@opengeni/db 0.31.1 → 0.36.0

package/dist/chunk-NBE6CHRI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/video-generation.ts"],"sourcesContent":["import {\n  GENERATED_VIDEO_MAX_BYTES,\n  GeneratedVideoReceipt,\n  SEEDANCE_2_5_MODEL_ID,\n  VideoGenerationPolicy,\n  VideoGenerationOperationSummary,\n  retainedGeneratedVideoReferenceFromFile,\n  type GeneratedVideoFacts,\n  type MediaGenerationResult,\n  type VideoGenerationFundingSource,\n  type VideoGenerationPolicy as VideoGenerationPolicyValue,\n} from \"@opengeni/contracts\";\nimport { and, eq, inArray, sql } from \"drizzle-orm\";\nimport type { Database } from \"./database\";\nimport { rawRows, withRlsContext, withWorkspaceRls } from \"./database\";\nimport * as schema from \"./schema\";\n\nexport const ACTIVE_VIDEO_GENERATION_STATUSES = [\n  \"preparing\",\n  \"prepared\",\n  \"accepted\",\n  \"submission_uncertain\",\n  \"provider_started\",\n  \"retaining\",\n] as const;\n\nexport type VideoGenerationOperation = typeof schema.videoGenerationOperations.$inferSelect;\nexport type VideoGenerationReference = typeof schema.videoGenerationReferences.$inferSelect;\nexport type GeneratedVideoArtifact = typeof schema.generatedVideoArtifacts.$inferSelect;\n\nexport type VideoGenerationOperationWithReferences = VideoGenerationOperation & {\n  references: VideoGenerationReference[];\n};\n\nexport class VideoGenerationConflictError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"VideoGenerationConflictError\";\n  }\n}\n\nexport class VideoGenerationCapacityError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"VideoGenerationCapacityError\";\n  }\n}\n\nexport class VideoGenerationCreditError extends Error {\n  constructor(message = \"insufficient OpenGeni credits\") {\n    super(message);\n    this.name = \"VideoGenerationCreditError\";\n  }\n}\n\nexport async function getWorkspaceVideoGenerationPolicy(\n  db: Database,\n  workspaceId: string,\n): Promise<VideoGenerationPolicyValue> {\n  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {\n    const [row] = await scopedDb\n      .select()\n      .from(schema.workspaceVideoGenerationPolicies)\n      .where(eq(schema.workspaceVideoGenerationPolicies.workspaceId, workspaceId))\n      .limit(1);\n    return policyFromRow(row);\n  });\n}\n\nexport async function updateWorkspaceVideoGenerationPolicy(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    subjectId: string;\n    expectedRevision: number;\n    fundingSource: VideoGenerationFundingSource;\n    enabledModelIds: string[];\n    defaultModelId: string | null;\n  },\n): Promise<VideoGenerationPolicyValue> {\n  const requested = VideoGenerationPolicy.parse({\n    schemaVersion: 1,\n    revision: input.expectedRevision + 1,\n    fundingSource: input.fundingSource,\n    enabledModelIds: input.enabledModelIds,\n    defaultModelId: input.defaultModelId,\n  });\n  assertSupportedModels(requested.enabledModelIds);\n  return await withRlsContext(\n    db,\n    { accountId: input.accountId, workspaceId: input.workspaceId },\n    async (scopedDb) =>\n      await scopedDb.transaction(async (tx) => {\n        const [workspace] = await tx\n          .select({ id: schema.workspaces.id })\n          .from(schema.workspaces)\n          .where(\n            and(\n              eq(schema.workspaces.id, input.workspaceId),\n              eq(schema.workspaces.accountId, input.accountId),\n            ),\n          )\n          .for(\"update\")\n          .limit(1);\n        if (!workspace) throw new Error(\"Workspace not found\");\n        const [current] = await tx\n          .select()\n          .from(schema.workspaceVideoGenerationPolicies)\n          .where(eq(schema.workspaceVideoGenerationPolicies.workspaceId, input.workspaceId))\n          .for(\"update\")\n          .limit(1);\n        const currentRevision = current?.revision ?? 0;\n        if (currentRevision !== input.expectedRevision) {\n          throw new VideoGenerationConflictError(\"Video generation policy changed\");\n        }\n        const now = new Date();\n        const values = {\n          workspaceId: input.workspaceId,\n          accountId: input.accountId,\n          revision: currentRevision + 1,\n          fundingSource: requested.fundingSource,\n          enabledModelIds: [...requested.enabledModelIds],\n          defaultModelId: requested.defaultModelId,\n          updatedBySubjectId: input.subjectId.slice(0, 1_024),\n          updatedAt: now,\n        };\n        const [row] = current\n          ? await tx\n              .update(schema.workspaceVideoGenerationPolicies)\n              .set(values)\n              .where(eq(schema.workspaceVideoGenerationPolicies.workspaceId, input.workspaceId))\n              .returning()\n          : await tx.insert(schema.workspaceVideoGenerationPolicies).values(values).returning();\n        if (!row) throw new Error(\"Video generation policy update was not persisted\");\n        return policyFromRow(row);\n      }),\n  );\n}\n\nexport type AdmitVideoGenerationOperationInput = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  attemptId: string;\n  toolCallId: string;\n  admissionKey: string;\n  requestDigest: string;\n  promptDigest: string;\n  requestEncrypted: string;\n  modelId: string;\n  sourceMode: string;\n  capabilityRevision: string;\n  policyRevision: number;\n  fundingSource: VideoGenerationFundingSource;\n  pricedCostMicros: number;\n  connectionId: string | null;\n  credentialVersion: number;\n  credentialEncrypted: string;\n  providerIdempotencyKey: string;\n  expectedArtifactId: string;\n  expectedFileId: string;\n  reservedBytes?: number;\n  workspaceQuotaBytes: number;\n  maxConcurrentPerWorkspace: number;\n  recoveryDeadlineAt: Date;\n  references: Array<{\n    ordinal: number;\n    role: string;\n    contentType: string;\n    sizeBytes: number;\n    sha256: string;\n    stagingObjectKey: string;\n    grantExpiresAt?: Date | null;\n    cleanupAfter: Date;\n  }>;\n};\n\nexport async function admitVideoGenerationOperation(\n  db: Database,\n  input: AdmitVideoGenerationOperationInput,\n): Promise<{ operation: VideoGenerationOperation; created: boolean }> {\n  const reservedBytes = input.reservedBytes ?? GENERATED_VIDEO_MAX_BYTES;\n  return await withRlsContext(\n    db,\n    { accountId: input.accountId, workspaceId: input.workspaceId },\n    async (scopedDb) =>\n      await scopedDb.transaction(async (tx) => {\n        await tx.execute(\n          sql`select pg_advisory_xact_lock(hashtextextended(${`video-generation:${input.admissionKey}`}, 0))`,\n        );\n        const [existing] = await tx\n          .select()\n          .from(schema.videoGenerationOperations)\n          .where(\n            and(\n              eq(schema.videoGenerationOperations.workspaceId, input.workspaceId),\n              eq(schema.videoGenerationOperations.admissionKey, input.admissionKey),\n            ),\n          )\n          .limit(1);\n        if (existing) {\n          assertAdmissionMatches(existing, input);\n          return { operation: existing, created: false };\n        }\n        const [policy] = await tx\n          .select()\n          .from(schema.workspaceVideoGenerationPolicies)\n          .where(eq(schema.workspaceVideoGenerationPolicies.workspaceId, input.workspaceId))\n          .for(\"update\")\n          .limit(1);\n        if (\n          !policy ||\n          policy.revision !== input.policyRevision ||\n          policy.fundingSource !== input.fundingSource ||\n          !policy.enabledModelIds.includes(input.modelId)\n        ) {\n          throw new VideoGenerationConflictError(\"Video generation capability changed\");\n        }\n        const active = await tx\n          .select({ id: schema.videoGenerationOperations.id })\n          .from(schema.videoGenerationOperations)\n          .where(\n            and(\n              eq(schema.videoGenerationOperations.workspaceId, input.workspaceId),\n              inArray(schema.videoGenerationOperations.status, [\n                ...ACTIVE_VIDEO_GENERATION_STATUSES,\n              ]),\n            ),\n          )\n          .for(\"update\");\n        if (active.length >= input.maxConcurrentPerWorkspace) {\n          throw new VideoGenerationCapacityError(\"Workspace video generation limit reached\");\n        }\n        await tx\n          .insert(schema.workspaceVideoGenerationQuotas)\n          .values({ workspaceId: input.workspaceId, accountId: input.accountId })\n          .onConflictDoNothing({ target: schema.workspaceVideoGenerationQuotas.workspaceId });\n        const [quota] = await tx\n          .select()\n          .from(schema.workspaceVideoGenerationQuotas)\n          .where(eq(schema.workspaceVideoGenerationQuotas.workspaceId, input.workspaceId))\n          .for(\"update\")\n          .limit(1);\n        if (!quota) throw new Error(\"Video generation quota row disappeared\");\n        if (quota.reservedBytes + quota.readyBytes + reservedBytes > input.workspaceQuotaBytes) {\n          throw new VideoGenerationCapacityError(\"Workspace video storage quota reached\");\n        }\n        const [operation] = await tx\n          .insert(schema.videoGenerationOperations)\n          .values({\n            id: input.id,\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            sessionId: input.sessionId,\n            turnId: input.turnId,\n            attemptId: input.attemptId,\n            toolCallId: input.toolCallId,\n            admissionKey: input.admissionKey,\n            requestDigest: input.requestDigest,\n            promptDigest: input.promptDigest,\n            requestEncrypted: input.requestEncrypted,\n            modelId: input.modelId,\n            sourceMode: input.sourceMode,\n            capabilityRevision: input.capabilityRevision,\n            fundingSource: input.fundingSource,\n            pricedCostMicros: input.pricedCostMicros,\n            creditState: input.pricedCostMicros > 0 ? \"debited\" : \"not_applicable\",\n            connectionId: input.connectionId,\n            credentialVersion: input.credentialVersion,\n            credentialEncrypted: input.credentialEncrypted,\n            providerIdempotencyKey: input.providerIdempotencyKey,\n            expectedArtifactId: input.expectedArtifactId,\n            expectedFileId: input.expectedFileId,\n            reservedBytes,\n            recoveryDeadlineAt: input.recoveryDeadlineAt,\n            status: input.references.length === 0 ? \"prepared\" : \"preparing\",\n            admissionOutputState: \"pending\",\n            terminalUpdateState: \"ineligible\",\n          })\n          .returning();\n        if (!operation) throw new Error(\"Video generation operation was not admitted\");\n        if (input.pricedCostMicros > 0) {\n          if (input.fundingSource !== \"opengeni_credits\" || input.connectionId !== null) {\n            throw new Error(\"Only OpenGeni-funded video operations may debit credits\");\n          }\n          await debitVideoGenerationCredits(tx, operation);\n        }\n        if (input.references.length > 0) {\n          await tx.insert(schema.videoGenerationReferences).values(\n            input.references.map((reference) => ({\n              operationId: operation.id,\n              workspaceId: input.workspaceId,\n              accountId: input.accountId,\n              grantExpiresAt: reference.grantExpiresAt ?? null,\n              ...reference,\n            })),\n          );\n        }\n        await tx\n          .update(schema.workspaceVideoGenerationQuotas)\n          .set({\n            reservedBytes: sql`${schema.workspaceVideoGenerationQuotas.reservedBytes} + ${reservedBytes}`,\n            updatedAt: new Date(),\n          })\n          .where(eq(schema.workspaceVideoGenerationQuotas.workspaceId, input.workspaceId));\n        return { operation, created: true };\n      }),\n  );\n}\n\n/**\n * Seal a reference-bearing operation only after every immutable staging object\n * has been uploaded and independently verified by the worker.  The source\n * sandbox path is intentionally not stored, so a failed preparation can only\n * be retried by the same logical tool call while its sandbox still exists.\n */\nexport async function markVideoGenerationPrepared(\n  db: Database,\n  input: OperationMutationInput,\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(db, input, async (tx, operation) => {\n    if (operation.status === \"prepared\") return operation;\n    if (operation.status !== \"preparing\") throw invalidTransition(operation, \"prepared\");\n    const references = await tx\n      .select({\n        stagingObjectKey: schema.videoGenerationReferences.stagingObjectKey,\n        cleanedAt: schema.videoGenerationReferences.cleanedAt,\n      })\n      .from(schema.videoGenerationReferences)\n      .where(eq(schema.videoGenerationReferences.operationId, operation.id));\n    if (\n      references.length === 0 ||\n      references.some((reference) => !reference.stagingObjectKey || reference.cleanedAt)\n    ) {\n      throw new VideoGenerationConflictError(\"Video references are not sealed\");\n    }\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({ status: \"prepared\", updatedAt: new Date() })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning();\n    return requireRow(updated, \"seal video generation references\");\n  });\n}\n\n/** Final authorization fence. Call only after the accepted function output is durable. */\nexport async function markVideoGenerationAccepted(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    operationId: string;\n    requestDigest: string;\n  },\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(\n    db,\n    input,\n    async (tx, operation) =>\n      await markVideoGenerationAcceptedInTransaction(tx, {\n        workspaceId: input.workspaceId,\n        operation,\n      }),\n  );\n}\n\n/**\n * Transactional half of acceptance.  The pending function result and this\n * transition must commit together: the provider reconciler never observes an\n * accepted operation whose model-visible `accepted` receipt was lost.\n */\nexport async function markVideoGenerationAcceptedInTransaction(\n  tx: Database,\n  input: {\n    workspaceId: string;\n    operation: VideoGenerationOperation;\n    toolCallId?: string;\n  },\n): Promise<VideoGenerationOperation> {\n  const operation = input.operation;\n  if (input.toolCallId !== undefined && operation.toolCallId !== input.toolCallId) {\n    throw new VideoGenerationConflictError(\"Video generation tool-call identity changed\");\n  }\n  if (operation.admissionOutputState === \"recorded\") return operation;\n  if (operation.status !== \"prepared\") {\n    throw new VideoGenerationConflictError(\"Video generation is no longer awaiting acceptance\");\n  }\n  const [policy] = await tx\n    .select()\n    .from(schema.workspaceVideoGenerationPolicies)\n    .where(eq(schema.workspaceVideoGenerationPolicies.workspaceId, input.workspaceId))\n    .for(\"share\")\n    .limit(1);\n  const [connection] = operation.connectionId\n    ? await tx\n        .select({\n          id: schema.connections.id,\n          version: schema.connections.version,\n          status: schema.connections.status,\n          metadata: schema.connections.metadata,\n        })\n        .from(schema.connections)\n        .where(\n          and(\n            eq(schema.connections.workspaceId, input.workspaceId),\n            eq(schema.connections.id, operation.connectionId),\n          ),\n        )\n        .for(\"share\")\n        .limit(1)\n    : [];\n  const workspaceGatewayAuthorized =\n    operation.fundingSource === \"workspace_gateway\" &&\n    connection?.status === \"active\" &&\n    connection.version === operation.credentialVersion &&\n    connection.metadata.credentialRole === \"vercel_ai_gateway\";\n  const managedAuthorized =\n    operation.fundingSource === \"opengeni_credits\" &&\n    operation.connectionId === null &&\n    (operation.creditState === \"debited\" ||\n      (operation.creditState === \"not_applicable\" && operation.pricedCostMicros === 0));\n  if (\n    !policy ||\n    policy.fundingSource !== operation.fundingSource ||\n    !policy.enabledModelIds.includes(operation.modelId) ||\n    (!workspaceGatewayAuthorized && !managedAuthorized)\n  ) {\n    throw new VideoGenerationConflictError(\"Video generation authorization changed\");\n  }\n  const now = new Date();\n  const [updated] = await tx\n    .update(schema.videoGenerationOperations)\n    .set({\n      status: \"accepted\",\n      admissionOutputState: \"recorded\",\n      terminalUpdateState: \"pending\",\n      nextReconcileAt: now,\n      updatedAt: now,\n    })\n    .where(eq(schema.videoGenerationOperations.id, operation.id))\n    .returning();\n  return requireRow(updated, \"record video generation acceptance\");\n}\n\nexport async function cancelVideoGenerationBeforeSubmit(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    operationId: string;\n    requestDigest: string;\n    reason: string;\n  },\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(db, input, async (tx, operation) => {\n    if (operation.status === \"cancelled_before_submit\") return operation;\n    if (!inPreSubmitState(operation.status) || operation.providerRequestSentAt) {\n      throw new VideoGenerationConflictError(\n        \"Video generation may already have reached the provider\",\n      );\n    }\n    const now = new Date();\n    await releaseReservedQuota(tx, operation, false);\n    const creditState = await refundVideoGenerationCredits(tx, operation, now);\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({\n        status: \"cancelled_before_submit\",\n        creditState,\n        quotaState: \"released\",\n        terminalAt: now,\n        terminalUpdateState:\n          operation.admissionOutputState === \"recorded\" ? \"pending\" : \"suppressed\",\n        credentialEncrypted: null,\n        requestEncrypted: null,\n        boundedPublicReason: boundPublicReason(input.reason),\n        updatedAt: now,\n      })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning();\n    if (!updated) throw new Error(\"Video generation cancellation was not recorded\");\n    return updated;\n  });\n}\n\n/**\n * Turn-interruption half of pre-submit cancellation. It runs under the same\n * session/turn transaction that closes unresolved tool calls, so an accepted\n * receipt can never race a cancellation of its operation.\n */\nexport async function cancelUnacceptedVideoGenerationsForToolCallsInTransaction(\n  tx: Database,\n  input: {\n    workspaceId: string;\n    sessionId: string;\n    turnId: string;\n    toolCallIds: readonly string[];\n    reason: string;\n    now: Date;\n  },\n): Promise<string[]> {\n  const toolCallIds = [...new Set(input.toolCallIds)];\n  if (toolCallIds.length === 0) return [];\n  const operations = await tx\n    .select()\n    .from(schema.videoGenerationOperations)\n    .where(\n      and(\n        eq(schema.videoGenerationOperations.workspaceId, input.workspaceId),\n        eq(schema.videoGenerationOperations.sessionId, input.sessionId),\n        eq(schema.videoGenerationOperations.turnId, input.turnId),\n        inArray(schema.videoGenerationOperations.toolCallId, toolCallIds),\n        eq(schema.videoGenerationOperations.admissionOutputState, \"pending\"),\n        inArray(schema.videoGenerationOperations.status, [\"preparing\", \"prepared\"]),\n        sql`${schema.videoGenerationOperations.providerRequestSentAt} is null`,\n      ),\n    )\n    .orderBy(schema.videoGenerationOperations.id)\n    .for(\"update\");\n  const cancelled: string[] = [];\n  for (const operation of operations) {\n    await releaseReservedQuota(tx, operation, false);\n    const creditState = await refundVideoGenerationCredits(tx, operation, input.now);\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({\n        status: \"cancelled_before_submit\",\n        creditState,\n        quotaState: \"released\",\n        terminalAt: input.now,\n        terminalUpdateState: \"suppressed\",\n        nextReconcileAt: input.now,\n        providerRequestEncrypted: null,\n        providerRequestExpiresAt: null,\n        credentialEncrypted: null,\n        requestEncrypted: null,\n        privateDataEraseAfter: input.now,\n        boundedPublicReason: boundPublicReason(input.reason),\n        reconcileLeaseOwner: null,\n        reconcileLeaseExpiresAt: null,\n        updatedAt: input.now,\n      })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning({ id: schema.videoGenerationOperations.id });\n    if (!updated) throw new Error(\"Interrupted video generation was not cancelled\");\n    await tx\n      .update(schema.videoGenerationReferences)\n      .set({ cleanupAfter: input.now })\n      .where(eq(schema.videoGenerationReferences.operationId, operation.id));\n    cancelled.push(updated.id);\n  }\n  return cancelled;\n}\n\nexport async function claimVideoGenerationOperations(\n  db: Database,\n  input: { owner: string; leaseSeconds: number; limit: number },\n): Promise<Array<{ operationId: string; accountId: string; workspaceId: string }>> {\n  const rows = await rawRows<{\n    operation_id: string;\n    account_id: string;\n    workspace_id: string;\n  }>(\n    db,\n    sql`select * from opengeni_private.claim_video_generation_operations(\n      ${input.owner}, ${input.leaseSeconds}, ${input.limit}\n    )`,\n  );\n  return rows.map((row) => ({\n    operationId: row.operation_id,\n    accountId: row.account_id,\n    workspaceId: row.workspace_id,\n  }));\n}\n\nexport async function getVideoGenerationOperation(\n  db: Database,\n  workspaceId: string,\n  operationId: string,\n): Promise<VideoGenerationOperationWithReferences | null> {\n  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {\n    const [operation] = await scopedDb\n      .select()\n      .from(schema.videoGenerationOperations)\n      .where(\n        and(\n          eq(schema.videoGenerationOperations.workspaceId, workspaceId),\n          eq(schema.videoGenerationOperations.id, operationId),\n        ),\n      )\n      .limit(1);\n    if (!operation) return null;\n    const references = await scopedDb\n      .select()\n      .from(schema.videoGenerationReferences)\n      .where(eq(schema.videoGenerationReferences.operationId, operationId))\n      .orderBy(schema.videoGenerationReferences.ordinal);\n    return { ...operation, references };\n  });\n}\n\nexport async function markVideoGenerationSubmissionUncertain(\n  db: Database,\n  input: OperationMutationInput & { nextReconcileAt: Date; error: string },\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(db, input, async (tx, operation) => {\n    if (operation.status !== \"submission_uncertain\" || !operation.providerRequestEncrypted) {\n      throw invalidTransition(operation, \"submission_uncertain\");\n    }\n    const now = new Date();\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({\n        status: \"submission_uncertain\",\n        providerRequestSentAt: operation.providerRequestSentAt ?? now,\n        nextReconcileAt: input.nextReconcileAt,\n        lastError: boundPrivateError(input.error),\n        reconcileLeaseOwner: null,\n        reconcileLeaseExpiresAt: null,\n        updatedAt: now,\n      })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning();\n    return requireRow(updated, \"record uncertain video submission\");\n  });\n}\n\n/**\n * Freeze the exact provider start body before issuing the request. If the\n * worker disappears after this transaction, recovery replays the same body\n * and idempotency key rather than reminting URLs or changing request bytes.\n */\nexport async function markVideoGenerationSubmissionIntent(\n  db: Database,\n  input: OperationMutationInput & {\n    encryptedProviderRequest: string;\n    providerRequestExpiresAt: Date;\n    nextReconcileAt: Date;\n  },\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(db, input, async (tx, operation) => {\n    if (operation.status === \"submission_uncertain\") {\n      if (!operation.providerRequestEncrypted || !operation.providerRequestExpiresAt) {\n        throw new VideoGenerationConflictError(\"Video provider request is incomplete\");\n      }\n      return operation;\n    }\n    if (operation.status !== \"accepted\") {\n      throw invalidTransition(operation, \"submission_uncertain\");\n    }\n    const now = new Date();\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({\n        status: \"submission_uncertain\",\n        providerRequestEncrypted: input.encryptedProviderRequest,\n        providerRequestExpiresAt: input.providerRequestExpiresAt,\n        nextReconcileAt: input.nextReconcileAt,\n        lastError: null,\n        reconcileLeaseOwner: null,\n        reconcileLeaseExpiresAt: null,\n        updatedAt: now,\n      })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning();\n    await tx\n      .update(schema.videoGenerationReferences)\n      .set({\n        grantExpiresAt: input.providerRequestExpiresAt,\n        cleanupAfter: new Date(\n          Math.max(\n            operation.recoveryDeadlineAt.getTime(),\n            input.providerRequestExpiresAt.getTime(),\n          ),\n        ),\n      })\n      .where(eq(schema.videoGenerationReferences.operationId, operation.id));\n    return requireRow(updated, \"record video provider submission intent\");\n  });\n}\n\nexport async function markVideoGenerationProviderStarted(\n  db: Database,\n  input: OperationMutationInput & { providerJobId: string; nextReconcileAt: Date },\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(db, input, async (tx, operation) => {\n    if (\n      operation.providerJobId === input.providerJobId &&\n      operation.status === \"provider_started\"\n    ) {\n      return operation;\n    }\n    if (!inArrayValue(operation.status, [\"accepted\", \"submission_uncertain\"])) {\n      throw invalidTransition(operation, \"provider_started\");\n    }\n    const now = new Date();\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({\n        status: \"provider_started\",\n        providerJobId: input.providerJobId.slice(0, 1_024),\n        providerRequestEncrypted: null,\n        providerRequestExpiresAt: null,\n        providerRequestSentAt: operation.providerRequestSentAt ?? now,\n        providerStartedAt: operation.providerStartedAt ?? now,\n        nextReconcileAt: input.nextReconcileAt,\n        lastError: null,\n        reconcileLeaseOwner: null,\n        reconcileLeaseExpiresAt: null,\n        updatedAt: now,\n      })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning();\n    return requireRow(updated, \"record video provider job\");\n  });\n}\n\nexport async function rescheduleVideoGenerationOperation(\n  db: Database,\n  input: OperationMutationInput & { owner?: string; nextReconcileAt: Date; error?: string },\n): Promise<boolean> {\n  return await withRlsContext(\n    db,\n    { accountId: input.accountId, workspaceId: input.workspaceId },\n    async (scopedDb) => {\n      const [updated] = await scopedDb\n        .update(schema.videoGenerationOperations)\n        .set({\n          nextReconcileAt: input.nextReconcileAt,\n          ...(input.error ? { lastError: boundPrivateError(input.error) } : {}),\n          reconcileLeaseOwner: null,\n          reconcileLeaseExpiresAt: null,\n          updatedAt: new Date(),\n        })\n        .where(\n          and(\n            eq(schema.videoGenerationOperations.workspaceId, input.workspaceId),\n            eq(schema.videoGenerationOperations.id, input.operationId),\n            eq(schema.videoGenerationOperations.requestDigest, input.requestDigest),\n            ...(input.owner\n              ? [eq(schema.videoGenerationOperations.reconcileLeaseOwner, input.owner)]\n              : []),\n          ),\n        )\n        .returning({ id: schema.videoGenerationOperations.id });\n      return updated !== undefined;\n    },\n  );\n}\n\nexport async function markVideoGenerationRetaining(\n  db: Database,\n  input: OperationMutationInput,\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(db, input, async (tx, operation) => {\n    if (operation.status === \"retaining\") return operation;\n    if (operation.status !== \"provider_started\") throw invalidTransition(operation, \"retaining\");\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({\n        status: \"retaining\",\n        nextReconcileAt: new Date(),\n        reconcileLeaseOwner: null,\n        reconcileLeaseExpiresAt: null,\n        updatedAt: new Date(),\n      })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning();\n    return requireRow(updated, \"begin video retention\");\n  });\n}\n\nexport async function settleVideoGenerationFailure(\n  db: Database,\n  input: OperationMutationInput & {\n    status: \"provider_failed\" | \"retention_failed\" | \"outcome_unknown\";\n    publicReason: string;\n    privateError?: string;\n  },\n): Promise<VideoGenerationOperation> {\n  return await mutateOperation(db, input, async (tx, operation) => {\n    if (operation.status === input.status) return operation;\n    const allowed =\n      input.status === \"provider_failed\"\n        ? [\"accepted\", \"submission_uncertain\", \"provider_started\"]\n        : input.status === \"retention_failed\"\n          ? [\"retaining\"]\n          : [\"submission_uncertain\", \"provider_started\"];\n    if (!inArrayValue(operation.status, allowed)) throw invalidTransition(operation, input.status);\n    await releaseReservedQuota(tx, operation, false);\n    const now = new Date();\n    const creditState = await refundVideoGenerationCredits(tx, operation, now);\n    const [updated] = await tx\n      .update(schema.videoGenerationOperations)\n      .set({\n        status: input.status,\n        creditState,\n        quotaState: \"released\",\n        terminalAt: now,\n        nextReconcileAt: null,\n        terminalUpdateState:\n          operation.admissionOutputState === \"recorded\" ? \"pending\" : \"suppressed\",\n        providerRequestEncrypted: null,\n        providerRequestExpiresAt: null,\n        credentialEncrypted: null,\n        requestEncrypted: null,\n        boundedPublicReason: boundPublicReason(input.publicReason),\n        lastError: input.privateError ? boundPrivateError(input.privateError) : null,\n        reconcileLeaseOwner: null,\n        reconcileLeaseExpiresAt: null,\n        privateDataEraseAfter: now,\n        updatedAt: now,\n      })\n      .where(eq(schema.videoGenerationOperations.id, operation.id))\n      .returning();\n    return requireRow(updated, \"settle failed video generation\");\n  });\n}\n\nexport type SettleVideoGenerationReadyInput = OperationMutationInput & {\n  fileId: string;\n  bucket: string;\n  objectKey: string;\n  sizeBytes: number;\n  sha256: string;\n  facts: GeneratedVideoFacts;\n};\n\nexport async function settleVideoGenerationReady(\n  db: Database,\n  input: SettleVideoGenerationReadyInput,\n): Promise<{ operation: VideoGenerationOperation; artifact: GeneratedVideoArtifact }> {\n  return await withRlsContext(\n    db,\n    { accountId: input.accountId, workspaceId: input.workspaceId },\n    async (scopedDb) =>\n      await scopedDb.transaction(async (tx) => {\n        const [operation] = await tx\n          .select()\n          .from(schema.videoGenerationOperations)\n          .where(\n            and(\n              eq(schema.videoGenerationOperations.workspaceId, input.workspaceId),\n              eq(schema.videoGenerationOperations.id, input.operationId),\n              eq(schema.videoGenerationOperations.requestDigest, input.requestDigest),\n            ),\n          )\n          .for(\"update\")\n          .limit(1);\n        if (!operation) throw new VideoGenerationConflictError(\"Video operation not found\");\n        const [existingArtifact] = await tx\n          .select()\n          .from(schema.generatedVideoArtifacts)\n          .where(eq(schema.generatedVideoArtifacts.operationId, operation.id))\n          .limit(1);\n        if (operation.status === \"completed\" && existingArtifact) {\n          return { operation, artifact: existingArtifact };\n        }\n        if (operation.status !== \"retaining\") throw invalidTransition(operation, \"completed\");\n        if (operation.expectedFileId !== input.fileId) {\n          throw new VideoGenerationConflictError(\"Video File identity changed during settlement\");\n        }\n        if (operation.expectedArtifactId === operation.expectedFileId) {\n          throw new Error(\"Video artifact and File identities must be distinct\");\n        }\n        const now = new Date();\n        await tx.insert(schema.files).values({\n          id: input.fileId,\n          accountId: input.accountId,\n          workspaceId: input.workspaceId,\n          status: \"ready\",\n          filename: `generated-video-${operation.expectedArtifactId}.mp4`,\n          safeFilename: `generated-video-${operation.expectedArtifactId}.mp4`,\n          contentType: \"video/mp4\",\n          sizeBytes: input.sizeBytes,\n          sha256: input.sha256,\n          bucket: input.bucket,\n          objectKey: input.objectKey,\n          updatedAt: now,\n        });\n        const [artifact] = await tx\n          .insert(schema.generatedVideoArtifacts)\n          .values({\n            id: operation.expectedArtifactId,\n            accountId: input.accountId,\n            workspaceId: input.workspaceId,\n            primaryFileId: input.fileId,\n            operationId: operation.id,\n            sessionId: operation.sessionId,\n            turnId: operation.turnId,\n            attemptId: operation.attemptId,\n            modelId: operation.modelId,\n            sourceMode: operation.sourceMode,\n            promptDigest: operation.promptDigest,\n            contentType: \"video/mp4\",\n            sizeBytes: input.sizeBytes,\n            sha256: input.sha256,\n            durationMillis: Math.round(input.facts.durationSeconds * 1_000),\n            width: input.facts.width,\n            height: input.facts.height,\n            fpsMilli: Math.round(input.facts.fps * 1_000),\n            videoCodec: input.facts.videoCodec,\n            audioCodec: input.facts.audioCodec,\n            hasAudio: input.facts.hasAudio,\n            sandboxFilename: `generated-video-${operation.expectedArtifactId}.mp4`,\n            readyAt: now,\n          })\n          .returning();\n        if (!artifact) throw new Error(\"Generated video artifact was not persisted\");\n        await tx\n          .update(schema.workspaceVideoGenerationQuotas)\n          .set({\n            reservedBytes: sql`${schema.workspaceVideoGenerationQuotas.reservedBytes} - ${operation.reservedBytes}`,\n            readyBytes: sql`${schema.workspaceVideoGenerationQuotas.readyBytes} + ${input.sizeBytes}`,\n            updatedAt: now,\n          })\n          .where(eq(schema.workspaceVideoGenerationQuotas.workspaceId, input.workspaceId));\n        const [updated] = await tx\n          .update(schema.videoGenerationOperations)\n          .set({\n            status: \"completed\",\n            quotaState: \"ready\",\n            terminalAt: now,\n            nextReconcileAt: null,\n            terminalUpdateState:\n              operation.admissionOutputState === \"recorded\" ? \"pending\" : \"suppressed\",\n            providerRequestEncrypted: null,\n            providerRequestExpiresAt: null,\n            credentialEncrypted: null,\n            requestEncrypted: null,\n            privateDataEraseAfter: now,\n            reconcileLeaseOwner: null,\n            reconcileLeaseExpiresAt: null,\n            updatedAt: now,\n          })\n          .where(eq(schema.videoGenerationOperations.id, operation.id))\n          .returning();\n        return {\n          operation: requireRow(updated, \"settle ready video generation\"),\n          artifact,\n        };\n      }),\n  );\n}\n\nexport async function getGeneratedVideoArtifact(\n  db: Database,\n  workspaceId: string,\n  artifactId: string,\n): Promise<{ artifact: GeneratedVideoArtifact; file: typeof schema.files.$inferSelect } | null> {\n  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {\n    const [row] = await scopedDb\n      .select({ artifact: schema.generatedVideoArtifacts, file: schema.files })\n      .from(schema.generatedVideoArtifacts)\n      .innerJoin(schema.files, eq(schema.files.id, schema.generatedVideoArtifacts.primaryFileId))\n      .where(\n        and(\n          eq(schema.generatedVideoArtifacts.workspaceId, workspaceId),\n          eq(schema.generatedVideoArtifacts.id, artifactId),\n        ),\n      )\n      .limit(1);\n    return row ?? null;\n  });\n}\n\nexport async function listSessionGeneratedVideoArtifacts(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n): Promise<Array<{ artifact: GeneratedVideoArtifact; file: typeof schema.files.$inferSelect }>> {\n  return await withWorkspaceRls(\n    db,\n    workspaceId,\n    async (scopedDb) =>\n      await scopedDb\n        .select({ artifact: schema.generatedVideoArtifacts, file: schema.files })\n        .from(schema.generatedVideoArtifacts)\n        .innerJoin(schema.files, eq(schema.files.id, schema.generatedVideoArtifacts.primaryFileId))\n        .where(\n          and(\n            eq(schema.generatedVideoArtifacts.workspaceId, workspaceId),\n            eq(schema.generatedVideoArtifacts.sessionId, sessionId),\n            sql`${schema.generatedVideoArtifacts.deletedAt} is null`,\n          ),\n        )\n        .orderBy(schema.generatedVideoArtifacts.createdAt, schema.generatedVideoArtifacts.id),\n  );\n}\n\n/**\n * Record one staging object as erased only after the object-store delete has\n * succeeded. Deleting first is safe because object deletion is idempotent; a\n * crash before this CAS simply repeats the same delete on recovery.\n */\nexport async function markVideoGenerationReferenceCleaned(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    operationId: string;\n    ordinal: number;\n    stagingObjectKey: string;\n  },\n): Promise<boolean> {\n  return await withRlsContext(\n    db,\n    { accountId: input.accountId, workspaceId: input.workspaceId },\n    async (scopedDb) => {\n      const [updated] = await scopedDb\n        .update(schema.videoGenerationReferences)\n        .set({\n          stagingObjectKey: null,\n          grantExpiresAt: null,\n          cleanupAfter: null,\n          cleanedAt: new Date(),\n        })\n        .where(\n          and(\n            eq(schema.videoGenerationReferences.workspaceId, input.workspaceId),\n            eq(schema.videoGenerationReferences.operationId, input.operationId),\n            eq(schema.videoGenerationReferences.ordinal, input.ordinal),\n            eq(schema.videoGenerationReferences.stagingObjectKey, input.stagingObjectKey),\n          ),\n        )\n        .returning({ operationId: schema.videoGenerationReferences.operationId });\n      if (updated) return true;\n      const [existing] = await scopedDb\n        .select({ cleanedAt: schema.videoGenerationReferences.cleanedAt })\n        .from(schema.videoGenerationReferences)\n        .where(\n          and(\n            eq(schema.videoGenerationReferences.workspaceId, input.workspaceId),\n            eq(schema.videoGenerationReferences.operationId, input.operationId),\n            eq(schema.videoGenerationReferences.ordinal, input.ordinal),\n          ),\n        )\n        .limit(1);\n      return existing?.cleanedAt !== null && existing?.cleanedAt !== undefined;\n    },\n  );\n}\n\nexport async function markVideoGenerationTerminalUpdate(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    operationId: string;\n    state: \"leased\" | \"delivered\" | \"suppressed\";\n    updateId?: string;\n  },\n): Promise<boolean> {\n  return await withRlsContext(\n    db,\n    { accountId: input.accountId, workspaceId: input.workspaceId },\n    async (scopedDb) => {\n      return await markVideoGenerationTerminalUpdateInTransaction(scopedDb, input);\n    },\n  );\n}\n\nexport async function markVideoGenerationTerminalUpdateInTransaction(\n  tx: Database,\n  input: {\n    workspaceId: string;\n    operationId: string;\n    state: \"leased\" | \"delivered\" | \"suppressed\";\n    updateId?: string;\n  },\n): Promise<boolean> {\n  const allowed =\n    input.state === \"leased\"\n      ? [\"pending\", \"leased\"]\n      : input.state === \"delivered\"\n        ? [\"leased\"]\n        : [\"pending\", \"leased\"];\n  const [updated] = await tx\n    .update(schema.videoGenerationOperations)\n    .set({\n      terminalUpdateState: input.state,\n      terminalUpdateId: input.state === \"suppressed\" ? null : (input.updateId ?? null),\n      updatedAt: new Date(),\n    })\n    .where(\n      and(\n        eq(schema.videoGenerationOperations.workspaceId, input.workspaceId),\n        eq(schema.videoGenerationOperations.id, input.operationId),\n        inArray(schema.videoGenerationOperations.terminalUpdateState, allowed),\n        ...(input.state === \"delivered\" && input.updateId\n          ? [eq(schema.videoGenerationOperations.terminalUpdateId, input.updateId)]\n          : []),\n      ),\n    )\n    .returning({ id: schema.videoGenerationOperations.id });\n  return updated !== undefined;\n}\n\nexport function mediaGenerationResultForOperation(input: {\n  operation: VideoGenerationOperation;\n  readyReceipt?: Extract<MediaGenerationResult, { status: \"ready\" }>[\"receipt\"];\n}): MediaGenerationResult {\n  if (input.operation.status === \"completed\" && input.readyReceipt) {\n    return {\n      type: \"media_generation_result\",\n      schemaVersion: 1,\n      status: \"ready\",\n      operationId: input.operation.id,\n      receipt: input.readyReceipt,\n    };\n  }\n  const failureStatus = input.operation.status;\n  if (\n    !inArrayValue(failureStatus, [\n      \"provider_failed\",\n      \"retention_failed\",\n      \"cancelled_before_submit\",\n      \"outcome_unknown\",\n    ])\n  ) {\n    throw new Error(\"Video generation operation is not terminal\");\n  }\n  return {\n    type: \"media_generation_result\",\n    schemaVersion: 1,\n    status: failureStatus,\n    operationId: input.operation.id,\n    boundedPublicReason:\n      input.operation.boundedPublicReason ?? \"Video generation did not complete.\",\n  } as MediaGenerationResult;\n}\n\n/** Build the compact public/model terminal envelope from durable canonical rows. */\nexport async function mediaGenerationResultForStoredOperation(\n  db: Database,\n  operation: VideoGenerationOperation,\n): Promise<MediaGenerationResult> {\n  if (operation.status !== \"completed\") {\n    return mediaGenerationResultForOperation({ operation });\n  }\n  const retained = await getGeneratedVideoArtifact(\n    db,\n    operation.workspaceId,\n    operation.expectedArtifactId,\n  );\n  if (!retained || retained.artifact.deletedAt) {\n    throw new Error(\"Completed video generation lost its retained artifact\");\n  }\n  const artifact = retainedGeneratedVideoReferenceFromFile({\n    id: retained.artifact.id,\n    workspaceId: retained.artifact.workspaceId,\n    status: retained.file.status,\n    contentType: retained.file.contentType,\n    sizeBytes: retained.file.sizeBytes,\n    sha256: retained.file.sha256,\n    updatedAt: retained.artifact.readyAt.toISOString(),\n    width: retained.artifact.width,\n    height: retained.artifact.height,\n  });\n  if (!artifact) throw new Error(\"Generated video receipt could not be constructed\");\n  const receipt = GeneratedVideoReceipt.parse({\n    type: \"generated_video\",\n    schemaVersion: 1,\n    operationId: operation.id,\n    artifact,\n    video: {\n      durationSeconds: retained.artifact.durationMillis / 1_000,\n      width: retained.artifact.width,\n      height: retained.artifact.height,\n      fps: retained.artifact.fpsMilli / 1_000,\n      hasAudio: retained.artifact.hasAudio,\n      videoCodec: retained.artifact.videoCodec,\n      audioCodec: retained.artifact.audioCodec,\n    },\n    sandboxPath: `/workspace/generated-videos/${retained.artifact.sandboxFilename}`,\n  });\n  return mediaGenerationResultForOperation({ operation, readyReceipt: receipt });\n}\n\nexport async function getVideoGenerationOperationSummary(\n  db: Database,\n  workspaceId: string,\n  operationId: string,\n): Promise<import(\"@opengeni/contracts\").VideoGenerationOperationSummary | null> {\n  const operation = await getVideoGenerationOperation(db, workspaceId, operationId);\n  if (!operation) return null;\n  const terminal = inArrayValue(operation.status, [\n    \"completed\",\n    \"provider_failed\",\n    \"cancelled_before_submit\",\n    \"outcome_unknown\",\n    \"retention_failed\",\n  ])\n    ? await mediaGenerationResultForStoredOperation(db, operation)\n    : null;\n  return VideoGenerationOperationSummary.parse({\n    schemaVersion: 1,\n    operationId: operation.id,\n    modelId: operation.modelId,\n    status: operation.status === \"submission_uncertain\" ? \"accepted\" : operation.status,\n    createdAt: operation.createdAt.toISOString(),\n    updatedAt: operation.updatedAt.toISOString(),\n    terminal,\n  });\n}\n\ntype OperationMutationInput = {\n  accountId: string;\n  workspaceId: string;\n  operationId: string;\n  requestDigest: string;\n};\n\nasync function mutateOperation<T>(\n  db: Database,\n  input: OperationMutationInput,\n  mutate: (tx: Database, operation: VideoGenerationOperation) => Promise<T>,\n): Promise<T> {\n  return await withRlsContext(\n    db,\n    { accountId: input.accountId, workspaceId: input.workspaceId },\n    async (scopedDb) =>\n      await scopedDb.transaction(async (txRaw) => {\n        const tx = txRaw as unknown as Database;\n        const [operation] = await tx\n          .select()\n          .from(schema.videoGenerationOperations)\n          .where(\n            and(\n              eq(schema.videoGenerationOperations.workspaceId, input.workspaceId),\n              eq(schema.videoGenerationOperations.id, input.operationId),\n              eq(schema.videoGenerationOperations.requestDigest, input.requestDigest),\n            ),\n          )\n          .for(\"update\")\n          .limit(1);\n        if (!operation) throw new VideoGenerationConflictError(\"Video operation not found\");\n        return await mutate(tx, operation);\n      }),\n  );\n}\n\nasync function releaseReservedQuota(\n  tx: Database,\n  operation: VideoGenerationOperation,\n  ready: boolean,\n): Promise<void> {\n  if (operation.quotaState !== \"reserved\") return;\n  await tx\n    .update(schema.workspaceVideoGenerationQuotas)\n    .set({\n      reservedBytes: sql`${schema.workspaceVideoGenerationQuotas.reservedBytes} - ${operation.reservedBytes}`,\n      ...(ready\n        ? {\n            readyBytes: sql`${schema.workspaceVideoGenerationQuotas.readyBytes} + ${operation.reservedBytes}`,\n          }\n        : {}),\n      updatedAt: new Date(),\n    })\n    .where(eq(schema.workspaceVideoGenerationQuotas.workspaceId, operation.workspaceId));\n}\n\nasync function debitVideoGenerationCredits(\n  tx: Database,\n  operation: VideoGenerationOperation,\n): Promise<void> {\n  if (operation.pricedCostMicros <= 0 || operation.fundingSource !== \"opengeni_credits\") {\n    throw new Error(\"Managed video credit debit has an invalid funding binding\");\n  }\n  await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${operation.accountId}))`);\n  const [balanceRow] = await tx\n    .select({\n      balanceMicros: sql<number>`coalesce(sum(${schema.creditLedgerEntries.amountMicros}), 0)`,\n    })\n    .from(schema.creditLedgerEntries)\n    .where(eq(schema.creditLedgerEntries.accountId, operation.accountId));\n  const balanceMicros = Number(balanceRow?.balanceMicros ?? 0);\n  if (!Number.isSafeInteger(balanceMicros) || balanceMicros < operation.pricedCostMicros) {\n    throw new VideoGenerationCreditError();\n  }\n  const now = new Date();\n  const inserted = await tx\n    .insert(schema.creditLedgerEntries)\n    .values({\n      accountId: operation.accountId,\n      workspaceId: operation.workspaceId,\n      type: \"video_generation_debit\",\n      amountMicros: -operation.pricedCostMicros,\n      sourceType: \"video_generation_operation\",\n      sourceId: operation.id,\n      idempotencyKey: `credit:video_generation_debit:${operation.id}`,\n      metadata: {\n        modelId: operation.modelId,\n        sourceMode: operation.sourceMode,\n        pricedCostMicros: operation.pricedCostMicros,\n      },\n      occurredAt: now,\n    })\n    .onConflictDoNothing({ target: schema.creditLedgerEntries.idempotencyKey })\n    .returning({ id: schema.creditLedgerEntries.id });\n  if (inserted.length !== 1) {\n    throw new VideoGenerationConflictError(\"Video generation credit debit already exists\");\n  }\n  await tx\n    .insert(schema.usageEvents)\n    .values({\n      accountId: operation.accountId,\n      workspaceId: operation.workspaceId,\n      eventType: \"video_generation.cost\",\n      quantity: operation.pricedCostMicros,\n      unit: \"usd_micros\",\n      sourceResourceType: \"video_generation_operation\",\n      sourceResourceId: operation.id,\n      sessionId: operation.sessionId,\n      turnId: operation.turnId,\n      turnAttemptId: operation.attemptId,\n      idempotencyKey: `usage:video_generation.cost:${operation.id}`,\n      occurredAt: now,\n    })\n    .onConflictDoNothing({ target: schema.usageEvents.idempotencyKey });\n}\n\nasync function refundVideoGenerationCredits(\n  tx: Database,\n  operation: VideoGenerationOperation,\n  now: Date,\n): Promise<VideoGenerationOperation[\"creditState\"]> {\n  if (operation.creditState !== \"debited\") return operation.creditState;\n  if (operation.fundingSource !== \"opengeni_credits\" || operation.pricedCostMicros <= 0) {\n    throw new Error(\"Video generation credit refund has an invalid funding binding\");\n  }\n  await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${operation.accountId}))`);\n  const inserted = await tx\n    .insert(schema.creditLedgerEntries)\n    .values({\n      accountId: operation.accountId,\n      workspaceId: operation.workspaceId,\n      type: \"video_generation_refund\",\n      amountMicros: operation.pricedCostMicros,\n      sourceType: \"video_generation_operation\",\n      sourceId: operation.id,\n      idempotencyKey: `credit:video_generation_refund:${operation.id}`,\n      metadata: {\n        modelId: operation.modelId,\n        sourceMode: operation.sourceMode,\n        pricedCostMicros: operation.pricedCostMicros,\n      },\n      occurredAt: now,\n    })\n    .onConflictDoNothing({ target: schema.creditLedgerEntries.idempotencyKey })\n    .returning({ id: schema.creditLedgerEntries.id });\n  if (inserted.length !== 1) {\n    throw new VideoGenerationConflictError(\"Video generation credit refund already exists\");\n  }\n  await tx\n    .insert(schema.usageEvents)\n    .values({\n      accountId: operation.accountId,\n      workspaceId: operation.workspaceId,\n      eventType: \"video_generation.refund\",\n      quantity: operation.pricedCostMicros,\n      unit: \"usd_micros\",\n      sourceResourceType: \"video_generation_operation\",\n      sourceResourceId: operation.id,\n      sessionId: operation.sessionId,\n      turnId: operation.turnId,\n      turnAttemptId: operation.attemptId,\n      idempotencyKey: `usage:video_generation.refund:${operation.id}`,\n      occurredAt: now,\n    })\n    .onConflictDoNothing({ target: schema.usageEvents.idempotencyKey });\n  return \"refunded\";\n}\n\nfunction policyFromRow(\n  row: typeof schema.workspaceVideoGenerationPolicies.$inferSelect | undefined,\n): VideoGenerationPolicyValue {\n  return VideoGenerationPolicy.parse(\n    row\n      ? {\n          schemaVersion: 1,\n          revision: row.revision,\n          fundingSource: row.fundingSource,\n          enabledModelIds: row.enabledModelIds,\n          defaultModelId: row.defaultModelId,\n        }\n      : {\n          schemaVersion: 1,\n          revision: 0,\n          fundingSource: \"workspace_gateway\",\n          enabledModelIds: [],\n          defaultModelId: null,\n        },\n  );\n}\n\nfunction assertSupportedModels(modelIds: readonly string[]): void {\n  for (const modelId of modelIds) {\n    if (modelId !== SEEDANCE_2_5_MODEL_ID) {\n      throw new Error(`Unknown video generation model: ${modelId}`);\n    }\n  }\n}\n\nfunction assertAdmissionMatches(\n  operation: VideoGenerationOperation,\n  input: AdmitVideoGenerationOperationInput,\n): void {\n  if (\n    operation.requestDigest !== input.requestDigest ||\n    operation.toolCallId !== input.toolCallId ||\n    operation.sessionId !== input.sessionId ||\n    operation.turnId !== input.turnId ||\n    operation.fundingSource !== input.fundingSource ||\n    operation.pricedCostMicros !== input.pricedCostMicros\n  ) {\n    throw new VideoGenerationConflictError(\n      \"Video generation admission key was reused with different arguments\",\n    );\n  }\n}\n\nfunction inPreSubmitState(status: string): boolean {\n  return inArrayValue(status, [\"preparing\", \"prepared\", \"accepted\"]);\n}\n\nfunction inArrayValue<T extends string>(value: string, candidates: readonly T[]): value is T {\n  return (candidates as readonly string[]).includes(value);\n}\n\nfunction invalidTransition(operation: VideoGenerationOperation, target: string): Error {\n  return new VideoGenerationConflictError(\n    `Invalid video generation transition ${operation.status} -> ${target}`,\n  );\n}\n\nfunction requireRow<T>(value: T | undefined, action: string): T {\n  if (!value) throw new Error(`Failed to ${action}`);\n  return value;\n}\n\nfunction boundPublicReason(value: string): string {\n  const normalized = value.replace(/\\s+/gu, \" \").trim();\n  return (normalized || \"Video generation did not complete.\").slice(0, 1_000);\n}\n\nfunction boundPrivateError(value: string): string {\n  return value.replace(/\\s+/gu, \" \").trim().slice(0, 4_096);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAKK;AACP,SAAS,KAAK,IAAI,SAAS,WAAW;AAK/B,IAAM,mCAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EACtD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EACtD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAAY,UAAU,iCAAiC;AACrD,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,eAAsB,kCACpB,IACA,aACqC;AACrC,SAAO,MAAM,iBAAiB,IAAI,aAAa,OAAO,aAAa;AACjE,UAAM,CAAC,GAAG,IAAI,MAAM,SACjB,OAAO,EACP,KAAY,gCAAgC,EAC5C,MAAM,GAAU,iCAAiC,aAAa,WAAW,CAAC,EAC1E,MAAM,CAAC;AACV,WAAO,cAAc,GAAG;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,qCACpB,IACA,OASqC;AACrC,QAAM,YAAY,sBAAsB,MAAM;AAAA,IAC5C,eAAe;AAAA,IACf,UAAU,MAAM,mBAAmB;AAAA,IACnC,eAAe,MAAM;AAAA,IACrB,iBAAiB,MAAM;AAAA,IACvB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,wBAAsB,UAAU,eAAe;AAC/C,SAAO,MAAM;AAAA,IACX;AAAA,IACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,IAC7D,OAAO,aACL,MAAM,SAAS,YAAY,OAAO,OAAO;AACvC,YAAM,CAAC,SAAS,IAAI,MAAM,GACvB,OAAO,EAAE,IAAW,WAAW,GAAG,CAAC,EACnC,KAAY,UAAU,EACtB;AAAA,QACC;AAAA,UACE,GAAU,WAAW,IAAI,MAAM,WAAW;AAAA,UAC1C,GAAU,WAAW,WAAW,MAAM,SAAS;AAAA,QACjD;AAAA,MACF,EACC,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,UAAI,CAAC,UAAW,OAAM,IAAI,MAAM,qBAAqB;AACrD,YAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAO,EACP,KAAY,gCAAgC,EAC5C,MAAM,GAAU,iCAAiC,aAAa,MAAM,WAAW,CAAC,EAChF,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,YAAM,kBAAkB,SAAS,YAAY;AAC7C,UAAI,oBAAoB,MAAM,kBAAkB;AAC9C,cAAM,IAAI,6BAA6B,iCAAiC;AAAA,MAC1E;AACA,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,SAAS;AAAA,QACb,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,UAAU,kBAAkB;AAAA,QAC5B,eAAe,UAAU;AAAA,QACzB,iBAAiB,CAAC,GAAG,UAAU,eAAe;AAAA,QAC9C,gBAAgB,UAAU;AAAA,QAC1B,oBAAoB,MAAM,UAAU,MAAM,GAAG,IAAK;AAAA,QAClD,WAAW;AAAA,MACb;AACA,YAAM,CAAC,GAAG,IAAI,UACV,MAAM,GACH,OAAc,gCAAgC,EAC9C,IAAI,MAAM,EACV,MAAM,GAAU,iCAAiC,aAAa,MAAM,WAAW,CAAC,EAChF,UAAU,IACb,MAAM,GAAG,OAAc,gCAAgC,EAAE,OAAO,MAAM,EAAE,UAAU;AACtF,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,kDAAkD;AAC5E,aAAO,cAAc,GAAG;AAAA,IAC1B,CAAC;AAAA,EACL;AACF;AA0CA,eAAsB,8BACpB,IACA,OACoE;AACpE,QAAM,gBAAgB,MAAM,iBAAiB;AAC7C,SAAO,MAAM;AAAA,IACX;AAAA,IACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,IAC7D,OAAO,aACL,MAAM,SAAS,YAAY,OAAO,OAAO;AACvC,YAAM,GAAG;AAAA,QACP,oDAAoD,oBAAoB,MAAM,YAAY,EAAE;AAAA,MAC9F;AACA,YAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAO,EACP,KAAY,yBAAyB,EACrC;AAAA,QACC;AAAA,UACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,cAAc,MAAM,YAAY;AAAA,QACtE;AAAA,MACF,EACC,MAAM,CAAC;AACV,UAAI,UAAU;AACZ,+BAAuB,UAAU,KAAK;AACtC,eAAO,EAAE,WAAW,UAAU,SAAS,MAAM;AAAA,MAC/C;AACA,YAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO,EACP,KAAY,gCAAgC,EAC5C,MAAM,GAAU,iCAAiC,aAAa,MAAM,WAAW,CAAC,EAChF,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,UACE,CAAC,UACD,OAAO,aAAa,MAAM,kBAC1B,OAAO,kBAAkB,MAAM,iBAC/B,CAAC,OAAO,gBAAgB,SAAS,MAAM,OAAO,GAC9C;AACA,cAAM,IAAI,6BAA6B,qCAAqC;AAAA,MAC9E;AACA,YAAM,SAAS,MAAM,GAClB,OAAO,EAAE,IAAW,0BAA0B,GAAG,CAAC,EAClD,KAAY,yBAAyB,EACrC;AAAA,QACC;AAAA,UACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,QAAe,0BAA0B,QAAQ;AAAA,YAC/C,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF,EACC,IAAI,QAAQ;AACf,UAAI,OAAO,UAAU,MAAM,2BAA2B;AACpD,cAAM,IAAI,6BAA6B,0CAA0C;AAAA,MACnF;AACA,YAAM,GACH,OAAc,8BAA8B,EAC5C,OAAO,EAAE,aAAa,MAAM,aAAa,WAAW,MAAM,UAAU,CAAC,EACrE,oBAAoB,EAAE,QAAe,+BAA+B,YAAY,CAAC;AACpF,YAAM,CAAC,KAAK,IAAI,MAAM,GACnB,OAAO,EACP,KAAY,8BAA8B,EAC1C,MAAM,GAAU,+BAA+B,aAAa,MAAM,WAAW,CAAC,EAC9E,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,wCAAwC;AACpE,UAAI,MAAM,gBAAgB,MAAM,aAAa,gBAAgB,MAAM,qBAAqB;AACtF,cAAM,IAAI,6BAA6B,uCAAuC;AAAA,MAChF;AACA,YAAM,CAAC,SAAS,IAAI,MAAM,GACvB,OAAc,yBAAyB,EACvC,OAAO;AAAA,QACN,IAAI,MAAM;AAAA,QACV,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,cAAc,MAAM;AAAA,QACpB,eAAe,MAAM;AAAA,QACrB,cAAc,MAAM;AAAA,QACpB,kBAAkB,MAAM;AAAA,QACxB,SAAS,MAAM;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,oBAAoB,MAAM;AAAA,QAC1B,eAAe,MAAM;AAAA,QACrB,kBAAkB,MAAM;AAAA,QACxB,aAAa,MAAM,mBAAmB,IAAI,YAAY;AAAA,QACtD,cAAc,MAAM;AAAA,QACpB,mBAAmB,MAAM;AAAA,QACzB,qBAAqB,MAAM;AAAA,QAC3B,wBAAwB,MAAM;AAAA,QAC9B,oBAAoB,MAAM;AAAA,QAC1B,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,oBAAoB,MAAM;AAAA,QAC1B,QAAQ,MAAM,WAAW,WAAW,IAAI,aAAa;AAAA,QACrD,sBAAsB;AAAA,QACtB,qBAAqB;AAAA,MACvB,CAAC,EACA,UAAU;AACb,UAAI,CAAC,UAAW,OAAM,IAAI,MAAM,6CAA6C;AAC7E,UAAI,MAAM,mBAAmB,GAAG;AAC9B,YAAI,MAAM,kBAAkB,sBAAsB,MAAM,iBAAiB,MAAM;AAC7E,gBAAM,IAAI,MAAM,yDAAyD;AAAA,QAC3E;AACA,cAAM,4BAA4B,IAAI,SAAS;AAAA,MACjD;AACA,UAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,cAAM,GAAG,OAAc,yBAAyB,EAAE;AAAA,UAChD,MAAM,WAAW,IAAI,CAAC,eAAe;AAAA,YACnC,aAAa,UAAU;AAAA,YACvB,aAAa,MAAM;AAAA,YACnB,WAAW,MAAM;AAAA,YACjB,gBAAgB,UAAU,kBAAkB;AAAA,YAC5C,GAAG;AAAA,UACL,EAAE;AAAA,QACJ;AAAA,MACF;AACA,YAAM,GACH,OAAc,8BAA8B,EAC5C,IAAI;AAAA,QACH,eAAe,MAAa,+BAA+B,aAAa,MAAM,aAAa;AAAA,QAC3F,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC,EACA,MAAM,GAAU,+BAA+B,aAAa,MAAM,WAAW,CAAC;AACjF,aAAO,EAAE,WAAW,SAAS,KAAK;AAAA,IACpC,CAAC;AAAA,EACL;AACF;AAQA,eAAsB,4BACpB,IACA,OACmC;AACnC,SAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,cAAc;AAC/D,QAAI,UAAU,WAAW,WAAY,QAAO;AAC5C,QAAI,UAAU,WAAW,YAAa,OAAM,kBAAkB,WAAW,UAAU;AACnF,UAAM,aAAa,MAAM,GACtB,OAAO;AAAA,MACN,kBAAyB,0BAA0B;AAAA,MACnD,WAAkB,0BAA0B;AAAA,IAC9C,CAAC,EACA,KAAY,yBAAyB,EACrC,MAAM,GAAU,0BAA0B,aAAa,UAAU,EAAE,CAAC;AACvE,QACE,WAAW,WAAW,KACtB,WAAW,KAAK,CAAC,cAAc,CAAC,UAAU,oBAAoB,UAAU,SAAS,GACjF;AACA,YAAM,IAAI,6BAA6B,iCAAiC;AAAA,IAC1E;AACA,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI,EAAE,QAAQ,YAAY,WAAW,oBAAI,KAAK,EAAE,CAAC,EACjD,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,WAAO,WAAW,SAAS,kCAAkC;AAAA,EAC/D,CAAC;AACH;AAGA,eAAsB,4BACpB,IACA,OAMmC;AACnC,SAAO,MAAM;AAAA,IACX;AAAA,IACA;AAAA,IACA,OAAO,IAAI,cACT,MAAM,yCAAyC,IAAI;AAAA,MACjD,aAAa,MAAM;AAAA,MACnB;AAAA,IACF,CAAC;AAAA,EACL;AACF;AAOA,eAAsB,yCACpB,IACA,OAKmC;AACnC,QAAM,YAAY,MAAM;AACxB,MAAI,MAAM,eAAe,UAAa,UAAU,eAAe,MAAM,YAAY;AAC/E,UAAM,IAAI,6BAA6B,6CAA6C;AAAA,EACtF;AACA,MAAI,UAAU,yBAAyB,WAAY,QAAO;AAC1D,MAAI,UAAU,WAAW,YAAY;AACnC,UAAM,IAAI,6BAA6B,mDAAmD;AAAA,EAC5F;AACA,QAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO,EACP,KAAY,gCAAgC,EAC5C,MAAM,GAAU,iCAAiC,aAAa,MAAM,WAAW,CAAC,EAChF,IAAI,OAAO,EACX,MAAM,CAAC;AACV,QAAM,CAAC,UAAU,IAAI,UAAU,eAC3B,MAAM,GACH,OAAO;AAAA,IACN,IAAW,YAAY;AAAA,IACvB,SAAgB,YAAY;AAAA,IAC5B,QAAe,YAAY;AAAA,IAC3B,UAAiB,YAAY;AAAA,EAC/B,CAAC,EACA,KAAY,WAAW,EACvB;AAAA,IACC;AAAA,MACE,GAAU,YAAY,aAAa,MAAM,WAAW;AAAA,MACpD,GAAU,YAAY,IAAI,UAAU,YAAY;AAAA,IAClD;AAAA,EACF,EACC,IAAI,OAAO,EACX,MAAM,CAAC,IACV,CAAC;AACL,QAAM,6BACJ,UAAU,kBAAkB,uBAC5B,YAAY,WAAW,YACvB,WAAW,YAAY,UAAU,qBACjC,WAAW,SAAS,mBAAmB;AACzC,QAAM,oBACJ,UAAU,kBAAkB,sBAC5B,UAAU,iBAAiB,SAC1B,UAAU,gBAAgB,aACxB,UAAU,gBAAgB,oBAAoB,UAAU,qBAAqB;AAClF,MACE,CAAC,UACD,OAAO,kBAAkB,UAAU,iBACnC,CAAC,OAAO,gBAAgB,SAAS,UAAU,OAAO,KACjD,CAAC,8BAA8B,CAAC,mBACjC;AACA,UAAM,IAAI,6BAA6B,wCAAwC;AAAA,EACjF;AACA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,IACH,QAAQ;AAAA,IACR,sBAAsB;AAAA,IACtB,qBAAqB;AAAA,IACrB,iBAAiB;AAAA,IACjB,WAAW;AAAA,EACb,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,SAAO,WAAW,SAAS,oCAAoC;AACjE;AAEA,eAAsB,kCACpB,IACA,OAOmC;AACnC,SAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,cAAc;AAC/D,QAAI,UAAU,WAAW,0BAA2B,QAAO;AAC3D,QAAI,CAAC,iBAAiB,UAAU,MAAM,KAAK,UAAU,uBAAuB;AAC1E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,qBAAqB,IAAI,WAAW,KAAK;AAC/C,UAAM,cAAc,MAAM,6BAA6B,IAAI,WAAW,GAAG;AACzE,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,QAAQ;AAAA,MACR;AAAA,MACA,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,qBACE,UAAU,yBAAyB,aAAa,YAAY;AAAA,MAC9D,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,qBAAqB,kBAAkB,MAAM,MAAM;AAAA,MACnD,WAAW;AAAA,IACb,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,gDAAgD;AAC9E,WAAO;AAAA,EACT,CAAC;AACH;AAOA,eAAsB,0DACpB,IACA,OAQmB;AACnB,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,MAAM,WAAW,CAAC;AAClD,MAAI,YAAY,WAAW,EAAG,QAAO,CAAC;AACtC,QAAM,aAAa,MAAM,GACtB,OAAO,EACP,KAAY,yBAAyB,EACrC;AAAA,IACC;AAAA,MACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,MAClE,GAAU,0BAA0B,WAAW,MAAM,SAAS;AAAA,MAC9D,GAAU,0BAA0B,QAAQ,MAAM,MAAM;AAAA,MACxD,QAAe,0BAA0B,YAAY,WAAW;AAAA,MAChE,GAAU,0BAA0B,sBAAsB,SAAS;AAAA,MACnE,QAAe,0BAA0B,QAAQ,CAAC,aAAa,UAAU,CAAC;AAAA,MAC1E,MAAa,0BAA0B,qBAAqB;AAAA,IAC9D;AAAA,EACF,EACC,QAAe,0BAA0B,EAAE,EAC3C,IAAI,QAAQ;AACf,QAAM,YAAsB,CAAC;AAC7B,aAAW,aAAa,YAAY;AAClC,UAAM,qBAAqB,IAAI,WAAW,KAAK;AAC/C,UAAM,cAAc,MAAM,6BAA6B,IAAI,WAAW,MAAM,GAAG;AAC/E,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,QAAQ;AAAA,MACR;AAAA,MACA,YAAY;AAAA,MACZ,YAAY,MAAM;AAAA,MAClB,qBAAqB;AAAA,MACrB,iBAAiB,MAAM;AAAA,MACvB,0BAA0B;AAAA,MAC1B,0BAA0B;AAAA,MAC1B,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,uBAAuB,MAAM;AAAA,MAC7B,qBAAqB,kBAAkB,MAAM,MAAM;AAAA,MACnD,qBAAqB;AAAA,MACrB,yBAAyB;AAAA,MACzB,WAAW,MAAM;AAAA,IACnB,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU,EAAE,IAAW,0BAA0B,GAAG,CAAC;AACxD,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,gDAAgD;AAC9E,UAAM,GACH,OAAc,yBAAyB,EACvC,IAAI,EAAE,cAAc,MAAM,IAAI,CAAC,EAC/B,MAAM,GAAU,0BAA0B,aAAa,UAAU,EAAE,CAAC;AACvE,cAAU,KAAK,QAAQ,EAAE;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,eAAsB,+BACpB,IACA,OACiF;AACjF,QAAM,OAAO,MAAM;AAAA,IAKjB;AAAA,IACA;AAAA,QACI,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK,MAAM,KAAK;AAAA;AAAA,EAExD;AACA,SAAO,KAAK,IAAI,CAAC,SAAS;AAAA,IACxB,aAAa,IAAI;AAAA,IACjB,WAAW,IAAI;AAAA,IACf,aAAa,IAAI;AAAA,EACnB,EAAE;AACJ;AAEA,eAAsB,4BACpB,IACA,aACA,aACwD;AACxD,SAAO,MAAM,iBAAiB,IAAI,aAAa,OAAO,aAAa;AACjE,UAAM,CAAC,SAAS,IAAI,MAAM,SACvB,OAAO,EACP,KAAY,yBAAyB,EACrC;AAAA,MACC;AAAA,QACE,GAAU,0BAA0B,aAAa,WAAW;AAAA,QAC5D,GAAU,0BAA0B,IAAI,WAAW;AAAA,MACrD;AAAA,IACF,EACC,MAAM,CAAC;AACV,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,aAAa,MAAM,SACtB,OAAO,EACP,KAAY,yBAAyB,EACrC,MAAM,GAAU,0BAA0B,aAAa,WAAW,CAAC,EACnE,QAAe,0BAA0B,OAAO;AACnD,WAAO,EAAE,GAAG,WAAW,WAAW;AAAA,EACpC,CAAC;AACH;AAEA,eAAsB,uCACpB,IACA,OACmC;AACnC,SAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,cAAc;AAC/D,QAAI,UAAU,WAAW,0BAA0B,CAAC,UAAU,0BAA0B;AACtF,YAAM,kBAAkB,WAAW,sBAAsB;AAAA,IAC3D;AACA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,QAAQ;AAAA,MACR,uBAAuB,UAAU,yBAAyB;AAAA,MAC1D,iBAAiB,MAAM;AAAA,MACvB,WAAW,kBAAkB,MAAM,KAAK;AAAA,MACxC,qBAAqB;AAAA,MACrB,yBAAyB;AAAA,MACzB,WAAW;AAAA,IACb,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,WAAO,WAAW,SAAS,mCAAmC;AAAA,EAChE,CAAC;AACH;AAOA,eAAsB,oCACpB,IACA,OAKmC;AACnC,SAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,cAAc;AAC/D,QAAI,UAAU,WAAW,wBAAwB;AAC/C,UAAI,CAAC,UAAU,4BAA4B,CAAC,UAAU,0BAA0B;AAC9E,cAAM,IAAI,6BAA6B,sCAAsC;AAAA,MAC/E;AACA,aAAO;AAAA,IACT;AACA,QAAI,UAAU,WAAW,YAAY;AACnC,YAAM,kBAAkB,WAAW,sBAAsB;AAAA,IAC3D;AACA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,QAAQ;AAAA,MACR,0BAA0B,MAAM;AAAA,MAChC,0BAA0B,MAAM;AAAA,MAChC,iBAAiB,MAAM;AAAA,MACvB,WAAW;AAAA,MACX,qBAAqB;AAAA,MACrB,yBAAyB;AAAA,MACzB,WAAW;AAAA,IACb,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,UAAM,GACH,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,gBAAgB,MAAM;AAAA,MACtB,cAAc,IAAI;AAAA,QAChB,KAAK;AAAA,UACH,UAAU,mBAAmB,QAAQ;AAAA,UACrC,MAAM,yBAAyB,QAAQ;AAAA,QACzC;AAAA,MACF;AAAA,IACF,CAAC,EACA,MAAM,GAAU,0BAA0B,aAAa,UAAU,EAAE,CAAC;AACvE,WAAO,WAAW,SAAS,yCAAyC;AAAA,EACtE,CAAC;AACH;AAEA,eAAsB,mCACpB,IACA,OACmC;AACnC,SAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,cAAc;AAC/D,QACE,UAAU,kBAAkB,MAAM,iBAClC,UAAU,WAAW,oBACrB;AACA,aAAO;AAAA,IACT;AACA,QAAI,CAAC,aAAa,UAAU,QAAQ,CAAC,YAAY,sBAAsB,CAAC,GAAG;AACzE,YAAM,kBAAkB,WAAW,kBAAkB;AAAA,IACvD;AACA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,QAAQ;AAAA,MACR,eAAe,MAAM,cAAc,MAAM,GAAG,IAAK;AAAA,MACjD,0BAA0B;AAAA,MAC1B,0BAA0B;AAAA,MAC1B,uBAAuB,UAAU,yBAAyB;AAAA,MAC1D,mBAAmB,UAAU,qBAAqB;AAAA,MAClD,iBAAiB,MAAM;AAAA,MACvB,WAAW;AAAA,MACX,qBAAqB;AAAA,MACrB,yBAAyB;AAAA,MACzB,WAAW;AAAA,IACb,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,WAAO,WAAW,SAAS,2BAA2B;AAAA,EACxD,CAAC;AACH;AAEA,eAAsB,mCACpB,IACA,OACkB;AAClB,SAAO,MAAM;AAAA,IACX;AAAA,IACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,IAC7D,OAAO,aAAa;AAClB,YAAM,CAAC,OAAO,IAAI,MAAM,SACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,QACH,iBAAiB,MAAM;AAAA,QACvB,GAAI,MAAM,QAAQ,EAAE,WAAW,kBAAkB,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,QACnE,qBAAqB;AAAA,QACrB,yBAAyB;AAAA,QACzB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC,EACA;AAAA,QACC;AAAA,UACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,IAAI,MAAM,WAAW;AAAA,UACzD,GAAU,0BAA0B,eAAe,MAAM,aAAa;AAAA,UACtE,GAAI,MAAM,QACN,CAAC,GAAU,0BAA0B,qBAAqB,MAAM,KAAK,CAAC,IACtE,CAAC;AAAA,QACP;AAAA,MACF,EACC,UAAU,EAAE,IAAW,0BAA0B,GAAG,CAAC;AACxD,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AACF;AAEA,eAAsB,6BACpB,IACA,OACmC;AACnC,SAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,cAAc;AAC/D,QAAI,UAAU,WAAW,YAAa,QAAO;AAC7C,QAAI,UAAU,WAAW,mBAAoB,OAAM,kBAAkB,WAAW,WAAW;AAC3F,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,QAAQ;AAAA,MACR,iBAAiB,oBAAI,KAAK;AAAA,MAC1B,qBAAqB;AAAA,MACrB,yBAAyB;AAAA,MACzB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,WAAO,WAAW,SAAS,uBAAuB;AAAA,EACpD,CAAC;AACH;AAEA,eAAsB,6BACpB,IACA,OAKmC;AACnC,SAAO,MAAM,gBAAgB,IAAI,OAAO,OAAO,IAAI,cAAc;AAC/D,QAAI,UAAU,WAAW,MAAM,OAAQ,QAAO;AAC9C,UAAM,UACJ,MAAM,WAAW,oBACb,CAAC,YAAY,wBAAwB,kBAAkB,IACvD,MAAM,WAAW,qBACf,CAAC,WAAW,IACZ,CAAC,wBAAwB,kBAAkB;AACnD,QAAI,CAAC,aAAa,UAAU,QAAQ,OAAO,EAAG,OAAM,kBAAkB,WAAW,MAAM,MAAM;AAC7F,UAAM,qBAAqB,IAAI,WAAW,KAAK;AAC/C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,MAAM,6BAA6B,IAAI,WAAW,GAAG;AACzE,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,MACH,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,iBAAiB;AAAA,MACjB,qBACE,UAAU,yBAAyB,aAAa,YAAY;AAAA,MAC9D,0BAA0B;AAAA,MAC1B,0BAA0B;AAAA,MAC1B,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,qBAAqB,kBAAkB,MAAM,YAAY;AAAA,MACzD,WAAW,MAAM,eAAe,kBAAkB,MAAM,YAAY,IAAI;AAAA,MACxE,qBAAqB;AAAA,MACrB,yBAAyB;AAAA,MACzB,uBAAuB;AAAA,MACvB,WAAW;AAAA,IACb,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,WAAO,WAAW,SAAS,gCAAgC;AAAA,EAC7D,CAAC;AACH;AAWA,eAAsB,2BACpB,IACA,OACoF;AACpF,SAAO,MAAM;AAAA,IACX;AAAA,IACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,IAC7D,OAAO,aACL,MAAM,SAAS,YAAY,OAAO,OAAO;AACvC,YAAM,CAAC,SAAS,IAAI,MAAM,GACvB,OAAO,EACP,KAAY,yBAAyB,EACrC;AAAA,QACC;AAAA,UACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,IAAI,MAAM,WAAW;AAAA,UACzD,GAAU,0BAA0B,eAAe,MAAM,aAAa;AAAA,QACxE;AAAA,MACF,EACC,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,UAAI,CAAC,UAAW,OAAM,IAAI,6BAA6B,2BAA2B;AAClF,YAAM,CAAC,gBAAgB,IAAI,MAAM,GAC9B,OAAO,EACP,KAAY,uBAAuB,EACnC,MAAM,GAAU,wBAAwB,aAAa,UAAU,EAAE,CAAC,EAClE,MAAM,CAAC;AACV,UAAI,UAAU,WAAW,eAAe,kBAAkB;AACxD,eAAO,EAAE,WAAW,UAAU,iBAAiB;AAAA,MACjD;AACA,UAAI,UAAU,WAAW,YAAa,OAAM,kBAAkB,WAAW,WAAW;AACpF,UAAI,UAAU,mBAAmB,MAAM,QAAQ;AAC7C,cAAM,IAAI,6BAA6B,+CAA+C;AAAA,MACxF;AACA,UAAI,UAAU,uBAAuB,UAAU,gBAAgB;AAC7D,cAAM,IAAI,MAAM,qDAAqD;AAAA,MACvE;AACA,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,GAAG,OAAc,KAAK,EAAE,OAAO;AAAA,QACnC,IAAI,MAAM;AAAA,QACV,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,QAAQ;AAAA,QACR,UAAU,mBAAmB,UAAU,kBAAkB;AAAA,QACzD,cAAc,mBAAmB,UAAU,kBAAkB;AAAA,QAC7D,aAAa;AAAA,QACb,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM;AAAA,QACd,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,WAAW;AAAA,MACb,CAAC;AACD,YAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAc,uBAAuB,EACrC,OAAO;AAAA,QACN,IAAI,UAAU;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,eAAe,MAAM;AAAA,QACrB,aAAa,UAAU;AAAA,QACvB,WAAW,UAAU;AAAA,QACrB,QAAQ,UAAU;AAAA,QAClB,WAAW,UAAU;AAAA,QACrB,SAAS,UAAU;AAAA,QACnB,YAAY,UAAU;AAAA,QACtB,cAAc,UAAU;AAAA,QACxB,aAAa;AAAA,QACb,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM;AAAA,QACd,gBAAgB,KAAK,MAAM,MAAM,MAAM,kBAAkB,GAAK;AAAA,QAC9D,OAAO,MAAM,MAAM;AAAA,QACnB,QAAQ,MAAM,MAAM;AAAA,QACpB,UAAU,KAAK,MAAM,MAAM,MAAM,MAAM,GAAK;AAAA,QAC5C,YAAY,MAAM,MAAM;AAAA,QACxB,YAAY,MAAM,MAAM;AAAA,QACxB,UAAU,MAAM,MAAM;AAAA,QACtB,iBAAiB,mBAAmB,UAAU,kBAAkB;AAAA,QAChE,SAAS;AAAA,MACX,CAAC,EACA,UAAU;AACb,UAAI,CAAC,SAAU,OAAM,IAAI,MAAM,4CAA4C;AAC3E,YAAM,GACH,OAAc,8BAA8B,EAC5C,IAAI;AAAA,QACH,eAAe,MAAa,+BAA+B,aAAa,MAAM,UAAU,aAAa;AAAA,QACrG,YAAY,MAAa,+BAA+B,UAAU,MAAM,MAAM,SAAS;AAAA,QACvF,WAAW;AAAA,MACb,CAAC,EACA,MAAM,GAAU,+BAA+B,aAAa,MAAM,WAAW,CAAC;AACjF,YAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,QACH,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,iBAAiB;AAAA,QACjB,qBACE,UAAU,yBAAyB,aAAa,YAAY;AAAA,QAC9D,0BAA0B;AAAA,QAC1B,0BAA0B;AAAA,QAC1B,qBAAqB;AAAA,QACrB,kBAAkB;AAAA,QAClB,uBAAuB;AAAA,QACvB,qBAAqB;AAAA,QACrB,yBAAyB;AAAA,QACzB,WAAW;AAAA,MACb,CAAC,EACA,MAAM,GAAU,0BAA0B,IAAI,UAAU,EAAE,CAAC,EAC3D,UAAU;AACb,aAAO;AAAA,QACL,WAAW,WAAW,SAAS,+BAA+B;AAAA,QAC9D;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACL;AACF;AAEA,eAAsB,0BACpB,IACA,aACA,YAC8F;AAC9F,SAAO,MAAM,iBAAiB,IAAI,aAAa,OAAO,aAAa;AACjE,UAAM,CAAC,GAAG,IAAI,MAAM,SACjB,OAAO,EAAE,UAAiB,yBAAyB,MAAa,MAAM,CAAC,EACvE,KAAY,uBAAuB,EACnC,UAAiB,OAAO,GAAU,MAAM,IAAW,wBAAwB,aAAa,CAAC,EACzF;AAAA,MACC;AAAA,QACE,GAAU,wBAAwB,aAAa,WAAW;AAAA,QAC1D,GAAU,wBAAwB,IAAI,UAAU;AAAA,MAClD;AAAA,IACF,EACC,MAAM,CAAC;AACV,WAAO,OAAO;AAAA,EAChB,CAAC;AACH;AAEA,eAAsB,mCACpB,IACA,aACA,WAC8F;AAC9F,SAAO,MAAM;AAAA,IACX;AAAA,IACA;AAAA,IACA,OAAO,aACL,MAAM,SACH,OAAO,EAAE,UAAiB,yBAAyB,MAAa,MAAM,CAAC,EACvE,KAAY,uBAAuB,EACnC,UAAiB,OAAO,GAAU,MAAM,IAAW,wBAAwB,aAAa,CAAC,EACzF;AAAA,MACC;AAAA,QACE,GAAU,wBAAwB,aAAa,WAAW;AAAA,QAC1D,GAAU,wBAAwB,WAAW,SAAS;AAAA,QACtD,MAAa,wBAAwB,SAAS;AAAA,MAChD;AAAA,IACF,EACC,QAAe,wBAAwB,WAAkB,wBAAwB,EAAE;AAAA,EAC1F;AACF;AAOA,eAAsB,oCACpB,IACA,OAOkB;AAClB,SAAO,MAAM;AAAA,IACX;AAAA,IACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,IAC7D,OAAO,aAAa;AAClB,YAAM,CAAC,OAAO,IAAI,MAAM,SACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,QACH,kBAAkB;AAAA,QAClB,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC,EACA;AAAA,QACC;AAAA,UACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,SAAS,MAAM,OAAO;AAAA,UAC1D,GAAU,0BAA0B,kBAAkB,MAAM,gBAAgB;AAAA,QAC9E;AAAA,MACF,EACC,UAAU,EAAE,aAAoB,0BAA0B,YAAY,CAAC;AAC1E,UAAI,QAAS,QAAO;AACpB,YAAM,CAAC,QAAQ,IAAI,MAAM,SACtB,OAAO,EAAE,WAAkB,0BAA0B,UAAU,CAAC,EAChE,KAAY,yBAAyB,EACrC;AAAA,QACC;AAAA,UACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,SAAS,MAAM,OAAO;AAAA,QAC5D;AAAA,MACF,EACC,MAAM,CAAC;AACV,aAAO,UAAU,cAAc,QAAQ,UAAU,cAAc;AAAA,IACjE;AAAA,EACF;AACF;AAEA,eAAsB,kCACpB,IACA,OAOkB;AAClB,SAAO,MAAM;AAAA,IACX;AAAA,IACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,IAC7D,OAAO,aAAa;AAClB,aAAO,MAAM,+CAA+C,UAAU,KAAK;AAAA,IAC7E;AAAA,EACF;AACF;AAEA,eAAsB,+CACpB,IACA,OAMkB;AAClB,QAAM,UACJ,MAAM,UAAU,WACZ,CAAC,WAAW,QAAQ,IACpB,MAAM,UAAU,cACd,CAAC,QAAQ,IACT,CAAC,WAAW,QAAQ;AAC5B,QAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAc,yBAAyB,EACvC,IAAI;AAAA,IACH,qBAAqB,MAAM;AAAA,IAC3B,kBAAkB,MAAM,UAAU,eAAe,OAAQ,MAAM,YAAY;AAAA,IAC3E,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA;AAAA,IACC;AAAA,MACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,MAClE,GAAU,0BAA0B,IAAI,MAAM,WAAW;AAAA,MACzD,QAAe,0BAA0B,qBAAqB,OAAO;AAAA,MACrE,GAAI,MAAM,UAAU,eAAe,MAAM,WACrC,CAAC,GAAU,0BAA0B,kBAAkB,MAAM,QAAQ,CAAC,IACtE,CAAC;AAAA,IACP;AAAA,EACF,EACC,UAAU,EAAE,IAAW,0BAA0B,GAAG,CAAC;AACxD,SAAO,YAAY;AACrB;AAEO,SAAS,kCAAkC,OAGxB;AACxB,MAAI,MAAM,UAAU,WAAW,eAAe,MAAM,cAAc;AAChE,WAAO;AAAA,MACL,MAAM;AAAA,MACN,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,aAAa,MAAM,UAAU;AAAA,MAC7B,SAAS,MAAM;AAAA,IACjB;AAAA,EACF;AACA,QAAM,gBAAgB,MAAM,UAAU;AACtC,MACE,CAAC,aAAa,eAAe;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,GACD;AACA,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,eAAe;AAAA,IACf,QAAQ;AAAA,IACR,aAAa,MAAM,UAAU;AAAA,IAC7B,qBACE,MAAM,UAAU,uBAAuB;AAAA,EAC3C;AACF;AAGA,eAAsB,wCACpB,IACA,WACgC;AAChC,MAAI,UAAU,WAAW,aAAa;AACpC,WAAO,kCAAkC,EAAE,UAAU,CAAC;AAAA,EACxD;AACA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AACA,MAAI,CAAC,YAAY,SAAS,SAAS,WAAW;AAC5C,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,QAAM,WAAW,wCAAwC;AAAA,IACvD,IAAI,SAAS,SAAS;AAAA,IACtB,aAAa,SAAS,SAAS;AAAA,IAC/B,QAAQ,SAAS,KAAK;AAAA,IACtB,aAAa,SAAS,KAAK;AAAA,IAC3B,WAAW,SAAS,KAAK;AAAA,IACzB,QAAQ,SAAS,KAAK;AAAA,IACtB,WAAW,SAAS,SAAS,QAAQ,YAAY;AAAA,IACjD,OAAO,SAAS,SAAS;AAAA,IACzB,QAAQ,SAAS,SAAS;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,kDAAkD;AACjF,QAAM,UAAU,sBAAsB,MAAM;AAAA,IAC1C,MAAM;AAAA,IACN,eAAe;AAAA,IACf,aAAa,UAAU;AAAA,IACvB;AAAA,IACA,OAAO;AAAA,MACL,iBAAiB,SAAS,SAAS,iBAAiB;AAAA,MACpD,OAAO,SAAS,SAAS;AAAA,MACzB,QAAQ,SAAS,SAAS;AAAA,MAC1B,KAAK,SAAS,SAAS,WAAW;AAAA,MAClC,UAAU,SAAS,SAAS;AAAA,MAC5B,YAAY,SAAS,SAAS;AAAA,MAC9B,YAAY,SAAS,SAAS;AAAA,IAChC;AAAA,IACA,aAAa,+BAA+B,SAAS,SAAS,eAAe;AAAA,EAC/E,CAAC;AACD,SAAO,kCAAkC,EAAE,WAAW,cAAc,QAAQ,CAAC;AAC/E;AAEA,eAAsB,mCACpB,IACA,aACA,aAC+E;AAC/E,QAAM,YAAY,MAAM,4BAA4B,IAAI,aAAa,WAAW;AAChF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,WAAW,aAAa,UAAU,QAAQ;AAAA,IAC9C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,IACG,MAAM,wCAAwC,IAAI,SAAS,IAC3D;AACJ,SAAO,gCAAgC,MAAM;AAAA,IAC3C,eAAe;AAAA,IACf,aAAa,UAAU;AAAA,IACvB,SAAS,UAAU;AAAA,IACnB,QAAQ,UAAU,WAAW,yBAAyB,aAAa,UAAU;AAAA,IAC7E,WAAW,UAAU,UAAU,YAAY;AAAA,IAC3C,WAAW,UAAU,UAAU,YAAY;AAAA,IAC3C;AAAA,EACF,CAAC;AACH;AASA,eAAe,gBACb,IACA,OACA,QACY;AACZ,SAAO,MAAM;AAAA,IACX;AAAA,IACA,EAAE,WAAW,MAAM,WAAW,aAAa,MAAM,YAAY;AAAA,IAC7D,OAAO,aACL,MAAM,SAAS,YAAY,OAAO,UAAU;AAC1C,YAAM,KAAK;AACX,YAAM,CAAC,SAAS,IAAI,MAAM,GACvB,OAAO,EACP,KAAY,yBAAyB,EACrC;AAAA,QACC;AAAA,UACE,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,UAClE,GAAU,0BAA0B,IAAI,MAAM,WAAW;AAAA,UACzD,GAAU,0BAA0B,eAAe,MAAM,aAAa;AAAA,QACxE;AAAA,MACF,EACC,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,UAAI,CAAC,UAAW,OAAM,IAAI,6BAA6B,2BAA2B;AAClF,aAAO,MAAM,OAAO,IAAI,SAAS;AAAA,IACnC,CAAC;AAAA,EACL;AACF;AAEA,eAAe,qBACb,IACA,WACA,OACe;AACf,MAAI,UAAU,eAAe,WAAY;AACzC,QAAM,GACH,OAAc,8BAA8B,EAC5C,IAAI;AAAA,IACH,eAAe,MAAa,+BAA+B,aAAa,MAAM,UAAU,aAAa;AAAA,IACrG,GAAI,QACA;AAAA,MACE,YAAY,MAAa,+BAA+B,UAAU,MAAM,UAAU,aAAa;AAAA,IACjG,IACA,CAAC;AAAA,IACL,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAM,GAAU,+BAA+B,aAAa,UAAU,WAAW,CAAC;AACvF;AAEA,eAAe,4BACb,IACA,WACe;AACf,MAAI,UAAU,oBAAoB,KAAK,UAAU,kBAAkB,oBAAoB;AACrF,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,QAAM,GAAG,QAAQ,4CAA4C,UAAU,SAAS,IAAI;AACpF,QAAM,CAAC,UAAU,IAAI,MAAM,GACxB,OAAO;AAAA,IACN,eAAe,mBAAkC,oBAAoB,YAAY;AAAA,EACnF,CAAC,EACA,KAAY,mBAAmB,EAC/B,MAAM,GAAU,oBAAoB,WAAW,UAAU,SAAS,CAAC;AACtE,QAAM,gBAAgB,OAAO,YAAY,iBAAiB,CAAC;AAC3D,MAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,UAAU,kBAAkB;AACtF,UAAM,IAAI,2BAA2B;AAAA,EACvC;AACA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,WAAW,MAAM,GACpB,OAAc,mBAAmB,EACjC,OAAO;AAAA,IACN,WAAW,UAAU;AAAA,IACrB,aAAa,UAAU;AAAA,IACvB,MAAM;AAAA,IACN,cAAc,CAAC,UAAU;AAAA,IACzB,YAAY;AAAA,IACZ,UAAU,UAAU;AAAA,IACpB,gBAAgB,iCAAiC,UAAU,EAAE;AAAA,IAC7D,UAAU;AAAA,MACR,SAAS,UAAU;AAAA,MACnB,YAAY,UAAU;AAAA,MACtB,kBAAkB,UAAU;AAAA,IAC9B;AAAA,IACA,YAAY;AAAA,EACd,CAAC,EACA,oBAAoB,EAAE,QAAe,oBAAoB,eAAe,CAAC,EACzE,UAAU,EAAE,IAAW,oBAAoB,GAAG,CAAC;AAClD,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,6BAA6B,8CAA8C;AAAA,EACvF;AACA,QAAM,GACH,OAAc,WAAW,EACzB,OAAO;AAAA,IACN,WAAW,UAAU;AAAA,IACrB,aAAa,UAAU;AAAA,IACvB,WAAW;AAAA,IACX,UAAU,UAAU;AAAA,IACpB,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,UAAU;AAAA,IAC5B,WAAW,UAAU;AAAA,IACrB,QAAQ,UAAU;AAAA,IAClB,eAAe,UAAU;AAAA,IACzB,gBAAgB,+BAA+B,UAAU,EAAE;AAAA,IAC3D,YAAY;AAAA,EACd,CAAC,EACA,oBAAoB,EAAE,QAAe,YAAY,eAAe,CAAC;AACtE;AAEA,eAAe,6BACb,IACA,WACA,KACkD;AAClD,MAAI,UAAU,gBAAgB,UAAW,QAAO,UAAU;AAC1D,MAAI,UAAU,kBAAkB,sBAAsB,UAAU,oBAAoB,GAAG;AACrF,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,GAAG,QAAQ,4CAA4C,UAAU,SAAS,IAAI;AACpF,QAAM,WAAW,MAAM,GACpB,OAAc,mBAAmB,EACjC,OAAO;AAAA,IACN,WAAW,UAAU;AAAA,IACrB,aAAa,UAAU;AAAA,IACvB,MAAM;AAAA,IACN,cAAc,UAAU;AAAA,IACxB,YAAY;AAAA,IACZ,UAAU,UAAU;AAAA,IACpB,gBAAgB,kCAAkC,UAAU,EAAE;AAAA,IAC9D,UAAU;AAAA,MACR,SAAS,UAAU;AAAA,MACnB,YAAY,UAAU;AAAA,MACtB,kBAAkB,UAAU;AAAA,IAC9B;AAAA,IACA,YAAY;AAAA,EACd,CAAC,EACA,oBAAoB,EAAE,QAAe,oBAAoB,eAAe,CAAC,EACzE,UAAU,EAAE,IAAW,oBAAoB,GAAG,CAAC;AAClD,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,6BAA6B,+CAA+C;AAAA,EACxF;AACA,QAAM,GACH,OAAc,WAAW,EACzB,OAAO;AAAA,IACN,WAAW,UAAU;AAAA,IACrB,aAAa,UAAU;AAAA,IACvB,WAAW;AAAA,IACX,UAAU,UAAU;AAAA,IACpB,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,kBAAkB,UAAU;AAAA,IAC5B,WAAW,UAAU;AAAA,IACrB,QAAQ,UAAU;AAAA,IAClB,eAAe,UAAU;AAAA,IACzB,gBAAgB,iCAAiC,UAAU,EAAE;AAAA,IAC7D,YAAY;AAAA,EACd,CAAC,EACA,oBAAoB,EAAE,QAAe,YAAY,eAAe,CAAC;AACpE,SAAO;AACT;AAEA,SAAS,cACP,KAC4B;AAC5B,SAAO,sBAAsB;AAAA,IAC3B,MACI;AAAA,MACE,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,eAAe,IAAI;AAAA,MACnB,iBAAiB,IAAI;AAAA,MACrB,gBAAgB,IAAI;AAAA,IACtB,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU;AAAA,MACV,eAAe;AAAA,MACf,iBAAiB,CAAC;AAAA,MAClB,gBAAgB;AAAA,IAClB;AAAA,EACN;AACF;AAEA,SAAS,sBAAsB,UAAmC;AAChE,aAAW,WAAW,UAAU;AAC9B,QAAI,YAAY,uBAAuB;AACrC,YAAM,IAAI,MAAM,mCAAmC,OAAO,EAAE;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,SAAS,uBACP,WACA,OACM;AACN,MACE,UAAU,kBAAkB,MAAM,iBAClC,UAAU,eAAe,MAAM,cAC/B,UAAU,cAAc,MAAM,aAC9B,UAAU,WAAW,MAAM,UAC3B,UAAU,kBAAkB,MAAM,iBAClC,UAAU,qBAAqB,MAAM,kBACrC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,QAAyB;AACjD,SAAO,aAAa,QAAQ,CAAC,aAAa,YAAY,UAAU,CAAC;AACnE;AAEA,SAAS,aAA+B,OAAe,YAAsC;AAC3F,SAAQ,WAAiC,SAAS,KAAK;AACzD;AAEA,SAAS,kBAAkB,WAAqC,QAAuB;AACrF,SAAO,IAAI;AAAA,IACT,uCAAuC,UAAU,MAAM,OAAO,MAAM;AAAA,EACtE;AACF;AAEA,SAAS,WAAc,OAAsB,QAAmB;AAC9D,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,aAAa,MAAM,EAAE;AACjD,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;AAChD,QAAM,aAAa,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK;AACpD,UAAQ,cAAc,sCAAsC,MAAM,GAAG,GAAK;AAC5E;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,QAAQ,SAAS,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAK;AAC1D;","names":[]}

package/dist/chunk-YHZXQ7HP.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/provision-roles.ts","../src/runtime-posture.ts","../src/role-relationships.ts"],"sourcesContent":["import postgres from \"postgres\";\nimport type { RlsStrategy } from \"./database\";\nimport {\n  RUNTIME_FULL_DML_TABLES,\n  RUNTIME_READ_INSERT_TABLES,\n  RUNTIME_READ_INSERT_UPDATE_TABLES,\n  RUNTIME_READ_ONLY_TABLES,\n  RUNTIME_READ_UPDATE_TABLES,\n} from \"./runtime-posture\";\nimport {\n  classifyRoleRelationships,\n  roleRelationshipsCatalogQuery,\n  type RoleRelationshipCatalogRow,\n} from \"./role-relationships\";\n\nexport type ProvisionResult = {\n  appRole: string | null;\n  artifactOutboxDispatcherRole: string | null;\n  artifactMaterializerRole: string | null;\n  hostExportRole: string | null;\n  temporalRole: string | null;\n  temporalDatabases: string[];\n  schema: string;\n  rlsStrategy: RlsStrategy;\n};\n\nexport type ProvisionRolesOptions = {\n  /**\n   * The schema OpenGeni's tables live in. The app-role GRANTs target this\n   * schema + `opengeni_private`. Defaults to `public` (standalone).\n   */\n  targetSchema?: string;\n  /**\n   * RLS posture (Step I). `\"force\"` (default) provisions the non-owner\n   * `opengeni_app` login role and GRANTs it table DML in the target schema —\n   * the role OpenGeni connects as under FORCE-RLS. `\"scoped\"` SKIPS the app-role\n   * provisioning entirely: the embedded host runs OpenGeni's queries over a role\n   * IT owns/manages (typically the schema owner), so OpenGeni neither creates\n   * nor grants the `opengeni_app` role. Temporal-role provisioning is unaffected\n   * by strategy.\n   */\n  rlsStrategy?: RlsStrategy;\n  appRole?: string;\n  appPassword?: string;\n  /** Global, EXECUTE-only artifact live-hint dispatcher capability. */\n  artifactOutboxDispatcherRole?: string;\n  artifactOutboxDispatcherPassword?: string;\n  /** Global, EXECUTE-only artifact materialization worker capability. */\n  artifactMaterializerRole?: string;\n  artifactMaterializerPassword?: string;\n  /**\n   * Optional cross-workspace projection role. It receives schema USAGE and\n   * EXECUTE only on the host-export API; it receives no table privileges.\n   * Provision it after the first migration run so the schema exists. The\n   * provisioner also registers same-owner default privileges for future\n   * host-export functions; shipped migrations preserve existing exporter ACLs\n   * when a migration-only upgrade adds a function.\n   */\n  hostExportRole?: string;\n  hostExportPassword?: string;\n  temporalRole?: string;\n  temporalPassword?: string;\n  temporalDatabases?: string[];\n};\n\n/**\n * SDK entry point (Step I): provision the OpenGeni database roles + grants over\n * a host-supplied admin connection. This is the named, parameterized form of the\n * historical env-driven `provision-roles` script (which still works as a CLI via\n * the `import.meta.main` block at the bottom — it just reads env into these\n * options).\n *\n * STANDALONE (default): `provisionRoles(adminConnection)` with no options →\n * `targetSchema: \"public\"`, `rlsStrategy: \"force\"`, reads `opengeni_app` creds\n * from env. Byte-for-byte the historical script behavior.\n *\n * EMBEDDED: `provisionRoles(adminConnection, { targetSchema, rlsStrategy })` lets\n * a host provision the app role over a dedicated schema (force) OR skip the\n * app role entirely and own the connection role itself (scoped).\n */\nexport async function provisionRoles(\n  adminConnection: string,\n  options: ProvisionRolesOptions = {},\n): Promise<ProvisionResult> {\n  const schema = validateIdentifier(\"targetSchema\", options.targetSchema ?? \"public\");\n  const rlsStrategy: RlsStrategy = options.rlsStrategy ?? \"force\";\n\n  const appRole = validateIdentifier(\n    \"appRole\",\n    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || \"opengeni_app\"),\n  );\n  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;\n  const artifactOutboxDispatcherRole = validateIdentifier(\n    \"artifactOutboxDispatcherRole\",\n    options.artifactOutboxDispatcherRole ??\n      (process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_USER?.trim() ||\n        \"opengeni_artifact_outbox_dispatcher\"),\n  );\n  const artifactOutboxDispatcherPassword =\n    options.artifactOutboxDispatcherPassword ??\n    process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_PASSWORD;\n  const artifactMaterializerRole = validateIdentifier(\n    \"artifactMaterializerRole\",\n    options.artifactMaterializerRole ??\n      (process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_USER?.trim() ||\n        \"opengeni_artifact_materializer\"),\n  );\n  const artifactMaterializerPassword =\n    options.artifactMaterializerPassword ??\n    process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_PASSWORD;\n  const hostExportRole = validateIdentifier(\n    \"hostExportRole\",\n    options.hostExportRole ??\n      (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || \"opengeni_host_exporter\"),\n  );\n  const hostExportPassword =\n    options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;\n  const temporalRole = validateIdentifier(\n    \"temporalRole\",\n    options.temporalRole ??\n      (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || \"opengeni_temporal\"),\n  );\n  const temporalPassword =\n    options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;\n  const temporalDatabases = (\n    options.temporalDatabases ??\n    commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? \"temporal,temporal_visibility\")\n  ).map((name) => validateIdentifier(\"temporalDatabases\", name));\n\n  const sql = postgres(adminConnection, { max: 1 });\n  try {\n    // FORCE strategy provisions the non-owner app role OpenGeni connects as.\n    // SCOPED strategy: the host owns the connection role; OpenGeni provisions no\n    // app role (skipped here), only the optional Temporal role.\n    let provisionedAppRole: string | null = null;\n    if (rlsStrategy === \"force\") {\n      if (!appPassword) {\n        throw new Error(\n          \"OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'\",\n        );\n      }\n      // Ownership and privilege-bearing role-graph edges cannot be safely\n      // guessed away. Refuse to mutate an existing role until an operator has\n      // explicitly transferred objects/removed those memberships; role\n      // attributes and direct grants, however, are deterministic and are\n      // converged below on every run. PostgreSQL 16+'s exact non-runtime-bearing\n      // creator-management edge is classified separately.\n      await assertAppRoleSafeToNormalize(sql, appRole);\n      await ensureRestrictedAppLoginRole(sql, appRole, appPassword);\n      provisionedAppRole = appRole;\n    }\n\n    let provisionedArtifactOutboxDispatcherRole: string | null = null;\n    if (artifactOutboxDispatcherPassword) {\n      await assertAppRoleSafeToNormalize(sql, artifactOutboxDispatcherRole);\n      await ensureRestrictedAppLoginRole(\n        sql,\n        artifactOutboxDispatcherRole,\n        artifactOutboxDispatcherPassword,\n      );\n      await grantArtifactCapabilityRoleIfSchemaExists(\n        sql,\n        artifactOutboxDispatcherRole,\n        schema,\n        \"outbox\",\n      );\n      provisionedArtifactOutboxDispatcherRole = artifactOutboxDispatcherRole;\n    }\n\n    let provisionedArtifactMaterializerRole: string | null = null;\n    if (artifactMaterializerPassword) {\n      await assertAppRoleSafeToNormalize(sql, artifactMaterializerRole);\n      await ensureRestrictedAppLoginRole(\n        sql,\n        artifactMaterializerRole,\n        artifactMaterializerPassword,\n      );\n      await grantArtifactCapabilityRoleIfSchemaExists(\n        sql,\n        artifactMaterializerRole,\n        schema,\n        \"materializer\",\n      );\n      provisionedArtifactMaterializerRole = artifactMaterializerRole;\n    }\n\n    if (temporalPassword) {\n      await ensureLoginRole(sql, temporalRole, temporalPassword);\n      for (const database of temporalDatabases) {\n        await ensureDatabase(sql, database, temporalRole);\n        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);\n      }\n    }\n\n    if (hostExportPassword) {\n      await ensureLoginRole(sql, hostExportRole, hostExportPassword);\n      await grantHostExportRoleIfSchemaExists(sql, hostExportRole);\n    }\n\n    if (rlsStrategy === \"force\") {\n      await grantAppRoleIfSchemaExists(sql, appRole, schema);\n    }\n\n    return {\n      appRole: provisionedAppRole,\n      artifactOutboxDispatcherRole: provisionedArtifactOutboxDispatcherRole,\n      artifactMaterializerRole: provisionedArtifactMaterializerRole,\n      hostExportRole: hostExportPassword ? hostExportRole : null,\n      temporalRole: temporalPassword ? temporalRole : null,\n      temporalDatabases: temporalPassword ? temporalDatabases : [],\n      schema,\n      rlsStrategy,\n    };\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * The exporter is intentionally separate from `opengeni_app`: its functions\n * project every workspace into a host-owned sink and therefore cannot be made\n * available to the tenant-scoped application role.\n */\nasync function grantHostExportRoleIfSchemaExists(sql: postgres.Sql, role: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function grantArtifactCapabilityRoleIfSchemaExists(\n  sql: postgres.Sql,\n  role: string,\n  dataSchema: string,\n  capability: \"outbox\" | \"materializer\",\n): Promise<void> {\n  const routines =\n    capability === \"outbox\"\n      ? [\n          \"claim_editable_artifact_live_outbox(text,integer,integer,name)\",\n          \"mark_editable_artifact_live_outbox_published(text,text,integer,name)\",\n          \"renew_editable_artifact_live_outbox(text,text,integer,integer,name)\",\n          \"retry_editable_artifact_live_outbox(text,text,integer,integer,text,name)\",\n          \"dead_letter_editable_artifact_live_outbox(text,text,integer,text,name)\",\n          \"release_editable_artifact_live_outbox(text,text,integer,name)\",\n        ]\n      : [\n          \"claim_editable_artifact_materializations(text,integer,integer,name)\",\n          \"renew_editable_artifact_materialization(uuid,uuid,text,text,text,integer,integer,name)\",\n          \"succeed_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,text,text,bigint,text,text,timestamp with time zone,name)\",\n          \"fail_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,name)\",\n        ];\n  const routineArray = `ARRAY[${routines.map(literal).join(\", \")}]`;\n  await sql.unsafe(`\nDO $$\nDECLARE routine_signature text;\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(dataSchema)})\n    AND EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private')\n  THEN\n    EXECUTE format('GRANT CONNECT ON DATABASE %I TO %I', current_database(), ${literal(role)});\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(dataSchema)}, ${literal(role)});\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format(\n      'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I',\n      ${literal(dataSchema)}, ${literal(role)}\n    );\n    EXECUTE format(\n      'REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I FROM %I',\n      ${literal(dataSchema)}, ${literal(role)}\n    );\n    EXECUTE format(\n      'REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA opengeni_private FROM %I',\n      ${literal(role)}\n    );\n    FOREACH routine_signature IN ARRAY ${routineArray} LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',\n          routine_signature, ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureLoginRole(sql: postgres.Sql, role: string, password: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  ELSE\n    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureRestrictedAppLoginRole(\n  sql: postgres.Sql,\n  role: string,\n  password: string,\n): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format(\n      'CREATE ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',\n      ${literal(role)},\n      ${literal(password)}\n    );\n  ELSIF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND rolsuper) THEN\n    EXECUTE format(\n      'ALTER ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',\n      ${literal(role)},\n      ${literal(password)}\n    );\n  ELSE\n    -- PostgreSQL requires elevated attributes merely to name SUPERUSER,\n    -- BYPASSRLS, REPLICATION, or CREATEDB in ALTER ROLE, even when setting them\n    -- false. The preflight has already proved those protected attributes are\n    -- false, so a managed CREATEROLE administrator converges only the\n    -- attributes it may change.\n    EXECUTE format(\n      'ALTER ROLE %I WITH LOGIN NOCREATEROLE NOINHERIT PASSWORD %L',\n      ${literal(role)},\n      ${literal(password)}\n    );\n  END IF;\nEND $$;\n`);\n}\n\n/**\n * Fail rather than silently revoking role relationships or transferring owned\n * objects. Those operations have effects outside OpenGeni's runtime grant\n * contract and require an explicit, audited operator decision.\n */\nasync function assertAppRoleSafeToNormalize(sql: postgres.Sql, role: string): Promise<void> {\n  const exists = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_roles where rolname = ${role}) as exists\n  `;\n  if (!exists[0]?.exists) {\n    return;\n  }\n\n  const [roleAttributes] = await sql<\n    {\n      administrator_superuser: boolean;\n      app_superuser: boolean;\n      app_bypass_rls: boolean;\n      app_create_database: boolean;\n      app_replication: boolean;\n    }[]\n  >`\n    select\n      administrator.rolsuper as administrator_superuser,\n      app.rolsuper as app_superuser,\n      app.rolbypassrls as app_bypass_rls,\n      app.rolcreatedb as app_create_database,\n      app.rolreplication as app_replication\n    from pg_roles app\n    join pg_roles administrator on administrator.rolname = current_user\n    where app.rolname = ${role}\n  `;\n  if (roleAttributes && !roleAttributes.administrator_superuser) {\n    const protectedAttributes = [\n      roleAttributes.app_superuser ? \"SUPERUSER\" : null,\n      roleAttributes.app_bypass_rls ? \"BYPASSRLS\" : null,\n      roleAttributes.app_create_database ? \"CREATEDB\" : null,\n      roleAttributes.app_replication ? \"REPLICATION\" : null,\n    ].filter((attribute): attribute is string => attribute !== null);\n    if (protectedAttributes.length > 0) {\n      throw new Error(\n        `Refusing to normalize app role ${role}: a non-superuser administrator cannot clear protected attributes (${protectedAttributes.join(\", \")})`,\n      );\n    }\n  }\n\n  const relationshipRows = await sql.unsafe<RoleRelationshipCatalogRow[]>(\n    roleRelationshipsCatalogQuery(\"$1\"),\n    [role],\n  );\n  const { unsafeRelationships } = classifyRoleRelationships(relationshipRows);\n  if (unsafeRelationships.length > 0) {\n    throw new Error(\n      `Refusing to normalize app role ${role}: remove privilege-bearing role relationships first (${unsafeRelationships.join(\", \")})`,\n    );\n  }\n\n  const ownedObjects = await sql<{ object_name: string }[]>`\n    select ('database:' || d.datname)::text as object_name\n    from pg_database d\n    join pg_roles owner on owner.oid = d.datdba\n    where owner.rolname = ${role}\n    union all\n    select ('schema:' || n.nspname)::text as object_name\n    from pg_namespace n\n    join pg_roles owner on owner.oid = n.nspowner\n    where owner.rolname = ${role}\n      and n.nspname <> 'information_schema'\n      and n.nspname !~ '^pg_'\n    union all\n    select ('relation:' || n.nspname || '.' || c.relname)::text as object_name\n    from pg_class c\n    join pg_namespace n on n.oid = c.relnamespace\n    join pg_roles owner on owner.oid = c.relowner\n    where owner.rolname = ${role}\n      and n.nspname <> 'information_schema'\n      and n.nspname !~ '^pg_'\n    union all\n    select (\n      'routine:' || n.nspname || '.' || p.proname || '(' ||\n      pg_get_function_identity_arguments(p.oid) || ')'\n    )::text as object_name\n    from pg_proc p\n    join pg_namespace n on n.oid = p.pronamespace\n    join pg_roles owner on owner.oid = p.proowner\n    where owner.rolname = ${role}\n      and n.nspname <> 'information_schema'\n      and n.nspname !~ '^pg_'\n    order by object_name\n  `;\n  if (ownedObjects.length > 0) {\n    throw new Error(\n      `Refusing to normalize app role ${role}: transfer owned objects first (${ownedObjects\n        .map((row) => row.object_name)\n        .join(\", \")})`,\n    );\n  }\n}\n\nasync function ensureDatabase(sql: postgres.Sql, database: string, owner: string): Promise<void> {\n  const existing = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_database where datname = ${database}) as exists\n  `;\n  if (!existing[0]?.exists) {\n    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);\n  }\n  await sql.unsafe(\n    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`,\n  );\n}\n\nasync function grantTemporalRoleInDatabase(\n  adminConnection: string,\n  database: string,\n  role: string,\n): Promise<void> {\n  const databaseUrl = databaseUrlFor(adminConnection, database);\n  const databaseSql = postgres(databaseUrl, { max: 1 });\n  try {\n    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);\n  } finally {\n    await databaseSql.end();\n  }\n}\n\n/**\n * Grant the app role table DML in the OpenGeni data schema + EXECUTE on the\n * `opengeni_private` helper functions. Schema-parameterized (Step I): standalone\n * passes `public`; embedded passes the dedicated schema. The grants are guarded\n * on schema existence so provisioning before migrate is a safe no-op.\n */\nasync function grantAppRoleIfSchemaExists(\n  sql: postgres.Sql,\n  role: string,\n  schema: string,\n): Promise<void> {\n  const runtimeFullDmlTables = `ARRAY[${RUNTIME_FULL_DML_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadOnlyTables = `ARRAY[${RUNTIME_READ_ONLY_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadUpdateTables = `ARRAY[${RUNTIME_READ_UPDATE_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(\", \")}]`;\n  await sql.unsafe(`\nDO $$\nDECLARE\n  owner_role text := current_user;\n  runtime_table text;\nBEGIN\n  EXECUTE format('REVOKE CREATE ON DATABASE %I FROM %I', current_database(), ${literal(role)});\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format('REVOKE CREATE ON SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format('REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});\n    FOREACH runtime_table IN ARRAY ${runtimeFullDmlTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadOnlyTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadUpdateTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, UPDATE ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadInsertTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, INSERT ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadInsertUpdateTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, INSERT, UPDATE ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- Migration 0110 creates this target-schema-local SECURITY DEFINER\n    -- capability before opengeni_app may exist. Re-converge its exact EXECUTE\n    -- grant here so the supported migrate-then-provision order is equivalent to\n    -- provisioning the role before that migration.\n    IF to_regprocedure(\n      format('%I.lock_nested_agent_depth_configuration()', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.lock_nested_agent_depth_configuration() TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.preference_registry_apply_lifecycle(text,uuid,integer,uuid,uuid,text,uuid,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_apply_lifecycle(text, uuid, integer, uuid, uuid, text, uuid, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.preference_registry_lock_heads(uuid[])', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_lock_heads(uuid[]) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.knowledge_memory_apply_operation(jsonb,text,text,text,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_apply_operation(jsonb, text, text, text, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.knowledge_memory_revert_operation(uuid,uuid,text,text,text,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_revert_operation(uuid, uuid, text, text, text, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.preference_registry_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_instruction_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.company_profile_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.company_profile_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.company_profile_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.company_profile_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.workspace_learning_policy_source_overrides_valid(jsonb)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_source_overrides_valid(jsonb) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.workspace_learning_policy_hash(text,jsonb)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_hash(text, jsonb) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.workspace_learning_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_apply_lifecycle(uuid, text, uuid, text, bigint, text, text, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0197 creates this target-schema-local SECURITY DEFINER lock\n    -- before opengeni_app may exist. Re-converge only its exact EXECUTE grant\n    -- for the supported migrate-then-provision install order; keep PUBLIC\n    -- revoked and do not widen table privileges.\n    IF to_regprocedure(\n      format(\n        '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_source_acl(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_complete_sync(uuid,uuid,text,text,timestamptz,jsonb,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_complete_sync(uuid, uuid, text, text, timestamptz, jsonb, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_advance_object_version(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_object_version(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format(\n      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',\n      owner_role,\n      ${literal(schema)},\n      ${literal(role)}\n    );\n    EXECUTE format(\n      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I GRANT USAGE, SELECT ON SEQUENCES TO %I',\n      owner_role,\n      ${literal(schema)},\n      ${literal(role)}\n    );\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format(\n      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private REVOKE EXECUTE ON FUNCTIONS FROM %I',\n      owner_role,\n      ${literal(role)}\n    );\n    -- Global cross-workspace artifact workers are separate capabilities. Never\n    -- let the generic tenant-scoped app role inherit them from the historical\n    -- blanket grant of already-installed helpers.\n    IF to_regprocedure('opengeni_private.claim_editable_artifact_live_outbox(text,integer,integer,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_live_outbox(text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.mark_editable_artifact_live_outbox_published(text, text, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_live_outbox(text, text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.retry_editable_artifact_live_outbox(text, text, integer, integer, text, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.dead_letter_editable_artifact_live_outbox(text, text, integer, text, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.release_editable_artifact_live_outbox(text, text, integer, name) FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.claim_editable_artifact_materializations(text,integer,integer,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_materializations(text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamptz, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name) FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.consume_editable_artifact_live_ticket(text,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.resolve_editable_artifact_ticket_data_schema(name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamptz, timestamptz, name) TO %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.consume_editable_artifact_live_ticket(text, name) TO %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.cleanup_expired_editable_artifact_live_tickets(integer, name) TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.authorize_editable_artifact_actor(uuid,uuid,text,text,text,text,text,text,integer,text,text,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name) TO %I',\n        ${literal(role)}\n      );\n    END IF;\n  END IF;\nEND $$;\n`);\n}\n\nfunction commaSeparated(value: string): string[] {\n  return value\n    .split(\",\")\n    .map((item) => item.trim())\n    .filter(Boolean);\n}\n\nfunction validateIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\nfunction identifier(value: string): string {\n  return `\"${value.replace(/\"/g, '\"\"')}\"`;\n}\n\nfunction literal(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`;\n}\n\nfunction databaseUrlFor(value: string, database: string): string {\n  const url = new URL(value);\n  url.pathname = `/${database}`;\n  return url.toString();\n}\n\n// CLI form (unchanged behavior): read env into the SDK options and run. This is\n// what `bun src/provision-roles.ts` / the `provision-roles` package script\n// invokes — standalone byte-for-byte the historical script (public schema,\n// force strategy, env-driven creds).\nif (import.meta.main) {\n  const adminUrl =\n    process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_ADMIN_URL ??\n    process.env.OPENGENI_DATABASE_URL;\n  if (!adminUrl) {\n    throw new Error(\n      \"OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required\",\n    );\n  }\n  const result = await provisionRoles(adminUrl, {\n    ...(process.env.OPENGENI_DB_SCHEMA?.trim()\n      ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() }\n      : {}),\n  });\n  console.log(JSON.stringify(result, null, 2));\n}\n","import { sql } from \"drizzle-orm\";\nimport type { Database, RlsStrategy } from \"./database\";\nimport {\n  classifyRoleRelationships,\n  roleRelationshipsCatalogQuery,\n  type RoleRelationshipCatalogRow,\n} from \"./role-relationships\";\n\nconst ARTIFACT_OUTBOX_CAPABILITY_ROUTINES = [\n  \"claim_editable_artifact_live_outbox(text, integer, integer, name)\",\n  \"mark_editable_artifact_live_outbox_published(text, text, integer, name)\",\n  \"renew_editable_artifact_live_outbox(text, text, integer, integer, name)\",\n  \"retry_editable_artifact_live_outbox(text, text, integer, integer, text, name)\",\n  \"dead_letter_editable_artifact_live_outbox(text, text, integer, text, name)\",\n  \"release_editable_artifact_live_outbox(text, text, integer, name)\",\n] as const;\n\nconst ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES = [\n  \"claim_editable_artifact_materializations(text, integer, integer, name)\",\n  \"renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name)\",\n  \"succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamp with time zone, name)\",\n  \"fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name)\",\n] as const;\n\nconst ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES = [\n  \"put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamp with time zone, timestamp with time zone, name)\",\n  \"consume_editable_artifact_live_ticket(text, name)\",\n  \"cleanup_expired_editable_artifact_live_tickets(integer, name)\",\n] as const;\n\nconst ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES = [\n  \"resolve_editable_artifact_ticket_data_schema(name)\",\n] as const;\n\nconst ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES = [\n  \"authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name)\",\n] as const;\n\nconst DEDICATED_ARTIFACT_CAPABILITY_ROUTINES = new Set<string>([\n  ...ARTIFACT_OUTBOX_CAPABILITY_ROUTINES,\n  ...ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES,\n  ...ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES,\n]);\n\nconst KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE =\n  \"knowledge_source_sync_lock_authority(uuid, uuid, uuid)\";\nconst KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [\n  \"knowledge_sources\",\n  \"knowledge_source_objects\",\n] as const;\n\nexport const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [\n  KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE,\n] as const;\n\n/**\n * The complete standalone tenant-table contract. Adding or removing a\n * FORCE-RLS table is an architectural change: update this list in the same\n * commit as the migration so startup cannot silently accept an unreviewed gap.\n */\nexport const FORCE_RLS_TABLES = [\n  \"agent_run_states\",\n  \"api_keys\",\n  \"attached_browser_devices\",\n  \"attached_browser_inventories\",\n  \"audit_events\",\n  \"auth_runs\",\n  \"billing_customers\",\n  \"browser_identities\",\n  \"browser_revision_components\",\n  \"browser_revisions\",\n  \"browser_session_associations\",\n  \"browser_sessions\",\n  \"browser_state_artifacts\",\n  \"capability_api_facets\",\n  \"capability_catalog_items\",\n  \"capability_component_owners\",\n  \"capability_facet_installations\",\n  \"capability_facets\",\n  \"capability_installations\",\n  \"capability_integration_facets\",\n  \"capability_mcp_facets\",\n  \"capability_operations\",\n  \"capability_plugin_installations\",\n  \"capability_plugin_versions\",\n  \"capability_plugins\",\n  \"capability_skill_facets\",\n  \"capability_skill_files\",\n  \"codex_apps_settings\",\n  \"codex_capacity_waiters\",\n  \"codex_credential_leases\",\n  \"codex_reset_redemption_attempts\",\n  \"codex_rotation_settings\",\n  \"codex_subscription_credentials\",\n  \"company_profile_activation_events\",\n  \"company_profile_heads\",\n  \"company_profile_revisions\",\n  \"company_profile_snapshots\",\n  \"composer_drafts\",\n  \"computer_session_associations\",\n  \"computer_sessions\",\n  \"connection_disconnect_operations\",\n  \"connections\",\n  \"connector_action_policies\",\n  \"connector_action_requests\",\n  \"credit_ledger_entries\",\n  \"device_enrollment_requests\",\n  \"document_bases\",\n  \"document_chunks\",\n  \"documents\",\n  \"editable_artifact_blob_refs\",\n  \"editable_artifact_idempotency_receipts\",\n  \"editable_artifact_live_outbox\",\n  \"editable_artifact_live_tickets\",\n  \"editable_artifact_materialization_jobs\",\n  \"editable_artifact_materialization_results\",\n  \"editable_artifact_operations\",\n  \"editable_artifact_replica_leases\",\n  \"editable_artifact_scope_authorization_heads\",\n  \"editable_artifact_sequence_checkpoints\",\n  \"editable_artifact_session_links\",\n  \"editable_artifact_snapshots\",\n  \"editable_artifact_transactions\",\n  \"editable_artifact_undo_claims\",\n  \"editable_artifact_versions\",\n  \"editable_artifacts\",\n  \"enrollments\",\n  \"file_uploads\",\n  \"files\",\n  \"generated_image_artifacts\",\n  \"generated_video_artifacts\",\n  \"github_installation_repositories\",\n  \"github_installations\",\n  \"host_export_config\",\n  \"host_export_consumers\",\n  \"host_export_cursor_state\",\n  \"host_export_dead_letters\",\n  \"host_export_outbox\",\n  \"image_generation_operations\",\n  \"import_batches\",\n  \"integration_feature_binding_owners\",\n  \"integration_feature_bindings\",\n  \"integration_feature_facets\",\n  \"integration_oauth_state_nonces\",\n  \"integration_spec_revisions\",\n  \"integration_tools\",\n  \"interaction_interventions\",\n  \"interaction_operations\",\n  \"interaction_resource_operations\",\n  \"knowledge_change_proposals\",\n  \"knowledge_claim_evidence\",\n  \"knowledge_claim_relations\",\n  \"knowledge_claim_reviews\",\n  \"knowledge_claims\",\n  \"knowledge_document_versions\",\n  \"knowledge_entities\",\n  \"knowledge_entity_aliases\",\n  \"knowledge_facts\",\n  \"knowledge_lifecycle_events\",\n  \"knowledge_memories\",\n  \"knowledge_memory_lifecycle_events\",\n  \"knowledge_memory_relationships\",\n  \"knowledge_operation_receipts\",\n  \"knowledge_providers\",\n  \"knowledge_source_acl_versions\",\n  \"knowledge_source_objects\",\n  \"knowledge_source_sync_index_obligations\",\n  \"knowledge_source_sync_item_outcomes\",\n  \"knowledge_source_sync_object_observations\",\n  \"knowledge_source_sync_states\",\n  \"knowledge_source_sync_wakes\",\n  \"knowledge_sources\",\n  \"knowledge_sync_runs\",\n  \"machine_metrics_latest\",\n  \"machine_metrics_series\",\n  \"machine_removal_operations\",\n  \"memory_slack_publication_configurations\",\n  \"memory_slack_publication_receipts\",\n  \"memory_slack_publications\",\n  \"model_call_facts\",\n  \"network_routes\",\n  \"new_session_drafts\",\n  \"pack_installation_components\",\n  \"pack_installations\",\n  \"preference_registry_events\",\n  \"preference_registry_preferences\",\n  \"preference_registry_revisions\",\n  \"preference_registry_snapshots\",\n  \"retained_screenshot_artifacts\",\n  \"rig_changes\",\n  \"rig_versions\",\n  \"rigs\",\n  \"sandbox_checkpoint_artifacts\",\n  \"sandbox_lease_holders\",\n  \"sandbox_leases\",\n  \"sandbox_pty_sessions\",\n  \"sandbox_retained_processes\",\n  \"sandbox_session_envelopes\",\n  \"sandbox_workspace_mutation_admissions\",\n  \"sandboxes\",\n  \"scheduled_task_runs\",\n  \"scheduled_tasks\",\n  \"session_attempt_codemode_calls\",\n  \"session_attempt_interruptions\",\n  \"session_attempt_tool_catalogs\",\n  \"session_command_receipts\",\n  \"session_events\",\n  \"session_goals\",\n  \"session_history_items\",\n  \"session_human_input_requests\",\n  \"session_list_snapshots\",\n  \"session_mcp_servers\",\n  \"session_pending_tool_calls\",\n  \"session_pins\",\n  \"session_realtime_connections\",\n  \"session_realtime_context_projections\",\n  \"session_realtime_entries\",\n  \"session_realtime_modes\",\n  \"session_recordings\",\n  \"session_spawn_denials\",\n  \"session_stream_acknowledgments\",\n  \"session_system_update_outbox\",\n  \"session_system_updates\",\n  \"session_turn_attempts\",\n  \"session_turns\",\n  \"session_workflow_wake_outbox\",\n  \"sessions\",\n  \"site_auth_connections\",\n  \"slack_bot_delete_operations\",\n  \"slack_bot_post_operations\",\n  \"slack_bot_user_links\",\n  \"slack_installation_bindings\",\n  \"slack_interaction_inbox\",\n  \"slack_interaction_progress_deliveries\",\n  \"slack_interactions\",\n  \"slack_user_link_access_request_operations\",\n  \"slack_user_link_access_requests\",\n  \"social_connections\",\n  \"social_posts\",\n  \"temporal_schedule_cleanup_outbox\",\n  \"transcription_recording_chunks\",\n  \"transcription_recording_objects\",\n  \"transcription_recording_segments\",\n  \"transcription_recordings\",\n  \"usage_events\",\n  \"video_generation_operations\",\n  \"video_generation_references\",\n  \"workspace_artifact_events\",\n  \"workspace_artifact_versions\",\n  \"workspace_artifacts\",\n  \"workspace_captures\",\n  \"workspace_control_events\",\n  \"workspace_inference_controls\",\n  \"workspace_instruction_policy_activation_events\",\n  \"workspace_instruction_policy_heads\",\n  \"workspace_instruction_policy_onboarding_proposals\",\n  \"workspace_instruction_policy_revisions\",\n  \"workspace_instruction_policy_snapshots\",\n  \"workspace_interaction_revisions\",\n  \"workspace_learning_policy_activation_events\",\n  \"workspace_learning_policy_heads\",\n  \"workspace_learning_policy_revisions\",\n  \"workspace_learning_policy_snapshots\",\n  \"workspace_model_policies\",\n  \"workspace_packs\",\n  \"workspace_screenshot_quotas\",\n  \"workspace_session_activity_revisions\",\n  \"workspace_variable_set_variables\",\n  \"workspace_variable_sets\",\n  \"workspace_video_generation_policies\",\n  \"workspace_video_generation_quotas\",\n] as const;\n\n/**\n * Deployment-global and authentication tables used by ordinary API/worker\n * traffic. They intentionally do not carry workspace RLS: their access model\n * is implemented by the authentication/access layer or by exact global keys.\n */\nexport const NON_RLS_RUNTIME_TABLES = [\n  \"auth_identities\",\n  \"auth_rate_limits\",\n  \"auth_sessions\",\n  \"auth_users\",\n  \"auth_verifications\",\n  \"integration_oauth_clients\",\n  \"managed_accounts\",\n  \"nested_agent_depth_configuration\",\n  \"stripe_webhook_events\",\n  \"workspace_memberships\",\n  \"workspaces\",\n] as const;\n\n/**\n * Exact full-CRUD class for the standalone runtime role. This is deliberately\n * explicit instead of being derived from FORCE_RLS_TABLES: adding a protected\n * table must not silently grant it broader DML than its migration intended.\n */\nexport const RUNTIME_FULL_DML_TABLES = [\n  \"agent_run_states\",\n  \"api_keys\",\n  \"audit_events\",\n  \"auth_identities\",\n  \"auth_rate_limits\",\n  \"auth_sessions\",\n  \"auth_users\",\n  \"auth_verifications\",\n  \"billing_customers\",\n  \"browser_session_associations\",\n  \"capability_catalog_items\",\n  \"capability_component_owners\",\n  \"capability_facet_installations\",\n  \"capability_installations\",\n  \"capability_operations\",\n  \"capability_plugin_installations\",\n  \"codex_apps_settings\",\n  \"codex_capacity_waiters\",\n  \"codex_credential_leases\",\n  \"codex_reset_redemption_attempts\",\n  \"codex_rotation_settings\",\n  \"codex_subscription_credentials\",\n  \"composer_drafts\",\n  \"computer_session_associations\",\n  \"connection_disconnect_operations\",\n  \"connections\",\n  \"connector_action_policies\",\n  \"connector_action_requests\",\n  \"credit_ledger_entries\",\n  \"device_enrollment_requests\",\n  \"document_bases\",\n  \"document_chunks\",\n  \"documents\",\n  \"editable_artifact_replica_leases\",\n  \"enrollments\",\n  \"file_uploads\",\n  \"files\",\n  \"generated_image_artifacts\",\n  \"generated_video_artifacts\",\n  \"github_installation_repositories\",\n  \"github_installations\",\n  \"image_generation_operations\",\n  \"import_batches\",\n  \"integration_feature_binding_owners\",\n  \"integration_feature_bindings\",\n  \"integration_oauth_clients\",\n  \"integration_oauth_state_nonces\",\n  \"knowledge_memories\",\n  \"knowledge_source_sync_index_obligations\",\n  \"knowledge_source_sync_item_outcomes\",\n  \"knowledge_source_sync_object_observations\",\n  \"knowledge_source_sync_states\",\n  \"knowledge_source_sync_wakes\",\n  \"machine_metrics_latest\",\n  \"machine_metrics_series\",\n  \"machine_removal_operations\",\n  \"managed_accounts\",\n  \"memory_slack_publication_configurations\",\n  \"memory_slack_publication_receipts\",\n  \"memory_slack_publications\",\n  \"model_call_facts\",\n  \"new_session_drafts\",\n  \"pack_installation_components\",\n  \"pack_installations\",\n  \"retained_screenshot_artifacts\",\n  \"rig_changes\",\n  \"rig_versions\",\n  \"rigs\",\n  \"sandbox_checkpoint_artifacts\",\n  \"sandbox_lease_holders\",\n  \"sandbox_leases\",\n  \"sandbox_pty_sessions\",\n  \"sandbox_retained_processes\",\n  \"sandbox_session_envelopes\",\n  \"sandbox_workspace_mutation_admissions\",\n  \"sandboxes\",\n  \"scheduled_task_runs\",\n  \"scheduled_tasks\",\n  \"session_attempt_interruptions\",\n  \"session_command_receipts\",\n  \"session_events\",\n  \"session_goals\",\n  \"session_history_items\",\n  \"session_human_input_requests\",\n  \"session_list_snapshots\",\n  \"session_mcp_servers\",\n  \"session_pending_tool_calls\",\n  \"session_pins\",\n  \"session_realtime_connections\",\n  \"session_realtime_context_projections\",\n  \"session_realtime_entries\",\n  \"session_realtime_modes\",\n  \"session_recordings\",\n  \"session_stream_acknowledgments\",\n  \"session_system_update_outbox\",\n  \"session_system_updates\",\n  \"session_turn_attempts\",\n  \"session_turns\",\n  \"session_workflow_wake_outbox\",\n  \"sessions\",\n  \"slack_bot_delete_operations\",\n  \"slack_bot_post_operations\",\n  \"slack_bot_user_links\",\n  \"slack_interaction_inbox\",\n  \"slack_interaction_progress_deliveries\",\n  \"slack_interactions\",\n  \"social_connections\",\n  \"social_posts\",\n  \"stripe_webhook_events\",\n  \"transcription_recording_chunks\",\n  \"transcription_recording_objects\",\n  \"transcription_recording_segments\",\n  \"transcription_recordings\",\n  \"usage_events\",\n  \"video_generation_operations\",\n  \"video_generation_references\",\n  \"workspace_artifacts\",\n  \"workspace_captures\",\n  \"workspace_control_events\",\n  \"workspace_inference_controls\",\n  \"workspace_instruction_policy_heads\",\n  \"workspace_memberships\",\n  \"workspace_model_policies\",\n  \"workspace_packs\",\n  \"workspace_screenshot_quotas\",\n  \"workspace_variable_set_variables\",\n  \"workspace_variable_sets\",\n  \"workspace_video_generation_policies\",\n  \"workspace_video_generation_quotas\",\n  \"workspaces\",\n] as const;\n\n/** Configuration and lifecycle-owned audit rows are read-only at runtime. */\nexport const RUNTIME_READ_ONLY_TABLES = [\n  \"company_profile_activation_events\",\n  \"company_profile_heads\",\n  \"company_profile_snapshots\",\n  \"knowledge_lifecycle_events\",\n  \"knowledge_memory_lifecycle_events\",\n  \"knowledge_memory_relationships\",\n  \"nested_agent_depth_configuration\",\n  \"preference_registry_events\",\n  \"preference_registry_snapshots\",\n  \"slack_installation_bindings\",\n  \"workspace_instruction_policy_snapshots\",\n  \"workspace_learning_policy_activation_events\",\n  \"workspace_learning_policy_heads\",\n  \"workspace_learning_policy_snapshots\",\n] as const;\n\n/** Existing runtime authorities that may be observed and advanced, never created or deleted. */\nexport const RUNTIME_READ_UPDATE_TABLES = [\"workspace_session_activity_revisions\"] as const;\n\n/** Append-only evidence/revision tables are insertable and queryable, never mutable. */\nexport const RUNTIME_READ_INSERT_TABLES = [\n  \"browser_revision_components\",\n  \"browser_revisions\",\n  \"company_profile_revisions\",\n  \"editable_artifact_blob_refs\",\n  \"editable_artifact_idempotency_receipts\",\n  \"editable_artifact_live_outbox\",\n  \"editable_artifact_materialization_jobs\",\n  \"editable_artifact_materialization_results\",\n  \"editable_artifact_operations\",\n  \"editable_artifact_sequence_checkpoints\",\n  \"editable_artifact_snapshots\",\n  \"editable_artifact_transactions\",\n  \"editable_artifact_undo_claims\",\n  \"editable_artifact_versions\",\n  \"knowledge_change_proposals\",\n  \"knowledge_claim_evidence\",\n  \"knowledge_claim_relations\",\n  \"knowledge_claim_reviews\",\n  \"knowledge_claims\",\n  \"knowledge_document_versions\",\n  \"knowledge_entities\",\n  \"knowledge_entity_aliases\",\n  \"knowledge_facts\",\n  \"knowledge_operation_receipts\",\n  \"knowledge_providers\",\n  \"knowledge_source_acl_versions\",\n  \"knowledge_source_objects\",\n  \"knowledge_sources\",\n  \"knowledge_sync_runs\",\n  \"preference_registry_preferences\",\n  \"preference_registry_revisions\",\n  \"session_attempt_tool_catalogs\",\n  \"session_spawn_denials\",\n  \"slack_user_link_access_request_operations\",\n  \"temporal_schedule_cleanup_outbox\",\n  \"workspace_artifact_events\",\n  \"workspace_artifact_versions\",\n  \"workspace_instruction_policy_activation_events\",\n  \"workspace_instruction_policy_onboarding_proposals\",\n  \"workspace_instruction_policy_revisions\",\n  \"workspace_learning_policy_revisions\",\n] as const;\n\n/** Durable operation journals are append/read plus claim/settle updates, never deletes. */\nexport const RUNTIME_READ_INSERT_UPDATE_TABLES = [\n  \"attached_browser_devices\",\n  \"attached_browser_inventories\",\n  \"auth_runs\",\n  \"browser_identities\",\n  \"browser_sessions\",\n  \"browser_state_artifacts\",\n  \"capability_api_facets\",\n  \"capability_facets\",\n  \"capability_integration_facets\",\n  \"capability_mcp_facets\",\n  \"capability_plugin_versions\",\n  \"capability_plugins\",\n  \"capability_skill_facets\",\n  \"capability_skill_files\",\n  \"computer_sessions\",\n  \"editable_artifact_session_links\",\n  \"editable_artifacts\",\n  \"integration_feature_facets\",\n  \"integration_spec_revisions\",\n  \"integration_tools\",\n  \"interaction_interventions\",\n  \"interaction_operations\",\n  \"interaction_resource_operations\",\n  \"network_routes\",\n  \"session_attempt_codemode_calls\",\n  \"site_auth_connections\",\n  \"slack_user_link_access_requests\",\n  \"workspace_interaction_revisions\",\n] as const;\n\n/**\n * These FORCE-RLS tables are owned by security-definer host-export routines.\n * The ordinary application role must have no direct table privileges on them.\n */\nexport const PROTECTED_NO_DIRECT_DML_TABLES = [\n  \"editable_artifact_live_tickets\",\n  \"editable_artifact_scope_authorization_heads\",\n  \"host_export_config\",\n  \"host_export_consumers\",\n  \"host_export_cursor_state\",\n  \"host_export_dead_letters\",\n  \"host_export_outbox\",\n] as const;\n\nexport type RuntimeTableDmlPrivilege = \"SELECT\" | \"INSERT\" | \"UPDATE\" | \"DELETE\";\nexport type RuntimeTablePrivilegeContract = Readonly<\n  Record<string, readonly RuntimeTableDmlPrivilege[]>\n>;\n\nconst FULL_DML_PRIVILEGES = [\"SELECT\", \"INSERT\", \"UPDATE\", \"DELETE\"] as const;\n\n/** Exact per-table DML contract. Absence means no direct table privileges. */\nexport const RUNTIME_TABLE_PRIVILEGES: RuntimeTablePrivilegeContract = Object.freeze({\n  ...Object.fromEntries(RUNTIME_FULL_DML_TABLES.map((table) => [table, FULL_DML_PRIVILEGES])),\n  ...Object.fromEntries(RUNTIME_READ_ONLY_TABLES.map((table) => [table, [\"SELECT\"] as const])),\n  ...Object.fromEntries(\n    RUNTIME_READ_UPDATE_TABLES.map((table) => [table, [\"SELECT\", \"UPDATE\"] as const]),\n  ),\n  ...Object.fromEntries(\n    RUNTIME_READ_INSERT_TABLES.map((table) => [table, [\"SELECT\", \"INSERT\"] as const]),\n  ),\n  ...Object.fromEntries(\n    RUNTIME_READ_INSERT_UPDATE_TABLES.map((table) => [\n      table,\n      [\"SELECT\", \"INSERT\", \"UPDATE\"] as const,\n    ]),\n  ),\n});\n\n/** All tables with any direct runtime DML; retained as the aggregate public contract. */\nexport const RUNTIME_DML_TABLES = Object.freeze(\n  Object.keys(RUNTIME_TABLE_PRIVILEGES).sort((a, b) => a.localeCompare(b)),\n);\n\nexport type RuntimeDatabasePostureOptions = {\n  rlsStrategy: RlsStrategy;\n  expectedRole?: string;\n  targetSchema?: string;\n  protectedTables?: readonly string[];\n  tablePrivileges?: RuntimeTablePrivilegeContract;\n  protectedNoDirectDmlTables?: readonly string[];\n};\n\nexport type RuntimeDatabaseIdentity = {\n  currentUser: string;\n  sessionUser: string;\n  databaseOwner: string;\n  canConnectDatabase: boolean;\n  canCreateInDatabase: boolean;\n  rowSecurity: string;\n  canLogin: boolean;\n  superuser: boolean;\n  inherit: boolean;\n  createRole: boolean;\n  createDatabase: boolean;\n  replication: boolean;\n  bypassRls: boolean;\n};\n\nexport type RuntimeSchemaPosture = {\n  name: string;\n  owner: string;\n  usage: boolean;\n  create: boolean;\n};\n\nexport type RuntimeTablePosture = {\n  name: string;\n  owner: string;\n  rlsEnabled: boolean;\n  rlsForced: boolean;\n  rlsActive: boolean;\n  policyCount: number;\n  artifactOutboxDispatcherPolicy: boolean;\n  artifactMaterializerPolicy: boolean;\n  select: boolean;\n  insert: boolean;\n  update: boolean;\n  delete: boolean;\n  truncate: boolean;\n  references: boolean;\n  trigger: boolean;\n};\n\nexport type RuntimeRoutinePosture = {\n  name: string;\n  owner: string;\n  execute: boolean;\n  securityDefiner: boolean;\n};\n\nexport type RuntimeTargetRoutinePosture = RuntimeRoutinePosture & {\n  publicExecute: boolean;\n};\n\nexport type RuntimeDatabasePosture = {\n  identity: RuntimeDatabaseIdentity;\n  /** Privilege-bearing role relationships; exact PG16+ management-only grants are excluded. */\n  memberships: string[];\n  schemas: RuntimeSchemaPosture[];\n  ownedSchemas: string[];\n  ownedRelations: string[];\n  tables: RuntimeTablePosture[];\n  targetRoutines: RuntimeTargetRoutinePosture[];\n  privateRoutines: RuntimeRoutinePosture[];\n};\n\nexport class RuntimeDatabasePostureError extends Error {\n  readonly violations: readonly string[];\n\n  constructor(violations: readonly string[]) {\n    super(`Runtime database posture check failed: ${violations.join(\"; \")}`);\n    this.name = \"RuntimeDatabasePostureError\";\n    this.violations = violations;\n  }\n}\n\ntype IdentityRow = {\n  current_user: string;\n  session_user: string;\n  database_owner: string;\n  can_connect_database: boolean;\n  can_create_in_database: boolean;\n  row_security: string;\n  rolcanlogin: boolean;\n  rolsuper: boolean;\n  rolinherit: boolean;\n  rolcreaterole: boolean;\n  rolcreatedb: boolean;\n  rolreplication: boolean;\n  rolbypassrls: boolean;\n};\n\nfunction resultRows<T>(result: unknown): T[] {\n  if (Array.isArray(result)) {\n    return result as T[];\n  }\n  const rows = (result as { rows?: unknown } | null)?.rows;\n  if (Array.isArray(rows)) {\n    return rows as T[];\n  }\n  throw new Error(\"Runtime database posture query returned an unsupported result shape\");\n}\n\nfunction sorted(values: Iterable<string>): string[] {\n  return [...values].sort((a, b) => a.localeCompare(b));\n}\n\nfunction difference(left: ReadonlySet<string>, right: ReadonlySet<string>): string[] {\n  return sorted([...left].filter((value) => !right.has(value)));\n}\n\n/** Inspect only PostgreSQL catalogs and privilege functions; no tenant rows. */\nexport async function inspectRuntimeDatabasePosture(\n  db: Database,\n  options: RuntimeDatabasePostureOptions,\n): Promise<RuntimeDatabasePosture> {\n  const targetSchema = options.targetSchema?.trim() || \"public\";\n\n  return await db.transaction(\n    async (tx) => {\n      const identityRows = resultRows<IdentityRow>(\n        await tx.execute(sql`\n          select\n            current_user::text as current_user,\n            session_user::text as session_user,\n            pg_get_userbyid(d.datdba)::text as database_owner,\n            has_database_privilege(current_user, d.oid, 'CONNECT') as can_connect_database,\n            has_database_privilege(current_user, d.oid, 'CREATE') as can_create_in_database,\n            current_setting('row_security')::text as row_security,\n            r.rolcanlogin,\n            r.rolsuper,\n            r.rolinherit,\n            r.rolcreaterole,\n            r.rolcreatedb,\n            r.rolreplication,\n            r.rolbypassrls\n          from pg_roles r\n          join pg_database d on d.datname = current_database()\n          where r.rolname = current_user\n        `),\n      );\n      const identity = identityRows[0];\n      if (!identity) {\n        throw new Error(\"Runtime database posture could not resolve the current PostgreSQL role\");\n      }\n\n      const mappedIdentity: RuntimeDatabaseIdentity = {\n        currentUser: identity.current_user,\n        sessionUser: identity.session_user,\n        databaseOwner: identity.database_owner,\n        canConnectDatabase: identity.can_connect_database,\n        canCreateInDatabase: identity.can_create_in_database,\n        rowSecurity: identity.row_security,\n        canLogin: identity.rolcanlogin,\n        superuser: identity.rolsuper,\n        inherit: identity.rolinherit,\n        createRole: identity.rolcreaterole,\n        createDatabase: identity.rolcreatedb,\n        replication: identity.rolreplication,\n        bypassRls: identity.rolbypassrls,\n      };\n\n      // Scoped/embedded topology deliberately leaves ownership and isolation to\n      // the host. Prove the connection identity is coherent, but do not impose\n      // the standalone opengeni_app object/grant contract on the host's role.\n      if (options.rlsStrategy === \"scoped\") {\n        return {\n          identity: mappedIdentity,\n          memberships: [],\n          schemas: [],\n          ownedSchemas: [],\n          ownedRelations: [],\n          tables: [],\n          targetRoutines: [],\n          privateRoutines: [],\n        };\n      }\n\n      const relationshipRows = resultRows<RoleRelationshipCatalogRow>(\n        await tx.execute(sql.raw(roleRelationshipsCatalogQuery(\"current_user\"))),\n      );\n      const memberships = classifyRoleRelationships(relationshipRows).unsafeRelationships;\n\n      const schemas = resultRows<{\n        name: string;\n        owner: string;\n        usage: boolean;\n        create: boolean;\n      }>(\n        await tx.execute(sql`\n          select\n            n.nspname::text as name,\n            pg_get_userbyid(n.nspowner)::text as owner,\n            has_schema_privilege(current_user, n.oid, 'USAGE') as usage,\n            has_schema_privilege(current_user, n.oid, 'CREATE') as create\n          from pg_namespace n\n          where n.nspname in (${targetSchema}, 'opengeni_private')\n          order by n.nspname\n        `),\n      );\n\n      const ownedSchemas = resultRows<{ name: string }>(\n        await tx.execute(sql`\n          select n.nspname::text as name\n          from pg_namespace n\n          join pg_roles r on r.oid = n.nspowner\n          where r.rolname = current_user\n            and n.nspname <> 'information_schema'\n            and n.nspname !~ '^pg_'\n          order by n.nspname\n        `),\n      ).map((row) => row.name);\n\n      const ownedRelations = resultRows<{ name: string }>(\n        await tx.execute(sql`\n          select (n.nspname || '.' || c.relname)::text as name\n          from pg_class c\n          join pg_namespace n on n.oid = c.relnamespace\n          join pg_roles r on r.oid = c.relowner\n          where r.rolname = current_user\n            and c.relkind in ('r', 'p', 'S', 'v', 'm', 'f')\n            and n.nspname <> 'information_schema'\n            and n.nspname !~ '^pg_'\n          order by n.nspname, c.relname\n        `),\n      ).map((row) => row.name);\n\n      const tables = resultRows<{\n        name: string;\n        owner: string;\n        rls_enabled: boolean;\n        rls_forced: boolean;\n        rls_active: boolean;\n        policy_count: number;\n        artifact_outbox_dispatcher_policy: boolean;\n        artifact_materializer_policy: boolean;\n        can_select: boolean;\n        can_insert: boolean;\n        can_update: boolean;\n        can_delete: boolean;\n        can_truncate: boolean;\n        can_references: boolean;\n        can_trigger: boolean;\n      }>(\n        await tx.execute(sql`\n          select\n            c.relname::text as name,\n            pg_get_userbyid(c.relowner)::text as owner,\n            c.relrowsecurity as rls_enabled,\n            c.relforcerowsecurity as rls_forced,\n            row_security_active(c.oid) as rls_active,\n            (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,\n            exists(\n              select 1 from pg_policy policy\n              where policy.polrelid = c.oid\n                and policy.polname = 'editable_artifact_outbox_dispatcher'\n            ) as artifact_outbox_dispatcher_policy,\n            exists(\n              select 1 from pg_policy policy\n              where policy.polrelid = c.oid\n                and policy.polname = 'editable_artifact_materializer_owner'\n            ) as artifact_materializer_policy,\n            has_table_privilege(current_user, c.oid, 'SELECT') as can_select,\n            has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,\n            has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,\n            has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,\n            has_table_privilege(current_user, c.oid, 'TRUNCATE') as can_truncate,\n            has_table_privilege(current_user, c.oid, 'REFERENCES') as can_references,\n            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger\n          from pg_class c\n          join pg_namespace n on n.oid = c.relnamespace\n          where n.nspname = ${targetSchema}\n            and c.relkind in ('r', 'p')\n          order by c.relname\n        `),\n      ).map((row) => ({\n        name: row.name,\n        owner: row.owner,\n        rlsEnabled: row.rls_enabled,\n        rlsForced: row.rls_forced,\n        rlsActive: row.rls_active,\n        policyCount: row.policy_count,\n        artifactOutboxDispatcherPolicy: row.artifact_outbox_dispatcher_policy,\n        artifactMaterializerPolicy: row.artifact_materializer_policy,\n        select: row.can_select,\n        insert: row.can_insert,\n        update: row.can_update,\n        delete: row.can_delete,\n        truncate: row.can_truncate,\n        references: row.can_references,\n        trigger: row.can_trigger,\n      }));\n\n      const targetRoutines = resultRows<{\n        name: string;\n        owner: string;\n        can_execute: boolean;\n        public_execute: boolean;\n        security_definer: boolean;\n      }>(\n        await tx.execute(sql`\n          select\n            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,\n            pg_get_userbyid(p.proowner)::text as owner,\n            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,\n            exists (\n              select 1\n              from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl\n              where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'\n            ) as public_execute,\n            p.prosecdef as security_definer\n          from pg_proc p\n          join pg_namespace n on n.oid = p.pronamespace\n          where p.oid = to_regprocedure(\n            format(\n              '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',\n              ${targetSchema}::text\n            )\n          )\n            and n.nspname = ${targetSchema}\n            and p.prokind in ('f', 'p')\n          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)\n        `),\n      ).map((row) => ({\n        name: row.name,\n        owner: row.owner,\n        execute: row.can_execute,\n        publicExecute: row.public_execute,\n        securityDefiner: row.security_definer,\n      }));\n\n      const privateRoutines = resultRows<{\n        name: string;\n        owner: string;\n        can_execute: boolean;\n        security_definer: boolean;\n      }>(\n        await tx.execute(sql`\n          select\n            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,\n            pg_get_userbyid(p.proowner)::text as owner,\n            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,\n            p.prosecdef as security_definer\n          from pg_proc p\n          join pg_namespace n on n.oid = p.pronamespace\n          where n.nspname = 'opengeni_private'\n            and p.prokind in ('f', 'p')\n          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)\n        `),\n      ).map((row) => ({\n        name: row.name,\n        owner: row.owner,\n        execute: row.can_execute,\n        securityDefiner: row.security_definer,\n      }));\n\n      return {\n        identity: mappedIdentity,\n        memberships,\n        schemas,\n        ownedSchemas,\n        ownedRelations,\n        tables,\n        targetRoutines,\n        privateRoutines,\n      };\n    },\n    { isolationLevel: \"repeatable read\", accessMode: \"read only\" },\n  );\n}\n\n/** Pure deterministic evaluator used by startup/readiness and unit tests. */\nexport function evaluateRuntimeDatabasePosture(\n  posture: RuntimeDatabasePosture,\n  options: RuntimeDatabasePostureOptions,\n): string[] {\n  const violations: string[] = [];\n  const identity = posture.identity;\n\n  if (!identity.currentUser || !identity.sessionUser) {\n    violations.push(\"database identity is empty\");\n  }\n  if (identity.currentUser !== identity.sessionUser) {\n    violations.push(\n      `current_user ${identity.currentUser} does not match session_user ${identity.sessionUser}`,\n    );\n  }\n  if (!identity.canConnectDatabase) {\n    violations.push(\"runtime role lacks CONNECT on the current database\");\n  }\n\n  if (options.rlsStrategy === \"scoped\") {\n    return violations;\n  }\n\n  const expectedRole = options.expectedRole?.trim() || \"opengeni_app\";\n  const targetSchema = options.targetSchema?.trim() || \"public\";\n  const protectedTables = new Set(options.protectedTables ?? FORCE_RLS_TABLES);\n  const tablePrivileges = options.tablePrivileges ?? RUNTIME_TABLE_PRIVILEGES;\n  const directRuntimeTables = new Set(Object.keys(tablePrivileges));\n  const protectedNoDirectDmlTables = new Set(\n    options.protectedNoDirectDmlTables ??\n      (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES),\n  );\n\n  if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {\n    violations.push(\n      `runtime identity must be ${expectedRole} (current_user=${identity.currentUser}, session_user=${identity.sessionUser})`,\n    );\n  }\n  if (!identity.canLogin) violations.push(\"runtime role is not LOGIN\");\n  if (identity.superuser) violations.push(\"runtime role is SUPERUSER\");\n  if (identity.bypassRls) violations.push(\"runtime role has BYPASSRLS\");\n  if (identity.createRole) violations.push(\"runtime role has CREATEROLE\");\n  if (identity.createDatabase) violations.push(\"runtime role has CREATEDB\");\n  if (identity.replication) violations.push(\"runtime role has REPLICATION\");\n  if (identity.inherit) violations.push(\"runtime role must be NOINHERIT\");\n  if (identity.databaseOwner === expectedRole) violations.push(\"runtime role owns the database\");\n  if (identity.canCreateInDatabase) {\n    violations.push(\"runtime role has CREATE on the current database\");\n  }\n  if (identity.rowSecurity.toLowerCase() !== \"on\") {\n    violations.push(`row_security is ${identity.rowSecurity}, expected on`);\n  }\n  if (posture.memberships.length > 0) {\n    violations.push(`runtime role has memberships: ${sorted(posture.memberships).join(\", \")}`);\n  }\n  if (posture.ownedSchemas.length > 0) {\n    violations.push(`runtime role owns schemas: ${sorted(posture.ownedSchemas).join(\", \")}`);\n  }\n  if (posture.ownedRelations.length > 0) {\n    violations.push(`runtime role owns relations: ${sorted(posture.ownedRelations).join(\", \")}`);\n  }\n\n  for (const schemaName of new Set([targetSchema, \"opengeni_private\"])) {\n    const schema = posture.schemas.find((candidate) => candidate.name === schemaName);\n    if (!schema) {\n      violations.push(`required schema ${schemaName} is missing`);\n      continue;\n    }\n    if (schema.owner === expectedRole) {\n      violations.push(`runtime role owns schema ${schemaName}`);\n    }\n    if (!schema.usage) violations.push(`runtime role lacks USAGE on schema ${schemaName}`);\n    if (schema.create) violations.push(`runtime role has CREATE on schema ${schemaName}`);\n  }\n\n  const tableByName = new Map(posture.tables.map((table) => [table.name, table]));\n  const actualRlsTables = new Set(\n    posture.tables.filter((table) => table.rlsEnabled).map((table) => table.name),\n  );\n  const classifiedProtectedTables = new Set([\n    ...directRuntimeTables,\n    ...protectedNoDirectDmlTables,\n  ]);\n  const unclassifiedProtectedTables = difference(protectedTables, classifiedProtectedTables);\n  if (unclassifiedProtectedTables.length > 0) {\n    violations.push(\n      `protected tables lack an explicit privilege class: ${unclassifiedProtectedTables.join(\", \")}`,\n    );\n  }\n  const protectedNoDirectDmlOverlap = difference(\n    protectedNoDirectDmlTables,\n    new Set([...protectedNoDirectDmlTables].filter((table) => !directRuntimeTables.has(table))),\n  );\n  if (protectedNoDirectDmlOverlap.length > 0) {\n    violations.push(\n      `protected no-direct-DML tables also declare runtime privileges: ${protectedNoDirectDmlOverlap.join(\", \")}`,\n    );\n  }\n  const nonProtectedNoDirectDmlTables = difference(protectedNoDirectDmlTables, protectedTables);\n  if (nonProtectedNoDirectDmlTables.length > 0) {\n    violations.push(\n      `no-direct-DML tables are absent from the protected contract: ${nonProtectedNoDirectDmlTables.join(\", \")}`,\n    );\n  }\n  const catalogTables = new Set(tableByName.keys());\n  const missingRuntimeTables = difference(directRuntimeTables, catalogTables);\n  if (missingRuntimeTables.length > 0) {\n    violations.push(`runtime privilege tables are missing: ${missingRuntimeTables.join(\", \")}`);\n  }\n  const missingTables = difference(protectedTables, catalogTables);\n  if (missingTables.length > 0) {\n    violations.push(`protected tables are missing: ${missingTables.join(\", \")}`);\n  }\n  const undeclaredRlsTables = difference(actualRlsTables, protectedTables);\n  if (undeclaredRlsTables.length > 0) {\n    violations.push(\n      `RLS tables are absent from the declared contract: ${undeclaredRlsTables.join(\", \")}`,\n    );\n  }\n\n  for (const table of posture.tables) {\n    const privileges = [\n      [\"SELECT\", table.select],\n      [\"INSERT\", table.insert],\n      [\"UPDATE\", table.update],\n      [\"DELETE\", table.delete],\n      [\"TRUNCATE\", table.truncate],\n      [\"REFERENCES\", table.references],\n      [\"TRIGGER\", table.trigger],\n    ] as const;\n    const expectedPrivileges = new Set<string>(tablePrivileges[table.name] ?? []);\n    if (table.owner === expectedRole) {\n      violations.push(`runtime role owns table ${table.name}`);\n    }\n    const missingPrivileges = privileges\n      .filter(([privilege, granted]) => expectedPrivileges.has(privilege) && !granted)\n      .map(([privilege]) => privilege);\n    if (missingPrivileges.length > 0) {\n      violations.push(\n        `table ${table.name} lacks required runtime privileges: ${missingPrivileges.join(\", \")}`,\n      );\n    }\n    const excessPrivileges = privileges\n      .filter(([privilege, granted]) => !expectedPrivileges.has(privilege) && granted)\n      .map(([privilege]) => privilege);\n    if (excessPrivileges.length > 0) {\n      violations.push(\n        `table ${table.name} grants excess runtime privileges: ${excessPrivileges.join(\", \")}`,\n      );\n    }\n  }\n\n  for (const tableName of protectedTables) {\n    const table = tableByName.get(tableName);\n    if (!table) continue;\n    if (!table.rlsEnabled) violations.push(`table ${tableName} does not ENABLE RLS`);\n    if (!table.rlsForced) violations.push(`table ${tableName} does not FORCE RLS`);\n    if (!table.rlsActive) violations.push(`table ${tableName} has inactive RLS for runtime role`);\n    if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);\n  }\n\n  const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;\n  for (const expectedRoutine of RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES) {\n    const matches = posture.targetRoutines.filter((routine) => routine.name === expectedRoutine);\n    if (matches.length !== 1) {\n      violations.push(\n        `target-schema runtime capability ${expectedRoutine} is missing or ambiguous`,\n      );\n      continue;\n    }\n    const routine = matches[0]!;\n    if (!routine.securityDefiner) {\n      violations.push(`target-schema runtime capability ${routine.name} is not SECURITY DEFINER`);\n    }\n    if (routine.name === KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE) {\n      const missingAuthorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (targetSchemaOwner && routine.owner !== targetSchemaOwner) {\n      violations.push(\n        `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match schema owner ${targetSchemaOwner}`,\n      );\n    }\n    if (!routine.execute) {\n      violations.push(`runtime role lacks target-schema capability ${routine.name}`);\n    }\n    if (routine.publicExecute) {\n      violations.push(`PUBLIC has forbidden target-schema capability ${routine.name}`);\n    }\n  }\n\n  const artifactOutbox = tableByName.get(\"editable_artifact_live_outbox\");\n  if (artifactOutbox) {\n    if (!artifactOutbox.artifactOutboxDispatcherPolicy) {\n      violations.push(\"table editable_artifact_live_outbox lacks its owner dispatcher RLS policy\");\n    }\n    for (const expectedRoutine of ARTIFACT_OUTBOX_CAPABILITY_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n      if (matches.length !== 1) {\n        violations.push(`artifact outbox capability ${expectedRoutine} is missing or ambiguous`);\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(`artifact outbox capability ${routine.name} is not SECURITY DEFINER`);\n      }\n      if (routine.owner !== artifactOutbox.owner) {\n        violations.push(\n          `artifact outbox capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactOutbox.owner}`,\n        );\n      }\n      if (routine.execute) {\n        violations.push(\n          `generic runtime role has forbidden global artifact outbox capability ${routine.name}`,\n        );\n      }\n    }\n  }\n\n  const artifactMaterializationJobs = tableByName.get(\"editable_artifact_materialization_jobs\");\n  if (artifactMaterializationJobs) {\n    for (const tableName of [\n      \"editable_artifact_materialization_jobs\",\n      \"editable_artifact_materialization_results\",\n      \"editable_artifact_blob_refs\",\n      \"editable_artifact_sequence_checkpoints\",\n      \"editable_artifact_versions\",\n      \"editable_artifact_idempotency_receipts\",\n    ]) {\n      const table = tableByName.get(tableName);\n      if (table && !table.artifactMaterializerPolicy) {\n        violations.push(`table ${tableName} lacks its owner materializer RLS policy`);\n      }\n    }\n    for (const expectedRoutine of ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n      if (matches.length !== 1) {\n        violations.push(\n          `artifact materializer capability ${expectedRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(`artifact materializer capability ${routine.name} is not SECURITY DEFINER`);\n      }\n      if (routine.owner !== artifactMaterializationJobs.owner) {\n        violations.push(\n          `artifact materializer capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactMaterializationJobs.owner}`,\n        );\n      }\n      if (routine.execute) {\n        violations.push(\n          `generic runtime role has forbidden global artifact materializer capability ${routine.name}`,\n        );\n      }\n    }\n  }\n  const artifactAuthority = tableByName.get(\"editable_artifacts\");\n  if (artifactAuthority) {\n    const matches = posture.privateRoutines.filter((routine) =>\n      routine.name.startsWith(\"advance_editable_artifact_authorization_revision(\"),\n    );\n    if (matches.length !== 1) {\n      violations.push(\n        \"editable artifact authorization revision capability is missing or ambiguous\",\n      );\n    } else {\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(\n          `editable artifact authorization revision capability ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (routine.owner !== artifactAuthority.owner) {\n        violations.push(\n          `editable artifact authorization revision capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`,\n        );\n      }\n    }\n    for (const expectedRoutine of ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES) {\n      const capabilityMatches = posture.privateRoutines.filter(\n        (routine) => routine.name === expectedRoutine,\n      );\n      if (capabilityMatches.length !== 1) {\n        violations.push(\n          `editable artifact authorization capability ${expectedRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = capabilityMatches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(\n          `editable artifact authorization capability ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (routine.owner !== artifactAuthority.owner) {\n        violations.push(\n          `editable artifact authorization capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(\n          `runtime role lacks editable artifact authorization capability ${routine.name}`,\n        );\n      }\n    }\n  }\n\n  const artifactLiveTickets = tableByName.get(\"editable_artifact_live_tickets\");\n  if (artifactLiveTickets) {\n    for (const expectedRoutine of ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n      if (matches.length !== 1) {\n        violations.push(\n          `artifact live ticket capability ${expectedRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(`artifact live ticket capability ${routine.name} is not SECURITY DEFINER`);\n      }\n      if (routine.owner !== artifactLiveTickets.owner) {\n        violations.push(\n          `artifact live ticket capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(`runtime role lacks artifact live ticket capability ${routine.name}`);\n      }\n    }\n    for (const internalRoutine of ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === internalRoutine);\n      if (matches.length !== 1) {\n        violations.push(\n          `artifact live ticket internal routine ${internalRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(\n          `artifact live ticket internal routine ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (routine.owner !== artifactLiveTickets.owner) {\n        violations.push(\n          `artifact live ticket internal routine ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`,\n        );\n      }\n      if (routine.execute) {\n        violations.push(`runtime role has forbidden ticket schema resolver ${routine.name}`);\n      }\n    }\n  }\n\n  if (posture.privateRoutines.length === 0) {\n    violations.push(\"opengeni_private has no helper routines\");\n  }\n  for (const routine of posture.privateRoutines) {\n    if (routine.owner === expectedRole) {\n      violations.push(`runtime role owns private routine ${routine.name}`);\n    }\n    const dedicatedArtifactCapability = DEDICATED_ARTIFACT_CAPABILITY_ROUTINES.has(routine.name);\n    if (!routine.execute && !dedicatedArtifactCapability) {\n      violations.push(`runtime role lacks EXECUTE on private routine ${routine.name}`);\n    }\n  }\n\n  return violations;\n}\n\nexport async function assertRuntimeDatabasePosture(\n  db: Database,\n  options: RuntimeDatabasePostureOptions,\n): Promise<RuntimeDatabasePosture> {\n  const posture = await inspectRuntimeDatabasePosture(db, options);\n  const violations = evaluateRuntimeDatabasePosture(posture, options);\n  if (violations.length > 0) {\n    throw new RuntimeDatabasePostureError(violations);\n  }\n  return posture;\n}\n\nexport function runtimeDatabaseReadyCheck(\n  db: Database,\n  options: RuntimeDatabasePostureOptions,\n): () => Promise<void> {\n  return async () => {\n    await assertRuntimeDatabasePosture(db, options);\n  };\n}\n","export type RoleRelationshipDirection = \"inherits\" | \"member\";\n\nexport type RoleRelationshipCatalogRow = {\n  relationship: string;\n  direction: RoleRelationshipDirection;\n  server_version_num: number;\n  admin_option: boolean | null;\n  inherit_option: boolean | null;\n  set_option: boolean | null;\n  member_is_superuser: boolean | null;\n  member_can_create_role: boolean | null;\n  grantor_role: string | null;\n  grantor_is_superuser: boolean | null;\n};\n\nexport type ClassifiedRoleRelationships = {\n  relationships: string[];\n  managementOnlyRelationships: string[];\n  unsafeRelationships: string[];\n};\n\ntype RoleTargetExpression = \"current_user\" | \"$1\";\n\n/**\n * One PostgreSQL 15-compatible catalog query for both provisioning and runtime\n * posture. PostgreSQL 16 added per-membership INHERIT and SET columns; reading\n * the catalog row through to_jsonb keeps this statement parseable on 15 while\n * leaving the missing options null and therefore fail-closed.\n */\nexport function roleRelationshipsCatalogQuery(targetRole: RoleTargetExpression): string {\n  return `\nwith recursive target_role(oid, rolname) as (\n  select oid, rolname\n  from pg_roles\n  where rolname = ${targetRole}\n), inherited_roles(oid, rolname) as (\n  select parent.oid, parent.rolname\n  from pg_auth_members membership\n  join target_role target on target.oid = membership.member\n  join pg_roles parent on parent.oid = membership.roleid\n  union\n  select parent.oid, parent.rolname\n  from inherited_roles inherited\n  join pg_auth_members membership on membership.member = inherited.oid\n  join pg_roles parent on parent.oid = membership.roleid\n), relationships as (\n  select\n    ('inherits:' || inherited.rolname)::text as relationship,\n    'inherits'::text as direction,\n    null::boolean as admin_option,\n    null::boolean as inherit_option,\n    null::boolean as set_option,\n    null::boolean as member_is_superuser,\n    null::boolean as member_can_create_role,\n    null::text as grantor_role,\n    null::boolean as grantor_is_superuser\n  from inherited_roles inherited\n  union all\n  select\n    ('member:' || member.rolname)::text as relationship,\n    'member'::text as direction,\n    membership.admin_option,\n    case\n      when current_setting('server_version_num')::integer >= 160000\n        then (to_jsonb(membership) ->> 'inherit_option')::boolean\n      else null::boolean\n    end as inherit_option,\n    case\n      when current_setting('server_version_num')::integer >= 160000\n        then (to_jsonb(membership) ->> 'set_option')::boolean\n      else null::boolean\n    end as set_option,\n    member.rolsuper as member_is_superuser,\n    member.rolcreaterole as member_can_create_role,\n    grantor.rolname::text as grantor_role,\n    grantor.rolsuper as grantor_is_superuser\n  from pg_auth_members membership\n  join target_role target on target.oid = membership.roleid\n  join pg_roles member on member.oid = membership.member\n  left join pg_roles grantor on grantor.oid = membership.grantor\n)\nselect\n  relationship,\n  direction,\n  current_setting('server_version_num')::integer as server_version_num,\n  admin_option,\n  inherit_option,\n  set_option,\n  member_is_superuser,\n  member_can_create_role,\n  grantor_role,\n  grantor_is_superuser\nfrom relationships\norder by relationship, direction, grantor_role nulls first\n`;\n}\n\n/**\n * PostgreSQL 16+ automatically gives a non-superuser CREATEROLE principal an\n * ADMIN-only grant on a role it creates. The exact edge below permits role\n * management but cannot inherit the app role's privileges or SET ROLE into it.\n */\nexport function isManagementOnlyRoleRelationship(row: RoleRelationshipCatalogRow): boolean {\n  return (\n    row.direction === \"member\" &&\n    row.server_version_num >= 160000 &&\n    row.admin_option === true &&\n    row.inherit_option === false &&\n    row.set_option === false &&\n    row.member_is_superuser === false &&\n    row.member_can_create_role === true &&\n    row.grantor_is_superuser === true\n  );\n}\n\nfunction sortedUnique(values: Iterable<string>): string[] {\n  return [...new Set(values)].sort((a, b) => a.localeCompare(b));\n}\n\n/** Classify exact management-only reverse grants while rejecting every other edge. */\nexport function classifyRoleRelationships(\n  rows: readonly RoleRelationshipCatalogRow[],\n): ClassifiedRoleRelationships {\n  const managementOnlyRows = rows.filter(isManagementOnlyRoleRelationship);\n  const unsafeRows = rows.filter((row) => !isManagementOnlyRoleRelationship(row));\n\n  return {\n    relationships: sortedUnique(rows.map((row) => row.relationship)),\n    managementOnlyRelationships: sortedUnique(managementOnlyRows.map((row) => row.relationship)),\n    unsafeRelationships: sortedUnique(unsafeRows.map((row) => row.relationship)),\n  };\n}\n"],"mappings":";AAAA,OAAO,cAAc;;;ACArB,SAAS,WAAW;;;AC6Bb,SAAS,8BAA8B,YAA0C;AACtF,SAAO;AAAA;AAAA;AAAA;AAAA,oBAIW,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6D9B;AAOO,SAAS,iCAAiC,KAA0C;AACzF,SACE,IAAI,cAAc,YAClB,IAAI,sBAAsB,QAC1B,IAAI,iBAAiB,QACrB,IAAI,mBAAmB,SACvB,IAAI,eAAe,SACnB,IAAI,wBAAwB,SAC5B,IAAI,2BAA2B,QAC/B,IAAI,yBAAyB;AAEjC;AAEA,SAAS,aAAa,QAAoC;AACxD,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAC/D;AAGO,SAAS,0BACd,MAC6B;AAC7B,QAAM,qBAAqB,KAAK,OAAO,gCAAgC;AACvE,QAAM,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC,iCAAiC,GAAG,CAAC;AAE9E,SAAO;AAAA,IACL,eAAe,aAAa,KAAK,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;AAAA,IAC/D,6BAA6B,aAAa,mBAAmB,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;AAAA,IAC3F,qBAAqB,aAAa,WAAW,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;AAAA,EAC7E;AACF;;;AD3HA,IAAM,sCAAsC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,4CAA4C;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,2CAA2C;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,yCAAyC;AAAA,EAC7C;AACF;AAEA,IAAM,6CAA6C;AAAA,EACjD;AACF;AAEA,IAAM,yCAAyC,oBAAI,IAAY;AAAA,EAC7D,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAED,IAAM,+CACJ;AACF,IAAM,8CAA8C;AAAA,EAClD;AAAA,EACA;AACF;AAEO,IAAM,4CAA4C;AAAA,EACvD;AACF;AAOO,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,6BAA6B,CAAC,sCAAsC;AAG1E,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,oCAAoC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,iCAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOA,IAAM,sBAAsB,CAAC,UAAU,UAAU,UAAU,QAAQ;AAG5D,IAAM,2BAA0D,OAAO,OAAO;AAAA,EACnF,GAAG,OAAO,YAAY,wBAAwB,IAAI,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAAA,EAC1F,GAAG,OAAO,YAAY,yBAAyB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAU,CAAC,CAAC;AAAA,EAC3F,GAAG,OAAO;AAAA,IACR,2BAA2B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,QAAQ,CAAU,CAAC;AAAA,EAClF;AAAA,EACA,GAAG,OAAO;AAAA,IACR,2BAA2B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,QAAQ,CAAU,CAAC;AAAA,EAClF;AAAA,EACA,GAAG,OAAO;AAAA,IACR,kCAAkC,IAAI,CAAC,UAAU;AAAA,MAC/C;AAAA,MACA,CAAC,UAAU,UAAU,QAAQ;AAAA,IAC/B,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,qBAAqB,OAAO;AAAA,EACvC,OAAO,KAAK,wBAAwB,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACzE;AA2EO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5C;AAAA,EAET,YAAY,YAA+B;AACzC,UAAM,0CAA0C,WAAW,KAAK,IAAI,CAAC,EAAE;AACvE,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAkBA,SAAS,WAAc,QAAsB;AAC3C,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,EACT;AACA,QAAM,OAAQ,QAAsC;AACpD,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,qEAAqE;AACvF;AAEA,SAAS,OAAO,QAAoC;AAClD,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACtD;AAEA,SAAS,WAAW,MAA2B,OAAsC;AACnF,SAAO,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAC9D;AAGA,eAAsB,8BACpB,IACA,SACiC;AACjC,QAAM,eAAe,QAAQ,cAAc,KAAK,KAAK;AAErD,SAAO,MAAM,GAAG;AAAA,IACd,OAAO,OAAO;AACZ,YAAM,eAAe;AAAA,QACnB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAkBhB;AAAA,MACH;AACA,YAAM,WAAW,aAAa,CAAC;AAC/B,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,MAAM,wEAAwE;AAAA,MAC1F;AAEA,YAAM,iBAA0C;AAAA,QAC9C,aAAa,SAAS;AAAA,QACtB,aAAa,SAAS;AAAA,QACtB,eAAe,SAAS;AAAA,QACxB,oBAAoB,SAAS;AAAA,QAC7B,qBAAqB,SAAS;AAAA,QAC9B,aAAa,SAAS;AAAA,QACtB,UAAU,SAAS;AAAA,QACnB,WAAW,SAAS;AAAA,QACpB,SAAS,SAAS;AAAA,QAClB,YAAY,SAAS;AAAA,QACrB,gBAAgB,SAAS;AAAA,QACzB,aAAa,SAAS;AAAA,QACtB,WAAW,SAAS;AAAA,MACtB;AAKA,UAAI,QAAQ,gBAAgB,UAAU;AACpC,eAAO;AAAA,UACL,UAAU;AAAA,UACV,aAAa,CAAC;AAAA,UACd,SAAS,CAAC;AAAA,UACV,cAAc,CAAC;AAAA,UACf,gBAAgB,CAAC;AAAA,UACjB,QAAQ,CAAC;AAAA,UACT,gBAAgB,CAAC;AAAA,UACjB,iBAAiB,CAAC;AAAA,QACpB;AAAA,MACF;AAEA,YAAM,mBAAmB;AAAA,QACvB,MAAM,GAAG,QAAQ,IAAI,IAAI,8BAA8B,cAAc,CAAC,CAAC;AAAA,MACzE;AACA,YAAM,cAAc,0BAA0B,gBAAgB,EAAE;AAEhE,YAAM,UAAU;AAAA,QAMd,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAOO,YAAY;AAAA;AAAA,SAEnC;AAAA,MACH;AAEA,YAAM,eAAe;AAAA,QACnB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAQhB;AAAA,MACH,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;AAEvB,YAAM,iBAAiB;AAAA,QACrB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAUhB;AAAA,MACH,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;AAEvB,YAAM,SAAS;AAAA,QAiBb,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8BA2BK,YAAY;AAAA;AAAA;AAAA,SAGjC;AAAA,MACH,EAAE,IAAI,CAAC,SAAS;AAAA,QACd,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,YAAY,IAAI;AAAA,QAChB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,gCAAgC,IAAI;AAAA,QACpC,4BAA4B,IAAI;AAAA,QAChC,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI;AAAA,MACf,EAAE;AAEF,YAAM,iBAAiB;AAAA,QAOrB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAgBT,YAAY;AAAA;AAAA;AAAA,8BAGE,YAAY;AAAA;AAAA;AAAA,SAGjC;AAAA,MACH,EAAE,IAAI,CAAC,SAAS;AAAA,QACd,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,SAAS,IAAI;AAAA,QACb,eAAe,IAAI;AAAA,QACnB,iBAAiB,IAAI;AAAA,MACvB,EAAE;AAEF,YAAM,kBAAkB;AAAA,QAMtB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAWhB;AAAA,MACH,EAAE,IAAI,CAAC,SAAS;AAAA,QACd,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,SAAS,IAAI;AAAA,QACb,iBAAiB,IAAI;AAAA,MACvB,EAAE;AAEF,aAAO;AAAA,QACL,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,EAAE,gBAAgB,mBAAmB,YAAY,YAAY;AAAA,EAC/D;AACF;AAGO,SAAS,+BACd,SACA,SACU;AACV,QAAM,aAAuB,CAAC;AAC9B,QAAM,WAAW,QAAQ;AAEzB,MAAI,CAAC,SAAS,eAAe,CAAC,SAAS,aAAa;AAClD,eAAW,KAAK,4BAA4B;AAAA,EAC9C;AACA,MAAI,SAAS,gBAAgB,SAAS,aAAa;AACjD,eAAW;AAAA,MACT,gBAAgB,SAAS,WAAW,gCAAgC,SAAS,WAAW;AAAA,IAC1F;AAAA,EACF;AACA,MAAI,CAAC,SAAS,oBAAoB;AAChC,eAAW,KAAK,oDAAoD;AAAA,EACtE;AAEA,MAAI,QAAQ,gBAAgB,UAAU;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,QAAQ,cAAc,KAAK,KAAK;AACrD,QAAM,eAAe,QAAQ,cAAc,KAAK,KAAK;AACrD,QAAM,kBAAkB,IAAI,IAAI,QAAQ,mBAAmB,gBAAgB;AAC3E,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,sBAAsB,IAAI,IAAI,OAAO,KAAK,eAAe,CAAC;AAChE,QAAM,6BAA6B,IAAI;AAAA,IACrC,QAAQ,+BACL,QAAQ,kBAAkB,CAAC,IAAI;AAAA,EACpC;AAEA,MAAI,SAAS,gBAAgB,gBAAgB,SAAS,gBAAgB,cAAc;AAClF,eAAW;AAAA,MACT,4BAA4B,YAAY,kBAAkB,SAAS,WAAW,kBAAkB,SAAS,WAAW;AAAA,IACtH;AAAA,EACF;AACA,MAAI,CAAC,SAAS,SAAU,YAAW,KAAK,2BAA2B;AACnE,MAAI,SAAS,UAAW,YAAW,KAAK,2BAA2B;AACnE,MAAI,SAAS,UAAW,YAAW,KAAK,4BAA4B;AACpE,MAAI,SAAS,WAAY,YAAW,KAAK,6BAA6B;AACtE,MAAI,SAAS,eAAgB,YAAW,KAAK,2BAA2B;AACxE,MAAI,SAAS,YAAa,YAAW,KAAK,8BAA8B;AACxE,MAAI,SAAS,QAAS,YAAW,KAAK,gCAAgC;AACtE,MAAI,SAAS,kBAAkB,aAAc,YAAW,KAAK,gCAAgC;AAC7F,MAAI,SAAS,qBAAqB;AAChC,eAAW,KAAK,iDAAiD;AAAA,EACnE;AACA,MAAI,SAAS,YAAY,YAAY,MAAM,MAAM;AAC/C,eAAW,KAAK,mBAAmB,SAAS,WAAW,eAAe;AAAA,EACxE;AACA,MAAI,QAAQ,YAAY,SAAS,GAAG;AAClC,eAAW,KAAK,iCAAiC,OAAO,QAAQ,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EAC3F;AACA,MAAI,QAAQ,aAAa,SAAS,GAAG;AACnC,eAAW,KAAK,8BAA8B,OAAO,QAAQ,YAAY,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EACzF;AACA,MAAI,QAAQ,eAAe,SAAS,GAAG;AACrC,eAAW,KAAK,gCAAgC,OAAO,QAAQ,cAAc,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7F;AAEA,aAAW,cAAc,oBAAI,IAAI,CAAC,cAAc,kBAAkB,CAAC,GAAG;AACpE,UAAM,SAAS,QAAQ,QAAQ,KAAK,CAAC,cAAc,UAAU,SAAS,UAAU;AAChF,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,mBAAmB,UAAU,aAAa;AAC1D;AAAA,IACF;AACA,QAAI,OAAO,UAAU,cAAc;AACjC,iBAAW,KAAK,4BAA4B,UAAU,EAAE;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,MAAO,YAAW,KAAK,sCAAsC,UAAU,EAAE;AACrF,QAAI,OAAO,OAAQ,YAAW,KAAK,qCAAqC,UAAU,EAAE;AAAA,EACtF;AAEA,QAAM,cAAc,IAAI,IAAI,QAAQ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;AAC9E,QAAM,kBAAkB,IAAI;AAAA,IAC1B,QAAQ,OAAO,OAAO,CAAC,UAAU,MAAM,UAAU,EAAE,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,EAC9E;AACA,QAAM,4BAA4B,oBAAI,IAAI;AAAA,IACxC,GAAG;AAAA,IACH,GAAG;AAAA,EACL,CAAC;AACD,QAAM,8BAA8B,WAAW,iBAAiB,yBAAyB;AACzF,MAAI,4BAA4B,SAAS,GAAG;AAC1C,eAAW;AAAA,MACT,sDAAsD,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9F;AAAA,EACF;AACA,QAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,IAAI,IAAI,CAAC,GAAG,0BAA0B,EAAE,OAAO,CAAC,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC,CAAC;AAAA,EAC5F;AACA,MAAI,4BAA4B,SAAS,GAAG;AAC1C,eAAW;AAAA,MACT,mEAAmE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,QAAM,gCAAgC,WAAW,4BAA4B,eAAe;AAC5F,MAAI,8BAA8B,SAAS,GAAG;AAC5C,eAAW;AAAA,MACT,gEAAgE,8BAA8B,KAAK,IAAI,CAAC;AAAA,IAC1G;AAAA,EACF;AACA,QAAM,gBAAgB,IAAI,IAAI,YAAY,KAAK,CAAC;AAChD,QAAM,uBAAuB,WAAW,qBAAqB,aAAa;AAC1E,MAAI,qBAAqB,SAAS,GAAG;AACnC,eAAW,KAAK,yCAAyC,qBAAqB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC5F;AACA,QAAM,gBAAgB,WAAW,iBAAiB,aAAa;AAC/D,MAAI,cAAc,SAAS,GAAG;AAC5B,eAAW,KAAK,iCAAiC,cAAc,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7E;AACA,QAAM,sBAAsB,WAAW,iBAAiB,eAAe;AACvE,MAAI,oBAAoB,SAAS,GAAG;AAClC,eAAW;AAAA,MACT,qDAAqD,oBAAoB,KAAK,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AAEA,aAAW,SAAS,QAAQ,QAAQ;AAClC,UAAM,aAAa;AAAA,MACjB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,YAAY,MAAM,QAAQ;AAAA,MAC3B,CAAC,cAAc,MAAM,UAAU;AAAA,MAC/B,CAAC,WAAW,MAAM,OAAO;AAAA,IAC3B;AACA,UAAM,qBAAqB,IAAI,IAAY,gBAAgB,MAAM,IAAI,KAAK,CAAC,CAAC;AAC5E,QAAI,MAAM,UAAU,cAAc;AAChC,iBAAW,KAAK,2BAA2B,MAAM,IAAI,EAAE;AAAA,IACzD;AACA,UAAM,oBAAoB,WACvB,OAAO,CAAC,CAAC,WAAW,OAAO,MAAM,mBAAmB,IAAI,SAAS,KAAK,CAAC,OAAO,EAC9E,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACjC,QAAI,kBAAkB,SAAS,GAAG;AAChC,iBAAW;AAAA,QACT,SAAS,MAAM,IAAI,uCAAuC,kBAAkB,KAAK,IAAI,CAAC;AAAA,MACxF;AAAA,IACF;AACA,UAAM,mBAAmB,WACtB,OAAO,CAAC,CAAC,WAAW,OAAO,MAAM,CAAC,mBAAmB,IAAI,SAAS,KAAK,OAAO,EAC9E,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACjC,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,SAAS,MAAM,IAAI,sCAAsC,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AAEA,aAAW,aAAa,iBAAiB;AACvC,UAAM,QAAQ,YAAY,IAAI,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,QAAI,CAAC,MAAM,WAAY,YAAW,KAAK,SAAS,SAAS,sBAAsB;AAC/E,QAAI,CAAC,MAAM,UAAW,YAAW,KAAK,SAAS,SAAS,qBAAqB;AAC7E,QAAI,CAAC,MAAM,UAAW,YAAW,KAAK,SAAS,SAAS,oCAAoC;AAC5F,QAAI,MAAM,cAAc,EAAG,YAAW,KAAK,SAAS,SAAS,oBAAoB;AAAA,EACnF;AAEA,QAAM,oBAAoB,QAAQ,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,YAAY,GAAG;AAC1F,aAAW,mBAAmB,2CAA2C;AACvE,UAAM,UAAU,QAAQ,eAAe,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC3F,QAAI,QAAQ,WAAW,GAAG;AACxB,iBAAW;AAAA,QACT,oCAAoC,eAAe;AAAA,MACrD;AACA;AAAA,IACF;AACA,UAAM,UAAU,QAAQ,CAAC;AACzB,QAAI,CAAC,QAAQ,iBAAiB;AAC5B,iBAAW,KAAK,oCAAoC,QAAQ,IAAI,0BAA0B;AAAA,IAC5F;AACA,QAAI,QAAQ,SAAS,8CAA8C;AACjE,YAAM,yBAAyB,4CAA4C;AAAA,QACzE,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,4CAA4C;AAAA,UAClE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,qBAAqB,QAAQ,UAAU,mBAAmB;AACnE,iBAAW;AAAA,QACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,gCAAgC,iBAAiB;AAAA,MAC1H;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS;AACpB,iBAAW,KAAK,+CAA+C,QAAQ,IAAI,EAAE;AAAA,IAC/E;AACA,QAAI,QAAQ,eAAe;AACzB,iBAAW,KAAK,iDAAiD,QAAQ,IAAI,EAAE;AAAA,IACjF;AAAA,EACF;AAEA,QAAM,iBAAiB,YAAY,IAAI,+BAA+B;AACtE,MAAI,gBAAgB;AAClB,QAAI,CAAC,eAAe,gCAAgC;AAClD,iBAAW,KAAK,2EAA2E;AAAA,IAC7F;AACA,eAAW,mBAAmB,qCAAqC;AACjE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW,KAAK,8BAA8B,eAAe,0BAA0B;AACvF;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW,KAAK,8BAA8B,QAAQ,IAAI,0BAA0B;AAAA,MACtF;AACA,UAAI,QAAQ,UAAU,eAAe,OAAO;AAC1C,mBAAW;AAAA,UACT,8BAA8B,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,eAAe,KAAK;AAAA,QACtH;AAAA,MACF;AACA,UAAI,QAAQ,SAAS;AACnB,mBAAW;AAAA,UACT,wEAAwE,QAAQ,IAAI;AAAA,QACtF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,8BAA8B,YAAY,IAAI,wCAAwC;AAC5F,MAAI,6BAA6B;AAC/B,eAAW,aAAa;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAG;AACD,YAAM,QAAQ,YAAY,IAAI,SAAS;AACvC,UAAI,SAAS,CAAC,MAAM,4BAA4B;AAC9C,mBAAW,KAAK,SAAS,SAAS,0CAA0C;AAAA,MAC9E;AAAA,IACF;AACA,eAAW,mBAAmB,2CAA2C;AACvE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW;AAAA,UACT,oCAAoC,eAAe;AAAA,QACrD;AACA;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW,KAAK,oCAAoC,QAAQ,IAAI,0BAA0B;AAAA,MAC5F;AACA,UAAI,QAAQ,UAAU,4BAA4B,OAAO;AACvD,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,4BAA4B,KAAK;AAAA,QACzI;AAAA,MACF;AACA,UAAI,QAAQ,SAAS;AACnB,mBAAW;AAAA,UACT,8EAA8E,QAAQ,IAAI;AAAA,QAC5F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,YAAY,IAAI,oBAAoB;AAC9D,MAAI,mBAAmB;AACrB,UAAM,UAAU,QAAQ,gBAAgB;AAAA,MAAO,CAAC,YAC9C,QAAQ,KAAK,WAAW,mDAAmD;AAAA,IAC7E;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,iBAAW;AAAA,QACT;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,uDAAuD,QAAQ,IAAI;AAAA,QACrE;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,kBAAkB,OAAO;AAC7C,mBAAW;AAAA,UACT,uDAAuD,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,kBAAkB,KAAK;AAAA,QAClJ;AAAA,MACF;AAAA,IACF;AACA,eAAW,mBAAmB,4CAA4C;AACxE,YAAM,oBAAoB,QAAQ,gBAAgB;AAAA,QAChD,CAACA,aAAYA,SAAQ,SAAS;AAAA,MAChC;AACA,UAAI,kBAAkB,WAAW,GAAG;AAClC,mBAAW;AAAA,UACT,8CAA8C,eAAe;AAAA,QAC/D;AACA;AAAA,MACF;AACA,YAAM,UAAU,kBAAkB,CAAC;AACnC,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,8CAA8C,QAAQ,IAAI;AAAA,QAC5D;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,kBAAkB,OAAO;AAC7C,mBAAW;AAAA,UACT,8CAA8C,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,kBAAkB,KAAK;AAAA,QACzI;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW;AAAA,UACT,iEAAiE,QAAQ,IAAI;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,sBAAsB,YAAY,IAAI,gCAAgC;AAC5E,MAAI,qBAAqB;AACvB,eAAW,mBAAmB,0CAA0C;AACtE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW;AAAA,UACT,mCAAmC,eAAe;AAAA,QACpD;AACA;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW,KAAK,mCAAmC,QAAQ,IAAI,0BAA0B;AAAA,MAC3F;AACA,UAAI,QAAQ,UAAU,oBAAoB,OAAO;AAC/C,mBAAW;AAAA,UACT,mCAAmC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,oBAAoB,KAAK;AAAA,QAChI;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW,KAAK,sDAAsD,QAAQ,IAAI,EAAE;AAAA,MACtF;AAAA,IACF;AACA,eAAW,mBAAmB,wCAAwC;AACpE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW;AAAA,UACT,yCAAyC,eAAe;AAAA,QAC1D;AACA;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,yCAAyC,QAAQ,IAAI;AAAA,QACvD;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,oBAAoB,OAAO;AAC/C,mBAAW;AAAA,UACT,yCAAyC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,oBAAoB,KAAK;AAAA,QACtI;AAAA,MACF;AACA,UAAI,QAAQ,SAAS;AACnB,mBAAW,KAAK,qDAAqD,QAAQ,IAAI,EAAE;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,gBAAgB,WAAW,GAAG;AACxC,eAAW,KAAK,yCAAyC;AAAA,EAC3D;AACA,aAAW,WAAW,QAAQ,iBAAiB;AAC7C,QAAI,QAAQ,UAAU,cAAc;AAClC,iBAAW,KAAK,qCAAqC,QAAQ,IAAI,EAAE;AAAA,IACrE;AACA,UAAM,8BAA8B,uCAAuC,IAAI,QAAQ,IAAI;AAC3F,QAAI,CAAC,QAAQ,WAAW,CAAC,6BAA6B;AACpD,iBAAW,KAAK,iDAAiD,QAAQ,IAAI,EAAE;AAAA,IACjF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,6BACpB,IACA,SACiC;AACjC,QAAM,UAAU,MAAM,8BAA8B,IAAI,OAAO;AAC/D,QAAM,aAAa,+BAA+B,SAAS,OAAO;AAClE,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAI,4BAA4B,UAAU;AAAA,EAClD;AACA,SAAO;AACT;AAEO,SAAS,0BACd,IACA,SACqB;AACrB,SAAO,YAAY;AACjB,UAAM,6BAA6B,IAAI,OAAO;AAAA,EAChD;AACF;;;ADlwCA,eAAsB,eACpB,iBACA,UAAiC,CAAC,GACR;AAC1B,QAAM,SAAS,mBAAmB,gBAAgB,QAAQ,gBAAgB,QAAQ;AAClF,QAAM,cAA2B,QAAQ,eAAe;AAExD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,YAAY,QAAQ,IAAI,4BAA4B,KAAK,KAAK;AAAA,EACxE;AACA,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,+BAA+B;AAAA,IACnC;AAAA,IACA,QAAQ,iCACL,QAAQ,IAAI,wCAAwC,KAAK,KACxD;AAAA,EACN;AACA,QAAM,mCACJ,QAAQ,oCACR,QAAQ,IAAI;AACd,QAAM,2BAA2B;AAAA,IAC/B;AAAA,IACA,QAAQ,6BACL,QAAQ,IAAI,8CAA8C,KAAK,KAC9D;AAAA,EACN;AACA,QAAM,+BACJ,QAAQ,gCACR,QAAQ,IAAI;AACd,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA,QAAQ,mBACL,QAAQ,IAAI,oCAAoC,KAAK,KAAK;AAAA,EAC/D;AACA,QAAM,qBACJ,QAAQ,sBAAsB,QAAQ,IAAI;AAC5C,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,QAAQ,iBACL,QAAQ,IAAI,iCAAiC,KAAK,KAAK;AAAA,EAC5D;AACA,QAAM,mBACJ,QAAQ,oBAAoB,QAAQ,IAAI;AAC1C,QAAM,qBACJ,QAAQ,qBACR,eAAe,QAAQ,IAAI,+BAA+B,8BAA8B,GACxF,IAAI,CAAC,SAAS,mBAAmB,qBAAqB,IAAI,CAAC;AAE7D,QAAMC,OAAM,SAAS,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAChD,MAAI;AAIF,QAAI,qBAAoC;AACxC,QAAI,gBAAgB,SAAS;AAC3B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAOA,YAAM,6BAA6BA,MAAK,OAAO;AAC/C,YAAM,6BAA6BA,MAAK,SAAS,WAAW;AAC5D,2BAAqB;AAAA,IACvB;AAEA,QAAI,0CAAyD;AAC7D,QAAI,kCAAkC;AACpC,YAAM,6BAA6BA,MAAK,4BAA4B;AACpE,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,gDAA0C;AAAA,IAC5C;AAEA,QAAI,sCAAqD;AACzD,QAAI,8BAA8B;AAChC,YAAM,6BAA6BA,MAAK,wBAAwB;AAChE,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,4CAAsC;AAAA,IACxC;AAEA,QAAI,kBAAkB;AACpB,YAAM,gBAAgBA,MAAK,cAAc,gBAAgB;AACzD,iBAAW,YAAY,mBAAmB;AACxC,cAAM,eAAeA,MAAK,UAAU,YAAY;AAChD,cAAM,4BAA4B,iBAAiB,UAAU,YAAY;AAAA,MAC3E;AAAA,IACF;AAEA,QAAI,oBAAoB;AACtB,YAAM,gBAAgBA,MAAK,gBAAgB,kBAAkB;AAC7D,YAAM,kCAAkCA,MAAK,cAAc;AAAA,IAC7D;AAEA,QAAI,gBAAgB,SAAS;AAC3B,YAAM,2BAA2BA,MAAK,SAAS,MAAM;AAAA,IACvD;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,8BAA8B;AAAA,MAC9B,0BAA0B;AAAA,MAC1B,gBAAgB,qBAAqB,iBAAiB;AAAA,MACtD,cAAc,mBAAmB,eAAe;AAAA,MAChD,mBAAmB,mBAAmB,oBAAoB,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAMA,KAAI,IAAI;AAAA,EAChB;AACF;AAOA,eAAe,kCAAkCA,MAAmB,MAA6B;AAC/F,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA;AAAA,yEAIsD,QAAQ,IAAI,CAAC;AAAA,4FACM,QAAQ,IAAI,CAAC;AAAA,iHACQ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAG7H;AACD;AAEA,eAAe,0CACbA,MACA,MACA,YACA,YACe;AACf,QAAM,WACJ,eAAe,WACX;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACN,QAAM,eAAe,SAAS,SAAS,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAC9D,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA;AAAA,0DAIuC,QAAQ,UAAU,CAAC;AAAA;AAAA;AAAA,+EAGE,QAAQ,IAAI,CAAC;AAAA,uDACrC,QAAQ,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qEACvB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,QAG1E,QAAQ,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,QAIrC,QAAQ,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,QAIrC,QAAQ,IAAI,CAAC;AAAA;AAAA,yCAEoB,YAAY;AAAA;AAAA;AAAA;AAAA,+BAItB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAM3C;AACD;AAEA,eAAe,gBAAgBA,MAAmB,MAAc,UAAiC;AAC/F,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,IAAI,CAAC;AAAA,yDACd,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA,wDAEpC,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA,CAG1F;AACD;AAEA,eAAe,6BACbA,MACA,MACA,UACe;AACf,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,QAG/D,QAAQ,IAAI,CAAC;AAAA,QACb,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjB,QAAQ,IAAI,CAAC;AAAA,QACb,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUjB,QAAQ,IAAI,CAAC;AAAA,QACb,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,CAIxB;AACD;AAOA,eAAe,6BAA6BA,MAAmB,MAA6B;AAC1F,QAAM,SAAS,MAAMA;AAAA,2DACoC,IAAI;AAAA;AAE7D,MAAI,CAAC,OAAO,CAAC,GAAG,QAAQ;AACtB;AAAA,EACF;AAEA,QAAM,CAAC,cAAc,IAAI,MAAMA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAiBP,IAAI;AAAA;AAE5B,MAAI,kBAAkB,CAAC,eAAe,yBAAyB;AAC7D,UAAM,sBAAsB;AAAA,MAC1B,eAAe,gBAAgB,cAAc;AAAA,MAC7C,eAAe,iBAAiB,cAAc;AAAA,MAC9C,eAAe,sBAAsB,aAAa;AAAA,MAClD,eAAe,kBAAkB,gBAAgB;AAAA,IACnD,EAAE,OAAO,CAAC,cAAmC,cAAc,IAAI;AAC/D,QAAI,oBAAoB,SAAS,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,kCAAkC,IAAI,sEAAsE,oBAAoB,KAAK,IAAI,CAAC;AAAA,MAC5I;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmB,MAAMA,KAAI;AAAA,IACjC,8BAA8B,IAAI;AAAA,IAClC,CAAC,IAAI;AAAA,EACP;AACA,QAAM,EAAE,oBAAoB,IAAI,0BAA0B,gBAAgB;AAC1E,MAAI,oBAAoB,SAAS,GAAG;AAClC,UAAM,IAAI;AAAA,MACR,kCAAkC,IAAI,wDAAwD,oBAAoB,KAAK,IAAI,CAAC;AAAA,IAC9H;AAAA,EACF;AAEA,QAAM,eAAe,MAAMA;AAAA;AAAA;AAAA;AAAA,4BAID,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,4BAKJ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAQJ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAWJ,IAAI;AAAA;AAAA;AAAA;AAAA;AAK9B,MAAI,aAAa,SAAS,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,kCAAkC,IAAI,mCAAmC,aACtE,IAAI,CAAC,QAAQ,IAAI,WAAW,EAC5B,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AACF;AAEA,eAAe,eAAeA,MAAmB,UAAkB,OAA8B;AAC/F,QAAM,WAAW,MAAMA;AAAA,8DACqC,QAAQ;AAAA;AAEpE,MAAI,CAAC,SAAS,CAAC,GAAG,QAAQ;AACxB,UAAMA,KAAI,OAAO,mBAAmB,WAAW,QAAQ,CAAC,UAAU,WAAW,KAAK,CAAC,EAAE;AAAA,EACvF;AACA,QAAMA,KAAI;AAAA,IACR,oCAAoC,WAAW,QAAQ,CAAC,OAAO,WAAW,KAAK,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,4BACb,iBACA,UACA,MACe;AACf,QAAM,cAAc,eAAe,iBAAiB,QAAQ;AAC5D,QAAM,cAAc,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AACpD,MAAI;AACF,UAAM,YAAY,OAAO,2CAA2C,WAAW,IAAI,CAAC,EAAE;AAAA,EACxF,UAAE;AACA,UAAM,YAAY,IAAI;AAAA,EACxB;AACF;AAQA,eAAe,2BACbA,MACA,MACA,QACe;AACf,QAAM,uBAAuB,SAAS,wBAAwB,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACrF,QAAM,wBAAwB,SAAS,yBAAyB,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACvF,QAAM,0BAA0B,SAAS,2BAA2B,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAC3F,QAAM,0BAA0B,SAAS,2BAA2B,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAC3F,QAAM,gCAAgC,SAAS,kCAAkC,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACxG,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+EAM4D,QAAQ,IAAI,CAAC;AAAA,0DAClC,QAAQ,MAAM,CAAC;AAAA,uDAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,2DAC7B,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,iFACX,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qCAC7E,oBAAoB;AAAA,uCAClB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,qBAAqB;AAAA,uCACnB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,uBAAuB;AAAA,uCACrB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,uBAAuB;AAAA,uCACrB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,6BAA6B;AAAA,uCAC3B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6DASoC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIlE,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,4DAIqC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIjE,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,6EAIsD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIlF,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,gEAIyC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIrE,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAUb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,gFAGyD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,QAIzG,QAAQ,MAAM,CAAC;AAAA,QACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,QAKb,QAAQ,MAAM,CAAC;AAAA,QACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qEAIgD,QAAQ,IAAI,CAAC;AAAA,yEACT,QAAQ,IAAI,CAAC;AAAA,wFACE,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,QAI7F,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQX,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,CAKtB;AACD;AAEA,SAAS,eAAe,OAAyB;AAC/C,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACnB;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,6CAA6C,KAAK,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,QAAQ,OAAuB;AACtC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,eAAe,OAAe,UAA0B;AAC/D,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,WAAW,IAAI,QAAQ;AAC3B,SAAO,IAAI,SAAS;AACtB;AAMA,IAAI,YAAY,MAAM;AACpB,QAAM,WACJ,QAAQ,IAAI,oCACZ,QAAQ,IAAI,+BACZ,QAAQ,IAAI;AACd,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,UAAU;AAAA,IAC5C,GAAI,QAAQ,IAAI,oBAAoB,KAAK,IACrC,EAAE,cAAc,QAAQ,IAAI,mBAAmB,KAAK,EAAE,IACtD,CAAC;AAAA,EACP,CAAC;AACD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;","names":["routine","sql"]}

package/dist/integration-features.d.ts

@@ -1,99 +0,0 @@
-import { type Database } from "./database.js";
-export type IntegrationFeatureKind = "knowledge_source" | "inbound_trigger" | "delivery_destination" | "identity_link";
-export type IntegrationFeatureBindingSummary = {
-    id: string;
-    featureKey: string;
-    kind: IntegrationFeatureKind;
-    bindingKey: string;
-    displayName: string;
-    connectionId: string | null;
-    status: "active" | "paused" | "needs_attention" | "disabled";
-    config: Record<string, unknown>;
-    version: number;
-    hasCursor: boolean;
-    lastSuccessAt: string | null;
-    lastErrorCode: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-export type IntegrationFeatureDefinitionSummary = {
-    featureKey: string;
-    kind: IntegrationFeatureKind;
-    configSchema: Record<string, unknown>;
-    capabilities: Record<string, unknown>;
-};
-export type IntegrationInstanceFeatures = {
-    capabilityId: string;
-    instanceKey: string;
-    providerDomain: string;
-    connectionId: string | null;
-    features: {
-        definition: IntegrationFeatureDefinitionSummary;
-        binding: IntegrationFeatureBindingSummary | null;
-    }[];
-};
-export type IntegrationFeatureMutationResult = {
-    capabilityId: string;
-    instanceKey: string;
-    featureKey: string;
-    status: "configured" | "paused" | "active";
-    binding: IntegrationFeatureBindingSummary;
-};
-export type IntegrationFeatureRemovalResult = {
-    capabilityId: string;
-    instanceKey: string;
-    featureKey: string;
-    status: "not_configured" | "removed" | "retained_by_other_owners";
-    binding: IntegrationFeatureBindingSummary | null;
-    remainingOwners: {
-        kind: "direct" | "plugin" | "pack" | "migration";
-        id: string;
-        removable: boolean;
-    }[];
-};
-export declare class IntegrationFeatureNotFoundError extends Error {
-    readonly name = "IntegrationFeatureNotFoundError";
-}
-export declare class IntegrationFeatureConnectionError extends Error {
-    readonly name = "IntegrationFeatureConnectionError";
-}
-export declare class IntegrationFeatureConfigError extends Error {
-    readonly name = "IntegrationFeatureConfigError";
-}
-export declare class IntegrationFeatureOperationIdempotencyError extends Error {
-    readonly name = "IntegrationFeatureOperationIdempotencyError";
-}
-export declare function listIntegrationInstanceFeatures(db: Database, workspaceId: string, subjectId: string, capabilityId: string, instanceKey: string): Promise<IntegrationInstanceFeatures>;
-export declare function configureIntegrationFeature(db: Database, input: {
-    accountId: string;
-    workspaceId: string;
-    subjectId: string;
-    capabilityId: string;
-    instanceKey: string;
-    featureKey: string;
-    displayName: string;
-    config: Record<string, unknown>;
-    expectedVersion?: number;
-    idempotencyKey: string;
-}): Promise<IntegrationFeatureMutationResult>;
-export declare function setIntegrationFeatureLifecycle(db: Database, input: {
-    accountId: string;
-    workspaceId: string;
-    subjectId: string;
-    capabilityId: string;
-    instanceKey: string;
-    featureKey: string;
-    action: "pause" | "resume";
-    expectedVersion: number;
-    idempotencyKey: string;
-}): Promise<IntegrationFeatureMutationResult>;
-export declare function removeIntegrationFeature(db: Database, input: {
-    accountId: string;
-    workspaceId: string;
-    subjectId: string;
-    capabilityId: string;
-    instanceKey: string;
-    featureKey: string;
-    expectedVersion: number;
-    idempotencyKey: string;
-}): Promise<IntegrationFeatureRemovalResult>;