live ticket capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(`runtime role lacks artifact live ticket capability ${routine.name}`);
+      }
+    }
+    for (const internalRoutine of ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === internalRoutine);
+      if (matches.length !== 1) {
+        violations.push(
+          `artifact live ticket internal routine ${internalRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(
+          `artifact live ticket internal routine ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (routine.owner !== artifactLiveTickets.owner) {
+        violations.push(
+          `artifact live ticket internal routine ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`
+        );
+      }
+      if (routine.execute) {
+        violations.push(`runtime role has forbidden ticket schema resolver ${routine.name}`);
+      }
+    }
+  }
   if (posture.privateRoutines.length === 0) {
     violations.push("opengeni_private has no helper routines");
   }
@@ -725,7 +1198,8 @@ function evaluateRuntimeDatabasePosture(posture, options) {
     if (routine.owner === expectedRole) {
       violations.push(`runtime role owns private routine ${routine.name}`);
     }
-    if (!routine.execute) {
+    const dedicatedArtifactCapability = DEDICATED_ARTIFACT_CAPABILITY_ROUTINES.has(routine.name);
+    if (!routine.execute && !dedicatedArtifactCapability) {
       violations.push(`runtime role lacks EXECUTE on private routine ${routine.name}`);
     }
   }
@@ -754,6 +1228,16 @@ async function provisionRoles(adminConnection, options = {}) {
     options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app")
   );
   const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
+  const artifactOutboxDispatcherRole = validateIdentifier(
+    "artifactOutboxDispatcherRole",
+    options.artifactOutboxDispatcherRole ?? (process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_USER?.trim() || "opengeni_artifact_outbox_dispatcher")
+  );
+  const artifactOutboxDispatcherPassword = options.artifactOutboxDispatcherPassword ?? process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_PASSWORD;
+  const artifactMaterializerRole = validateIdentifier(
+    "artifactMaterializerRole",
+    options.artifactMaterializerRole ?? (process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_USER?.trim() || "opengeni_artifact_materializer")
+  );
+  const artifactMaterializerPassword = options.artifactMaterializerPassword ?? process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_PASSWORD;
   const hostExportRole = validateIdentifier(
     "hostExportRole",
     options.hostExportRole ?? (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || "opengeni_host_exporter")
@@ -778,6 +1262,38 @@ async function provisionRoles(adminConnection, options = {}) {
       await ensureRestrictedAppLoginRole(sql2, appRole, appPassword);
       provisionedAppRole = appRole;
     }
+    let provisionedArtifactOutboxDispatcherRole = null;
+    if (artifactOutboxDispatcherPassword) {
+      await assertAppRoleSafeToNormalize(sql2, artifactOutboxDispatcherRole);
+      await ensureRestrictedAppLoginRole(
+        sql2,
+        artifactOutboxDispatcherRole,
+        artifactOutboxDispatcherPassword
+      );
+      await grantArtifactCapabilityRoleIfSchemaExists(
+        sql2,
+        artifactOutboxDispatcherRole,
+        schema,
+        "outbox"
+      );
+      provisionedArtifactOutboxDispatcherRole = artifactOutboxDispatcherRole;
+    }
+    let provisionedArtifactMaterializerRole = null;
+    if (artifactMaterializerPassword) {
+      await assertAppRoleSafeToNormalize(sql2, artifactMaterializerRole);
+      await ensureRestrictedAppLoginRole(
+        sql2,
+        artifactMaterializerRole,
+        artifactMaterializerPassword
+      );
+      await grantArtifactCapabilityRoleIfSchemaExists(
+        sql2,
+        artifactMaterializerRole,
+        schema,
+        "materializer"
+      );
+      provisionedArtifactMaterializerRole = artifactMaterializerRole;
+    }
     if (temporalPassword) {
       await ensureLoginRole(sql2, temporalRole, temporalPassword);
       for (const database of temporalDatabases) {
@@ -794,6 +1310,8 @@ async function provisionRoles(adminConnection, options = {}) {
     }
     return {
       appRole: provisionedAppRole,
+      artifactOutboxDispatcherRole: provisionedArtifactOutboxDispatcherRole,
+      artifactMaterializerRole: provisionedArtifactMaterializerRole,
       hostExportRole: hostExportPassword ? hostExportRole : null,
       temporalRole: temporalPassword ? temporalRole : null,
       temporalDatabases: temporalPassword ? temporalDatabases : [],
@@ -816,6 +1334,55 @@ BEGIN
 END $$;
 `);
 }
+async function grantArtifactCapabilityRoleIfSchemaExists(sql2, role, dataSchema, capability) {
+  const routines = capability === "outbox" ? [
+    "claim_editable_artifact_live_outbox(text,integer,integer,name)",
+    "mark_editable_artifact_live_outbox_published(text,text,integer,name)",
+    "renew_editable_artifact_live_outbox(text,text,integer,integer,name)",
+    "retry_editable_artifact_live_outbox(text,text,integer,integer,text,name)",
+    "dead_letter_editable_artifact_live_outbox(text,text,integer,text,name)",
+    "release_editable_artifact_live_outbox(text,text,integer,name)"
+  ] : [
+    "claim_editable_artifact_materializations(text,integer,integer,name)",
+    "renew_editable_artifact_materialization(uuid,uuid,text,text,text,integer,integer,name)",
+    "succeed_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,text,text,bigint,text,text,timestamp with time zone,name)",
+    "fail_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,name)"
+  ];
+  const routineArray = `ARRAY[${routines.map(literal).join(", ")}]`;
+  await sql2.unsafe(`
+DO $$
+DECLARE routine_signature text;
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(dataSchema)})
+    AND EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private')
+  THEN
+    EXECUTE format('GRANT CONNECT ON DATABASE %I TO %I', current_database(), ${literal(role)});
+    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(dataSchema)}, ${literal(role)});
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format(
+      'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I',
+      ${literal(dataSchema)}, ${literal(role)}
+    );
+    EXECUTE format(
+      'REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I FROM %I',
+      ${literal(dataSchema)}, ${literal(role)}
+    );
+    EXECUTE format(
+      'REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA opengeni_private FROM %I',
+      ${literal(role)}
+    );
+    FOREACH routine_signature IN ARRAY ${routineArray} LOOP
+      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',
+          routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+  END IF;
+END $$;
+`);
+}
 async function ensureLoginRole(sql2, role, password) {
   await sql2.unsafe(`
 DO $$
@@ -962,7 +1529,9 @@ async function grantTemporalRoleInDatabase(adminConnection, database, role) {
 async function grantAppRoleIfSchemaExists(sql2, role, schema) {
   const runtimeFullDmlTables = `ARRAY[${RUNTIME_FULL_DML_TABLES.map(literal).join(", ")}]`;
   const runtimeReadOnlyTables = `ARRAY[${RUNTIME_READ_ONLY_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadUpdateTables = `ARRAY[${RUNTIME_READ_UPDATE_TABLES.map(literal).join(", ")}]`;
   const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(", ")}]`;
   await sql2.unsafe(`
 DO $$
 DECLARE
@@ -994,6 +1563,16 @@ BEGIN
         );
       END IF;
     END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadUpdateTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, UPDATE ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
     FOREACH runtime_table IN ARRAY ${runtimeReadInsertTables} LOOP
       IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
         EXECUTE format(
@@ -1004,6 +1583,16 @@ BEGIN
         );
       END IF;
     END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadInsertUpdateTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT, UPDATE ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
     -- Migration 0110 creates this target-schema-local SECURITY DEFINER
     -- capability before opengeni_app may exist. Re-converge its exact EXECUTE
     -- grant here so the supported migrate-then-provision order is equivalent to
@@ -1086,6 +1675,72 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.company_profile_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.company_profile_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.company_profile_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.company_profile_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.workspace_learning_policy_source_overrides_valid(jsonb)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_source_overrides_valid(jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.workspace_learning_policy_hash(text,jsonb)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_hash(text, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.workspace_learning_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',
@@ -1098,6 +1753,26 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    -- Migration 0197 creates this target-schema-local SECURITY DEFINER lock
+    -- before opengeni_app may exist. Re-converge only its exact EXECUTE grant
+    -- for the supported migrate-then-provision install order; keep PUBLIC
+    -- revoked and do not widen table privileges.
+    IF to_regprocedure(
+      format(
+        '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
@@ -1153,10 +1828,81 @@ BEGIN
     EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});
     EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
     EXECUTE format(
-      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private GRANT EXECUTE ON FUNCTIONS TO %I',
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private REVOKE EXECUTE ON FUNCTIONS FROM %I',
       owner_role,
       ${literal(role)}
     );
+    -- Global cross-workspace artifact workers are separate capabilities. Never
+    -- let the generic tenant-scoped app role inherit them from the historical
+    -- blanket grant of already-installed helpers.
+    IF to_regprocedure('opengeni_private.claim_editable_artifact_live_outbox(text,integer,integer,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_live_outbox(text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.mark_editable_artifact_live_outbox_published(text, text, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_live_outbox(text, text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.retry_editable_artifact_live_outbox(text, text, integer, integer, text, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.dead_letter_editable_artifact_live_outbox(text, text, integer, text, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.release_editable_artifact_live_outbox(text, text, integer, name) FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.claim_editable_artifact_materializations(text,integer,integer,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_materializations(text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamptz, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name) FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.consume_editable_artifact_live_ticket(text,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.resolve_editable_artifact_ticket_data_schema(name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamptz, timestamptz, name) TO %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.consume_editable_artifact_live_ticket(text, name) TO %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.cleanup_expired_editable_artifact_live_tickets(integer, name) TO %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.authorize_editable_artifact_actor(uuid,uuid,text,text,text,text,text,text,integer,text,text,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name) TO %I',
+        ${literal(role)}
+      );
+    END IF;
   END IF;
 END $$;
 `);
@@ -1195,11 +1941,14 @@ if (import.meta.main) {
 }
 
 export {
+  RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
   FORCE_RLS_TABLES,
   NON_RLS_RUNTIME_TABLES,
   RUNTIME_FULL_DML_TABLES,
   RUNTIME_READ_ONLY_TABLES,
+  RUNTIME_READ_UPDATE_TABLES,
   RUNTIME_READ_INSERT_TABLES,
+  RUNTIME_READ_INSERT_UPDATE_TABLES,
   PROTECTED_NO_DIRECT_DML_TABLES,
   RUNTIME_TABLE_PRIVILEGES,
   RUNTIME_DML_TABLES,
@@ -1210,4 +1959,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-DBS5HPEW.js.map
+//# sourceMappingURL=chunk-YHZXQ7HP.js.map