@opengeni/db 0.36.1 → 3.1.0-canary.0

package/dist/chunk-OF5OBB76.js

@@ -0,0 +1,4457 @@
+// src/provision-roles.ts
+import postgres from "postgres";
+
+// src/runtime-posture.ts
+import { sql } from "drizzle-orm";
+
+// src/role-relationships.ts
+function roleRelationshipsCatalogQuery(targetRole) {
+  return `
+with recursive target_role(oid, rolname) as (
+  select oid, rolname
+  from pg_roles
+  where rolname = ${targetRole}
+), inherited_roles(oid, rolname) as (
+  select parent.oid, parent.rolname
+  from pg_auth_members membership
+  join target_role target on target.oid = membership.member
+  join pg_roles parent on parent.oid = membership.roleid
+  union
+  select parent.oid, parent.rolname
+  from inherited_roles inherited
+  join pg_auth_members membership on membership.member = inherited.oid
+  join pg_roles parent on parent.oid = membership.roleid
+), relationships as (
+  select
+    ('inherits:' || inherited.rolname)::text as relationship,
+    'inherits'::text as direction,
+    null::boolean as admin_option,
+    null::boolean as inherit_option,
+    null::boolean as set_option,
+    null::boolean as member_is_superuser,
+    null::boolean as member_can_create_role,
+    null::text as grantor_role,
+    null::boolean as grantor_is_superuser
+  from inherited_roles inherited
+  union all
+  select
+    ('member:' || member.rolname)::text as relationship,
+    'member'::text as direction,
+    membership.admin_option,
+    case
+      when current_setting('server_version_num')::integer >= 160000
+        then (to_jsonb(membership) ->> 'inherit_option')::boolean
+      else null::boolean
+    end as inherit_option,
+    case
+      when current_setting('server_version_num')::integer >= 160000
+        then (to_jsonb(membership) ->> 'set_option')::boolean
+      else null::boolean
+    end as set_option,
+    member.rolsuper as member_is_superuser,
+    member.rolcreaterole as member_can_create_role,
+    grantor.rolname::text as grantor_role,
+    grantor.rolsuper as grantor_is_superuser
+  from pg_auth_members membership
+  join target_role target on target.oid = membership.roleid
+  join pg_roles member on member.oid = membership.member
+  left join pg_roles grantor on grantor.oid = membership.grantor
+)
+select
+  relationship,
+  direction,
+  current_setting('server_version_num')::integer as server_version_num,
+  admin_option,
+  inherit_option,
+  set_option,
+  member_is_superuser,
+  member_can_create_role,
+  grantor_role,
+  grantor_is_superuser
+from relationships
+order by relationship, direction, grantor_role nulls first
+`;
+}
+function isManagementOnlyRoleRelationship(row) {
+  return row.direction === "member" && row.server_version_num >= 16e4 && row.admin_option === true && row.inherit_option === false && row.set_option === false && row.member_is_superuser === false && row.member_can_create_role === true && row.grantor_is_superuser === true;
+}
+function sortedUnique(values) {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+function classifyRoleRelationships(rows) {
+  const managementOnlyRows = rows.filter(isManagementOnlyRoleRelationship);
+  const unsafeRows = rows.filter((row) => !isManagementOnlyRoleRelationship(row));
+  return {
+    relationships: sortedUnique(rows.map((row) => row.relationship)),
+    managementOnlyRelationships: sortedUnique(managementOnlyRows.map((row) => row.relationship)),
+    unsafeRelationships: sortedUnique(unsafeRows.map((row) => row.relationship))
+  };
+}
+
+// src/runtime-posture.ts
+var ARTIFACT_OUTBOX_CAPABILITY_ROUTINES = [
+  "claim_editable_artifact_live_outbox(text, integer, integer, name)",
+  "mark_editable_artifact_live_outbox_published(text, text, integer, name)",
+  "renew_editable_artifact_live_outbox(text, text, integer, integer, name)",
+  "retry_editable_artifact_live_outbox(text, text, integer, integer, text, name)",
+  "dead_letter_editable_artifact_live_outbox(text, text, integer, text, name)",
+  "release_editable_artifact_live_outbox(text, text, integer, name)"
+];
+var ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES = [
+  "claim_editable_artifact_materializations(text, integer, integer, name)",
+  "renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name)",
+  "succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamp with time zone, name)",
+  "fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name)"
+];
+var ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES = [
+  "put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamp with time zone, timestamp with time zone, name)",
+  "consume_editable_artifact_live_ticket(text, name)",
+  "cleanup_expired_editable_artifact_live_tickets(integer, name)"
+];
+var ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES = [
+  "resolve_editable_artifact_ticket_data_schema(name)"
+];
+var ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES = [
+  "authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name)"
+];
+var DEDICATED_ARTIFACT_CAPABILITY_ROUTINES = /* @__PURE__ */ new Set([
+  ...ARTIFACT_OUTBOX_CAPABILITY_ROUTINES,
+  ...ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES,
+  ...ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES
+]);
+var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE = "knowledge_source_sync_lock_authority(uuid, uuid, uuid)";
+var GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE = "google_drive_file_authorized(uuid, uuid, text, uuid)";
+var GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE = "google_drive_document_citation(uuid, uuid, text, uuid, uuid)";
+var GOOGLE_DRIVE_AUTHORITY_TABLES = [
+  "connections",
+  "files",
+  "google_drive_object_acl_evidence",
+  "google_drive_object_acl_principals",
+  "knowledge_document_versions",
+  "knowledge_providers",
+  "knowledge_source_objects",
+  "knowledge_source_sync_index_obligations",
+  "knowledge_source_sync_states",
+  "knowledge_sources"
+];
+var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [
+  "knowledge_sources",
+  "knowledge_source_objects"
+];
+var MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE = "ensure_managed_human_personal_workspace(uuid, text, uuid)";
+var ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [
+  "list_self_organization_memberships(text)",
+  "list_self_organization_invitations(text)",
+  "list_self_organization_invitations(text, uuid, integer)",
+  "get_self_organization_invitation(text, uuid)",
+  "list_organization_invitations(uuid, text, uuid, integer)",
+  "list_organization_members(uuid, text)",
+  "get_organization_administration_overview(uuid, text)",
+  "create_managed_organization(text, text, text, uuid)",
+  "assert_organization_shared_workspace_administrator(uuid, uuid, text)",
+  "open_organization_shared_workspace_administration_capability(uuid, uuid, text)",
+  "close_organization_shared_workspace_administration_capability(uuid)",
+  "create_organization_shared_workspace(uuid, text, text, text, text, uuid)",
+  "upsert_organization_shared_workspace_member(uuid, uuid, text, uuid, text, text, jsonb, boolean)",
+  "update_organization_name(uuid, text, text, timestamp with time zone, uuid)",
+  "create_organization_invitation_v2(jsonb)",
+  "bind_pending_organization_invitations_for_verified_email(text, text)",
+  "has_pending_organization_invitation_for_subject(text)",
+  "accept_organization_invitation_v2(jsonb)",
+  "organization_membership_command(jsonb)",
+  "prepare_organization_membership_protocol_settlements(jsonb)",
+  "assert_active_managed_human_organization_membership(uuid, text)",
+  "resolve_workspace_writer_grant_identity(uuid, text)",
+  "prepare_workspace_membership_removal_settlements(jsonb)",
+  "workspace_membership_removal_command(jsonb)",
+  "get_organization_retention_policy(uuid, text)",
+  "preview_organization_retention_deletions(uuid, integer)",
+  "claim_organization_retention_deletion(uuid, uuid, uuid[])",
+  "list_organization_retention_deletion_objects(uuid, uuid, uuid, text, integer)",
+  "record_organization_retention_object_deleted(uuid, uuid, uuid, text, text, text, text)",
+  "fail_organization_retention_deletion(uuid, uuid, uuid, text)",
+  "finalize_organization_retention_deletion(uuid, uuid, uuid, text)",
+  "complete_organization_retention_deletion(uuid, uuid, uuid, text)"
+];
+var ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES = [
+  "organization_invitation_binding_events",
+  "organization_membership_invitations",
+  "organization_membership_lifecycle_events",
+  "organization_membership_operation_receipts",
+  "organization_memberships",
+  "organization_profile_events",
+  "organization_shared_workspace_administration_capabilities",
+  "organization_user_resource_authorities",
+  "organization_user_resource_grants",
+  "organization_user_retention_deletion_events",
+  "organization_user_retention_deletions",
+  "organization_user_retention_object_deletion_receipts",
+  "organization_user_retention_object_obligations",
+  "organization_user_retention_policies"
+];
+var PRIVATE_SESSION_CREATE_POLICY_ROUTINE = "get_private_session_create_policy(uuid, uuid, text)";
+var ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE = "get_organization_private_session_settings(uuid, text)";
+var ORGANIZATION_PRIVATE_SESSION_SETTINGS_UPDATE_ROUTINE = "update_organization_private_session_settings(uuid, text, boolean, bigint, uuid)";
+var ORGANIZATION_PRIVATE_SESSION_ROUTINE_AUTHORITY_TABLES = {
+  [PRIVATE_SESSION_CREATE_POLICY_ROUTINE]: [
+    "organization_memberships",
+    "organization_private_session_settings",
+    "session_tenancy_activations",
+    "workspace_memberships",
+    "workspaces"
+  ],
+  [ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE]: [
+    "managed_accounts",
+    "organization_memberships",
+    "organization_private_session_settings",
+    "session_tenancy_activations"
+  ],
+  [ORGANIZATION_PRIVATE_SESSION_SETTINGS_UPDATE_ROUTINE]: [
+    "managed_accounts",
+    "organization_memberships",
+    "organization_private_session_setting_events",
+    "organization_private_session_settings",
+    "session_tenancy_activations"
+  ]
+};
+var ORGANIZATION_PRIVATE_SESSION_ROUTINES = Object.keys(
+  ORGANIZATION_PRIVATE_SESSION_ROUTINE_AUTHORITY_TABLES
+);
+var ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE = "organization_private_sessions_enabled(uuid)";
+var PREFERENCE_KNOWLEDGE_PROPOSAL_ROUTINE = "preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamp with time zone, text)";
+var PREFERENCE_KNOWLEDGE_PROPOSAL_AUTHORITY_TABLES = [
+  "company_brain_preference_proposal_receipts",
+  "knowledge_change_proposals",
+  "knowledge_claim_evidence",
+  "knowledge_claim_reviews",
+  "knowledge_claims",
+  "preference_registry_events",
+  "preference_registry_preferences",
+  "preference_registry_revisions",
+  "session_attempt_interruptions",
+  "session_turn_attempts",
+  "session_turns",
+  "sessions",
+  "workspaces"
+];
+var MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES = [
+  "organization_memberships",
+  "organization_user_retention_policies",
+  "organization_user_resource_authorities",
+  "organization_user_resource_grants"
+];
+var PERSONAL_RESOURCE_ATTEMPT_RESOLVER_ROUTINE = "resolve_session_attempt_personal_resources(uuid, uuid, uuid)";
+var USER_RESOURCE_LIFECYCLE_ROUTINES = [
+  "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)",
+  "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)",
+  "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)",
+  "revoke_self_user_resource_grant(uuid, uuid, uuid)",
+  "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)"
+];
+var CONNECTION_AUTHORITY_ROUTINES = [
+  "resolve_personal_connection_authority_selection(uuid, uuid, text, uuid, jsonb)",
+  "resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)",
+  "resolve_connection_use_authority(uuid, uuid, uuid, jsonb)"
+];
+var PERSONAL_GITHUB_REPOSITORY_AUTHORITY_ROUTINES = [
+  "get_self_personal_github_repository_selection(uuid, uuid, text, uuid)",
+  "mutate_self_personal_github_repository_selection(uuid, uuid, text, uuid, bigint, bigint, text, jsonb, boolean)"
+];
+var PERSONAL_GITHUB_REPOSITORY_AUTHORITY_TABLES = [
+  "personal_github_repository_selection_heads",
+  "personal_github_repository_selection_operations",
+  "personal_github_repository_selections"
+];
+var SCHEDULED_PERSONAL_RESOURCE_ROUTINES = [
+  "freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint)",
+  "clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint)",
+  "refresh_scheduled_task_personal_resources_clone_connections(uuid, uuid, uuid, bigint, bigint)",
+  "create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb)",
+  "materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text)",
+  "scheduled_task_run_personal_resource_authority(uuid, uuid, uuid)",
+  "scheduled_task_run_connection_authority_subject(uuid, uuid, uuid)",
+  "scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint)",
+  "record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint)",
+  "clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint)",
+  "scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint)",
+  "scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint)",
+  "validate_scheduled_agent_run_live_authority(uuid, uuid, uuid)",
+  "scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid)",
+  "scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)",
+  "bind_scheduled_task_run_session(uuid, uuid, uuid, uuid)",
+  "transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text)"
+];
+var PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE = "personal_resource_delegation_capability_active(text)";
+var PERSONAL_RESOURCE_CAPABILITY_TABLE = "personal_resource_delegation_capabilities";
+var SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE = "scheduled_personal_resource_capability_active(text)";
+var SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE = "scheduled_personal_resource_capabilities";
+var VARIABLE_SET_CAPABILITY_PREDICATE_ROUTINE = "variable_set_authority_capability_active(text)";
+var VARIABLE_SET_CAPABILITY_TABLE = "variable_set_authority_capabilities";
+var PERSONAL_DOCUMENT_CAPABILITY_PREDICATE_ROUTINE = "personal_document_authority_capability_active(text)";
+var PERSONAL_DOCUMENT_CAPABILITY_TABLE = "personal_document_authority_capabilities";
+var PERSONAL_DOCUMENT_AUTHORITY_ROUTINES = [
+  "create_personal_document_authority(uuid, uuid, uuid)",
+  "resolve_document_original_file(uuid, uuid, text, uuid)",
+  "resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)"
+];
+var DOCUMENT_MIGRATION_CAPABILITY_PREDICATE_ROUTINE = "document_migration_capability_active(text)";
+var DOCUMENT_MIGRATION_CAPABILITY_TABLE = "document_migration_capabilities";
+var DOCUMENT_MIGRATION_AUTHORITY_ROUTINES = [
+  "list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)",
+  "reclassify_document_authority(jsonb)",
+  "run_document_default_collection_backfill(jsonb)"
+];
+var VARIABLE_SET_AUTHORITY_ROUTINES = [
+  "create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)",
+  "list_scoped_variable_sets(uuid, uuid, uuid, text, text)",
+  "count_scoped_variable_sets(uuid, uuid, text)",
+  "mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean)",
+  "read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer)",
+  "materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)",
+  "materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid)"
+];
+var SCOPED_COMPUTE_CAPABILITY_PREDICATE_ROUTINE = "scoped_compute_capability_active(text)";
+var SCOPED_COMPUTE_CAPABILITY_TABLE = "scoped_compute_capabilities";
+var CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE = "connection_tenancy_backfill_capabilities";
+var CONNECTION_TENANCY_BACKFILL_CAPABILITY_PREDICATE_ROUTINE = "connection_tenancy_backfill_capability_active(uuid)";
+var SCOPED_COMPUTE_AUTHORITY_ROUTINES = [
+  "create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean)",
+  "list_scoped_rigs(uuid, uuid, uuid, text, text)",
+  "count_scoped_rigs(uuid, uuid, text)",
+  "mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean)",
+  "finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean)",
+  "list_scoped_enrollments(uuid, uuid, uuid, text)",
+  "get_scoped_sandbox(uuid, uuid, uuid)",
+  "authorize_scoped_sandbox_attach(uuid, uuid, uuid)",
+  "materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer)",
+  "authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid)",
+  "assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean)",
+  "list_scoped_machine_dependent_sessions(uuid, uuid, uuid)",
+  "detach_scoped_machine_dependent_sessions(uuid, uuid, uuid)"
+];
+var CANONICAL_HUMAN_IDENTITY_ROUTINES = [
+  "ensure_canonical_human_identity(text, text)",
+  "validate_canonical_human_session(text, text, boolean)",
+  "get_canonical_human_identity_projection(text)",
+  "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)"
+];
+var CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES = [
+  "canonical_human_identities",
+  "canonical_human_identity_subjects",
+  "canonical_human_login_bindings",
+  "canonical_human_identity_operations"
+];
+var SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE = "session_private_actor_visible(uuid, uuid, uuid, text)";
+var SESSION_REFERENCE_VISIBLE_ROUTINE = "session_reference_visible(uuid, uuid, uuid)";
+var TASK_NOTE_CAPABILITY_ROUTINES = [
+  "create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)",
+  "archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)",
+  "list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)",
+  "replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)",
+  "resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)"
+];
+var COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE = "company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer)";
+var COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE = "company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamp with time zone, uuid, integer)";
+var GOVERNED_LEARNING_EVALUATION_ROUTINE = "evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)";
+var GOVERNED_LEARNING_ACTIVATION_ROUTINES = [
+  "activate_governed_learning_decision(uuid, uuid, uuid, uuid)",
+  "activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid)",
+  "confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)",
+  "undo_governed_learning_activation(uuid, uuid, uuid, uuid)"
+];
+var GOVERNED_LEARNING_INSPECTION_ROUTINES = [
+  "inspect_governed_learning_decisions(uuid, uuid, text, integer)",
+  "inspect_governed_learning_activations(uuid, uuid, text, integer)",
+  "inspect_governed_learning_activation_undos(uuid, uuid, text, integer)"
+];
+var GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES = [
+  "governed_learning_decision_receipts",
+  "governed_learning_activation_receipts",
+  "governed_learning_activation_undo_receipts",
+  "sessions"
+];
+var COMPANY_PROFILE_AGENT_ADMIN_ROUTINES = [
+  "propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)",
+  "confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)"
+];
+var COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES = [
+  "company_profile_activation_events",
+  "company_profile_agent_confirmation_receipts",
+  "company_profile_agent_proposal_receipts",
+  "company_profile_heads",
+  "company_profile_revisions",
+  "managed_accounts",
+  "organization_memberships",
+  "session_human_input_requests",
+  "session_turn_attempts",
+  "session_turns",
+  "sessions",
+  "workspaces"
+];
+var GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES = [
+  "document_chunks",
+  "documents",
+  "governed_learning_decision_receipts",
+  "knowledge_change_proposals",
+  "knowledge_claim_evidence",
+  "knowledge_claim_relations",
+  "knowledge_claim_reviews",
+  "knowledge_claims",
+  "knowledge_document_versions",
+  "knowledge_providers",
+  "knowledge_source_acl_versions",
+  "knowledge_source_objects",
+  "knowledge_sources",
+  "session_attempt_interruptions",
+  "session_turn_attempts",
+  "session_turns",
+  "sessions",
+  "task_notes",
+  "workspace_learning_policy_snapshots",
+  "workspaces"
+];
+var GOVERNED_LEARNING_ACTIVATION_AUTHORITY_TABLES = [
+  ...GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES,
+  "company_brain_preference_proposal_receipts",
+  "governed_learning_activation_receipts",
+  "governed_learning_activation_undo_receipts",
+  "preference_registry_events",
+  "preference_registry_preferences",
+  "preference_registry_revisions",
+  "remember_knowledge_confirmation_receipts",
+  "session_human_input_requests",
+  "workspace_instruction_policy_activation_events",
+  "workspace_instruction_policy_deactivation_events",
+  "workspace_instruction_policy_heads",
+  "workspace_instruction_policy_onboarding_proposals",
+  "workspace_instruction_policy_revisions",
+  "workspace_learning_policy_heads",
+  "workspace_learning_policy_revisions"
+];
+var TRANSITION_SESSION_VISIBILITY_ROUTINE = "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer)";
+var LEGACY_FORK_SESSION_CONTENT_ROUTINE = "fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer)";
+var FORK_SESSION_CONTENT_ROUTINE = "fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)";
+var REPLAY_APPLIED_SESSION_FORK_ROUTINE = "replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)";
+var SESSION_TENANCY_ACTIVATED_ROUTINE = "session_tenancy_product_activated(uuid, integer)";
+var SESSION_TENANCY_ANY_ACTIVATION_ROUTINE = "session_tenancy_any_product_activation()";
+var SESSION_TENANCY_QUIESCENCE_ROUTINE = "assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean)";
+var TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE = "check_tenancy_backfill_activation_evidence(uuid)";
+var SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE = "session_visibility_lifecycle_capability_held()";
+var PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES = [
+  "open_private_session_create_capability(uuid, uuid, uuid, text)",
+  "open_private_child_session_create_capability(uuid, uuid, uuid, uuid, uuid, uuid, integer)",
+  "close_private_session_create_capability(uuid)"
+];
+var SESSION_AUTHORITY_ROUTINES = /* @__PURE__ */ new Set([
+  LEGACY_FORK_SESSION_CONTENT_ROUTINE,
+  FORK_SESSION_CONTENT_ROUTINE,
+  REPLAY_APPLIED_SESSION_FORK_ROUTINE,
+  SESSION_TENANCY_ACTIVATED_ROUTINE,
+  SESSION_TENANCY_ANY_ACTIVATION_ROUTINE,
+  SESSION_TENANCY_QUIESCENCE_ROUTINE,
+  PERSONAL_RESOURCE_ATTEMPT_RESOLVER_ROUTINE,
+  ...USER_RESOURCE_LIFECYCLE_ROUTINES,
+  ...CONNECTION_AUTHORITY_ROUTINES,
+  ...SCHEDULED_PERSONAL_RESOURCE_ROUTINES,
+  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
+  SESSION_REFERENCE_VISIBLE_ROUTINE,
+  SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE,
+  ...PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES,
+  TRANSITION_SESSION_VISIBILITY_ROUTINE,
+  ...TASK_NOTE_CAPABILITY_ROUTINES,
+  COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE,
+  COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE
+]);
+var XAI_CREATE_CREDENTIAL_ROUTINE = "create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamp with time zone)";
+var XAI_DISCONNECT_CREDENTIAL_ROUTINE = "disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb)";
+var XAI_SNAPSHOT_VALIDATOR_ROUTINE = "xai_provider_account_authority_snapshot_v1_valid(jsonb)";
+var XAI_AUTHORITY_LIVE_ROUTINE = "xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint)";
+var XAI_POOL_VISIBLE_ROUTINE = "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)";
+var XAI_RESOLVE_POOL_ROUTINE = "resolve_xai_authority_pool(uuid, uuid, text, jsonb)";
+var XAI_REVALIDATE_CREDENTIAL_ROUTINE = "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)";
+var XAI_AUTHORITY_TABLES = [
+  "organization_memberships",
+  "organization_user_resource_authorities",
+  "workspace_memberships",
+  "xai_subscription_credentials"
+];
+var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
+  COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE,
+  COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE,
+  ...COMPANY_PROFILE_AGENT_ADMIN_ROUTINES,
+  GOVERNED_LEARNING_EVALUATION_ROUTINE,
+  ...GOVERNED_LEARNING_ACTIVATION_ROUTINES,
+  ...GOVERNED_LEARNING_INSPECTION_ROUTINES,
+  FORK_SESSION_CONTENT_ROUTINE,
+  LEGACY_FORK_SESSION_CONTENT_ROUTINE,
+  REPLAY_APPLIED_SESSION_FORK_ROUTINE,
+  SESSION_TENANCY_ACTIVATED_ROUTINE,
+  SESSION_TENANCY_ANY_ACTIVATION_ROUTINE,
+  XAI_AUTHORITY_LIVE_ROUTINE,
+  XAI_CREATE_CREDENTIAL_ROUTINE,
+  XAI_DISCONNECT_CREDENTIAL_ROUTINE,
+  GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE,
+  GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE,
+  KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE,
+  MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE,
+  ...ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES,
+  ...ORGANIZATION_PRIVATE_SESSION_ROUTINES,
+  ...PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES,
+  PERSONAL_RESOURCE_ATTEMPT_RESOLVER_ROUTINE,
+  ...USER_RESOURCE_LIFECYCLE_ROUTINES,
+  PREFERENCE_KNOWLEDGE_PROPOSAL_ROUTINE,
+  ...VARIABLE_SET_AUTHORITY_ROUTINES,
+  ...CONNECTION_AUTHORITY_ROUTINES,
+  ...PERSONAL_GITHUB_REPOSITORY_AUTHORITY_ROUTINES,
+  ...PERSONAL_DOCUMENT_AUTHORITY_ROUTINES,
+  ...DOCUMENT_MIGRATION_AUTHORITY_ROUTINES,
+  ...SCOPED_COMPUTE_AUTHORITY_ROUTINES,
+  ...SCHEDULED_PERSONAL_RESOURCE_ROUTINES,
+  ...CANONICAL_HUMAN_IDENTITY_ROUTINES,
+  ...TASK_NOTE_CAPABILITY_ROUTINES,
+  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
+  SESSION_REFERENCE_VISIBLE_ROUTINE,
+  SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE,
+  TRANSITION_SESSION_VISIBILITY_ROUTINE,
+  XAI_POOL_VISIBLE_ROUTINE,
+  XAI_RESOLVE_POOL_ROUTINE,
+  XAI_REVALIDATE_CREDENTIAL_ROUTINE,
+  XAI_SNAPSHOT_VALIDATOR_ROUTINE
+];
+var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
+  ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE,
+  SESSION_TENANCY_QUIESCENCE_ROUTINE,
+  TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE
+];
+var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
+  SESSION_REFERENCE_VISIBLE_ROUTINE,
+  XAI_SNAPSHOT_VALIDATOR_ROUTINE
+];
+var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set(
+  RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES
+);
+var FORCE_RLS_TABLES = [
+  "agent_run_states",
+  "api_keys",
+  "attached_browser_devices",
+  "attached_browser_inventories",
+  "audit_events",
+  "auth_runs",
+  "automation_run_event_links",
+  "automation_runs",
+  "automation_sources",
+  "automation_trigger_events",
+  "automation_trigger_revisions",
+  "automation_triggers",
+  "billing_customers",
+  "browser_identities",
+  "browser_revision_components",
+  "browser_revisions",
+  "browser_session_associations",
+  "browser_sessions",
+  "browser_state_artifacts",
+  "browser_state_uploads",
+  "canonical_human_identities",
+  "canonical_human_identity_operations",
+  "canonical_human_identity_subjects",
+  "canonical_human_login_bindings",
+  "capability_api_facets",
+  "capability_catalog_items",
+  "capability_component_owners",
+  "capability_facet_installations",
+  "capability_facets",
+  "capability_installations",
+  "capability_integration_facets",
+  "capability_mcp_facets",
+  "capability_operations",
+  "capability_plugin_installations",
+  "capability_plugin_versions",
+  "capability_plugins",
+  "capability_skill_facets",
+  "capability_skill_files",
+  "channels",
+  "codex_apps_settings",
+  "codex_capacity_waiters",
+  "codex_credential_leases",
+  "codex_reset_redemption_attempts",
+  "codex_rotation_settings",
+  "codex_subscription_credentials",
+  "company_brain_context_selection_receipts",
+  "company_brain_preference_proposal_receipts",
+  "company_brain_turn_context_snapshots",
+  "company_profile_activation_events",
+  "company_profile_agent_confirmation_receipts",
+  "company_profile_agent_proposal_receipts",
+  "company_profile_heads",
+  "company_profile_revisions",
+  "company_profile_snapshots",
+  "composer_drafts",
+  "computer_session_associations",
+  "computer_sessions",
+  "connection_disconnect_operations",
+  "connection_use_audit_facts",
+  "connection_use_once_consumption_receipts",
+  "connections",
+  "connector_action_policies",
+  "connector_action_requests",
+  "credit_ledger_entries",
+  "device_enrollment_requests",
+  "document_authority_reclassifications",
+  "document_bases",
+  "document_chunks",
+  "document_default_collection_backfill_operations",
+  "document_default_collection_backfill_receipts",
+  "document_default_collection_backfill_runs",
+  "documents",
+  "editable_artifact_blob_refs",
+  "editable_artifact_idempotency_receipts",
+  "editable_artifact_live_outbox",
+  "editable_artifact_live_tickets",
+  "editable_artifact_materialization_jobs",
+  "editable_artifact_materialization_results",
+  "editable_artifact_operations",
+  "editable_artifact_replica_leases",
+  "editable_artifact_scope_authorization_heads",
+  "editable_artifact_sequence_checkpoints",
+  "editable_artifact_session_links",
+  "editable_artifact_snapshots",
+  "editable_artifact_transactions",
+  "editable_artifact_undo_claims",
+  "editable_artifact_versions",
+  "editable_artifacts",
+  "enrollments",
+  "file_uploads",
+  "files",
+  "generated_image_artifacts",
+  "generated_video_artifacts",
+  "github_installation_repositories",
+  "github_installations",
+  "google_drive_object_acl_evidence",
+  "google_drive_object_acl_principals",
+  "governed_learning_activation_receipts",
+  "governed_learning_activation_undo_receipts",
+  "governed_learning_decision_receipts",
+  "host_export_config",
+  "host_export_consumers",
+  "host_export_cursor_state",
+  "host_export_dead_letters",
+  "host_export_outbox",
+  "image_generation_operations",
+  "import_batches",
+  "integration_facet_binding_owners",
+  "integration_facet_bindings",
+  "integration_facet_definitions",
+  "integration_oauth_state_nonces",
+  "integration_spec_revisions",
+  "integration_tools",
+  "interaction_interventions",
+  "interaction_operations",
+  "interaction_resource_operations",
+  "knowledge_change_proposals",
+  "knowledge_claim_evidence",
+  "knowledge_claim_relations",
+  "knowledge_claim_reviews",
+  "knowledge_claims",
+  "knowledge_document_versions",
+  "knowledge_entities",
+  "knowledge_entity_aliases",
+  "knowledge_facts",
+  "knowledge_lifecycle_events",
+  "knowledge_memories",
+  "knowledge_memory_lifecycle_events",
+  "knowledge_memory_relationships",
+  "knowledge_operation_receipts",
+  "knowledge_providers",
+  "knowledge_source_acl_versions",
+  "knowledge_source_objects",
+  "knowledge_source_sync_index_obligations",
+  "knowledge_source_sync_item_outcomes",
+  "knowledge_source_sync_object_observations",
+  "knowledge_source_sync_states",
+  "knowledge_source_sync_wakes",
+  "knowledge_sources",
+  "knowledge_sync_runs",
+  "machine_metrics_latest",
+  "machine_metrics_series",
+  "machine_removal_operations",
+  "memory_slack_publication_configurations",
+  "memory_slack_publication_receipts",
+  "memory_slack_publications",
+  "model_call_facts",
+  "network_routes",
+  "new_session_drafts",
+  "organization_invitation_binding_events",
+  "organization_membership_invitations",
+  "organization_membership_lifecycle_events",
+  "organization_membership_operation_receipts",
+  "organization_memberships",
+  "organization_private_session_setting_events",
+  "organization_private_session_settings",
+  "organization_profile_events",
+  "organization_shared_workspace_administration_capabilities",
+  "organization_user_resource_authorities",
+  "organization_user_resource_grants",
+  "organization_user_retention_deletion_events",
+  "organization_user_retention_deletions",
+  "organization_user_retention_object_deletion_receipts",
+  "organization_user_retention_object_obligations",
+  "organization_user_retention_policies",
+  "pack_installation_components",
+  "pack_installations",
+  "personal_document_once_consumption_receipts",
+  "personal_github_repository_selection_heads",
+  "personal_github_repository_selection_operations",
+  "personal_github_repository_selections",
+  "personal_resource_once_consumption_receipts",
+  "pr_review_app_registrations",
+  "pr_review_repository_bindings",
+  "preference_registry_events",
+  "preference_registry_preferences",
+  "preference_registry_revisions",
+  "preference_registry_snapshots",
+  "private_session_create_capabilities",
+  "remember_knowledge_confirmation_receipts",
+  "retained_screenshot_artifacts",
+  "rig_changes",
+  "rig_versions",
+  "rigs",
+  "sandbox_checkpoint_artifacts",
+  "sandbox_lease_holders",
+  "sandbox_leases",
+  "sandbox_pty_sessions",
+  "sandbox_retained_processes",
+  "sandbox_session_envelopes",
+  "sandbox_workspace_mutation_admissions",
+  "sandboxes",
+  "scheduled_task_connection_authority_snapshots",
+  "scheduled_task_personal_resource_authorities",
+  "scheduled_task_personal_resource_snapshots",
+  "scheduled_task_reusable_connection_materializations",
+  "scheduled_task_revision_authorities",
+  "scheduled_task_run_connection_authority_snapshots",
+  "scheduled_task_run_personal_resource_admissions",
+  "scheduled_task_run_personal_resource_once_receipts",
+  "scheduled_task_run_personal_resource_snapshots",
+  "scheduled_task_runs",
+  "scheduled_tasks",
+  "session_attempt_codemode_calls",
+  "session_attempt_connected_machine_authorizations",
+  "session_attempt_interruptions",
+  "session_attempt_personal_document_admissions",
+  "session_attempt_personal_document_snapshots",
+  "session_attempt_personal_resource_admissions",
+  "session_attempt_personal_resource_snapshots",
+  "session_attempt_tool_catalogs",
+  "session_background_commands",
+  "session_command_receipts",
+  "session_events",
+  "session_goal_revisions",
+  "session_goals",
+  "session_history_items",
+  "session_human_input_requests",
+  "session_list_snapshots",
+  "session_mcp_servers",
+  "session_pending_tool_calls",
+  "session_pins",
+  "session_realtime_connections",
+  "session_realtime_context_projections",
+  "session_realtime_entries",
+  "session_realtime_modes",
+  "session_recordings",
+  "session_spawn_denials",
+  "session_stream_acknowledgments",
+  "session_system_update_outbox",
+  "session_system_updates",
+  "session_tenancy_activations",
+  "session_turn_attempts",
+  "session_turn_startup_milestones",
+  "session_turns",
+  "session_visibility_write_capabilities",
+  "session_workflow_wake_outbox",
+  "sessions",
+  "site_auth_connections",
+  "slack_app_home_refreshes",
+  "slack_bot_delete_operations",
+  "slack_bot_post_operations",
+  "slack_bot_update_operations",
+  "slack_bot_user_links",
+  "slack_channel_routes",
+  "slack_installation_bindings",
+  "slack_interaction_action_handles",
+  "slack_interaction_inbox",
+  "slack_interaction_progress_deliveries",
+  "slack_interactions",
+  "slack_route_prompt_options",
+  "slack_route_prompts",
+  "slack_shared_task_origins",
+  "slack_task_policy_activation_events",
+  "slack_task_policy_heads",
+  "slack_task_policy_revisions",
+  "slack_user_dm_routes",
+  "slack_user_link_access_request_operations",
+  "slack_user_link_access_requests",
+  "social_connections",
+  "social_posts",
+  "task_note_events",
+  "task_note_knowledge_promotion_capabilities",
+  "task_note_replacement_receipts",
+  "task_note_write_capabilities",
+  "task_notes",
+  "temporal_schedule_cleanup_outbox",
+  "tenancy_backfill_receipts",
+  "tenancy_backfill_unresolved_rows",
+  "transcription_recording_chunks",
+  "transcription_recording_objects",
+  "transcription_recording_segments",
+  "transcription_recordings",
+  "turn_connection_authority_snapshots",
+  "turn_personal_resource_attachment_receipts",
+  "turn_personal_resource_once_receipts",
+  "turn_personal_resource_snapshots",
+  "usage_events",
+  "video_generation_operations",
+  "video_generation_references",
+  "workspace_artifact_events",
+  "workspace_artifact_versions",
+  "workspace_artifacts",
+  "workspace_captures",
+  "workspace_control_events",
+  "workspace_inference_controls",
+  "workspace_instruction_policy_activation_events",
+  "workspace_instruction_policy_deactivation_events",
+  "workspace_instruction_policy_heads",
+  "workspace_instruction_policy_onboarding_proposals",
+  "workspace_instruction_policy_revisions",
+  "workspace_instruction_policy_snapshots",
+  "workspace_interaction_revisions",
+  "workspace_learning_policy_activation_events",
+  "workspace_learning_policy_heads",
+  "workspace_learning_policy_revisions",
+  "workspace_learning_policy_snapshots",
+  "workspace_model_policies",
+  "workspace_packs",
+  "workspace_screenshot_quotas",
+  "workspace_session_activity_revisions",
+  "workspace_variable_set_variables",
+  "workspace_variable_sets",
+  "workspace_video_generation_policies",
+  "workspace_video_generation_quotas",
+  "xai_capacity_waiters",
+  "xai_credential_leases",
+  "xai_rotation_settings",
+  "xai_session_account_pins",
+  "xai_subscription_credentials"
+];
+var NON_RLS_RUNTIME_TABLES = [
+  "auth_identities",
+  "auth_rate_limits",
+  "auth_sessions",
+  "auth_users",
+  "auth_verifications",
+  "automation_webhook_endpoints",
+  "integration_oauth_clients",
+  "managed_accounts",
+  "nested_agent_depth_configuration",
+  "stripe_webhook_events",
+  "workspace_memberships",
+  "workspaces"
+];
+var RUNTIME_FULL_DML_TABLES = [
+  "agent_run_states",
+  "api_keys",
+  "audit_events",
+  "auth_identities",
+  "auth_rate_limits",
+  "auth_sessions",
+  "auth_users",
+  "auth_verifications",
+  "automation_run_event_links",
+  "automation_runs",
+  "automation_sources",
+  "automation_trigger_events",
+  "automation_trigger_revisions",
+  "automation_triggers",
+  "automation_webhook_endpoints",
+  "billing_customers",
+  "browser_session_associations",
+  "capability_catalog_items",
+  "capability_component_owners",
+  "capability_facet_installations",
+  "capability_installations",
+  "capability_operations",
+  "capability_plugin_installations",
+  "channels",
+  "codex_apps_settings",
+  "codex_capacity_waiters",
+  "codex_credential_leases",
+  "codex_reset_redemption_attempts",
+  "codex_rotation_settings",
+  "codex_subscription_credentials",
+  "composer_drafts",
+  "computer_session_associations",
+  "connection_disconnect_operations",
+  "connections",
+  "connector_action_policies",
+  "connector_action_requests",
+  "credit_ledger_entries",
+  "device_enrollment_requests",
+  "document_bases",
+  "document_chunks",
+  "documents",
+  "editable_artifact_replica_leases",
+  "enrollments",
+  "file_uploads",
+  "files",
+  "generated_image_artifacts",
+  "generated_video_artifacts",
+  "github_installation_repositories",
+  "github_installations",
+  "image_generation_operations",
+  "import_batches",
+  "integration_facet_binding_owners",
+  "integration_facet_bindings",
+  "integration_oauth_clients",
+  "integration_oauth_state_nonces",
+  "knowledge_memories",
+  "knowledge_source_sync_index_obligations",
+  "knowledge_source_sync_item_outcomes",
+  "knowledge_source_sync_object_observations",
+  "knowledge_source_sync_states",
+  "knowledge_source_sync_wakes",
+  "machine_metrics_latest",
+  "machine_metrics_series",
+  "machine_removal_operations",
+  "managed_accounts",
+  "memory_slack_publication_configurations",
+  "memory_slack_publication_receipts",
+  "memory_slack_publications",
+  "model_call_facts",
+  "new_session_drafts",
+  "pack_installation_components",
+  "pack_installations",
+  "pr_review_app_registrations",
+  "pr_review_repository_bindings",
+  "retained_screenshot_artifacts",
+  "rig_changes",
+  "rig_versions",
+  "rigs",
+  "sandbox_checkpoint_artifacts",
+  "sandbox_lease_holders",
+  "sandbox_leases",
+  "sandbox_pty_sessions",
+  "sandbox_retained_processes",
+  "sandbox_session_envelopes",
+  "sandbox_workspace_mutation_admissions",
+  "sandboxes",
+  "session_attempt_interruptions",
+  "session_background_commands",
+  "session_command_receipts",
+  "session_events",
+  "session_goals",
+  "session_history_items",
+  "session_human_input_requests",
+  "session_list_snapshots",
+  "session_mcp_servers",
+  "session_pending_tool_calls",
+  "session_pins",
+  "session_realtime_connections",
+  "session_realtime_context_projections",
+  "session_realtime_entries",
+  "session_realtime_modes",
+  "session_recordings",
+  "session_stream_acknowledgments",
+  "session_system_update_outbox",
+  "session_system_updates",
+  "session_turn_attempts",
+  "session_turns",
+  "session_workflow_wake_outbox",
+  "sessions",
+  "slack_app_home_refreshes",
+  "slack_bot_delete_operations",
+  "slack_bot_post_operations",
+  "slack_bot_update_operations",
+  "slack_bot_user_links",
+  "slack_channel_routes",
+  "slack_interaction_action_handles",
+  "slack_interaction_inbox",
+  "slack_interaction_progress_deliveries",
+  "slack_interactions",
+  "slack_route_prompt_options",
+  "slack_route_prompts",
+  "slack_user_dm_routes",
+  "social_connections",
+  "social_posts",
+  "stripe_webhook_events",
+  "transcription_recording_chunks",
+  "transcription_recording_objects",
+  "transcription_recording_segments",
+  "transcription_recordings",
+  "usage_events",
+  "video_generation_operations",
+  "video_generation_references",
+  "workspace_artifacts",
+  "workspace_captures",
+  "workspace_control_events",
+  "workspace_inference_controls",
+  "workspace_instruction_policy_heads",
+  "workspace_memberships",
+  "workspace_model_policies",
+  "workspace_packs",
+  "workspace_screenshot_quotas",
+  "workspace_video_generation_policies",
+  "workspace_video_generation_quotas",
+  "workspaces",
+  "xai_capacity_waiters",
+  "xai_credential_leases",
+  "xai_rotation_settings",
+  "xai_session_account_pins",
+  "xai_subscription_credentials"
+];
+var RUNTIME_READ_ONLY_TABLES = [
+  "company_profile_activation_events",
+  "company_profile_heads",
+  "company_profile_snapshots",
+  "document_authority_reclassifications",
+  "knowledge_lifecycle_events",
+  "knowledge_memory_lifecycle_events",
+  "knowledge_memory_relationships",
+  "nested_agent_depth_configuration",
+  "preference_registry_events",
+  "preference_registry_snapshots",
+  "session_tenancy_activations",
+  "slack_installation_bindings",
+  "slack_task_policy_activation_events",
+  "slack_task_policy_heads",
+  "slack_task_policy_revisions",
+  "workspace_instruction_policy_deactivation_events",
+  "workspace_instruction_policy_snapshots",
+  "workspace_learning_policy_activation_events",
+  "workspace_learning_policy_heads",
+  "workspace_learning_policy_snapshots"
+];
+var RUNTIME_READ_UPDATE_TABLES = ["workspace_session_activity_revisions"];
+var RUNTIME_READ_INSERT_TABLES = [
+  "browser_revision_components",
+  "browser_revisions",
+  "company_profile_revisions",
+  "editable_artifact_blob_refs",
+  "editable_artifact_idempotency_receipts",
+  "editable_artifact_live_outbox",
+  "editable_artifact_materialization_jobs",
+  "editable_artifact_materialization_results",
+  "editable_artifact_operations",
+  "editable_artifact_sequence_checkpoints",
+  "editable_artifact_snapshots",
+  "editable_artifact_transactions",
+  "editable_artifact_undo_claims",
+  "editable_artifact_versions",
+  "google_drive_object_acl_evidence",
+  "google_drive_object_acl_principals",
+  "knowledge_change_proposals",
+  "knowledge_claim_evidence",
+  "knowledge_claim_relations",
+  "knowledge_claim_reviews",
+  "knowledge_claims",
+  "knowledge_document_versions",
+  "knowledge_entities",
+  "knowledge_entity_aliases",
+  "knowledge_facts",
+  "knowledge_operation_receipts",
+  "knowledge_providers",
+  "knowledge_source_acl_versions",
+  "knowledge_source_objects",
+  "knowledge_sources",
+  "knowledge_sync_runs",
+  "preference_registry_preferences",
+  "preference_registry_revisions",
+  "session_attempt_tool_catalogs",
+  "session_goal_revisions",
+  "session_spawn_denials",
+  "slack_shared_task_origins",
+  "slack_user_link_access_request_operations",
+  "temporal_schedule_cleanup_outbox",
+  "workspace_artifact_events",
+  "workspace_artifact_versions",
+  "workspace_instruction_policy_activation_events",
+  "workspace_instruction_policy_onboarding_proposals",
+  "workspace_instruction_policy_revisions",
+  "workspace_learning_policy_revisions"
+];
+var RUNTIME_READ_INSERT_UPDATE_TABLES = [
+  "attached_browser_devices",
+  "attached_browser_inventories",
+  "auth_runs",
+  "browser_identities",
+  "browser_sessions",
+  "browser_state_artifacts",
+  "browser_state_uploads",
+  "capability_api_facets",
+  "capability_facets",
+  "capability_integration_facets",
+  "capability_mcp_facets",
+  "capability_plugin_versions",
+  "capability_plugins",
+  "capability_skill_facets",
+  "capability_skill_files",
+  "computer_sessions",
+  "editable_artifact_session_links",
+  "editable_artifacts",
+  "integration_facet_definitions",
+  "integration_spec_revisions",
+  "integration_tools",
+  "interaction_interventions",
+  "interaction_operations",
+  "interaction_resource_operations",
+  "network_routes",
+  "scheduled_task_runs",
+  "scheduled_tasks",
+  "session_attempt_codemode_calls",
+  "session_turn_startup_milestones",
+  "site_auth_connections",
+  "slack_user_link_access_requests",
+  "workspace_interaction_revisions"
+];
+var PROTECTED_NO_DIRECT_DML_TABLES = [
+  "canonical_human_identities",
+  "canonical_human_identity_operations",
+  "canonical_human_identity_subjects",
+  "canonical_human_login_bindings",
+  "company_brain_context_selection_receipts",
+  "company_brain_preference_proposal_receipts",
+  "company_brain_turn_context_snapshots",
+  "company_profile_agent_confirmation_receipts",
+  "company_profile_agent_proposal_receipts",
+  "connection_use_audit_facts",
+  "connection_use_once_consumption_receipts",
+  "document_default_collection_backfill_operations",
+  "document_default_collection_backfill_receipts",
+  "document_default_collection_backfill_runs",
+  "editable_artifact_live_tickets",
+  "editable_artifact_scope_authorization_heads",
+  "governed_learning_activation_receipts",
+  "governed_learning_activation_undo_receipts",
+  "governed_learning_decision_receipts",
+  "host_export_config",
+  "host_export_consumers",
+  "host_export_cursor_state",
+  "host_export_dead_letters",
+  "host_export_outbox",
+  "organization_invitation_binding_events",
+  "organization_membership_invitations",
+  "organization_membership_lifecycle_events",
+  "organization_membership_operation_receipts",
+  "organization_memberships",
+  "organization_private_session_setting_events",
+  "organization_private_session_settings",
+  "organization_profile_events",
+  "organization_shared_workspace_administration_capabilities",
+  "organization_user_resource_authorities",
+  "organization_user_resource_grants",
+  "organization_user_retention_deletion_events",
+  "organization_user_retention_deletions",
+  "organization_user_retention_object_deletion_receipts",
+  "organization_user_retention_object_obligations",
+  "organization_user_retention_policies",
+  "personal_document_once_consumption_receipts",
+  "personal_github_repository_selection_heads",
+  "personal_github_repository_selection_operations",
+  "personal_github_repository_selections",
+  "personal_resource_once_consumption_receipts",
+  "private_session_create_capabilities",
+  "remember_knowledge_confirmation_receipts",
+  "scheduled_task_connection_authority_snapshots",
+  "scheduled_task_personal_resource_authorities",
+  "scheduled_task_personal_resource_snapshots",
+  "scheduled_task_reusable_connection_materializations",
+  "scheduled_task_revision_authorities",
+  "scheduled_task_run_connection_authority_snapshots",
+  "scheduled_task_run_personal_resource_admissions",
+  "scheduled_task_run_personal_resource_once_receipts",
+  "scheduled_task_run_personal_resource_snapshots",
+  "session_attempt_connected_machine_authorizations",
+  "session_attempt_personal_document_admissions",
+  "session_attempt_personal_document_snapshots",
+  "session_attempt_personal_resource_admissions",
+  "session_attempt_personal_resource_snapshots",
+  "session_visibility_write_capabilities",
+  "task_note_events",
+  "task_note_knowledge_promotion_capabilities",
+  "task_note_replacement_receipts",
+  "task_note_write_capabilities",
+  "task_notes",
+  "tenancy_backfill_receipts",
+  "tenancy_backfill_unresolved_rows",
+  "turn_connection_authority_snapshots",
+  "turn_personal_resource_attachment_receipts",
+  "turn_personal_resource_once_receipts",
+  "turn_personal_resource_snapshots",
+  "workspace_variable_set_variables",
+  "workspace_variable_sets"
+];
+var FULL_DML_PRIVILEGES = ["SELECT", "INSERT", "UPDATE", "DELETE"];
+var RUNTIME_TABLE_PRIVILEGES = Object.freeze({
+  ...Object.fromEntries(RUNTIME_FULL_DML_TABLES.map((table) => [table, FULL_DML_PRIVILEGES])),
+  ...Object.fromEntries(RUNTIME_READ_ONLY_TABLES.map((table) => [table, ["SELECT"]])),
+  ...Object.fromEntries(
+    RUNTIME_READ_UPDATE_TABLES.map((table) => [table, ["SELECT", "UPDATE"]])
+  ),
+  ...Object.fromEntries(
+    RUNTIME_READ_INSERT_TABLES.map((table) => [table, ["SELECT", "INSERT"]])
+  ),
+  ...Object.fromEntries(
+    RUNTIME_READ_INSERT_UPDATE_TABLES.map((table) => [
+      table,
+      ["SELECT", "INSERT", "UPDATE"]
+    ])
+  )
+});
+var RUNTIME_DML_TABLES = Object.freeze(
+  Object.keys(RUNTIME_TABLE_PRIVILEGES).sort((a, b) => a.localeCompare(b))
+);
+var RuntimeDatabasePostureError = class extends Error {
+  violations;
+  constructor(violations) {
+    super(`Runtime database posture check failed: ${violations.join("; ")}`);
+    this.name = "RuntimeDatabasePostureError";
+    this.violations = violations;
+  }
+};
+function resultRows(result) {
+  if (Array.isArray(result)) {
+    return result;
+  }
+  const rows = result?.rows;
+  if (Array.isArray(rows)) {
+    return rows;
+  }
+  throw new Error("Runtime database posture query returned an unsupported result shape");
+}
+function sorted(values) {
+  return [...values].sort((a, b) => a.localeCompare(b));
+}
+function difference(left, right) {
+  return sorted([...left].filter((value) => !right.has(value)));
+}
+async function inspectRuntimeDatabasePosture(db, options) {
+  const targetSchema = options.targetSchema?.trim() || "public";
+  return await db.transaction(
+    async (tx) => {
+      const identityRows = resultRows(
+        await tx.execute(sql`
+          select
+            current_user::text as current_user,
+            session_user::text as session_user,
+            pg_get_userbyid(d.datdba)::text as database_owner,
+            has_database_privilege(current_user, d.oid, 'CONNECT') as can_connect_database,
+            has_database_privilege(current_user, d.oid, 'CREATE') as can_create_in_database,
+            current_setting('row_security')::text as row_security,
+            r.rolcanlogin,
+            r.rolsuper,
+            r.rolinherit,
+            r.rolcreaterole,
+            r.rolcreatedb,
+            r.rolreplication,
+            r.rolbypassrls
+          from pg_roles r
+          join pg_database d on d.datname = current_database()
+          where r.rolname = current_user
+        `)
+      );
+      const identity = identityRows[0];
+      if (!identity) {
+        throw new Error("Runtime database posture could not resolve the current PostgreSQL role");
+      }
+      const mappedIdentity = {
+        currentUser: identity.current_user,
+        sessionUser: identity.session_user,
+        databaseOwner: identity.database_owner,
+        canConnectDatabase: identity.can_connect_database,
+        canCreateInDatabase: identity.can_create_in_database,
+        rowSecurity: identity.row_security,
+        canLogin: identity.rolcanlogin,
+        superuser: identity.rolsuper,
+        inherit: identity.rolinherit,
+        createRole: identity.rolcreaterole,
+        createDatabase: identity.rolcreatedb,
+        replication: identity.rolreplication,
+        bypassRls: identity.rolbypassrls
+      };
+      const activationRows = resultRows(
+        await tx.execute(sql`select session_tenancy_any_product_activation() as activated`)
+      );
+      const sessionTenancyProductActivationPresent = activationRows[0]?.activated === true;
+      if (options.rlsStrategy === "scoped") {
+        return {
+          identity: mappedIdentity,
+          memberships: [],
+          schemas: [],
+          ownedSchemas: [],
+          ownedRelations: [],
+          tables: [],
+          privateTables: [],
+          targetRoutines: [],
+          privateRoutines: [],
+          sessionTenancyProductActivationPresent
+        };
+      }
+      const relationshipRows = resultRows(
+        await tx.execute(sql.raw(roleRelationshipsCatalogQuery("current_user")))
+      );
+      const memberships = classifyRoleRelationships(relationshipRows).unsafeRelationships;
+      const schemas = resultRows(
+        await tx.execute(sql`
+          select
+            n.nspname::text as name,
+            pg_get_userbyid(n.nspowner)::text as owner,
+            has_schema_privilege(current_user, n.oid, 'USAGE') as usage,
+            has_schema_privilege(current_user, n.oid, 'CREATE') as create
+          from pg_namespace n
+          where n.nspname in (${targetSchema}, 'opengeni_private')
+          order by n.nspname
+        `)
+      );
+      const ownedSchemas = resultRows(
+        await tx.execute(sql`
+          select n.nspname::text as name
+          from pg_namespace n
+          join pg_roles r on r.oid = n.nspowner
+          where r.rolname = current_user
+            and n.nspname <> 'information_schema'
+            and n.nspname !~ '^pg_'
+          order by n.nspname
+        `)
+      ).map((row) => row.name);
+      const ownedRelations = resultRows(
+        await tx.execute(sql`
+          select (n.nspname || '.' || c.relname)::text as name
+          from pg_class c
+          join pg_namespace n on n.oid = c.relnamespace
+          join pg_roles r on r.oid = c.relowner
+          where r.rolname = current_user
+            and c.relkind in ('r', 'p', 'S', 'v', 'm', 'f')
+            and n.nspname <> 'information_schema'
+            and n.nspname !~ '^pg_'
+          order by n.nspname, c.relname
+        `)
+      ).map((row) => row.name);
+      const tables = resultRows(
+        await tx.execute(sql`
+          select
+            c.relname::text as name,
+            pg_get_userbyid(c.relowner)::text as owner,
+            c.relrowsecurity as rls_enabled,
+            c.relforcerowsecurity as rls_forced,
+            row_security_active(c.oid) as rls_active,
+            (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,
+            exists(
+              select 1 from pg_policy policy
+              where policy.polrelid = c.oid
+                and policy.polname = 'editable_artifact_outbox_dispatcher'
+            ) as artifact_outbox_dispatcher_policy,
+            exists(
+              select 1 from pg_policy policy
+              where policy.polrelid = c.oid
+                and policy.polname = 'editable_artifact_materializer_owner'
+            ) as artifact_materializer_policy,
+            has_table_privilege(current_user, c.oid, 'SELECT') as can_select,
+            has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,
+            has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,
+            has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,
+            has_table_privilege(current_user, c.oid, 'TRUNCATE') as can_truncate,
+            has_table_privilege(current_user, c.oid, 'REFERENCES') as can_references,
+            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger
+          from pg_class c
+          join pg_namespace n on n.oid = c.relnamespace
+          where n.nspname = ${targetSchema}
+            and c.relkind in ('r', 'p')
+          order by c.relname
+        `)
+      ).map((row) => ({
+        name: row.name,
+        owner: row.owner,
+        rlsEnabled: row.rls_enabled,
+        rlsForced: row.rls_forced,
+        rlsActive: row.rls_active,
+        policyCount: row.policy_count,
+        artifactOutboxDispatcherPolicy: row.artifact_outbox_dispatcher_policy,
+        artifactMaterializerPolicy: row.artifact_materializer_policy,
+        select: row.can_select,
+        insert: row.can_insert,
+        update: row.can_update,
+        delete: row.can_delete,
+        truncate: row.can_truncate,
+        references: row.can_references,
+        trigger: row.can_trigger
+      }));
+      const privateTables = resultRows(
+        await tx.execute(sql`
+          select
+            c.relname::text as name,
+            pg_get_userbyid(c.relowner)::text as owner,
+            has_table_privilege(current_user, c.oid, 'SELECT') as can_select,
+            has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,
+            has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,
+            has_table_privilege(current_user, c.oid, 'DELETE') as can_delete
+          from pg_class c
+          join pg_namespace n on n.oid = c.relnamespace
+          where n.nspname = 'opengeni_private'
+            and c.relkind in ('r', 'p')
+            and c.relname in (
+              ${PERSONAL_RESOURCE_CAPABILITY_TABLE},
+              ${SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE},
+              ${VARIABLE_SET_CAPABILITY_TABLE},
+              ${PERSONAL_DOCUMENT_CAPABILITY_TABLE},
+              ${DOCUMENT_MIGRATION_CAPABILITY_TABLE},
+              ${SCOPED_COMPUTE_CAPABILITY_TABLE},
+              ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE}
+            )
+        `)
+      ).map((row) => ({
+        name: row.name,
+        owner: row.owner,
+        select: row.can_select,
+        insert: row.can_insert,
+        update: row.can_update,
+        delete: row.can_delete
+      }));
+      const targetRoutines = resultRows(
+        await tx.execute(sql`
+          select
+            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,
+            pg_get_userbyid(p.proowner)::text as owner,
+            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,
+            exists (
+              select 1
+              from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl
+              where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'
+            ) as public_execute,
+            p.prosecdef as security_definer
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+          where n.nspname = ${targetSchema}
+            and p.prokind in ('f', 'p')
+            and (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')') = any(
+              array[
+                ${sql.join(
+          [
+            ...RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
+            ...RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES
+          ].map((name) => sql`${name}`),
+          sql`, `
+        )}
+              ]::text[]
+            )
+          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)
+        `)
+      ).map((row) => ({
+        name: row.name,
+        owner: row.owner,
+        execute: row.can_execute,
+        publicExecute: row.public_execute,
+        securityDefiner: row.security_definer
+      })).sort((left, right) => left.name.localeCompare(right.name));
+      const privateRoutines = resultRows(
+        await tx.execute(sql`
+          select
+            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,
+            pg_get_userbyid(p.proowner)::text as owner,
+            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,
+            exists (
+              select 1
+              from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl
+              where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'
+            ) as public_execute,
+            p.prosecdef as security_definer
+          from pg_proc p
+          join pg_namespace n on n.oid = p.pronamespace
+          where n.nspname = 'opengeni_private'
+            and p.prokind in ('f', 'p')
+          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)
+        `)
+      ).map((row) => ({
+        name: row.name,
+        owner: row.owner,
+        execute: row.can_execute,
+        publicExecute: row.public_execute,
+        securityDefiner: row.security_definer
+      }));
+      return {
+        identity: mappedIdentity,
+        memberships,
+        schemas,
+        ownedSchemas,
+        ownedRelations,
+        tables,
+        privateTables,
+        targetRoutines,
+        privateRoutines,
+        sessionTenancyProductActivationPresent
+      };
+    },
+    { isolationLevel: "repeatable read", accessMode: "read only" }
+  );
+}
+function evaluateRuntimeDatabasePosture(posture, options) {
+  const violations = [];
+  const identity = posture.identity;
+  if (posture.sessionTenancyProductActivationPresent && options.organizationTenancyCanonicalActivationEnabled !== true) {
+    violations.push(
+      "session-tenancy product activation is durable but OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED is not true"
+    );
+  }
+  if (!identity.currentUser || !identity.sessionUser) {
+    violations.push("database identity is empty");
+  }
+  if (identity.currentUser !== identity.sessionUser) {
+    violations.push(
+      `current_user ${identity.currentUser} does not match session_user ${identity.sessionUser}`
+    );
+  }
+  if (!identity.canConnectDatabase) {
+    violations.push("runtime role lacks CONNECT on the current database");
+  }
+  if (options.rlsStrategy === "scoped") {
+    return violations;
+  }
+  const expectedRole = options.expectedRole?.trim() || "opengeni_app";
+  const targetSchema = options.targetSchema?.trim() || "public";
+  const protectedTables = new Set(options.protectedTables ?? FORCE_RLS_TABLES);
+  const tablePrivileges = options.tablePrivileges ?? RUNTIME_TABLE_PRIVILEGES;
+  const directRuntimeTables = new Set(Object.keys(tablePrivileges));
+  const protectedNoDirectDmlTables = new Set(
+    options.protectedNoDirectDmlTables ?? (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES)
+  );
+  if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {
+    violations.push(
+      `runtime identity must be ${expectedRole} (current_user=${identity.currentUser}, session_user=${identity.sessionUser})`
+    );
+  }
+  if (!identity.canLogin) violations.push("runtime role is not LOGIN");
+  if (identity.superuser) violations.push("runtime role is SUPERUSER");
+  if (identity.bypassRls) violations.push("runtime role has BYPASSRLS");
+  if (identity.createRole) violations.push("runtime role has CREATEROLE");
+  if (identity.createDatabase) violations.push("runtime role has CREATEDB");
+  if (identity.replication) violations.push("runtime role has REPLICATION");
+  if (identity.inherit) violations.push("runtime role must be NOINHERIT");
+  if (identity.databaseOwner === expectedRole) violations.push("runtime role owns the database");
+  if (identity.canCreateInDatabase) {
+    violations.push("runtime role has CREATE on the current database");
+  }
+  if (identity.rowSecurity.toLowerCase() !== "on") {
+    violations.push(`row_security is ${identity.rowSecurity}, expected on`);
+  }
+  if (posture.memberships.length > 0) {
+    violations.push(`runtime role has memberships: ${sorted(posture.memberships).join(", ")}`);
+  }
+  if (posture.ownedSchemas.length > 0) {
+    violations.push(`runtime role owns schemas: ${sorted(posture.ownedSchemas).join(", ")}`);
+  }
+  if (posture.ownedRelations.length > 0) {
+    violations.push(`runtime role owns relations: ${sorted(posture.ownedRelations).join(", ")}`);
+  }
+  for (const schemaName of /* @__PURE__ */ new Set([targetSchema, "opengeni_private"])) {
+    const schema = posture.schemas.find((candidate) => candidate.name === schemaName);
+    if (!schema) {
+      violations.push(`required schema ${schemaName} is missing`);
+      continue;
+    }
+    if (schema.owner === expectedRole) {
+      violations.push(`runtime role owns schema ${schemaName}`);
+    }
+    if (!schema.usage) violations.push(`runtime role lacks USAGE on schema ${schemaName}`);
+    if (schema.create) violations.push(`runtime role has CREATE on schema ${schemaName}`);
+  }
+  const tableByName = new Map(posture.tables.map((table) => [table.name, table]));
+  const actualRlsTables = new Set(
+    posture.tables.filter((table) => table.rlsEnabled).map((table) => table.name)
+  );
+  const classifiedProtectedTables = /* @__PURE__ */ new Set([
+    ...directRuntimeTables,
+    ...protectedNoDirectDmlTables
+  ]);
+  const unclassifiedProtectedTables = difference(protectedTables, classifiedProtectedTables);
+  if (unclassifiedProtectedTables.length > 0) {
+    violations.push(
+      `protected tables lack an explicit privilege class: ${unclassifiedProtectedTables.join(", ")}`
+    );
+  }
+  const protectedNoDirectDmlOverlap = difference(
+    protectedNoDirectDmlTables,
+    new Set([...protectedNoDirectDmlTables].filter((table) => !directRuntimeTables.has(table)))
+  );
+  if (protectedNoDirectDmlOverlap.length > 0) {
+    violations.push(
+      `protected no-direct-DML tables also declare runtime privileges: ${protectedNoDirectDmlOverlap.join(", ")}`
+    );
+  }
+  const nonProtectedNoDirectDmlTables = difference(protectedNoDirectDmlTables, protectedTables);
+  if (nonProtectedNoDirectDmlTables.length > 0) {
+    violations.push(
+      `no-direct-DML tables are absent from the protected contract: ${nonProtectedNoDirectDmlTables.join(", ")}`
+    );
+  }
+  const catalogTables = new Set(tableByName.keys());
+  const missingRuntimeTables = difference(directRuntimeTables, catalogTables);
+  if (missingRuntimeTables.length > 0) {
+    violations.push(`runtime privilege tables are missing: ${missingRuntimeTables.join(", ")}`);
+  }
+  const missingTables = difference(protectedTables, catalogTables);
+  if (missingTables.length > 0) {
+    violations.push(`protected tables are missing: ${missingTables.join(", ")}`);
+  }
+  const undeclaredRlsTables = difference(actualRlsTables, protectedTables);
+  if (undeclaredRlsTables.length > 0) {
+    violations.push(
+      `RLS tables are absent from the declared contract: ${undeclaredRlsTables.join(", ")}`
+    );
+  }
+  for (const table of posture.tables) {
+    const privileges = [
+      ["SELECT", table.select],
+      ["INSERT", table.insert],
+      ["UPDATE", table.update],
+      ["DELETE", table.delete],
+      ["TRUNCATE", table.truncate],
+      ["REFERENCES", table.references],
+      ["TRIGGER", table.trigger]
+    ];
+    const expectedPrivileges = new Set(tablePrivileges[table.name] ?? []);
+    if (table.owner === expectedRole) {
+      violations.push(`runtime role owns table ${table.name}`);
+    }
+    const missingPrivileges = privileges.filter(([privilege, granted]) => expectedPrivileges.has(privilege) && !granted).map(([privilege]) => privilege);
+    if (missingPrivileges.length > 0) {
+      violations.push(
+        `table ${table.name} lacks required runtime privileges: ${missingPrivileges.join(", ")}`
+      );
+    }
+    const excessPrivileges = privileges.filter(([privilege, granted]) => !expectedPrivileges.has(privilege) && granted).map(([privilege]) => privilege);
+    if (excessPrivileges.length > 0) {
+      violations.push(
+        `table ${table.name} grants excess runtime privileges: ${excessPrivileges.join(", ")}`
+      );
+    }
+  }
+  for (const tableName of protectedTables) {
+    const table = tableByName.get(tableName);
+    if (!table) continue;
+    if (!table.rlsEnabled) violations.push(`table ${tableName} does not ENABLE RLS`);
+    if (!table.rlsForced) violations.push(`table ${tableName} does not FORCE RLS`);
+    if (!table.rlsActive) violations.push(`table ${tableName} has inactive RLS for runtime role`);
+    if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);
+  }
+  const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;
+  for (const forbiddenRoutine of RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES) {
+    const matches = posture.targetRoutines.filter((routine2) => routine2.name === forbiddenRoutine);
+    if (matches.length !== 1) {
+      violations.push(
+        `owner-internal target-schema helper ${forbiddenRoutine} is missing or ambiguous`
+      );
+      continue;
+    }
+    const routine = matches[0];
+    if (!routine.securityDefiner) {
+      violations.push(
+        `owner-internal target-schema helper ${routine.name} is not SECURITY DEFINER`
+      );
+    }
+    const authorityOwner = tableByName.get("sessions")?.owner ?? targetSchemaOwner;
+    if (authorityOwner && routine.owner !== authorityOwner) {
+      violations.push(
+        `owner-internal target-schema helper ${routine.name} owner ${routine.owner} does not match session authority owner ${authorityOwner}`
+      );
+    }
+    if (routine.execute) {
+      violations.push(`runtime role has forbidden owner-internal helper ${routine.name}`);
+    }
+    if (routine.publicExecute) {
+      violations.push(`PUBLIC has forbidden owner-internal helper ${routine.name}`);
+    }
+  }
+  for (const expectedRoutine of RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES) {
+    const matches = posture.targetRoutines.filter((routine2) => routine2.name === expectedRoutine);
+    if (matches.length !== 1) {
+      violations.push(
+        `target-schema runtime capability ${expectedRoutine} is missing or ambiguous`
+      );
+      continue;
+    }
+    const routine = matches[0];
+    if (RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET.has(routine.name)) {
+      if (routine.securityDefiner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} must be SECURITY INVOKER`
+        );
+      }
+    } else if (!routine.securityDefiner) {
+      violations.push(`target-schema runtime capability ${routine.name} is not SECURITY DEFINER`);
+    }
+    if (routine.name === GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE || routine.name === GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE) {
+      const missingAuthorityTables = GOOGLE_DRIVE_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = GOOGLE_DRIVE_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (routine.name === KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE) {
+      const missingAuthorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (routine.name === MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE) {
+      const authorityTables = MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityOwners.size > 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (authorityTables[0] && routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
+    } else if (routine.name === GOVERNED_LEARNING_EVALUATION_ROUTINE) {
+      if (!tableByName.has("governed_learning_decision_receipts")) {
+        continue;
+      }
+      const missingAuthorityTables = GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (GOVERNED_LEARNING_INSPECTION_ROUTINES.includes(
+      routine.name
+    )) {
+      if (!tableByName.has("governed_learning_decision_receipts")) continue;
+      const missingAuthorityTables = GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES.filter(
+        (name) => !tableByName.has(name)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES.map(
+          (name) => tableByName.get(name)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1 || routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner does not match governed-learning inspection authority`
+          );
+        }
+      }
+    } else if (GOVERNED_LEARNING_ACTIVATION_ROUTINES.includes(
+      routine.name
+    )) {
+      if (!tableByName.has("governed_learning_activation_receipts")) {
+        continue;
+      }
+      const missingAuthorityTables = GOVERNED_LEARNING_ACTIVATION_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = GOVERNED_LEARNING_ACTIVATION_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (COMPANY_PROFILE_AGENT_ADMIN_ROUTINES.includes(
+      routine.name
+    )) {
+      const missingAuthorityTables = COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES.includes(routine.name)) {
+      const missingAuthorityTables = ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (ORGANIZATION_PRIVATE_SESSION_ROUTINES.includes(routine.name)) {
+      if (!tableByName.has("organization_private_session_settings")) {
+        continue;
+      }
+      const authorityTableNames = ORGANIZATION_PRIVATE_SESSION_ROUTINE_AUTHORITY_TABLES[routine.name];
+      const missingAuthorityTables = authorityTableNames.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = authorityTableNames.map((tableName) => tableByName.get(tableName));
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (routine.name === PREFERENCE_KNOWLEDGE_PROPOSAL_ROUTINE) {
+      if (!tableByName.has("company_brain_preference_proposal_receipts")) {
+        continue;
+      }
+      const missingAuthorityTables = PREFERENCE_KNOWLEDGE_PROPOSAL_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = PREFERENCE_KNOWLEDGE_PROPOSAL_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (CANONICAL_HUMAN_IDENTITY_ROUTINES.includes(routine.name)) {
+      const authorityTables = CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} canonical identity authority tables are missing`
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
+    } else if (PERSONAL_GITHUB_REPOSITORY_AUTHORITY_ROUTINES.includes(routine.name)) {
+      const authorityTables = PERSONAL_GITHUB_REPOSITORY_AUTHORITY_TABLES.map(
+        (tableName) => tableByName.get(tableName)
+      ).filter((table) => table !== void 0);
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityOwners.size > 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} personal GitHub repository authority table owners do not match`
+        );
+      } else {
+        const authorityOwner = authorityTables[0]?.owner ?? targetSchemaOwner;
+        if (authorityOwner && routine.owner !== authorityOwner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match personal GitHub repository authority owner ${authorityOwner}`
+          );
+        }
+      }
+    } else if (PERSONAL_DOCUMENT_AUTHORITY_ROUTINES.includes(routine.name) || DOCUMENT_MIGRATION_AUTHORITY_ROUTINES.includes(routine.name)) {
+      const authorityOwner = tableByName.get("documents")?.owner ?? targetSchemaOwner;
+      if (authorityOwner && routine.owner !== authorityOwner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match document authority owner ${authorityOwner}`
+        );
+      }
+    } else if (VARIABLE_SET_AUTHORITY_ROUTINES.includes(routine.name)) {
+      const authorityTables = ["workspace_variable_sets", "workspace_variable_set_variables"].map((tableName) => tableByName.get(tableName)).filter((table) => table !== void 0);
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityOwners.size > 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} variable-set table owners do not match`
+        );
+      } else {
+        const authorityOwner = authorityTables[0]?.owner ?? targetSchemaOwner;
+        if (authorityOwner && routine.owner !== authorityOwner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match variable-set authority owner ${authorityOwner}`
+          );
+        }
+      }
+    } else if (SCOPED_COMPUTE_AUTHORITY_ROUTINES.includes(routine.name)) {
+      const authorityTables = ["rigs", "rig_versions", "enrollments", "sandboxes"].map((tableName) => tableByName.get(tableName)).filter((table) => table !== void 0);
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityOwners.size > 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} scoped-compute table owners do not match`
+        );
+      } else {
+        const authorityOwner = authorityTables[0]?.owner ?? targetSchemaOwner;
+        if (authorityOwner && routine.owner !== authorityOwner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match scoped-compute authority owner ${authorityOwner}`
+          );
+        }
+      }
+    } else if (SESSION_AUTHORITY_ROUTINES.has(routine.name)) {
+      const authorityOwner = tableByName.get("sessions")?.owner ?? targetSchemaOwner;
+      if (authorityOwner && routine.owner !== authorityOwner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match session authority owner ${authorityOwner}`
+        );
+      }
+    } else if (routine.name === XAI_SNAPSHOT_VALIDATOR_ROUTINE) {
+    } else if (routine.name === XAI_CREATE_CREDENTIAL_ROUTINE || routine.name === XAI_DISCONNECT_CREDENTIAL_ROUTINE || routine.name === XAI_AUTHORITY_LIVE_ROUTINE || routine.name === XAI_POOL_VISIBLE_ROUTINE || routine.name === XAI_RESOLVE_POOL_ROUTINE || routine.name === XAI_REVALIDATE_CREDENTIAL_ROUTINE) {
+      if (!tableByName.has("xai_subscription_credentials")) {
+        continue;
+      }
+      const missingAuthorityTables = XAI_AUTHORITY_TABLES.filter(
+        (tableName) => !tableByName.has(tableName)
+      );
+      if (missingAuthorityTables.length > 0) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
+        );
+      } else {
+        const authorityTables = XAI_AUTHORITY_TABLES.map(
+          (tableName) => tableByName.get(tableName)
+        );
+        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+        if (authorityOwners.size !== 1) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+          );
+        } else if (routine.owner !== authorityTables[0].owner) {
+          violations.push(
+            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+          );
+        }
+      }
+    } else if (targetSchemaOwner && routine.owner !== targetSchemaOwner) {
+      violations.push(
+        `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match schema owner ${targetSchemaOwner}`
+      );
+    }
+    if (!routine.execute) {
+      violations.push(`runtime role lacks target-schema capability ${routine.name}`);
+    }
+    if (routine.publicExecute) {
+      violations.push(`PUBLIC has forbidden target-schema capability ${routine.name}`);
+    }
+  }
+  const artifactOutbox = tableByName.get("editable_artifact_live_outbox");
+  if (artifactOutbox) {
+    if (!artifactOutbox.artifactOutboxDispatcherPolicy) {
+      violations.push("table editable_artifact_live_outbox lacks its owner dispatcher RLS policy");
+    }
+    for (const expectedRoutine of ARTIFACT_OUTBOX_CAPABILITY_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
+      if (matches.length !== 1) {
+        violations.push(`artifact outbox capability ${expectedRoutine} is missing or ambiguous`);
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(`artifact outbox capability ${routine.name} is not SECURITY DEFINER`);
+      }
+      if (routine.owner !== artifactOutbox.owner) {
+        violations.push(
+          `artifact outbox capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactOutbox.owner}`
+        );
+      }
+      if (routine.execute) {
+        violations.push(
+          `generic runtime role has forbidden global artifact outbox capability ${routine.name}`
+        );
+      }
+    }
+  }
+  const artifactMaterializationJobs = tableByName.get("editable_artifact_materialization_jobs");
+  if (artifactMaterializationJobs) {
+    for (const tableName of [
+      "editable_artifact_materialization_jobs",
+      "editable_artifact_materialization_results",
+      "editable_artifact_blob_refs",
+      "editable_artifact_sequence_checkpoints",
+      "editable_artifact_versions",
+      "editable_artifact_idempotency_receipts"
+    ]) {
+      const table = tableByName.get(tableName);
+      if (table && !table.artifactMaterializerPolicy) {
+        violations.push(`table ${tableName} lacks its owner materializer RLS policy`);
+      }
+    }
+    for (const expectedRoutine of ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
+      if (matches.length !== 1) {
+        violations.push(
+          `artifact materializer capability ${expectedRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(`artifact materializer capability ${routine.name} is not SECURITY DEFINER`);
+      }
+      if (routine.owner !== artifactMaterializationJobs.owner) {
+        violations.push(
+          `artifact materializer capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactMaterializationJobs.owner}`
+        );
+      }
+      if (routine.execute) {
+        violations.push(
+          `generic runtime role has forbidden global artifact materializer capability ${routine.name}`
+        );
+      }
+    }
+  }
+  const artifactAuthority = tableByName.get("editable_artifacts");
+  if (artifactAuthority) {
+    const matches = posture.privateRoutines.filter(
+      (routine) => routine.name.startsWith("advance_editable_artifact_authorization_revision(")
+    );
+    if (matches.length !== 1) {
+      violations.push(
+        "editable artifact authorization revision capability is missing or ambiguous"
+      );
+    } else {
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(
+          `editable artifact authorization revision capability ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (routine.owner !== artifactAuthority.owner) {
+        violations.push(
+          `editable artifact authorization revision capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`
+        );
+      }
+    }
+    for (const expectedRoutine of ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES) {
+      const capabilityMatches = posture.privateRoutines.filter(
+        (routine2) => routine2.name === expectedRoutine
+      );
+      if (capabilityMatches.length !== 1) {
+        violations.push(
+          `editable artifact authorization capability ${expectedRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = capabilityMatches[0];
+      if (!routine.securityDefiner) {
+        violations.push(
+          `editable artifact authorization capability ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (routine.owner !== artifactAuthority.owner) {
+        violations.push(
+          `editable artifact authorization capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(
+          `runtime role lacks editable artifact authorization capability ${routine.name}`
+        );
+      }
+    }
+  }
+  const artifactLiveTickets = tableByName.get("editable_artifact_live_tickets");
+  if (artifactLiveTickets) {
+    for (const expectedRoutine of ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
+      if (matches.length !== 1) {
+        violations.push(
+          `artifact live ticket capability ${expectedRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(`artifact live ticket capability ${routine.name} is not SECURITY DEFINER`);
+      }
+      if (routine.owner !== artifactLiveTickets.owner) {
+        violations.push(
+          `artifact live ticket capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(`runtime role lacks artifact live ticket capability ${routine.name}`);
+      }
+    }
+    for (const internalRoutine of ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES) {
+      const matches = posture.privateRoutines.filter((routine2) => routine2.name === internalRoutine);
+      if (matches.length !== 1) {
+        violations.push(
+          `artifact live ticket internal routine ${internalRoutine} is missing or ambiguous`
+        );
+        continue;
+      }
+      const routine = matches[0];
+      if (!routine.securityDefiner) {
+        violations.push(
+          `artifact live ticket internal routine ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (routine.owner !== artifactLiveTickets.owner) {
+        violations.push(
+          `artifact live ticket internal routine ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`
+        );
+      }
+      if (routine.execute) {
+        violations.push(`runtime role has forbidden ticket schema resolver ${routine.name}`);
+      }
+    }
+  }
+  const personalResourceCapabilityTables = posture.privateTables.filter(
+    (table) => table.name === PERSONAL_RESOURCE_CAPABILITY_TABLE
+  );
+  const personalResourceCapabilityRoutines = posture.privateRoutines.filter(
+    (routine) => routine.name === PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE
+  );
+  if (personalResourceCapabilityTables.length !== 1) {
+    violations.push(
+      `personal-resource capability table ${PERSONAL_RESOURCE_CAPABILITY_TABLE} is missing or ambiguous`
+    );
+  }
+  if (personalResourceCapabilityRoutines.length !== 1) {
+    violations.push(
+      `personal-resource capability predicate ${PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`
+    );
+  }
+  if (personalResourceCapabilityTables.length === 1 && personalResourceCapabilityRoutines.length === 1) {
+    const table = personalResourceCapabilityTables[0];
+    const routine = personalResourceCapabilityRoutines[0];
+    if (routine.owner !== table.owner) {
+      violations.push(
+        `personal-resource capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`
+      );
+    }
+    if (!routine.securityDefiner) {
+      violations.push(
+        `personal-resource capability predicate ${routine.name} is not SECURITY DEFINER`
+      );
+    }
+    if (!routine.execute) {
+      violations.push(`runtime role lacks personal-resource capability predicate ${routine.name}`);
+    }
+    if (routine.publicExecute) {
+      violations.push(
+        `PUBLIC has forbidden personal-resource capability predicate ${routine.name}`
+      );
+    }
+    const directPrivileges = [
+      ["SELECT", table.select],
+      ["INSERT", table.insert],
+      ["UPDATE", table.update],
+      ["DELETE", table.delete]
+    ].filter(([, granted]) => granted);
+    if (directPrivileges.length > 0) {
+      violations.push(
+        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+      );
+    }
+  }
+  const personalDocumentCapabilityTables = posture.privateTables.filter(
+    (table) => table.name === PERSONAL_DOCUMENT_CAPABILITY_TABLE
+  );
+  const personalDocumentCapabilityRoutines = posture.privateRoutines.filter(
+    (routine) => routine.name === PERSONAL_DOCUMENT_CAPABILITY_PREDICATE_ROUTINE
+  );
+  if (personalDocumentCapabilityTables.length !== 1) {
+    violations.push(
+      `personal-document capability table ${PERSONAL_DOCUMENT_CAPABILITY_TABLE} is missing or ambiguous`
+    );
+  }
+  if (personalDocumentCapabilityRoutines.length !== 1) {
+    violations.push(
+      `personal-document capability predicate ${PERSONAL_DOCUMENT_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`
+    );
+  }
+  if (personalDocumentCapabilityTables.length === 1 && personalDocumentCapabilityRoutines.length === 1) {
+    const table = personalDocumentCapabilityTables[0];
+    const routine = personalDocumentCapabilityRoutines[0];
+    if (routine.owner !== table.owner) {
+      violations.push(
+        `personal-document capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`
+      );
+    }
+    if (!routine.securityDefiner) {
+      violations.push(
+        `personal-document capability predicate ${routine.name} is not SECURITY DEFINER`
+      );
+    }
+    if (!routine.execute) {
+      violations.push(`runtime role lacks personal-document capability predicate ${routine.name}`);
+    }
+    if (routine.publicExecute) {
+      violations.push(
+        `PUBLIC has forbidden personal-document capability predicate ${routine.name}`
+      );
+    }
+    const directPrivileges = [
+      ["SELECT", table.select],
+      ["INSERT", table.insert],
+      ["UPDATE", table.update],
+      ["DELETE", table.delete]
+    ].filter(([, granted]) => granted);
+    if (directPrivileges.length > 0) {
+      violations.push(
+        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+      );
+    }
+  }
+  const documentMigrationCapabilityTables = posture.privateTables.filter(
+    (table) => table.name === DOCUMENT_MIGRATION_CAPABILITY_TABLE
+  );
+  const documentMigrationCapabilityRoutines = posture.privateRoutines.filter(
+    (routine) => routine.name === DOCUMENT_MIGRATION_CAPABILITY_PREDICATE_ROUTINE
+  );
+  if (documentMigrationCapabilityTables.length !== 1) {
+    violations.push(
+      `document-migration capability table ${DOCUMENT_MIGRATION_CAPABILITY_TABLE} is missing or ambiguous`
+    );
+  }
+  if (documentMigrationCapabilityRoutines.length !== 1) {
+    violations.push(
+      `document-migration capability predicate ${DOCUMENT_MIGRATION_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`
+    );
+  }
+  if (documentMigrationCapabilityTables.length === 1 && documentMigrationCapabilityRoutines.length === 1) {
+    const table = documentMigrationCapabilityTables[0];
+    const routine = documentMigrationCapabilityRoutines[0];
+    if (routine.owner !== table.owner) {
+      violations.push(
+        `document-migration capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`
+      );
+    }
+    if (!routine.securityDefiner) {
+      violations.push(
+        `document-migration capability predicate ${routine.name} is not SECURITY DEFINER`
+      );
+    }
+    if (!routine.execute) {
+      violations.push(`runtime role lacks document-migration capability predicate ${routine.name}`);
+    }
+    if (routine.publicExecute) {
+      violations.push(
+        `PUBLIC has forbidden document-migration capability predicate ${routine.name}`
+      );
+    }
+    const directPrivileges = [
+      ["SELECT", table.select],
+      ["INSERT", table.insert],
+      ["UPDATE", table.update],
+      ["DELETE", table.delete]
+    ].filter(([, granted]) => granted);
+    if (directPrivileges.length > 0) {
+      violations.push(
+        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+      );
+    }
+  }
+  const scheduledCapabilityTables = posture.privateTables.filter(
+    (table) => table.name === SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE
+  );
+  const scheduledCapabilityRoutines = posture.privateRoutines.filter(
+    (routine) => routine.name === SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE
+  );
+  if (scheduledCapabilityTables.length !== 1) {
+    violations.push(
+      `scheduled personal-resource capability table ${SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE} is missing or ambiguous`
+    );
+  }
+  if (scheduledCapabilityRoutines.length !== 1) {
+    violations.push(
+      `scheduled personal-resource capability predicate ${SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`
+    );
+  }
+  if (scheduledCapabilityTables.length === 1 && scheduledCapabilityRoutines.length === 1) {
+    const table = scheduledCapabilityTables[0];
+    const routine = scheduledCapabilityRoutines[0];
+    if (routine.owner !== table.owner) {
+      violations.push(
+        `scheduled personal-resource capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`
+      );
+    }
+    if (!routine.securityDefiner) {
+      violations.push(
+        `scheduled personal-resource capability predicate ${routine.name} is not SECURITY DEFINER`
+      );
+    }
+    if (!routine.execute) {
+      violations.push(
+        `runtime role lacks scheduled personal-resource capability predicate ${routine.name}`
+      );
+    }
+    if (routine.publicExecute) {
+      violations.push(
+        `PUBLIC has forbidden scheduled personal-resource capability predicate ${routine.name}`
+      );
+    }
+    const directPrivileges = [
+      ["SELECT", table.select],
+      ["INSERT", table.insert],
+      ["UPDATE", table.update],
+      ["DELETE", table.delete]
+    ].filter(([, granted]) => granted);
+    if (directPrivileges.length > 0) {
+      violations.push(
+        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+      );
+    }
+  }
+  if (options.protectedTables === void 0) {
+    const variableSetCapabilityTables = posture.privateTables.filter(
+      (table) => table.name === VARIABLE_SET_CAPABILITY_TABLE
+    );
+    const variableSetCapabilityRoutines = posture.privateRoutines.filter(
+      (routine) => routine.name === VARIABLE_SET_CAPABILITY_PREDICATE_ROUTINE
+    );
+    if (variableSetCapabilityTables.length !== 1) {
+      violations.push(
+        `variable-set capability table ${VARIABLE_SET_CAPABILITY_TABLE} is missing or ambiguous`
+      );
+    }
+    if (variableSetCapabilityRoutines.length !== 1) {
+      violations.push(
+        `variable-set capability predicate ${VARIABLE_SET_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`
+      );
+    }
+    if (variableSetCapabilityTables.length === 1 && variableSetCapabilityRoutines.length === 1) {
+      const table = variableSetCapabilityTables[0];
+      const routine = variableSetCapabilityRoutines[0];
+      if (routine.owner !== table.owner) {
+        violations.push(
+          `variable-set capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`
+        );
+      }
+      if (!routine.securityDefiner) {
+        violations.push(
+          `variable-set capability predicate ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(`runtime role lacks variable-set capability predicate ${routine.name}`);
+      }
+      if (routine.publicExecute) {
+        violations.push(`PUBLIC has forbidden variable-set capability predicate ${routine.name}`);
+      }
+      const directPrivileges = [
+        ["SELECT", table.select],
+        ["INSERT", table.insert],
+        ["UPDATE", table.update],
+        ["DELETE", table.delete]
+      ].filter(([, granted]) => granted);
+      if (directPrivileges.length > 0) {
+        violations.push(
+          `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+        );
+      }
+    }
+    const scopedComputeCapabilityTables = posture.privateTables.filter(
+      (table) => table.name === SCOPED_COMPUTE_CAPABILITY_TABLE
+    );
+    const scopedComputeCapabilityRoutines = posture.privateRoutines.filter(
+      (routine) => routine.name === SCOPED_COMPUTE_CAPABILITY_PREDICATE_ROUTINE
+    );
+    if (scopedComputeCapabilityTables.length !== 1) {
+      violations.push(
+        `scoped-compute capability table ${SCOPED_COMPUTE_CAPABILITY_TABLE} is missing or ambiguous`
+      );
+    }
+    if (scopedComputeCapabilityRoutines.length !== 1) {
+      violations.push(
+        `scoped-compute capability predicate ${SCOPED_COMPUTE_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`
+      );
+    }
+    if (scopedComputeCapabilityTables.length === 1 && scopedComputeCapabilityRoutines.length === 1) {
+      const table = scopedComputeCapabilityTables[0];
+      const routine = scopedComputeCapabilityRoutines[0];
+      if (routine.owner !== table.owner) {
+        violations.push(
+          `scoped-compute capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`
+        );
+      }
+      if (!routine.securityDefiner) {
+        violations.push(
+          `scoped-compute capability predicate ${routine.name} is not SECURITY DEFINER`
+        );
+      }
+      if (!routine.execute) {
+        violations.push(`runtime role lacks scoped-compute capability predicate ${routine.name}`);
+      }
+      if (routine.publicExecute) {
+        violations.push(`PUBLIC has forbidden scoped-compute capability predicate ${routine.name}`);
+      }
+      const directPrivileges = [
+        ["SELECT", table.select],
+        ["INSERT", table.insert],
+        ["UPDATE", table.update],
+        ["DELETE", table.delete]
+      ].filter(([, granted]) => granted);
+      if (directPrivileges.length > 0) {
+        violations.push(
+          `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+        );
+      }
+    }
+  }
+  if (posture.privateRoutines.length === 0) {
+    violations.push("opengeni_private has no helper routines");
+  }
+  const connectionBackfillCapabilityTables = posture.privateTables.filter(
+    (table) => table.name === CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE
+  );
+  const connectionBackfillCapabilityRoutines = posture.privateRoutines.filter(
+    (routine) => routine.name === CONNECTION_TENANCY_BACKFILL_CAPABILITY_PREDICATE_ROUTINE
+  );
+  if (connectionBackfillCapabilityTables.length !== 1) {
+    violations.push(
+      `connection-tenancy backfill capability table ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE} is missing or ambiguous`
+    );
+  }
+  if (connectionBackfillCapabilityRoutines.length !== 1) {
+    violations.push(
+      `connection-tenancy backfill capability predicate ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`
+    );
+  }
+  if (connectionBackfillCapabilityTables.length === 1 && connectionBackfillCapabilityRoutines.length === 1) {
+    const table = connectionBackfillCapabilityTables[0];
+    const routine = connectionBackfillCapabilityRoutines[0];
+    if (routine.owner !== table.owner) {
+      violations.push(
+        `connection-tenancy backfill capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`
+      );
+    }
+    if (!routine.securityDefiner) {
+      violations.push(
+        `connection-tenancy backfill capability predicate ${routine.name} is not SECURITY DEFINER`
+      );
+    }
+    if (!routine.execute) {
+      violations.push(
+        `runtime role lacks connection-tenancy backfill capability predicate ${routine.name}`
+      );
+    }
+    if (routine.publicExecute) {
+      violations.push(
+        `PUBLIC has forbidden connection-tenancy backfill capability predicate ${routine.name}`
+      );
+    }
+    const directPrivileges = [
+      ["SELECT", table.select],
+      ["INSERT", table.insert],
+      ["UPDATE", table.update],
+      ["DELETE", table.delete]
+    ].filter(([, granted]) => granted);
+    if (directPrivileges.length > 0) {
+      violations.push(
+        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(", ")}`
+      );
+    }
+  }
+  for (const routine of posture.privateRoutines) {
+    if (routine.owner === expectedRole) {
+      violations.push(`runtime role owns private routine ${routine.name}`);
+    }
+    const dedicatedArtifactCapability = DEDICATED_ARTIFACT_CAPABILITY_ROUTINES.has(routine.name);
+    if (!routine.execute && !dedicatedArtifactCapability) {
+      violations.push(`runtime role lacks EXECUTE on private routine ${routine.name}`);
+    }
+  }
+  return violations;
+}
+async function assertRuntimeDatabasePosture(db, options) {
+  const posture = await inspectRuntimeDatabasePosture(db, options);
+  const violations = evaluateRuntimeDatabasePosture(posture, options);
+  if (violations.length > 0) {
+    throw new RuntimeDatabasePostureError(violations);
+  }
+  return posture;
+}
+function runtimeDatabaseReadyCheck(db, options) {
+  return async () => {
+    await assertRuntimeDatabasePosture(db, options);
+  };
+}
+
+// src/provision-roles.ts
+async function provisionRoles(adminConnection, options = {}) {
+  const schema = validateIdentifier("targetSchema", options.targetSchema ?? "public");
+  const rlsStrategy = options.rlsStrategy ?? "force";
+  const appRole = validateIdentifier(
+    "appRole",
+    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app")
+  );
+  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
+  const artifactOutboxDispatcherRole = validateIdentifier(
+    "artifactOutboxDispatcherRole",
+    options.artifactOutboxDispatcherRole ?? (process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_USER?.trim() || "opengeni_artifact_outbox_dispatcher")
+  );
+  const artifactOutboxDispatcherPassword = options.artifactOutboxDispatcherPassword ?? process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_PASSWORD;
+  const artifactMaterializerRole = validateIdentifier(
+    "artifactMaterializerRole",
+    options.artifactMaterializerRole ?? (process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_USER?.trim() || "opengeni_artifact_materializer")
+  );
+  const artifactMaterializerPassword = options.artifactMaterializerPassword ?? process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_PASSWORD;
+  const hostExportRole = validateIdentifier(
+    "hostExportRole",
+    options.hostExportRole ?? (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || "opengeni_host_exporter")
+  );
+  const hostExportPassword = options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;
+  const temporalRole = validateIdentifier(
+    "temporalRole",
+    options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal")
+  );
+  const temporalPassword = options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;
+  const temporalDatabases = (options.temporalDatabases ?? commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? "temporal,temporal_visibility")).map((name) => validateIdentifier("temporalDatabases", name));
+  const sql2 = postgres(adminConnection, { max: 1 });
+  try {
+    let provisionedAppRole = null;
+    if (rlsStrategy === "force") {
+      if (!appPassword) {
+        throw new Error(
+          "OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'"
+        );
+      }
+      await assertAppRoleSafeToNormalize(sql2, appRole);
+      await ensureRestrictedAppLoginRole(sql2, appRole, appPassword);
+      provisionedAppRole = appRole;
+    }
+    let provisionedArtifactOutboxDispatcherRole = null;
+    if (artifactOutboxDispatcherPassword) {
+      await assertAppRoleSafeToNormalize(sql2, artifactOutboxDispatcherRole);
+      await ensureRestrictedAppLoginRole(
+        sql2,
+        artifactOutboxDispatcherRole,
+        artifactOutboxDispatcherPassword
+      );
+      await grantArtifactCapabilityRoleIfSchemaExists(
+        sql2,
+        artifactOutboxDispatcherRole,
+        schema,
+        "outbox"
+      );
+      provisionedArtifactOutboxDispatcherRole = artifactOutboxDispatcherRole;
+    }
+    let provisionedArtifactMaterializerRole = null;
+    if (artifactMaterializerPassword) {
+      await assertAppRoleSafeToNormalize(sql2, artifactMaterializerRole);
+      await ensureRestrictedAppLoginRole(
+        sql2,
+        artifactMaterializerRole,
+        artifactMaterializerPassword
+      );
+      await grantArtifactCapabilityRoleIfSchemaExists(
+        sql2,
+        artifactMaterializerRole,
+        schema,
+        "materializer"
+      );
+      provisionedArtifactMaterializerRole = artifactMaterializerRole;
+    }
+    if (temporalPassword) {
+      await ensureLoginRole(sql2, temporalRole, temporalPassword);
+      for (const database of temporalDatabases) {
+        await ensureDatabase(sql2, database, temporalRole);
+        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);
+      }
+    }
+    if (hostExportPassword) {
+      await ensureLoginRole(sql2, hostExportRole, hostExportPassword);
+      await grantHostExportRoleIfSchemaExists(sql2, hostExportRole);
+    }
+    if (rlsStrategy === "force") {
+      await grantAppRoleIfSchemaExists(sql2, appRole, schema);
+    }
+    return {
+      appRole: provisionedAppRole,
+      artifactOutboxDispatcherRole: provisionedArtifactOutboxDispatcherRole,
+      artifactMaterializerRole: provisionedArtifactMaterializerRole,
+      hostExportRole: hostExportPassword ? hostExportRole : null,
+      temporalRole: temporalPassword ? temporalRole : null,
+      temporalDatabases: temporalPassword ? temporalDatabases : [],
+      schema,
+      rlsStrategy
+    };
+  } finally {
+    await sql2.end();
+  }
+}
+async function grantHostExportRoleIfSchemaExists(sql2, role) {
+  await sql2.unsafe(`
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});
+    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});
+    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});
+  END IF;
+END $$;
+`);
+}
+async function grantArtifactCapabilityRoleIfSchemaExists(sql2, role, dataSchema, capability) {
+  const routines = capability === "outbox" ? [
+    "claim_editable_artifact_live_outbox(text,integer,integer,name)",
+    "mark_editable_artifact_live_outbox_published(text,text,integer,name)",
+    "renew_editable_artifact_live_outbox(text,text,integer,integer,name)",
+    "retry_editable_artifact_live_outbox(text,text,integer,integer,text,name)",
+    "dead_letter_editable_artifact_live_outbox(text,text,integer,text,name)",
+    "release_editable_artifact_live_outbox(text,text,integer,name)"
+  ] : [
+    "claim_editable_artifact_materializations(text,integer,integer,name)",
+    "renew_editable_artifact_materialization(uuid,uuid,text,text,text,integer,integer,name)",
+    "succeed_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,text,text,bigint,text,text,timestamp with time zone,name)",
+    "fail_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,name)"
+  ];
+  const routineArray = `ARRAY[${routines.map(literal).join(", ")}]`;
+  await sql2.unsafe(`
+DO $$
+DECLARE routine_signature text;
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(dataSchema)})
+    AND EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private')
+  THEN
+    EXECUTE format('GRANT CONNECT ON DATABASE %I TO %I', current_database(), ${literal(role)});
+    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(dataSchema)}, ${literal(role)});
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format(
+      'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I',
+      ${literal(dataSchema)}, ${literal(role)}
+    );
+    EXECUTE format(
+      'REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I FROM %I',
+      ${literal(dataSchema)}, ${literal(role)}
+    );
+    EXECUTE format(
+      'REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA opengeni_private FROM %I',
+      ${literal(role)}
+    );
+    FOREACH routine_signature IN ARRAY ${routineArray} LOOP
+      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',
+          routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+  END IF;
+END $$;
+`);
+}
+async function ensureLoginRole(sql2, role, password) {
+  await sql2.unsafe(`
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
+    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
+  ELSE
+    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
+  END IF;
+END $$;
+`);
+}
+async function ensureRestrictedAppLoginRole(sql2, role, password) {
+  await sql2.unsafe(`
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
+    EXECUTE format(
+      'CREATE ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
+  ELSIF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND rolsuper) THEN
+    EXECUTE format(
+      'ALTER ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
+  ELSE
+    -- PostgreSQL requires elevated attributes merely to name SUPERUSER,
+    -- BYPASSRLS, REPLICATION, or CREATEDB in ALTER ROLE, even when setting them
+    -- false. The preflight has already proved those protected attributes are
+    -- false, so a managed CREATEROLE administrator converges only the
+    -- attributes it may change.
+    EXECUTE format(
+      'ALTER ROLE %I WITH LOGIN NOCREATEROLE NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
+  END IF;
+END $$;
+`);
+}
+async function assertAppRoleSafeToNormalize(sql2, role) {
+  const exists = await sql2`
+    select exists(select 1 from pg_roles where rolname = ${role}) as exists
+  `;
+  if (!exists[0]?.exists) {
+    return;
+  }
+  const [roleAttributes] = await sql2`
+    select
+      administrator.rolsuper as administrator_superuser,
+      app.rolsuper as app_superuser,
+      app.rolbypassrls as app_bypass_rls,
+      app.rolcreatedb as app_create_database,
+      app.rolreplication as app_replication
+    from pg_roles app
+    join pg_roles administrator on administrator.rolname = current_user
+    where app.rolname = ${role}
+  `;
+  if (roleAttributes && !roleAttributes.administrator_superuser) {
+    const protectedAttributes = [
+      roleAttributes.app_superuser ? "SUPERUSER" : null,
+      roleAttributes.app_bypass_rls ? "BYPASSRLS" : null,
+      roleAttributes.app_create_database ? "CREATEDB" : null,
+      roleAttributes.app_replication ? "REPLICATION" : null
+    ].filter((attribute) => attribute !== null);
+    if (protectedAttributes.length > 0) {
+      throw new Error(
+        `Refusing to normalize app role ${role}: a non-superuser administrator cannot clear protected attributes (${protectedAttributes.join(", ")})`
+      );
+    }
+  }
+  const relationshipRows = await sql2.unsafe(
+    roleRelationshipsCatalogQuery("$1"),
+    [role]
+  );
+  const { unsafeRelationships } = classifyRoleRelationships(relationshipRows);
+  if (unsafeRelationships.length > 0) {
+    throw new Error(
+      `Refusing to normalize app role ${role}: remove privilege-bearing role relationships first (${unsafeRelationships.join(", ")})`
+    );
+  }
+  const ownedObjects = await sql2`
+    select ('database:' || d.datname)::text as object_name
+    from pg_database d
+    join pg_roles owner on owner.oid = d.datdba
+    where owner.rolname = ${role}
+    union all
+    select ('schema:' || n.nspname)::text as object_name
+    from pg_namespace n
+    join pg_roles owner on owner.oid = n.nspowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    union all
+    select ('relation:' || n.nspname || '.' || c.relname)::text as object_name
+    from pg_class c
+    join pg_namespace n on n.oid = c.relnamespace
+    join pg_roles owner on owner.oid = c.relowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    union all
+    select (
+      'routine:' || n.nspname || '.' || p.proname || '(' ||
+      pg_get_function_identity_arguments(p.oid) || ')'
+    )::text as object_name
+    from pg_proc p
+    join pg_namespace n on n.oid = p.pronamespace
+    join pg_roles owner on owner.oid = p.proowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    order by object_name
+  `;
+  if (ownedObjects.length > 0) {
+    throw new Error(
+      `Refusing to normalize app role ${role}: transfer owned objects first (${ownedObjects.map((row) => row.object_name).join(", ")})`
+    );
+  }
+}
+async function ensureDatabase(sql2, database, owner) {
+  const existing = await sql2`
+    select exists(select 1 from pg_database where datname = ${database}) as exists
+  `;
+  if (!existing[0]?.exists) {
+    await sql2.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);
+  }
+  await sql2.unsafe(
+    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`
+  );
+}
+async function grantTemporalRoleInDatabase(adminConnection, database, role) {
+  const databaseUrl = databaseUrlFor(adminConnection, database);
+  const databaseSql = postgres(databaseUrl, { max: 1 });
+  try {
+    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);
+  } finally {
+    await databaseSql.end();
+  }
+}
+async function grantAppRoleIfSchemaExists(sql2, role, schema) {
+  const runtimeFullDmlTables = `ARRAY[${RUNTIME_FULL_DML_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadOnlyTables = `ARRAY[${RUNTIME_READ_ONLY_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadUpdateTables = `ARRAY[${RUNTIME_READ_UPDATE_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(", ")}]`;
+  const organizationMembershipLifecycleRoutines = `ARRAY[${[
+    "list_self_organization_memberships(text)",
+    "list_self_organization_invitations(text)",
+    "list_self_organization_invitations(text,uuid,integer)",
+    "get_self_organization_invitation(text,uuid)",
+    "list_organization_members(uuid,text)",
+    "list_organization_invitations(uuid,text,uuid,integer)",
+    "get_organization_administration_overview(uuid,text)",
+    "create_managed_organization(text,text,text,uuid)",
+    "assert_organization_shared_workspace_administrator(uuid,uuid,text)",
+    "open_organization_shared_workspace_administration_capability(uuid,uuid,text)",
+    "close_organization_shared_workspace_administration_capability(uuid)",
+    "create_organization_shared_workspace(uuid,text,text,text,text,uuid)",
+    "upsert_organization_shared_workspace_member(uuid,uuid,text,uuid,text,text,jsonb,boolean)",
+    "update_organization_name(uuid,text,text,timestamptz,uuid)",
+    "create_organization_invitation_v2(jsonb)",
+    "bind_pending_organization_invitations_for_verified_email(text,text)",
+    "has_pending_organization_invitation_for_subject(text)",
+    "accept_organization_invitation_v2(jsonb)",
+    "organization_membership_command(jsonb)",
+    "prepare_organization_membership_protocol_settlements(jsonb)",
+    "assert_active_managed_human_organization_membership(uuid,text)",
+    "resolve_workspace_writer_grant_identity(uuid,text)",
+    "prepare_workspace_membership_removal_settlements(jsonb)",
+    "workspace_membership_removal_command(jsonb)",
+    "get_organization_retention_policy(uuid,text)",
+    "preview_organization_retention_deletions(uuid,integer)",
+    "claim_organization_retention_deletion(uuid,uuid,uuid[])",
+    "list_organization_retention_deletion_objects(uuid,uuid,uuid,text,integer)",
+    "record_organization_retention_object_deleted(uuid,uuid,uuid,text,text,text,text)",
+    "fail_organization_retention_deletion(uuid,uuid,uuid,text)",
+    "finalize_organization_retention_deletion(uuid,uuid,uuid,text)",
+    "complete_organization_retention_deletion(uuid,uuid,uuid,text)"
+  ].map(literal).join(", ")}]`;
+  await sql2.unsafe(`
+DO $$
+DECLARE
+  owner_role text := current_user;
+  runtime_table text;
+  routine_signature text;
+BEGIN
+  EXECUTE format('REVOKE CREATE ON DATABASE %I FROM %I', current_database(), ${literal(role)});
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format('REVOKE CREATE ON SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format('REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
+    FOREACH runtime_table IN ARRAY ${runtimeFullDmlTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadOnlyTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadUpdateTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, UPDATE ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadInsertTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadInsertUpdateTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT, UPDATE ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    -- Migration 0301 creates this target-schema capability before
+    -- opengeni_app exists on a fresh migrate-then-provision installation. Its
+    -- policy is evaluated for ordinary session-list snapshot writes, so the
+    -- runtime role must be able to execute the predicate even when no
+    -- visibility-transition capability is active. Re-converge the exact ACL
+    -- here and keep PUBLIC revoked.
+    IF to_regprocedure(
+      format('%I.session_visibility_lifecycle_capability_held()', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_visibility_lifecycle_capability_held() FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_visibility_lifecycle_capability_held() TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0300's tenancy backfill ledger seam has the same shape: its
+    -- own conditional GRANT block is skipped whenever opengeni_app does not
+    -- yet exist, and these three live in the data schema rather than
+    -- opengeni_private, so the blanket sweep above never reaches them.
+    -- Re-converge them here so migrate-then-provision matches the reverse
+    -- order; without this the "only write path" seam is unreachable on a
+    -- green-field database.
+    FOR routine_signature IN
+      SELECT unnest(ARRAY[
+        'open_tenancy_backfill_receipt(uuid, text, text)',
+        'record_tenancy_backfill_unresolved(uuid, uuid, text)',
+        'complete_tenancy_backfill_receipt(uuid, bigint, bigint, text)'
+      ])
+    LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature))
+        IS NOT NULL
+      THEN
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)},
+          routine_signature,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    -- Migration 0291's classification assertion seam has the same shape: its
+    -- own conditional GRANT block is skipped whenever opengeni_app does not yet
+    -- exist, and it lives in the data schema rather than opengeni_private, so
+    -- the blanket sweep above never reaches it. (Its inner capability predicate
+    -- IS in opengeni_private and is covered by that sweep.)
+    IF to_regprocedure(
+      format(
+        '%I.verify_organization_resource_classification(uuid,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.verify_organization_resource_classification(uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0297's session ownership seams have the same shape: their own
+    -- conditional GRANT block is skipped whenever opengeni_app does not yet
+    -- exist, and they live in the data schema rather than opengeni_private, so
+    -- the blanket sweep above never reaches them. (Their inner capability
+    -- predicate IS in opengeni_private and is covered by that sweep.)
+    IF to_regprocedure(
+      format(
+        '%I.classify_organization_session_ownership(uuid,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.classify_organization_session_ownership(uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.backfill_organization_session_ownership(uuid,integer,boolean,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.backfill_organization_session_ownership(uuid, integer, boolean, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0340's bounded connection convergence and repaired parity
+    -- seams also live in the data schema. Converge their exact grants for the
+    -- supported migrate-then-provision order.
+    FOREACH routine_signature IN ARRAY ARRAY[
+      'classify_organization_connection_authority(uuid,text)',
+      'backfill_organization_connection_authority(uuid,integer,boolean)',
+      'check_organization_tenancy_parity(uuid,integer,integer)'
+    ] LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature))
+        IS NOT NULL
+      THEN
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)},
+          routine_signature,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    -- Migration 0110 creates this target-schema-local SECURITY DEFINER
+    -- capability before opengeni_app may exist. Re-converge its exact EXECUTE
+    -- grant here so the supported migrate-then-provision order is equivalent to
+    -- provisioning the role before that migration.
+    IF to_regprocedure(
+      format('%I.lock_nested_agent_depth_configuration()', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.lock_nested_agent_depth_configuration() TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.preference_registry_apply_lifecycle(text,uuid,integer,uuid,uuid,text,uuid,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_apply_lifecycle(text, uuid, integer, uuid, uuid, text, uuid, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.preference_registry_lock_heads(uuid[])', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_lock_heads(uuid[]) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.knowledge_memory_apply_operation(jsonb,text,text,text,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_apply_operation(jsonb, text, text, text, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.knowledge_memory_revert_operation(uuid,uuid,text,text,text,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_revert_operation(uuid, uuid, text, text, text, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.preference_registry_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0289 creates this definer accessor before opengeni_app may
+    -- exist, so its migration-time GRANT is skipped on the supported
+    -- migrate-then-provision order. Re-converge it here.
+    IF to_regprocedure(
+      format(
+        '%I.preference_registry_activation_authority(uuid,uuid[])',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_activation_authority(uuid, uuid[]) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.preference_registry_create_knowledge_proposal_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,uuid,text,text,text,text,integer,text,jsonb,timestamptz,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamptz, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.create_task_note_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.company_brain_context_get_or_create_selection(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.company_brain_inspect_context_receipts(uuid,uuid,text,uuid,timestamptz,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamptz, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.evaluate_governed_learning_proposal(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.activate_governed_learning_decision(uuid,uuid,uuid,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.activate_governed_learning_decision(uuid, uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.activate_human_confirmed_learning_decision(uuid,uuid,uuid,uuid,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.confirm_remember_knowledge_claim(uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.undo_governed_learning_activation(uuid,uuid,uuid,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.undo_governed_learning_activation(uuid, uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.inspect_governed_learning_decisions(uuid,uuid,text,integer)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.inspect_governed_learning_decisions(uuid, uuid, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.inspect_governed_learning_activations(uuid,uuid,text,integer)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.inspect_governed_learning_activations(uuid, uuid, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.inspect_governed_learning_activation_undos(uuid,uuid,text,integer)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.inspect_governed_learning_activation_undos(uuid, uuid, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.replace_task_note_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid,uuid,integer,text,text,integer,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.resolve_task_note_knowledge_promotion_source(uuid,uuid,uuid,uuid,uuid,integer,uuid,integer,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_instruction_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.company_profile_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.company_profile_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.company_profile_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.company_profile_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.propose_company_profile_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.confirm_company_profile_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.workspace_learning_policy_source_overrides_valid(jsonb)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_source_overrides_valid(jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.workspace_learning_policy_hash(text,jsonb)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_hash(text, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.workspace_learning_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.slack_task_policy_update(uuid,text,uuid,uuid,jsonb,uuid,bigint,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.slack_task_policy_update(uuid, text, uuid, uuid, jsonb, uuid, bigint, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_apply_lifecycle(uuid, text, uuid, text, bigint, text, text, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0197 creates this target-schema-local SECURITY DEFINER lock
+    -- before opengeni_app may exist. Re-converge only its exact EXECUTE grant
+    -- for the supported migrate-then-provision install order; keep PUBLIC
+    -- revoked and do not widen table privileges.
+    IF to_regprocedure(
+      format(
+        '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0243 adds the exact Google Drive object authorization and
+    -- safe-citation projections. Re-converge both capabilities for the same
+    -- supported migrate-then-provision order without granting direct mutation
+    -- of their append-only ACL evidence tables.
+    IF to_regprocedure(
+      format(
+        '%I.google_drive_file_authorized(uuid,uuid,text,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.google_drive_file_authorized(uuid, uuid, text, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.google_drive_file_authorized(uuid, uuid, text, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.google_drive_document_citation(uuid,uuid,text,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.google_drive_document_citation(uuid, uuid, text, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.google_drive_document_citation(uuid, uuid, text, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.ensure_managed_human_personal_workspace(uuid,text,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    FOREACH routine_signature IN ARRAY ${organizationMembershipLifecycleRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    IF to_regprocedure(format('%I.ensure_canonical_human_identity(text,text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.ensure_canonical_human_identity(text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.ensure_canonical_human_identity(text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.validate_canonical_human_session(text,text,boolean)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.get_canonical_human_identity_projection(text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.get_canonical_human_identity_projection(text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_canonical_human_identity_projection(text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.apply_canonical_human_identity_operation(uuid,text,bigint,text,uuid,text,text,text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0225 creates these target-schema-local session visibility
+    -- capabilities before opengeni_app may exist. Re-converge their exact
+    -- EXECUTE grants for migrate-then-provision installs without granting
+    -- blanket execution on target-schema routines.
+    IF to_regprocedure(
+      format(
+        '%I.session_private_actor_visible(uuid,uuid,uuid,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.session_reference_visible(uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.transition_session_visibility(uuid,uuid,uuid,text,text,integer,text,text,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,text,text,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.replay_applied_session_fork(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.session_tenancy_product_activated(uuid,integer)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_tenancy_product_activated(uuid, integer) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_tenancy_product_activated(uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_tenancy_any_product_activation() FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_tenancy_any_product_activation() TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean) FROM %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.get_private_session_create_policy(uuid,uuid,text)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.get_private_session_create_policy(uuid, uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_private_session_create_policy(uuid, uuid, text) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.get_organization_private_session_settings(uuid,text)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.get_organization_private_session_settings(uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_organization_private_session_settings(uuid, text) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.update_organization_private_session_settings(uuid,text,boolean,bigint,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.update_organization_private_session_settings(uuid, text, boolean, bigint, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.update_organization_private_session_settings(uuid, text, boolean, bigint, uuid) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.organization_private_sessions_enabled(uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.organization_private_sessions_enabled(uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.organization_private_sessions_enabled(uuid) FROM %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.open_private_session_create_capability(uuid,uuid,uuid,text)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.open_private_session_create_capability(uuid, uuid, uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.open_private_session_create_capability(uuid, uuid, uuid, text) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.close_private_session_create_capability(uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.close_private_session_create_capability(uuid) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.open_private_child_session_create_capability(uuid,uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.open_private_child_session_create_capability(uuid,uuid,uuid,uuid,uuid,uuid,integer) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.open_private_child_session_create_capability(uuid,uuid,uuid,uuid,uuid,uuid,integer) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.create_xai_subscription_credential(uuid,uuid,text,text,text,text,text,text,text,timestamptz)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.resolve_session_attempt_personal_resources(uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.resolve_session_attempt_personal_resources(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.resolve_session_attempt_personal_resources(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.accept_turn_personal_resource_attachment(uuid,uuid,uuid,uuid,text,integer,boolean,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.list_self_user_resource_authorities(uuid,uuid,text,uuid,integer)', ${literal(schema)}))
+      IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_user_resource_authorities(uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_user_resource_authorities(uuid) FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, boolean) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, boolean) FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid) FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_user_resource_authorities(uuid, uuid, text, uuid, integer) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_self_user_resource_authorities(uuid, uuid, text, uuid, integer) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+    END IF;
+    IF to_regprocedure(format('%I.resolve_connection_use_authority(uuid,uuid,uuid,jsonb)', ${literal(schema)}))
+      IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_connection_authorities(uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_connection_authorities(uuid) FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_connection_use_grant(uuid, uuid, uuid, text, text, uuid, boolean) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_connection_use_grant(uuid, uuid, uuid, text, text, uuid, boolean) FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_connection_use_grant(uuid, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_connection_use_grant(uuid, uuid) FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_connection_use_authority(uuid, uuid, uuid, jsonb) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_connection_use_authority(uuid, uuid, uuid, jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      IF to_regprocedure(format('%I.resolve_personal_connection_authority_selection(uuid,uuid,text,uuid,jsonb)', ${literal(schema)})) IS NOT NULL THEN
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_personal_connection_authority_selection(uuid, uuid, text, uuid, jsonb) FROM PUBLIC', ${literal(schema)});
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_personal_connection_authority_selection(uuid, uuid, text, uuid, jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      END IF;
+      IF to_regprocedure(format('%I.resolve_accepted_connection_use(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,uuid,text,text,text,text)', ${literal(schema)})) IS NOT NULL THEN
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text) FROM PUBLIC', ${literal(schema)});
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text) TO %I', ${literal(schema)}, ${literal(role)});
+      END IF;
+    END IF;
+    IF to_regprocedure(
+      format('%I.get_self_personal_github_repository_selection(uuid,uuid,text,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.get_self_personal_github_repository_selection(uuid,uuid,text,uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_self_personal_github_repository_selection(uuid,uuid,text,uuid) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.mutate_self_personal_github_repository_selection(uuid,uuid,text,uuid,bigint,bigint,text,jsonb,boolean) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.mutate_self_personal_github_repository_selection(uuid,uuid,text,uuid,bigint,bigint,text,jsonb,boolean) TO %I',
+        ${literal(schema)}, ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL PRIVILEGES ON TABLE %I.personal_github_repository_selection_heads, %I.personal_github_repository_selections, %I.personal_github_repository_selection_operations FROM %I',
+        ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.create_personal_document_authority(uuid,uuid,uuid)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.create_personal_document_authority(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.create_personal_document_authority(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_document_original_file(uuid, uuid, text, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_document_original_file(uuid, uuid, text, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.prepare_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.prepare_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.personal_document_authority_capability_active(text) FROM PUBLIC');
+      EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.personal_document_authority_capability_active(text) TO %I', ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE opengeni_private.personal_document_authority_capabilities FROM %I', ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.session_attempt_personal_document_admissions FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.session_attempt_personal_document_snapshots FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.personal_document_once_consumption_receipts FROM %I', ${literal(schema)}, ${literal(role)});
+    END IF;
+    IF to_regprocedure(
+      format('%I.reclassify_document_authority(jsonb)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.reclassify_document_authority(jsonb) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.reclassify_document_authority(jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamptz, uuid) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamptz, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION %I.run_document_default_collection_backfill(jsonb) FROM PUBLIC', ${literal(schema)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.run_document_default_collection_backfill(jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.document_migration_capability_active(text) FROM PUBLIC');
+      EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.document_migration_capability_active(text) TO %I', ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE opengeni_private.document_migration_capabilities FROM %I', ${literal(role)});
+      EXECUTE format('GRANT SELECT ON TABLE %I.document_authority_reclassifications TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE INSERT, UPDATE, DELETE ON TABLE %I.document_authority_reclassifications FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.document_default_collection_backfill_runs, %I.document_default_collection_backfill_operations, %I.document_default_collection_backfill_receipts FROM %I', ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)});
+    END IF;
+    IF to_regprocedure(
+      format('%I.create_scoped_variable_set(uuid,uuid,text,text,text,jsonb,boolean)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_variable_sets(uuid, uuid, uuid, text, text) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.count_scoped_variable_sets(uuid, uuid, text) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.workspace_variable_sets FROM %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.workspace_variable_set_variables FROM %I', ${literal(schema)}, ${literal(role)});
+    END IF;
+    IF to_regprocedure(
+      format('%I.create_scoped_rig(uuid,uuid,text,text,text,text,jsonb,boolean)', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_rigs(uuid, uuid, uuid, text, text) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.count_scoped_rigs(uuid, uuid, text) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_enrollments(uuid, uuid, uuid, text) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.get_scoped_sandbox(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_scoped_sandbox_attach(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_machine_dependent_sessions(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.detach_scoped_machine_dependent_sessions(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.session_attempt_connected_machine_authorizations FROM %I', ${literal(schema)}, ${literal(role)});
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.freeze_scheduled_task_personal_resources(uuid,uuid,uuid,bigint)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      IF to_regprocedure(
+        format(
+          '%I.refresh_scheduled_task_personal_resources_clone_connections(uuid,uuid,uuid,bigint,bigint)',
+          ${literal(schema)}
+        )
+      ) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.refresh_scheduled_task_personal_resources_clone_connections(uuid, uuid, uuid, bigint, bigint) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.refresh_scheduled_task_personal_resources_clone_connections(uuid, uuid, uuid, bigint, bigint) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.scheduled_task_run_connection_authority_subject(uuid, uuid, uuid) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_run_connection_authority_subject(uuid, uuid, uuid) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.validate_scheduled_agent_run_live_authority(uuid, uuid, uuid) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.validate_scheduled_agent_run_live_authority(uuid, uuid, uuid) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.bind_scheduled_task_run_session(uuid, uuid, uuid, uuid) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.bind_scheduled_task_run_session(uuid, uuid, uuid, uuid) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text) FROM PUBLIC',
+          ${literal(schema)}
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text) TO %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE DELETE ON TABLE %I.scheduled_tasks, %I.scheduled_task_runs FROM %I',
+          ${literal(schema)}, ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_connection_authority_snapshots FROM %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_run_connection_authority_snapshots FROM %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_reusable_connection_materializations FROM %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+        EXECUTE format(
+          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_revision_authorities FROM %I',
+          ${literal(schema)}, ${literal(role)}
+        );
+      END IF;
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.scheduled_task_run_personal_resource_authority(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scheduled_task_run_personal_resource_authority(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_source_acl(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_complete_sync(uuid,uuid,text,text,timestamptz,jsonb,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_complete_sync(uuid, uuid, text, text, timestamptz, jsonb, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.scoped_knowledge_advance_object_version(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_object_version(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',
+      owner_role,
+      ${literal(schema)},
+      ${literal(role)}
+    );
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I GRANT USAGE, SELECT ON SEQUENCES TO %I',
+      owner_role,
+      ${literal(schema)},
+      ${literal(role)}
+    );
+  END IF;
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});
+    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private REVOKE EXECUTE ON FUNCTIONS FROM %I',
+      owner_role,
+      ${literal(role)}
+    );
+    IF to_regprocedure('opengeni_private.personal_resource_delegation_capability_active(text)') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION
+        opengeni_private.personal_resource_delegation_capability_active(text)
+        FROM PUBLIC;
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.personal_resource_delegation_capability_active(text) TO %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.scheduled_personal_resource_capability_active(text)') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION
+        opengeni_private.scheduled_personal_resource_capability_active(text)
+        FROM PUBLIC;
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.scheduled_personal_resource_capability_active(text) TO %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.variable_set_authority_capability_active(text)') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION
+        opengeni_private.variable_set_authority_capability_active(text)
+        FROM PUBLIC;
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.variable_set_authority_capability_active(text) TO %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.variable_set_authority_capabilities FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.scoped_compute_capability_active(text)') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION opengeni_private.scoped_compute_capability_active(text) FROM PUBLIC;
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.scoped_compute_capability_active(text) TO %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.scoped_compute_capabilities FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    -- Global cross-workspace artifact workers are separate capabilities. Never
+    -- let the generic tenant-scoped app role inherit them from the historical
+    -- blanket grant of already-installed helpers.
+    IF to_regprocedure('opengeni_private.claim_editable_artifact_live_outbox(text,integer,integer,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_live_outbox(text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.mark_editable_artifact_live_outbox_published(text, text, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_live_outbox(text, text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.retry_editable_artifact_live_outbox(text, text, integer, integer, text, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.dead_letter_editable_artifact_live_outbox(text, text, integer, text, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.release_editable_artifact_live_outbox(text, text, integer, name) FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.claim_editable_artifact_materializations(text,integer,integer,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_materializations(text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamptz, name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name) FROM %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.consume_editable_artifact_live_ticket(text,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE EXECUTE ON FUNCTION opengeni_private.resolve_editable_artifact_ticket_data_schema(name) FROM %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamptz, timestamptz, name) TO %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.consume_editable_artifact_live_ticket(text, name) TO %I',
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.cleanup_expired_editable_artifact_live_tickets(integer, name) TO %I',
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure('opengeni_private.authorize_editable_artifact_actor(uuid,uuid,text,text,text,text,text,text,integer,text,text,name)') IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION opengeni_private.authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name) TO %I',
+        ${literal(role)}
+      );
+    END IF;
+    FOREACH routine_signature IN ARRAY ARRAY[
+      'complete_temporal_schedule_connector_cleanup(uuid,uuid)',
+      'upgrade_temporal_schedule_connector_cleanup(uuid,uuid,text,uuid,text,jsonb,uuid)',
+      'complete_workspace_temporal_connector_cleanups(uuid,uuid)'
+    ] LOOP
+      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION opengeni_private.%s FROM PUBLIC',
+          routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',
+          routine_signature,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+  END IF;
+END $$;
+`);
+}
+function commaSeparated(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean);
+}
+function validateIdentifier(name, value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);
+  }
+  return value;
+}
+function identifier(value) {
+  return `"${value.replace(/"/g, '""')}"`;
+}
+function literal(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function databaseUrlFor(value, database) {
+  const url = new URL(value);
+  url.pathname = `/${database}`;
+  return url.toString();
+}
+if (import.meta.main) {
+  const adminUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_ADMIN_URL ?? process.env.OPENGENI_DATABASE_URL;
+  if (!adminUrl) {
+    throw new Error(
+      "OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required"
+    );
+  }
+  const result = await provisionRoles(adminUrl, {
+    ...process.env.OPENGENI_DB_SCHEMA?.trim() ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() } : {}
+  });
+  console.log(JSON.stringify(result, null, 2));
+}
+
+export {
+  RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
+  RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES,
+  RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES,
+  FORCE_RLS_TABLES,
+  NON_RLS_RUNTIME_TABLES,
+  RUNTIME_FULL_DML_TABLES,
+  RUNTIME_READ_ONLY_TABLES,
+  RUNTIME_READ_UPDATE_TABLES,
+  RUNTIME_READ_INSERT_TABLES,
+  RUNTIME_READ_INSERT_UPDATE_TABLES,
+  PROTECTED_NO_DIRECT_DML_TABLES,
+  RUNTIME_TABLE_PRIVILEGES,
+  RUNTIME_DML_TABLES,
+  RuntimeDatabasePostureError,
+  inspectRuntimeDatabasePosture,
+  evaluateRuntimeDatabasePosture,
+  assertRuntimeDatabasePosture,
+  runtimeDatabaseReadyCheck,
+  provisionRoles
+};
+//# sourceMappingURL=chunk-OF5OBB76.js.map