@opengeni/db 1.0.1 → 3.2.0-canary.0

package/dist/chunk-NXAFLCQX.js

@@ -1,2468 +0,0 @@
-// src/provision-roles.ts
-import postgres from "postgres";
-
-// src/runtime-posture.ts
-import { sql } from "drizzle-orm";
-
-// src/role-relationships.ts
-function roleRelationshipsCatalogQuery(targetRole) {
-  return `
-with recursive target_role(oid, rolname) as (
-  select oid, rolname
-  from pg_roles
-  where rolname = ${targetRole}
-), inherited_roles(oid, rolname) as (
-  select parent.oid, parent.rolname
-  from pg_auth_members membership
-  join target_role target on target.oid = membership.member
-  join pg_roles parent on parent.oid = membership.roleid
-  union
-  select parent.oid, parent.rolname
-  from inherited_roles inherited
-  join pg_auth_members membership on membership.member = inherited.oid
-  join pg_roles parent on parent.oid = membership.roleid
-), relationships as (
-  select
-    ('inherits:' || inherited.rolname)::text as relationship,
-    'inherits'::text as direction,
-    null::boolean as admin_option,
-    null::boolean as inherit_option,
-    null::boolean as set_option,
-    null::boolean as member_is_superuser,
-    null::boolean as member_can_create_role,
-    null::text as grantor_role,
-    null::boolean as grantor_is_superuser
-  from inherited_roles inherited
-  union all
-  select
-    ('member:' || member.rolname)::text as relationship,
-    'member'::text as direction,
-    membership.admin_option,
-    case
-      when current_setting('server_version_num')::integer >= 160000
-        then (to_jsonb(membership) ->> 'inherit_option')::boolean
-      else null::boolean
-    end as inherit_option,
-    case
-      when current_setting('server_version_num')::integer >= 160000
-        then (to_jsonb(membership) ->> 'set_option')::boolean
-      else null::boolean
-    end as set_option,
-    member.rolsuper as member_is_superuser,
-    member.rolcreaterole as member_can_create_role,
-    grantor.rolname::text as grantor_role,
-    grantor.rolsuper as grantor_is_superuser
-  from pg_auth_members membership
-  join target_role target on target.oid = membership.roleid
-  join pg_roles member on member.oid = membership.member
-  left join pg_roles grantor on grantor.oid = membership.grantor
-)
-select
-  relationship,
-  direction,
-  current_setting('server_version_num')::integer as server_version_num,
-  admin_option,
-  inherit_option,
-  set_option,
-  member_is_superuser,
-  member_can_create_role,
-  grantor_role,
-  grantor_is_superuser
-from relationships
-order by relationship, direction, grantor_role nulls first
-`;
-}
-function isManagementOnlyRoleRelationship(row) {
-  return row.direction === "member" && row.server_version_num >= 16e4 && row.admin_option === true && row.inherit_option === false && row.set_option === false && row.member_is_superuser === false && row.member_can_create_role === true && row.grantor_is_superuser === true;
-}
-function sortedUnique(values) {
-  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
-}
-function classifyRoleRelationships(rows) {
-  const managementOnlyRows = rows.filter(isManagementOnlyRoleRelationship);
-  const unsafeRows = rows.filter((row) => !isManagementOnlyRoleRelationship(row));
-  return {
-    relationships: sortedUnique(rows.map((row) => row.relationship)),
-    managementOnlyRelationships: sortedUnique(managementOnlyRows.map((row) => row.relationship)),
-    unsafeRelationships: sortedUnique(unsafeRows.map((row) => row.relationship))
-  };
-}
-
-// src/runtime-posture.ts
-var ARTIFACT_OUTBOX_CAPABILITY_ROUTINES = [
-  "claim_editable_artifact_live_outbox(text, integer, integer, name)",
-  "mark_editable_artifact_live_outbox_published(text, text, integer, name)",
-  "renew_editable_artifact_live_outbox(text, text, integer, integer, name)",
-  "retry_editable_artifact_live_outbox(text, text, integer, integer, text, name)",
-  "dead_letter_editable_artifact_live_outbox(text, text, integer, text, name)",
-  "release_editable_artifact_live_outbox(text, text, integer, name)"
-];
-var ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES = [
-  "claim_editable_artifact_materializations(text, integer, integer, name)",
-  "renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name)",
-  "succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamp with time zone, name)",
-  "fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name)"
-];
-var ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES = [
-  "put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamp with time zone, timestamp with time zone, name)",
-  "consume_editable_artifact_live_ticket(text, name)",
-  "cleanup_expired_editable_artifact_live_tickets(integer, name)"
-];
-var ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES = [
-  "resolve_editable_artifact_ticket_data_schema(name)"
-];
-var ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES = [
-  "authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name)"
-];
-var DEDICATED_ARTIFACT_CAPABILITY_ROUTINES = /* @__PURE__ */ new Set([
-  ...ARTIFACT_OUTBOX_CAPABILITY_ROUTINES,
-  ...ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES,
-  ...ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES
-]);
-var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE = "knowledge_source_sync_lock_authority(uuid, uuid, uuid)";
-var GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE = "google_drive_file_authorized(uuid, uuid, text, uuid)";
-var GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE = "google_drive_document_citation(uuid, uuid, text, uuid, uuid)";
-var GOOGLE_DRIVE_AUTHORITY_TABLES = [
-  "connections",
-  "files",
-  "google_drive_object_acl_evidence",
-  "google_drive_object_acl_principals",
-  "knowledge_document_versions",
-  "knowledge_providers",
-  "knowledge_source_objects",
-  "knowledge_source_sync_index_obligations",
-  "knowledge_source_sync_states",
-  "knowledge_sources"
-];
-var KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [
-  "knowledge_sources",
-  "knowledge_source_objects"
-];
-var MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE = "ensure_managed_human_personal_workspace(uuid, text, uuid)";
-var MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES = [
-  "organization_memberships",
-  "organization_user_retention_policies",
-  "organization_user_resource_authorities",
-  "organization_user_resource_grants"
-];
-var CANONICAL_HUMAN_IDENTITY_ROUTINES = [
-  "ensure_canonical_human_identity(text, text)",
-  "validate_canonical_human_session(text, text, boolean)",
-  "get_canonical_human_identity_projection(text)",
-  "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)"
-];
-var CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES = [
-  "canonical_human_identities",
-  "canonical_human_identity_subjects",
-  "canonical_human_login_bindings",
-  "canonical_human_identity_operations"
-];
-var SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE = "session_private_actor_visible(uuid, uuid, uuid, text)";
-var SESSION_REFERENCE_VISIBLE_ROUTINE = "session_reference_visible(uuid, uuid, uuid)";
-var TASK_NOTE_CAPABILITY_ROUTINES = [
-  "create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)",
-  "archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)",
-  "list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)"
-];
-var TRANSITION_SESSION_VISIBILITY_ROUTINE = "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text)";
-var FORK_SESSION_CONTENT_ROUTINE = "fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text)";
-var SESSION_AUTHORITY_ROUTINES = /* @__PURE__ */ new Set([
-  FORK_SESSION_CONTENT_ROUTINE,
-  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
-  SESSION_REFERENCE_VISIBLE_ROUTINE,
-  TRANSITION_SESSION_VISIBILITY_ROUTINE,
-  ...TASK_NOTE_CAPABILITY_ROUTINES
-]);
-var XAI_CREATE_CREDENTIAL_ROUTINE = "create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamp with time zone)";
-var XAI_DISCONNECT_CREDENTIAL_ROUTINE = "disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb)";
-var XAI_SNAPSHOT_VALIDATOR_ROUTINE = "xai_provider_account_authority_snapshot_v1_valid(jsonb)";
-var XAI_AUTHORITY_LIVE_ROUTINE = "xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint)";
-var XAI_POOL_VISIBLE_ROUTINE = "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)";
-var XAI_RESOLVE_POOL_ROUTINE = "resolve_xai_authority_pool(uuid, uuid, text, jsonb)";
-var XAI_REVALIDATE_CREDENTIAL_ROUTINE = "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)";
-var XAI_AUTHORITY_TABLES = [
-  "organization_memberships",
-  "organization_user_resource_authorities",
-  "workspace_memberships",
-  "xai_subscription_credentials"
-];
-var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
-  FORK_SESSION_CONTENT_ROUTINE,
-  XAI_AUTHORITY_LIVE_ROUTINE,
-  XAI_CREATE_CREDENTIAL_ROUTINE,
-  XAI_DISCONNECT_CREDENTIAL_ROUTINE,
-  GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE,
-  GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE,
-  KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE,
-  MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE,
-  ...CANONICAL_HUMAN_IDENTITY_ROUTINES,
-  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
-  SESSION_REFERENCE_VISIBLE_ROUTINE,
-  TRANSITION_SESSION_VISIBILITY_ROUTINE,
-  XAI_POOL_VISIBLE_ROUTINE,
-  XAI_RESOLVE_POOL_ROUTINE,
-  XAI_REVALIDATE_CREDENTIAL_ROUTINE,
-  XAI_SNAPSHOT_VALIDATOR_ROUTINE
-];
-var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
-  SESSION_REFERENCE_VISIBLE_ROUTINE,
-  XAI_SNAPSHOT_VALIDATOR_ROUTINE
-];
-var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set(
-  RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES
-);
-var FORCE_RLS_TABLES = [
-  "agent_run_states",
-  "api_keys",
-  "attached_browser_devices",
-  "attached_browser_inventories",
-  "audit_events",
-  "auth_runs",
-  "billing_customers",
-  "browser_identities",
-  "browser_revision_components",
-  "browser_revisions",
-  "browser_session_associations",
-  "browser_sessions",
-  "browser_state_artifacts",
-  "browser_state_uploads",
-  "canonical_human_identities",
-  "canonical_human_identity_operations",
-  "canonical_human_identity_subjects",
-  "canonical_human_login_bindings",
-  "capability_api_facets",
-  "capability_catalog_items",
-  "capability_component_owners",
-  "capability_facet_installations",
-  "capability_facets",
-  "capability_installations",
-  "capability_integration_facets",
-  "capability_mcp_facets",
-  "capability_operations",
-  "capability_plugin_installations",
-  "capability_plugin_versions",
-  "capability_plugins",
-  "capability_skill_facets",
-  "capability_skill_files",
-  "channels",
-  "codex_apps_settings",
-  "codex_capacity_waiters",
-  "codex_credential_leases",
-  "codex_reset_redemption_attempts",
-  "codex_rotation_settings",
-  "codex_subscription_credentials",
-  "company_profile_activation_events",
-  "company_profile_heads",
-  "company_profile_revisions",
-  "company_profile_snapshots",
-  "composer_drafts",
-  "computer_session_associations",
-  "computer_sessions",
-  "connection_disconnect_operations",
-  "connections",
-  "connector_action_policies",
-  "connector_action_requests",
-  "credit_ledger_entries",
-  "device_enrollment_requests",
-  "document_bases",
-  "document_chunks",
-  "documents",
-  "editable_artifact_blob_refs",
-  "editable_artifact_idempotency_receipts",
-  "editable_artifact_live_outbox",
-  "editable_artifact_live_tickets",
-  "editable_artifact_materialization_jobs",
-  "editable_artifact_materialization_results",
-  "editable_artifact_operations",
-  "editable_artifact_replica_leases",
-  "editable_artifact_scope_authorization_heads",
-  "editable_artifact_sequence_checkpoints",
-  "editable_artifact_session_links",
-  "editable_artifact_snapshots",
-  "editable_artifact_transactions",
-  "editable_artifact_undo_claims",
-  "editable_artifact_versions",
-  "editable_artifacts",
-  "enrollments",
-  "file_uploads",
-  "files",
-  "generated_image_artifacts",
-  "generated_video_artifacts",
-  "github_installation_repositories",
-  "github_installations",
-  "google_drive_object_acl_evidence",
-  "google_drive_object_acl_principals",
-  "host_export_config",
-  "host_export_consumers",
-  "host_export_cursor_state",
-  "host_export_dead_letters",
-  "host_export_outbox",
-  "image_generation_operations",
-  "import_batches",
-  "integration_facet_binding_owners",
-  "integration_facet_bindings",
-  "integration_facet_definitions",
-  "integration_oauth_state_nonces",
-  "integration_spec_revisions",
-  "integration_tools",
-  "interaction_interventions",
-  "interaction_operations",
-  "interaction_resource_operations",
-  "knowledge_change_proposals",
-  "knowledge_claim_evidence",
-  "knowledge_claim_relations",
-  "knowledge_claim_reviews",
-  "knowledge_claims",
-  "knowledge_document_versions",
-  "knowledge_entities",
-  "knowledge_entity_aliases",
-  "knowledge_facts",
-  "knowledge_lifecycle_events",
-  "knowledge_memories",
-  "knowledge_memory_lifecycle_events",
-  "knowledge_memory_relationships",
-  "knowledge_operation_receipts",
-  "knowledge_providers",
-  "knowledge_source_acl_versions",
-  "knowledge_source_objects",
-  "knowledge_source_sync_index_obligations",
-  "knowledge_source_sync_item_outcomes",
-  "knowledge_source_sync_object_observations",
-  "knowledge_source_sync_states",
-  "knowledge_source_sync_wakes",
-  "knowledge_sources",
-  "knowledge_sync_runs",
-  "machine_metrics_latest",
-  "machine_metrics_series",
-  "machine_removal_operations",
-  "memory_slack_publication_configurations",
-  "memory_slack_publication_receipts",
-  "memory_slack_publications",
-  "model_call_facts",
-  "network_routes",
-  "new_session_drafts",
-  "organization_memberships",
-  "organization_user_resource_authorities",
-  "organization_user_resource_grants",
-  "organization_user_retention_policies",
-  "pack_installation_components",
-  "pack_installations",
-  "preference_registry_events",
-  "preference_registry_preferences",
-  "preference_registry_revisions",
-  "preference_registry_snapshots",
-  "retained_screenshot_artifacts",
-  "rig_changes",
-  "rig_versions",
-  "rigs",
-  "sandbox_checkpoint_artifacts",
-  "sandbox_lease_holders",
-  "sandbox_leases",
-  "sandbox_pty_sessions",
-  "sandbox_retained_processes",
-  "sandbox_session_envelopes",
-  "sandbox_workspace_mutation_admissions",
-  "sandboxes",
-  "scheduled_task_runs",
-  "scheduled_tasks",
-  "session_attempt_codemode_calls",
-  "session_attempt_interruptions",
-  "session_attempt_tool_catalogs",
-  "session_command_receipts",
-  "session_events",
-  "session_goal_revisions",
-  "session_goals",
-  "session_history_items",
-  "session_human_input_requests",
-  "session_list_snapshots",
-  "session_mcp_servers",
-  "session_pending_tool_calls",
-  "session_pins",
-  "session_realtime_connections",
-  "session_realtime_context_projections",
-  "session_realtime_entries",
-  "session_realtime_modes",
-  "session_recordings",
-  "session_spawn_denials",
-  "session_stream_acknowledgments",
-  "session_system_update_outbox",
-  "session_system_updates",
-  "session_turn_attempts",
-  "session_turns",
-  "session_visibility_write_capabilities",
-  "session_workflow_wake_outbox",
-  "sessions",
-  "site_auth_connections",
-  "slack_bot_delete_operations",
-  "slack_bot_post_operations",
-  "slack_bot_update_operations",
-  "slack_bot_user_links",
-  "slack_installation_bindings",
-  "slack_interaction_action_handles",
-  "slack_interaction_inbox",
-  "slack_interaction_progress_deliveries",
-  "slack_interactions",
-  "slack_shared_task_origins",
-  "slack_task_policy_activation_events",
-  "slack_task_policy_heads",
-  "slack_task_policy_revisions",
-  "slack_user_link_access_request_operations",
-  "slack_user_link_access_requests",
-  "social_connections",
-  "social_posts",
-  "task_note_events",
-  "task_note_write_capabilities",
-  "task_notes",
-  "temporal_schedule_cleanup_outbox",
-  "transcription_recording_chunks",
-  "transcription_recording_objects",
-  "transcription_recording_segments",
-  "transcription_recordings",
-  "usage_events",
-  "video_generation_operations",
-  "video_generation_references",
-  "workspace_artifact_events",
-  "workspace_artifact_versions",
-  "workspace_artifacts",
-  "workspace_captures",
-  "workspace_control_events",
-  "workspace_inference_controls",
-  "workspace_instruction_policy_activation_events",
-  "workspace_instruction_policy_heads",
-  "workspace_instruction_policy_onboarding_proposals",
-  "workspace_instruction_policy_revisions",
-  "workspace_instruction_policy_snapshots",
-  "workspace_interaction_revisions",
-  "workspace_learning_policy_activation_events",
-  "workspace_learning_policy_heads",
-  "workspace_learning_policy_revisions",
-  "workspace_learning_policy_snapshots",
-  "workspace_model_policies",
-  "workspace_packs",
-  "workspace_screenshot_quotas",
-  "workspace_session_activity_revisions",
-  "workspace_variable_set_variables",
-  "workspace_variable_sets",
-  "workspace_video_generation_policies",
-  "workspace_video_generation_quotas",
-  "xai_capacity_waiters",
-  "xai_credential_leases",
-  "xai_rotation_settings",
-  "xai_session_account_pins",
-  "xai_subscription_credentials"
-];
-var NON_RLS_RUNTIME_TABLES = [
-  "auth_identities",
-  "auth_rate_limits",
-  "auth_sessions",
-  "auth_users",
-  "auth_verifications",
-  "integration_oauth_clients",
-  "managed_accounts",
-  "nested_agent_depth_configuration",
-  "stripe_webhook_events",
-  "workspace_memberships",
-  "workspaces"
-];
-var RUNTIME_FULL_DML_TABLES = [
-  "agent_run_states",
-  "api_keys",
-  "audit_events",
-  "auth_identities",
-  "auth_rate_limits",
-  "auth_sessions",
-  "auth_users",
-  "auth_verifications",
-  "billing_customers",
-  "browser_session_associations",
-  "capability_catalog_items",
-  "capability_component_owners",
-  "capability_facet_installations",
-  "capability_installations",
-  "capability_operations",
-  "capability_plugin_installations",
-  "channels",
-  "codex_apps_settings",
-  "codex_capacity_waiters",
-  "codex_credential_leases",
-  "codex_reset_redemption_attempts",
-  "codex_rotation_settings",
-  "codex_subscription_credentials",
-  "composer_drafts",
-  "computer_session_associations",
-  "connection_disconnect_operations",
-  "connections",
-  "connector_action_policies",
-  "connector_action_requests",
-  "credit_ledger_entries",
-  "device_enrollment_requests",
-  "document_bases",
-  "document_chunks",
-  "documents",
-  "editable_artifact_replica_leases",
-  "enrollments",
-  "file_uploads",
-  "files",
-  "generated_image_artifacts",
-  "generated_video_artifacts",
-  "github_installation_repositories",
-  "github_installations",
-  "image_generation_operations",
-  "import_batches",
-  "integration_facet_binding_owners",
-  "integration_facet_bindings",
-  "integration_oauth_clients",
-  "integration_oauth_state_nonces",
-  "knowledge_memories",
-  "knowledge_source_sync_index_obligations",
-  "knowledge_source_sync_item_outcomes",
-  "knowledge_source_sync_object_observations",
-  "knowledge_source_sync_states",
-  "knowledge_source_sync_wakes",
-  "machine_metrics_latest",
-  "machine_metrics_series",
-  "machine_removal_operations",
-  "managed_accounts",
-  "memory_slack_publication_configurations",
-  "memory_slack_publication_receipts",
-  "memory_slack_publications",
-  "model_call_facts",
-  "new_session_drafts",
-  "pack_installation_components",
-  "pack_installations",
-  "retained_screenshot_artifacts",
-  "rig_changes",
-  "rig_versions",
-  "rigs",
-  "sandbox_checkpoint_artifacts",
-  "sandbox_lease_holders",
-  "sandbox_leases",
-  "sandbox_pty_sessions",
-  "sandbox_retained_processes",
-  "sandbox_session_envelopes",
-  "sandbox_workspace_mutation_admissions",
-  "sandboxes",
-  "scheduled_task_runs",
-  "scheduled_tasks",
-  "session_attempt_interruptions",
-  "session_command_receipts",
-  "session_events",
-  "session_goals",
-  "session_history_items",
-  "session_human_input_requests",
-  "session_list_snapshots",
-  "session_mcp_servers",
-  "session_pending_tool_calls",
-  "session_pins",
-  "session_realtime_connections",
-  "session_realtime_context_projections",
-  "session_realtime_entries",
-  "session_realtime_modes",
-  "session_recordings",
-  "session_stream_acknowledgments",
-  "session_system_update_outbox",
-  "session_system_updates",
-  "session_turn_attempts",
-  "session_turns",
-  "session_workflow_wake_outbox",
-  "sessions",
-  "slack_bot_delete_operations",
-  "slack_bot_post_operations",
-  "slack_bot_update_operations",
-  "slack_bot_user_links",
-  "slack_interaction_action_handles",
-  "slack_interaction_inbox",
-  "slack_interaction_progress_deliveries",
-  "slack_interactions",
-  "social_connections",
-  "social_posts",
-  "stripe_webhook_events",
-  "transcription_recording_chunks",
-  "transcription_recording_objects",
-  "transcription_recording_segments",
-  "transcription_recordings",
-  "usage_events",
-  "video_generation_operations",
-  "video_generation_references",
-  "workspace_artifacts",
-  "workspace_captures",
-  "workspace_control_events",
-  "workspace_inference_controls",
-  "workspace_instruction_policy_heads",
-  "workspace_memberships",
-  "workspace_model_policies",
-  "workspace_packs",
-  "workspace_screenshot_quotas",
-  "workspace_variable_set_variables",
-  "workspace_variable_sets",
-  "workspace_video_generation_policies",
-  "workspace_video_generation_quotas",
-  "workspaces",
-  "xai_capacity_waiters",
-  "xai_credential_leases",
-  "xai_rotation_settings",
-  "xai_session_account_pins",
-  "xai_subscription_credentials"
-];
-var RUNTIME_READ_ONLY_TABLES = [
-  "company_profile_activation_events",
-  "company_profile_heads",
-  "company_profile_snapshots",
-  "knowledge_lifecycle_events",
-  "knowledge_memory_lifecycle_events",
-  "knowledge_memory_relationships",
-  "nested_agent_depth_configuration",
-  "preference_registry_events",
-  "preference_registry_snapshots",
-  "slack_installation_bindings",
-  "slack_task_policy_activation_events",
-  "slack_task_policy_heads",
-  "slack_task_policy_revisions",
-  "workspace_instruction_policy_snapshots",
-  "workspace_learning_policy_activation_events",
-  "workspace_learning_policy_heads",
-  "workspace_learning_policy_snapshots"
-];
-var RUNTIME_READ_UPDATE_TABLES = ["workspace_session_activity_revisions"];
-var RUNTIME_READ_INSERT_TABLES = [
-  "browser_revision_components",
-  "browser_revisions",
-  "company_profile_revisions",
-  "editable_artifact_blob_refs",
-  "editable_artifact_idempotency_receipts",
-  "editable_artifact_live_outbox",
-  "editable_artifact_materialization_jobs",
-  "editable_artifact_materialization_results",
-  "editable_artifact_operations",
-  "editable_artifact_sequence_checkpoints",
-  "editable_artifact_snapshots",
-  "editable_artifact_transactions",
-  "editable_artifact_undo_claims",
-  "editable_artifact_versions",
-  "google_drive_object_acl_evidence",
-  "google_drive_object_acl_principals",
-  "knowledge_change_proposals",
-  "knowledge_claim_evidence",
-  "knowledge_claim_relations",
-  "knowledge_claim_reviews",
-  "knowledge_claims",
-  "knowledge_document_versions",
-  "knowledge_entities",
-  "knowledge_entity_aliases",
-  "knowledge_facts",
-  "knowledge_operation_receipts",
-  "knowledge_providers",
-  "knowledge_source_acl_versions",
-  "knowledge_source_objects",
-  "knowledge_sources",
-  "knowledge_sync_runs",
-  "preference_registry_preferences",
-  "preference_registry_revisions",
-  "session_attempt_tool_catalogs",
-  "session_goal_revisions",
-  "session_spawn_denials",
-  "slack_shared_task_origins",
-  "slack_user_link_access_request_operations",
-  "temporal_schedule_cleanup_outbox",
-  "workspace_artifact_events",
-  "workspace_artifact_versions",
-  "workspace_instruction_policy_activation_events",
-  "workspace_instruction_policy_onboarding_proposals",
-  "workspace_instruction_policy_revisions",
-  "workspace_learning_policy_revisions"
-];
-var RUNTIME_READ_INSERT_UPDATE_TABLES = [
-  "attached_browser_devices",
-  "attached_browser_inventories",
-  "auth_runs",
-  "browser_identities",
-  "browser_sessions",
-  "browser_state_artifacts",
-  "browser_state_uploads",
-  "capability_api_facets",
-  "capability_facets",
-  "capability_integration_facets",
-  "capability_mcp_facets",
-  "capability_plugin_versions",
-  "capability_plugins",
-  "capability_skill_facets",
-  "capability_skill_files",
-  "computer_sessions",
-  "editable_artifact_session_links",
-  "editable_artifacts",
-  "integration_facet_definitions",
-  "integration_spec_revisions",
-  "integration_tools",
-  "interaction_interventions",
-  "interaction_operations",
-  "interaction_resource_operations",
-  "network_routes",
-  "session_attempt_codemode_calls",
-  "site_auth_connections",
-  "slack_user_link_access_requests",
-  "workspace_interaction_revisions"
-];
-var PROTECTED_NO_DIRECT_DML_TABLES = [
-  "canonical_human_identities",
-  "canonical_human_identity_operations",
-  "canonical_human_identity_subjects",
-  "canonical_human_login_bindings",
-  "editable_artifact_live_tickets",
-  "editable_artifact_scope_authorization_heads",
-  "host_export_config",
-  "host_export_consumers",
-  "host_export_cursor_state",
-  "host_export_dead_letters",
-  "host_export_outbox",
-  "organization_memberships",
-  "organization_user_resource_authorities",
-  "organization_user_resource_grants",
-  "organization_user_retention_policies",
-  "session_visibility_write_capabilities",
-  "task_note_events",
-  "task_note_write_capabilities",
-  "task_notes"
-];
-var FULL_DML_PRIVILEGES = ["SELECT", "INSERT", "UPDATE", "DELETE"];
-var RUNTIME_TABLE_PRIVILEGES = Object.freeze({
-  ...Object.fromEntries(RUNTIME_FULL_DML_TABLES.map((table) => [table, FULL_DML_PRIVILEGES])),
-  ...Object.fromEntries(RUNTIME_READ_ONLY_TABLES.map((table) => [table, ["SELECT"]])),
-  ...Object.fromEntries(
-    RUNTIME_READ_UPDATE_TABLES.map((table) => [table, ["SELECT", "UPDATE"]])
-  ),
-  ...Object.fromEntries(
-    RUNTIME_READ_INSERT_TABLES.map((table) => [table, ["SELECT", "INSERT"]])
-  ),
-  ...Object.fromEntries(
-    RUNTIME_READ_INSERT_UPDATE_TABLES.map((table) => [
-      table,
-      ["SELECT", "INSERT", "UPDATE"]
-    ])
-  )
-});
-var RUNTIME_DML_TABLES = Object.freeze(
-  Object.keys(RUNTIME_TABLE_PRIVILEGES).sort((a, b) => a.localeCompare(b))
-);
-var RuntimeDatabasePostureError = class extends Error {
-  violations;
-  constructor(violations) {
-    super(`Runtime database posture check failed: ${violations.join("; ")}`);
-    this.name = "RuntimeDatabasePostureError";
-    this.violations = violations;
-  }
-};
-function resultRows(result) {
-  if (Array.isArray(result)) {
-    return result;
-  }
-  const rows = result?.rows;
-  if (Array.isArray(rows)) {
-    return rows;
-  }
-  throw new Error("Runtime database posture query returned an unsupported result shape");
-}
-function sorted(values) {
-  return [...values].sort((a, b) => a.localeCompare(b));
-}
-function difference(left, right) {
-  return sorted([...left].filter((value) => !right.has(value)));
-}
-async function inspectRuntimeDatabasePosture(db, options) {
-  const targetSchema = options.targetSchema?.trim() || "public";
-  return await db.transaction(
-    async (tx) => {
-      const identityRows = resultRows(
-        await tx.execute(sql`
-          select
-            current_user::text as current_user,
-            session_user::text as session_user,
-            pg_get_userbyid(d.datdba)::text as database_owner,
-            has_database_privilege(current_user, d.oid, 'CONNECT') as can_connect_database,
-            has_database_privilege(current_user, d.oid, 'CREATE') as can_create_in_database,
-            current_setting('row_security')::text as row_security,
-            r.rolcanlogin,
-            r.rolsuper,
-            r.rolinherit,
-            r.rolcreaterole,
-            r.rolcreatedb,
-            r.rolreplication,
-            r.rolbypassrls
-          from pg_roles r
-          join pg_database d on d.datname = current_database()
-          where r.rolname = current_user
-        `)
-      );
-      const identity = identityRows[0];
-      if (!identity) {
-        throw new Error("Runtime database posture could not resolve the current PostgreSQL role");
-      }
-      const mappedIdentity = {
-        currentUser: identity.current_user,
-        sessionUser: identity.session_user,
-        databaseOwner: identity.database_owner,
-        canConnectDatabase: identity.can_connect_database,
-        canCreateInDatabase: identity.can_create_in_database,
-        rowSecurity: identity.row_security,
-        canLogin: identity.rolcanlogin,
-        superuser: identity.rolsuper,
-        inherit: identity.rolinherit,
-        createRole: identity.rolcreaterole,
-        createDatabase: identity.rolcreatedb,
-        replication: identity.rolreplication,
-        bypassRls: identity.rolbypassrls
-      };
-      if (options.rlsStrategy === "scoped") {
-        return {
-          identity: mappedIdentity,
-          memberships: [],
-          schemas: [],
-          ownedSchemas: [],
-          ownedRelations: [],
-          tables: [],
-          targetRoutines: [],
-          privateRoutines: []
-        };
-      }
-      const relationshipRows = resultRows(
-        await tx.execute(sql.raw(roleRelationshipsCatalogQuery("current_user")))
-      );
-      const memberships = classifyRoleRelationships(relationshipRows).unsafeRelationships;
-      const schemas = resultRows(
-        await tx.execute(sql`
-          select
-            n.nspname::text as name,
-            pg_get_userbyid(n.nspowner)::text as owner,
-            has_schema_privilege(current_user, n.oid, 'USAGE') as usage,
-            has_schema_privilege(current_user, n.oid, 'CREATE') as create
-          from pg_namespace n
-          where n.nspname in (${targetSchema}, 'opengeni_private')
-          order by n.nspname
-        `)
-      );
-      const ownedSchemas = resultRows(
-        await tx.execute(sql`
-          select n.nspname::text as name
-          from pg_namespace n
-          join pg_roles r on r.oid = n.nspowner
-          where r.rolname = current_user
-            and n.nspname <> 'information_schema'
-            and n.nspname !~ '^pg_'
-          order by n.nspname
-        `)
-      ).map((row) => row.name);
-      const ownedRelations = resultRows(
-        await tx.execute(sql`
-          select (n.nspname || '.' || c.relname)::text as name
-          from pg_class c
-          join pg_namespace n on n.oid = c.relnamespace
-          join pg_roles r on r.oid = c.relowner
-          where r.rolname = current_user
-            and c.relkind in ('r', 'p', 'S', 'v', 'm', 'f')
-            and n.nspname <> 'information_schema'
-            and n.nspname !~ '^pg_'
-          order by n.nspname, c.relname
-        `)
-      ).map((row) => row.name);
-      const tables = resultRows(
-        await tx.execute(sql`
-          select
-            c.relname::text as name,
-            pg_get_userbyid(c.relowner)::text as owner,
-            c.relrowsecurity as rls_enabled,
-            c.relforcerowsecurity as rls_forced,
-            row_security_active(c.oid) as rls_active,
-            (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,
-            exists(
-              select 1 from pg_policy policy
-              where policy.polrelid = c.oid
-                and policy.polname = 'editable_artifact_outbox_dispatcher'
-            ) as artifact_outbox_dispatcher_policy,
-            exists(
-              select 1 from pg_policy policy
-              where policy.polrelid = c.oid
-                and policy.polname = 'editable_artifact_materializer_owner'
-            ) as artifact_materializer_policy,
-            has_table_privilege(current_user, c.oid, 'SELECT') as can_select,
-            has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,
-            has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,
-            has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,
-            has_table_privilege(current_user, c.oid, 'TRUNCATE') as can_truncate,
-            has_table_privilege(current_user, c.oid, 'REFERENCES') as can_references,
-            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger
-          from pg_class c
-          join pg_namespace n on n.oid = c.relnamespace
-          where n.nspname = ${targetSchema}
-            and c.relkind in ('r', 'p')
-          order by c.relname
-        `)
-      ).map((row) => ({
-        name: row.name,
-        owner: row.owner,
-        rlsEnabled: row.rls_enabled,
-        rlsForced: row.rls_forced,
-        rlsActive: row.rls_active,
-        policyCount: row.policy_count,
-        artifactOutboxDispatcherPolicy: row.artifact_outbox_dispatcher_policy,
-        artifactMaterializerPolicy: row.artifact_materializer_policy,
-        select: row.can_select,
-        insert: row.can_insert,
-        update: row.can_update,
-        delete: row.can_delete,
-        truncate: row.can_truncate,
-        references: row.can_references,
-        trigger: row.can_trigger
-      }));
-      const targetRoutines = resultRows(
-        await tx.execute(sql`
-          select
-            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,
-            pg_get_userbyid(p.proowner)::text as owner,
-            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,
-            exists (
-              select 1
-              from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl
-              where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'
-            ) as public_execute,
-            p.prosecdef as security_definer
-          from pg_proc p
-          join pg_namespace n on n.oid = p.pronamespace
-          where n.nspname = ${targetSchema}
-            and p.prokind in ('f', 'p')
-            and (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')') = any(
-              array[
-                ${sql.join(
-          RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES.map((name) => sql`${name}`),
-          sql`, `
-        )}
-              ]::text[]
-            )
-          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)
-        `)
-      ).map((row) => ({
-        name: row.name,
-        owner: row.owner,
-        execute: row.can_execute,
-        publicExecute: row.public_execute,
-        securityDefiner: row.security_definer
-      }));
-      const privateRoutines = resultRows(
-        await tx.execute(sql`
-          select
-            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,
-            pg_get_userbyid(p.proowner)::text as owner,
-            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,
-            p.prosecdef as security_definer
-          from pg_proc p
-          join pg_namespace n on n.oid = p.pronamespace
-          where n.nspname = 'opengeni_private'
-            and p.prokind in ('f', 'p')
-          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)
-        `)
-      ).map((row) => ({
-        name: row.name,
-        owner: row.owner,
-        execute: row.can_execute,
-        securityDefiner: row.security_definer
-      }));
-      return {
-        identity: mappedIdentity,
-        memberships,
-        schemas,
-        ownedSchemas,
-        ownedRelations,
-        tables,
-        targetRoutines,
-        privateRoutines
-      };
-    },
-    { isolationLevel: "repeatable read", accessMode: "read only" }
-  );
-}
-function evaluateRuntimeDatabasePosture(posture, options) {
-  const violations = [];
-  const identity = posture.identity;
-  if (!identity.currentUser || !identity.sessionUser) {
-    violations.push("database identity is empty");
-  }
-  if (identity.currentUser !== identity.sessionUser) {
-    violations.push(
-      `current_user ${identity.currentUser} does not match session_user ${identity.sessionUser}`
-    );
-  }
-  if (!identity.canConnectDatabase) {
-    violations.push("runtime role lacks CONNECT on the current database");
-  }
-  if (options.rlsStrategy === "scoped") {
-    return violations;
-  }
-  const expectedRole = options.expectedRole?.trim() || "opengeni_app";
-  const targetSchema = options.targetSchema?.trim() || "public";
-  const protectedTables = new Set(options.protectedTables ?? FORCE_RLS_TABLES);
-  const tablePrivileges = options.tablePrivileges ?? RUNTIME_TABLE_PRIVILEGES;
-  const directRuntimeTables = new Set(Object.keys(tablePrivileges));
-  const protectedNoDirectDmlTables = new Set(
-    options.protectedNoDirectDmlTables ?? (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES)
-  );
-  if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {
-    violations.push(
-      `runtime identity must be ${expectedRole} (current_user=${identity.currentUser}, session_user=${identity.sessionUser})`
-    );
-  }
-  if (!identity.canLogin) violations.push("runtime role is not LOGIN");
-  if (identity.superuser) violations.push("runtime role is SUPERUSER");
-  if (identity.bypassRls) violations.push("runtime role has BYPASSRLS");
-  if (identity.createRole) violations.push("runtime role has CREATEROLE");
-  if (identity.createDatabase) violations.push("runtime role has CREATEDB");
-  if (identity.replication) violations.push("runtime role has REPLICATION");
-  if (identity.inherit) violations.push("runtime role must be NOINHERIT");
-  if (identity.databaseOwner === expectedRole) violations.push("runtime role owns the database");
-  if (identity.canCreateInDatabase) {
-    violations.push("runtime role has CREATE on the current database");
-  }
-  if (identity.rowSecurity.toLowerCase() !== "on") {
-    violations.push(`row_security is ${identity.rowSecurity}, expected on`);
-  }
-  if (posture.memberships.length > 0) {
-    violations.push(`runtime role has memberships: ${sorted(posture.memberships).join(", ")}`);
-  }
-  if (posture.ownedSchemas.length > 0) {
-    violations.push(`runtime role owns schemas: ${sorted(posture.ownedSchemas).join(", ")}`);
-  }
-  if (posture.ownedRelations.length > 0) {
-    violations.push(`runtime role owns relations: ${sorted(posture.ownedRelations).join(", ")}`);
-  }
-  for (const schemaName of /* @__PURE__ */ new Set([targetSchema, "opengeni_private"])) {
-    const schema = posture.schemas.find((candidate) => candidate.name === schemaName);
-    if (!schema) {
-      violations.push(`required schema ${schemaName} is missing`);
-      continue;
-    }
-    if (schema.owner === expectedRole) {
-      violations.push(`runtime role owns schema ${schemaName}`);
-    }
-    if (!schema.usage) violations.push(`runtime role lacks USAGE on schema ${schemaName}`);
-    if (schema.create) violations.push(`runtime role has CREATE on schema ${schemaName}`);
-  }
-  const tableByName = new Map(posture.tables.map((table) => [table.name, table]));
-  const actualRlsTables = new Set(
-    posture.tables.filter((table) => table.rlsEnabled).map((table) => table.name)
-  );
-  const classifiedProtectedTables = /* @__PURE__ */ new Set([
-    ...directRuntimeTables,
-    ...protectedNoDirectDmlTables
-  ]);
-  const unclassifiedProtectedTables = difference(protectedTables, classifiedProtectedTables);
-  if (unclassifiedProtectedTables.length > 0) {
-    violations.push(
-      `protected tables lack an explicit privilege class: ${unclassifiedProtectedTables.join(", ")}`
-    );
-  }
-  const protectedNoDirectDmlOverlap = difference(
-    protectedNoDirectDmlTables,
-    new Set([...protectedNoDirectDmlTables].filter((table) => !directRuntimeTables.has(table)))
-  );
-  if (protectedNoDirectDmlOverlap.length > 0) {
-    violations.push(
-      `protected no-direct-DML tables also declare runtime privileges: ${protectedNoDirectDmlOverlap.join(", ")}`
-    );
-  }
-  const nonProtectedNoDirectDmlTables = difference(protectedNoDirectDmlTables, protectedTables);
-  if (nonProtectedNoDirectDmlTables.length > 0) {
-    violations.push(
-      `no-direct-DML tables are absent from the protected contract: ${nonProtectedNoDirectDmlTables.join(", ")}`
-    );
-  }
-  const catalogTables = new Set(tableByName.keys());
-  const missingRuntimeTables = difference(directRuntimeTables, catalogTables);
-  if (missingRuntimeTables.length > 0) {
-    violations.push(`runtime privilege tables are missing: ${missingRuntimeTables.join(", ")}`);
-  }
-  const missingTables = difference(protectedTables, catalogTables);
-  if (missingTables.length > 0) {
-    violations.push(`protected tables are missing: ${missingTables.join(", ")}`);
-  }
-  const undeclaredRlsTables = difference(actualRlsTables, protectedTables);
-  if (undeclaredRlsTables.length > 0) {
-    violations.push(
-      `RLS tables are absent from the declared contract: ${undeclaredRlsTables.join(", ")}`
-    );
-  }
-  for (const table of posture.tables) {
-    const privileges = [
-      ["SELECT", table.select],
-      ["INSERT", table.insert],
-      ["UPDATE", table.update],
-      ["DELETE", table.delete],
-      ["TRUNCATE", table.truncate],
-      ["REFERENCES", table.references],
-      ["TRIGGER", table.trigger]
-    ];
-    const expectedPrivileges = new Set(tablePrivileges[table.name] ?? []);
-    if (table.owner === expectedRole) {
-      violations.push(`runtime role owns table ${table.name}`);
-    }
-    const missingPrivileges = privileges.filter(([privilege, granted]) => expectedPrivileges.has(privilege) && !granted).map(([privilege]) => privilege);
-    if (missingPrivileges.length > 0) {
-      violations.push(
-        `table ${table.name} lacks required runtime privileges: ${missingPrivileges.join(", ")}`
-      );
-    }
-    const excessPrivileges = privileges.filter(([privilege, granted]) => !expectedPrivileges.has(privilege) && granted).map(([privilege]) => privilege);
-    if (excessPrivileges.length > 0) {
-      violations.push(
-        `table ${table.name} grants excess runtime privileges: ${excessPrivileges.join(", ")}`
-      );
-    }
-  }
-  for (const tableName of protectedTables) {
-    const table = tableByName.get(tableName);
-    if (!table) continue;
-    if (!table.rlsEnabled) violations.push(`table ${tableName} does not ENABLE RLS`);
-    if (!table.rlsForced) violations.push(`table ${tableName} does not FORCE RLS`);
-    if (!table.rlsActive) violations.push(`table ${tableName} has inactive RLS for runtime role`);
-    if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);
-  }
-  const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;
-  for (const expectedRoutine of RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES) {
-    const matches = posture.targetRoutines.filter((routine2) => routine2.name === expectedRoutine);
-    if (matches.length !== 1) {
-      violations.push(
-        `target-schema runtime capability ${expectedRoutine} is missing or ambiguous`
-      );
-      continue;
-    }
-    const routine = matches[0];
-    if (RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET.has(routine.name)) {
-      if (routine.securityDefiner) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} must be SECURITY INVOKER`
-        );
-      }
-    } else if (!routine.securityDefiner) {
-      violations.push(`target-schema runtime capability ${routine.name} is not SECURITY DEFINER`);
-    }
-    if (routine.name === GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE || routine.name === GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE) {
-      const missingAuthorityTables = GOOGLE_DRIVE_AUTHORITY_TABLES.filter(
-        (tableName) => !tableByName.has(tableName)
-      );
-      if (missingAuthorityTables.length > 0) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
-        );
-      } else {
-        const authorityTables = GOOGLE_DRIVE_AUTHORITY_TABLES.map(
-          (tableName) => tableByName.get(tableName)
-        );
-        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
-        if (authorityOwners.size !== 1) {
-          violations.push(
-            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
-          );
-        } else if (routine.owner !== authorityTables[0].owner) {
-          violations.push(
-            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
-          );
-        }
-      }
-    } else if (routine.name === KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE) {
-      const missingAuthorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.filter(
-        (tableName) => !tableByName.has(tableName)
-      );
-      if (missingAuthorityTables.length > 0) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
-        );
-      } else {
-        const authorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.map(
-          (tableName) => tableByName.get(tableName)
-        );
-        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
-        if (authorityOwners.size !== 1) {
-          violations.push(
-            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
-          );
-        } else if (routine.owner !== authorityTables[0].owner) {
-          violations.push(
-            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
-          );
-        }
-      }
-    } else if (routine.name === MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE) {
-      const authorityTables = MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES.filter(
-        (tableName) => tableByName.has(tableName)
-      ).map((tableName) => tableByName.get(tableName));
-      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
-      if (authorityOwners.size > 1) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
-        );
-      } else if (authorityTables[0] && routine.owner !== authorityTables[0].owner) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
-        );
-      }
-    } else if (CANONICAL_HUMAN_IDENTITY_ROUTINES.includes(routine.name)) {
-      const authorityTables = CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.filter(
-        (tableName) => tableByName.has(tableName)
-      ).map((tableName) => tableByName.get(tableName));
-      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
-      if (authorityTables.length !== CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.length) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} canonical identity authority tables are missing`
-        );
-      } else if (authorityOwners.size !== 1) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
-        );
-      } else if (routine.owner !== authorityTables[0].owner) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
-        );
-      }
-    } else if (SESSION_AUTHORITY_ROUTINES.has(routine.name)) {
-      const authorityOwner = tableByName.get("sessions")?.owner ?? targetSchemaOwner;
-      if (authorityOwner && routine.owner !== authorityOwner) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match session authority owner ${authorityOwner}`
-        );
-      }
-    } else if (routine.name === XAI_SNAPSHOT_VALIDATOR_ROUTINE) {
-    } else if (routine.name === XAI_CREATE_CREDENTIAL_ROUTINE || routine.name === XAI_DISCONNECT_CREDENTIAL_ROUTINE || routine.name === XAI_AUTHORITY_LIVE_ROUTINE || routine.name === XAI_POOL_VISIBLE_ROUTINE || routine.name === XAI_RESOLVE_POOL_ROUTINE || routine.name === XAI_REVALIDATE_CREDENTIAL_ROUTINE) {
-      if (!tableByName.has("xai_subscription_credentials")) {
-        continue;
-      }
-      const missingAuthorityTables = XAI_AUTHORITY_TABLES.filter(
-        (tableName) => !tableByName.has(tableName)
-      );
-      if (missingAuthorityTables.length > 0) {
-        violations.push(
-          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(", ")}`
-        );
-      } else {
-        const authorityTables = XAI_AUTHORITY_TABLES.map(
-          (tableName) => tableByName.get(tableName)
-        );
-        const authorityOwners = new Set(authorityTables.map((table) => table.owner));
-        if (authorityOwners.size !== 1) {
-          violations.push(
-            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
-          );
-        } else if (routine.owner !== authorityTables[0].owner) {
-          violations.push(
-            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
-          );
-        }
-      }
-    } else if (targetSchemaOwner && routine.owner !== targetSchemaOwner) {
-      violations.push(
-        `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match schema owner ${targetSchemaOwner}`
-      );
-    }
-    if (!routine.execute) {
-      violations.push(`runtime role lacks target-schema capability ${routine.name}`);
-    }
-    if (routine.publicExecute) {
-      violations.push(`PUBLIC has forbidden target-schema capability ${routine.name}`);
-    }
-  }
-  const artifactOutbox = tableByName.get("editable_artifact_live_outbox");
-  if (artifactOutbox) {
-    if (!artifactOutbox.artifactOutboxDispatcherPolicy) {
-      violations.push("table editable_artifact_live_outbox lacks its owner dispatcher RLS policy");
-    }
-    for (const expectedRoutine of ARTIFACT_OUTBOX_CAPABILITY_ROUTINES) {
-      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
-      if (matches.length !== 1) {
-        violations.push(`artifact outbox capability ${expectedRoutine} is missing or ambiguous`);
-        continue;
-      }
-      const routine = matches[0];
-      if (!routine.securityDefiner) {
-        violations.push(`artifact outbox capability ${routine.name} is not SECURITY DEFINER`);
-      }
-      if (routine.owner !== artifactOutbox.owner) {
-        violations.push(
-          `artifact outbox capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactOutbox.owner}`
-        );
-      }
-      if (routine.execute) {
-        violations.push(
-          `generic runtime role has forbidden global artifact outbox capability ${routine.name}`
-        );
-      }
-    }
-  }
-  const artifactMaterializationJobs = tableByName.get("editable_artifact_materialization_jobs");
-  if (artifactMaterializationJobs) {
-    for (const tableName of [
-      "editable_artifact_materialization_jobs",
-      "editable_artifact_materialization_results",
-      "editable_artifact_blob_refs",
-      "editable_artifact_sequence_checkpoints",
-      "editable_artifact_versions",
-      "editable_artifact_idempotency_receipts"
-    ]) {
-      const table = tableByName.get(tableName);
-      if (table && !table.artifactMaterializerPolicy) {
-        violations.push(`table ${tableName} lacks its owner materializer RLS policy`);
-      }
-    }
-    for (const expectedRoutine of ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES) {
-      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
-      if (matches.length !== 1) {
-        violations.push(
-          `artifact materializer capability ${expectedRoutine} is missing or ambiguous`
-        );
-        continue;
-      }
-      const routine = matches[0];
-      if (!routine.securityDefiner) {
-        violations.push(`artifact materializer capability ${routine.name} is not SECURITY DEFINER`);
-      }
-      if (routine.owner !== artifactMaterializationJobs.owner) {
-        violations.push(
-          `artifact materializer capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactMaterializationJobs.owner}`
-        );
-      }
-      if (routine.execute) {
-        violations.push(
-          `generic runtime role has forbidden global artifact materializer capability ${routine.name}`
-        );
-      }
-    }
-  }
-  const artifactAuthority = tableByName.get("editable_artifacts");
-  if (artifactAuthority) {
-    const matches = posture.privateRoutines.filter(
-      (routine) => routine.name.startsWith("advance_editable_artifact_authorization_revision(")
-    );
-    if (matches.length !== 1) {
-      violations.push(
-        "editable artifact authorization revision capability is missing or ambiguous"
-      );
-    } else {
-      const routine = matches[0];
-      if (!routine.securityDefiner) {
-        violations.push(
-          `editable artifact authorization revision capability ${routine.name} is not SECURITY DEFINER`
-        );
-      }
-      if (routine.owner !== artifactAuthority.owner) {
-        violations.push(
-          `editable artifact authorization revision capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`
-        );
-      }
-    }
-    for (const expectedRoutine of ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES) {
-      const capabilityMatches = posture.privateRoutines.filter(
-        (routine2) => routine2.name === expectedRoutine
-      );
-      if (capabilityMatches.length !== 1) {
-        violations.push(
-          `editable artifact authorization capability ${expectedRoutine} is missing or ambiguous`
-        );
-        continue;
-      }
-      const routine = capabilityMatches[0];
-      if (!routine.securityDefiner) {
-        violations.push(
-          `editable artifact authorization capability ${routine.name} is not SECURITY DEFINER`
-        );
-      }
-      if (routine.owner !== artifactAuthority.owner) {
-        violations.push(
-          `editable artifact authorization capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`
-        );
-      }
-      if (!routine.execute) {
-        violations.push(
-          `runtime role lacks editable artifact authorization capability ${routine.name}`
-        );
-      }
-    }
-  }
-  const artifactLiveTickets = tableByName.get("editable_artifact_live_tickets");
-  if (artifactLiveTickets) {
-    for (const expectedRoutine of ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES) {
-      const matches = posture.privateRoutines.filter((routine2) => routine2.name === expectedRoutine);
-      if (matches.length !== 1) {
-        violations.push(
-          `artifact live ticket capability ${expectedRoutine} is missing or ambiguous`
-        );
-        continue;
-      }
-      const routine = matches[0];
-      if (!routine.securityDefiner) {
-        violations.push(`artifact live ticket capability ${routine.name} is not SECURITY DEFINER`);
-      }
-      if (routine.owner !== artifactLiveTickets.owner) {
-        violations.push(
-          `artifact live ticket capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`
-        );
-      }
-      if (!routine.execute) {
-        violations.push(`runtime role lacks artifact live ticket capability ${routine.name}`);
-      }
-    }
-    for (const internalRoutine of ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES) {
-      const matches = posture.privateRoutines.filter((routine2) => routine2.name === internalRoutine);
-      if (matches.length !== 1) {
-        violations.push(
-          `artifact live ticket internal routine ${internalRoutine} is missing or ambiguous`
-        );
-        continue;
-      }
-      const routine = matches[0];
-      if (!routine.securityDefiner) {
-        violations.push(
-          `artifact live ticket internal routine ${routine.name} is not SECURITY DEFINER`
-        );
-      }
-      if (routine.owner !== artifactLiveTickets.owner) {
-        violations.push(
-          `artifact live ticket internal routine ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`
-        );
-      }
-      if (routine.execute) {
-        violations.push(`runtime role has forbidden ticket schema resolver ${routine.name}`);
-      }
-    }
-  }
-  if (posture.privateRoutines.length === 0) {
-    violations.push("opengeni_private has no helper routines");
-  }
-  for (const routine of posture.privateRoutines) {
-    if (routine.owner === expectedRole) {
-      violations.push(`runtime role owns private routine ${routine.name}`);
-    }
-    const dedicatedArtifactCapability = DEDICATED_ARTIFACT_CAPABILITY_ROUTINES.has(routine.name);
-    if (!routine.execute && !dedicatedArtifactCapability) {
-      violations.push(`runtime role lacks EXECUTE on private routine ${routine.name}`);
-    }
-  }
-  return violations;
-}
-async function assertRuntimeDatabasePosture(db, options) {
-  const posture = await inspectRuntimeDatabasePosture(db, options);
-  const violations = evaluateRuntimeDatabasePosture(posture, options);
-  if (violations.length > 0) {
-    throw new RuntimeDatabasePostureError(violations);
-  }
-  return posture;
-}
-function runtimeDatabaseReadyCheck(db, options) {
-  return async () => {
-    await assertRuntimeDatabasePosture(db, options);
-  };
-}
-
-// src/provision-roles.ts
-async function provisionRoles(adminConnection, options = {}) {
-  const schema = validateIdentifier("targetSchema", options.targetSchema ?? "public");
-  const rlsStrategy = options.rlsStrategy ?? "force";
-  const appRole = validateIdentifier(
-    "appRole",
-    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app")
-  );
-  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
-  const artifactOutboxDispatcherRole = validateIdentifier(
-    "artifactOutboxDispatcherRole",
-    options.artifactOutboxDispatcherRole ?? (process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_USER?.trim() || "opengeni_artifact_outbox_dispatcher")
-  );
-  const artifactOutboxDispatcherPassword = options.artifactOutboxDispatcherPassword ?? process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_PASSWORD;
-  const artifactMaterializerRole = validateIdentifier(
-    "artifactMaterializerRole",
-    options.artifactMaterializerRole ?? (process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_USER?.trim() || "opengeni_artifact_materializer")
-  );
-  const artifactMaterializerPassword = options.artifactMaterializerPassword ?? process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_PASSWORD;
-  const hostExportRole = validateIdentifier(
-    "hostExportRole",
-    options.hostExportRole ?? (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || "opengeni_host_exporter")
-  );
-  const hostExportPassword = options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;
-  const temporalRole = validateIdentifier(
-    "temporalRole",
-    options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal")
-  );
-  const temporalPassword = options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;
-  const temporalDatabases = (options.temporalDatabases ?? commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? "temporal,temporal_visibility")).map((name) => validateIdentifier("temporalDatabases", name));
-  const sql2 = postgres(adminConnection, { max: 1 });
-  try {
-    let provisionedAppRole = null;
-    if (rlsStrategy === "force") {
-      if (!appPassword) {
-        throw new Error(
-          "OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'"
-        );
-      }
-      await assertAppRoleSafeToNormalize(sql2, appRole);
-      await ensureRestrictedAppLoginRole(sql2, appRole, appPassword);
-      provisionedAppRole = appRole;
-    }
-    let provisionedArtifactOutboxDispatcherRole = null;
-    if (artifactOutboxDispatcherPassword) {
-      await assertAppRoleSafeToNormalize(sql2, artifactOutboxDispatcherRole);
-      await ensureRestrictedAppLoginRole(
-        sql2,
-        artifactOutboxDispatcherRole,
-        artifactOutboxDispatcherPassword
-      );
-      await grantArtifactCapabilityRoleIfSchemaExists(
-        sql2,
-        artifactOutboxDispatcherRole,
-        schema,
-        "outbox"
-      );
-      provisionedArtifactOutboxDispatcherRole = artifactOutboxDispatcherRole;
-    }
-    let provisionedArtifactMaterializerRole = null;
-    if (artifactMaterializerPassword) {
-      await assertAppRoleSafeToNormalize(sql2, artifactMaterializerRole);
-      await ensureRestrictedAppLoginRole(
-        sql2,
-        artifactMaterializerRole,
-        artifactMaterializerPassword
-      );
-      await grantArtifactCapabilityRoleIfSchemaExists(
-        sql2,
-        artifactMaterializerRole,
-        schema,
-        "materializer"
-      );
-      provisionedArtifactMaterializerRole = artifactMaterializerRole;
-    }
-    if (temporalPassword) {
-      await ensureLoginRole(sql2, temporalRole, temporalPassword);
-      for (const database of temporalDatabases) {
-        await ensureDatabase(sql2, database, temporalRole);
-        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);
-      }
-    }
-    if (hostExportPassword) {
-      await ensureLoginRole(sql2, hostExportRole, hostExportPassword);
-      await grantHostExportRoleIfSchemaExists(sql2, hostExportRole);
-    }
-    if (rlsStrategy === "force") {
-      await grantAppRoleIfSchemaExists(sql2, appRole, schema);
-    }
-    return {
-      appRole: provisionedAppRole,
-      artifactOutboxDispatcherRole: provisionedArtifactOutboxDispatcherRole,
-      artifactMaterializerRole: provisionedArtifactMaterializerRole,
-      hostExportRole: hostExportPassword ? hostExportRole : null,
-      temporalRole: temporalPassword ? temporalRole : null,
-      temporalDatabases: temporalPassword ? temporalDatabases : [],
-      schema,
-      rlsStrategy
-    };
-  } finally {
-    await sql2.end();
-  }
-}
-async function grantHostExportRoleIfSchemaExists(sql2, role) {
-  await sql2.unsafe(`
-DO $$
-BEGIN
-  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN
-    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});
-    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});
-    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});
-  END IF;
-END $$;
-`);
-}
-async function grantArtifactCapabilityRoleIfSchemaExists(sql2, role, dataSchema, capability) {
-  const routines = capability === "outbox" ? [
-    "claim_editable_artifact_live_outbox(text,integer,integer,name)",
-    "mark_editable_artifact_live_outbox_published(text,text,integer,name)",
-    "renew_editable_artifact_live_outbox(text,text,integer,integer,name)",
-    "retry_editable_artifact_live_outbox(text,text,integer,integer,text,name)",
-    "dead_letter_editable_artifact_live_outbox(text,text,integer,text,name)",
-    "release_editable_artifact_live_outbox(text,text,integer,name)"
-  ] : [
-    "claim_editable_artifact_materializations(text,integer,integer,name)",
-    "renew_editable_artifact_materialization(uuid,uuid,text,text,text,integer,integer,name)",
-    "succeed_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,text,text,bigint,text,text,timestamp with time zone,name)",
-    "fail_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,name)"
-  ];
-  const routineArray = `ARRAY[${routines.map(literal).join(", ")}]`;
-  await sql2.unsafe(`
-DO $$
-DECLARE routine_signature text;
-BEGIN
-  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(dataSchema)})
-    AND EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private')
-  THEN
-    EXECUTE format('GRANT CONNECT ON DATABASE %I TO %I', current_database(), ${literal(role)});
-    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(dataSchema)}, ${literal(role)});
-    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
-    EXECUTE format(
-      'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I',
-      ${literal(dataSchema)}, ${literal(role)}
-    );
-    EXECUTE format(
-      'REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I FROM %I',
-      ${literal(dataSchema)}, ${literal(role)}
-    );
-    EXECUTE format(
-      'REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA opengeni_private FROM %I',
-      ${literal(role)}
-    );
-    FOREACH routine_signature IN ARRAY ${routineArray} LOOP
-      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN
-        EXECUTE format(
-          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',
-          routine_signature, ${literal(role)}
-        );
-      END IF;
-    END LOOP;
-  END IF;
-END $$;
-`);
-}
-async function ensureLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
-    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
-  ELSE
-    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});
-  END IF;
-END $$;
-`);
-}
-async function ensureRestrictedAppLoginRole(sql2, role, password) {
-  await sql2.unsafe(`
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
-    EXECUTE format(
-      'CREATE ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
-      ${literal(role)},
-      ${literal(password)}
-    );
-  ELSIF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND rolsuper) THEN
-    EXECUTE format(
-      'ALTER ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
-      ${literal(role)},
-      ${literal(password)}
-    );
-  ELSE
-    -- PostgreSQL requires elevated attributes merely to name SUPERUSER,
-    -- BYPASSRLS, REPLICATION, or CREATEDB in ALTER ROLE, even when setting them
-    -- false. The preflight has already proved those protected attributes are
-    -- false, so a managed CREATEROLE administrator converges only the
-    -- attributes it may change.
-    EXECUTE format(
-      'ALTER ROLE %I WITH LOGIN NOCREATEROLE NOINHERIT PASSWORD %L',
-      ${literal(role)},
-      ${literal(password)}
-    );
-  END IF;
-END $$;
-`);
-}
-async function assertAppRoleSafeToNormalize(sql2, role) {
-  const exists = await sql2`
-    select exists(select 1 from pg_roles where rolname = ${role}) as exists
-  `;
-  if (!exists[0]?.exists) {
-    return;
-  }
-  const [roleAttributes] = await sql2`
-    select
-      administrator.rolsuper as administrator_superuser,
-      app.rolsuper as app_superuser,
-      app.rolbypassrls as app_bypass_rls,
-      app.rolcreatedb as app_create_database,
-      app.rolreplication as app_replication
-    from pg_roles app
-    join pg_roles administrator on administrator.rolname = current_user
-    where app.rolname = ${role}
-  `;
-  if (roleAttributes && !roleAttributes.administrator_superuser) {
-    const protectedAttributes = [
-      roleAttributes.app_superuser ? "SUPERUSER" : null,
-      roleAttributes.app_bypass_rls ? "BYPASSRLS" : null,
-      roleAttributes.app_create_database ? "CREATEDB" : null,
-      roleAttributes.app_replication ? "REPLICATION" : null
-    ].filter((attribute) => attribute !== null);
-    if (protectedAttributes.length > 0) {
-      throw new Error(
-        `Refusing to normalize app role ${role}: a non-superuser administrator cannot clear protected attributes (${protectedAttributes.join(", ")})`
-      );
-    }
-  }
-  const relationshipRows = await sql2.unsafe(
-    roleRelationshipsCatalogQuery("$1"),
-    [role]
-  );
-  const { unsafeRelationships } = classifyRoleRelationships(relationshipRows);
-  if (unsafeRelationships.length > 0) {
-    throw new Error(
-      `Refusing to normalize app role ${role}: remove privilege-bearing role relationships first (${unsafeRelationships.join(", ")})`
-    );
-  }
-  const ownedObjects = await sql2`
-    select ('database:' || d.datname)::text as object_name
-    from pg_database d
-    join pg_roles owner on owner.oid = d.datdba
-    where owner.rolname = ${role}
-    union all
-    select ('schema:' || n.nspname)::text as object_name
-    from pg_namespace n
-    join pg_roles owner on owner.oid = n.nspowner
-    where owner.rolname = ${role}
-      and n.nspname <> 'information_schema'
-      and n.nspname !~ '^pg_'
-    union all
-    select ('relation:' || n.nspname || '.' || c.relname)::text as object_name
-    from pg_class c
-    join pg_namespace n on n.oid = c.relnamespace
-    join pg_roles owner on owner.oid = c.relowner
-    where owner.rolname = ${role}
-      and n.nspname <> 'information_schema'
-      and n.nspname !~ '^pg_'
-    union all
-    select (
-      'routine:' || n.nspname || '.' || p.proname || '(' ||
-      pg_get_function_identity_arguments(p.oid) || ')'
-    )::text as object_name
-    from pg_proc p
-    join pg_namespace n on n.oid = p.pronamespace
-    join pg_roles owner on owner.oid = p.proowner
-    where owner.rolname = ${role}
-      and n.nspname <> 'information_schema'
-      and n.nspname !~ '^pg_'
-    order by object_name
-  `;
-  if (ownedObjects.length > 0) {
-    throw new Error(
-      `Refusing to normalize app role ${role}: transfer owned objects first (${ownedObjects.map((row) => row.object_name).join(", ")})`
-    );
-  }
-}
-async function ensureDatabase(sql2, database, owner) {
-  const existing = await sql2`
-    select exists(select 1 from pg_database where datname = ${database}) as exists
-  `;
-  if (!existing[0]?.exists) {
-    await sql2.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);
-  }
-  await sql2.unsafe(
-    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`
-  );
-}
-async function grantTemporalRoleInDatabase(adminConnection, database, role) {
-  const databaseUrl = databaseUrlFor(adminConnection, database);
-  const databaseSql = postgres(databaseUrl, { max: 1 });
-  try {
-    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);
-  } finally {
-    await databaseSql.end();
-  }
-}
-async function grantAppRoleIfSchemaExists(sql2, role, schema) {
-  const runtimeFullDmlTables = `ARRAY[${RUNTIME_FULL_DML_TABLES.map(literal).join(", ")}]`;
-  const runtimeReadOnlyTables = `ARRAY[${RUNTIME_READ_ONLY_TABLES.map(literal).join(", ")}]`;
-  const runtimeReadUpdateTables = `ARRAY[${RUNTIME_READ_UPDATE_TABLES.map(literal).join(", ")}]`;
-  const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(", ")}]`;
-  const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(", ")}]`;
-  await sql2.unsafe(`
-DO $$
-DECLARE
-  owner_role text := current_user;
-  runtime_table text;
-BEGIN
-  EXECUTE format('REVOKE CREATE ON DATABASE %I FROM %I', current_database(), ${literal(role)});
-  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN
-    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
-    EXECUTE format('REVOKE CREATE ON SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
-    EXECUTE format('REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
-    FOREACH runtime_table IN ARRAY ${runtimeFullDmlTables} LOOP
-      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
-        EXECUTE format(
-          'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.%I TO %I',
-          ${literal(schema)},
-          runtime_table,
-          ${literal(role)}
-        );
-      END IF;
-    END LOOP;
-    FOREACH runtime_table IN ARRAY ${runtimeReadOnlyTables} LOOP
-      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
-        EXECUTE format(
-          'GRANT SELECT ON TABLE %I.%I TO %I',
-          ${literal(schema)},
-          runtime_table,
-          ${literal(role)}
-        );
-      END IF;
-    END LOOP;
-    FOREACH runtime_table IN ARRAY ${runtimeReadUpdateTables} LOOP
-      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
-        EXECUTE format(
-          'GRANT SELECT, UPDATE ON TABLE %I.%I TO %I',
-          ${literal(schema)},
-          runtime_table,
-          ${literal(role)}
-        );
-      END IF;
-    END LOOP;
-    FOREACH runtime_table IN ARRAY ${runtimeReadInsertTables} LOOP
-      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
-        EXECUTE format(
-          'GRANT SELECT, INSERT ON TABLE %I.%I TO %I',
-          ${literal(schema)},
-          runtime_table,
-          ${literal(role)}
-        );
-      END IF;
-    END LOOP;
-    FOREACH runtime_table IN ARRAY ${runtimeReadInsertUpdateTables} LOOP
-      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
-        EXECUTE format(
-          'GRANT SELECT, INSERT, UPDATE ON TABLE %I.%I TO %I',
-          ${literal(schema)},
-          runtime_table,
-          ${literal(role)}
-        );
-      END IF;
-    END LOOP;
-    -- Migration 0110 creates this target-schema-local SECURITY DEFINER
-    -- capability before opengeni_app may exist. Re-converge its exact EXECUTE
-    -- grant here so the supported migrate-then-provision order is equivalent to
-    -- provisioning the role before that migration.
-    IF to_regprocedure(
-      format('%I.lock_nested_agent_depth_configuration()', ${literal(schema)})
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.lock_nested_agent_depth_configuration() TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.preference_registry_apply_lifecycle(text,uuid,integer,uuid,uuid,text,uuid,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.preference_registry_apply_lifecycle(text, uuid, integer, uuid, uuid, text, uuid, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format('%I.preference_registry_lock_heads(uuid[])', ${literal(schema)})
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.preference_registry_lock_heads(uuid[]) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.knowledge_memory_apply_operation(jsonb,text,text,text,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_apply_operation(jsonb, text, text, text, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.knowledge_memory_revert_operation(uuid,uuid,text,text,text,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.knowledge_memory_revert_operation(uuid, uuid, text, text, text, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.preference_registry_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.preference_registry_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.create_task_note_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.workspace_instruction_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.company_profile_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.company_profile_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.company_profile_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.company_profile_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.workspace_learning_policy_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format('%I.workspace_learning_policy_source_overrides_valid(jsonb)', ${literal(schema)})
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_source_overrides_valid(jsonb) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format('%I.workspace_learning_policy_hash(text,jsonb)', ${literal(schema)})
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_hash(text, jsonb) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.workspace_learning_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.slack_task_policy_update(uuid,text,uuid,uuid,jsonb,uuid,bigint,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.slack_task_policy_update(uuid, text, uuid, uuid, jsonb, uuid, bigint, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_apply_lifecycle(uuid, text, uuid, text, bigint, text, text, text, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    -- Migration 0197 creates this target-schema-local SECURITY DEFINER lock
-    -- before opengeni_app may exist. Re-converge only its exact EXECUTE grant
-    -- for the supported migrate-then-provision install order; keep PUBLIC
-    -- revoked and do not widen table privileges.
-    IF to_regprocedure(
-      format(
-        '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    -- Migration 0243 adds the exact Google Drive object authorization and
-    -- safe-citation projections. Re-converge both capabilities for the same
-    -- supported migrate-then-provision order without granting direct mutation
-    -- of their append-only ACL evidence tables.
-    IF to_regprocedure(
-      format(
-        '%I.google_drive_file_authorized(uuid,uuid,text,uuid)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.google_drive_file_authorized(uuid, uuid, text, uuid) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.google_drive_file_authorized(uuid, uuid, text, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.google_drive_document_citation(uuid,uuid,text,uuid,uuid)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.google_drive_document_citation(uuid, uuid, text, uuid, uuid) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.google_drive_document_citation(uuid, uuid, text, uuid, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.ensure_managed_human_personal_workspace(uuid,text,uuid)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(format('%I.ensure_canonical_human_identity(text,text)', ${literal(schema)})) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.ensure_canonical_human_identity(text, text) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.ensure_canonical_human_identity(text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(format('%I.validate_canonical_human_session(text,text,boolean)', ${literal(schema)})) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(format('%I.get_canonical_human_identity_projection(text)', ${literal(schema)})) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.get_canonical_human_identity_projection(text) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.get_canonical_human_identity_projection(text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(format('%I.apply_canonical_human_identity_operation(uuid,text,bigint,text,uuid,text,text,text)', ${literal(schema)})) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    -- Migration 0225 creates these target-schema-local session visibility
-    -- capabilities before opengeni_app may exist. Re-converge their exact
-    -- EXECUTE grants for migrate-then-provision installs without granting
-    -- blanket execution on target-schema routines.
-    IF to_regprocedure(
-      format(
-        '%I.session_private_actor_visible(uuid,uuid,uuid,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.session_reference_visible(uuid,uuid,uuid)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.transition_session_visibility(uuid,uuid,uuid,text,text,integer,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.create_xai_subscription_credential(uuid,uuid,text,text,text,text,text,text,text,timestamptz)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE ALL ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) FROM PUBLIC',
-        ${literal(schema)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_source_acl(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.scoped_knowledge_complete_sync(uuid,uuid,text,text,timestamptz,jsonb,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_complete_sync(uuid, uuid, text, text, timestamptz, jsonb, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure(
-      format(
-        '%I.scoped_knowledge_advance_object_version(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',
-        ${literal(schema)}
-      )
-    ) IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_object_version(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',
-        ${literal(schema)},
-        ${literal(role)}
-      );
-    END IF;
-    EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
-    EXECUTE format(
-      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',
-      owner_role,
-      ${literal(schema)},
-      ${literal(role)}
-    );
-    EXECUTE format(
-      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I GRANT USAGE, SELECT ON SEQUENCES TO %I',
-      owner_role,
-      ${literal(schema)},
-      ${literal(role)}
-    );
-  END IF;
-  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN
-    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
-    EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});
-    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
-    EXECUTE format(
-      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private REVOKE EXECUTE ON FUNCTIONS FROM %I',
-      owner_role,
-      ${literal(role)}
-    );
-    -- Global cross-workspace artifact workers are separate capabilities. Never
-    -- let the generic tenant-scoped app role inherit them from the historical
-    -- blanket grant of already-installed helpers.
-    IF to_regprocedure('opengeni_private.claim_editable_artifact_live_outbox(text,integer,integer,name)') IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_live_outbox(text, integer, integer, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.mark_editable_artifact_live_outbox_published(text, text, integer, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_live_outbox(text, text, integer, integer, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.retry_editable_artifact_live_outbox(text, text, integer, integer, text, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.dead_letter_editable_artifact_live_outbox(text, text, integer, text, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.release_editable_artifact_live_outbox(text, text, integer, name) FROM %I',
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure('opengeni_private.claim_editable_artifact_materializations(text,integer,integer,name)') IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_materializations(text, integer, integer, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamptz, name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name) FROM %I',
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure('opengeni_private.consume_editable_artifact_live_ticket(text,name)') IS NOT NULL THEN
-      EXECUTE format(
-        'REVOKE EXECUTE ON FUNCTION opengeni_private.resolve_editable_artifact_ticket_data_schema(name) FROM %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION opengeni_private.put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamptz, timestamptz, name) TO %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION opengeni_private.consume_editable_artifact_live_ticket(text, name) TO %I',
-        ${literal(role)}
-      );
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION opengeni_private.cleanup_expired_editable_artifact_live_tickets(integer, name) TO %I',
-        ${literal(role)}
-      );
-    END IF;
-    IF to_regprocedure('opengeni_private.authorize_editable_artifact_actor(uuid,uuid,text,text,text,text,text,text,integer,text,text,name)') IS NOT NULL THEN
-      EXECUTE format(
-        'GRANT EXECUTE ON FUNCTION opengeni_private.authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name) TO %I',
-        ${literal(role)}
-      );
-    END IF;
-  END IF;
-END $$;
-`);
-}
-function commaSeparated(value) {
-  return value.split(",").map((item) => item.trim()).filter(Boolean);
-}
-function validateIdentifier(name, value) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
-    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);
-  }
-  return value;
-}
-function identifier(value) {
-  return `"${value.replace(/"/g, '""')}"`;
-}
-function literal(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-function databaseUrlFor(value, database) {
-  const url = new URL(value);
-  url.pathname = `/${database}`;
-  return url.toString();
-}
-if (import.meta.main) {
-  const adminUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_ADMIN_URL ?? process.env.OPENGENI_DATABASE_URL;
-  if (!adminUrl) {
-    throw new Error(
-      "OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required"
-    );
-  }
-  const result = await provisionRoles(adminUrl, {
-    ...process.env.OPENGENI_DB_SCHEMA?.trim() ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() } : {}
-  });
-  console.log(JSON.stringify(result, null, 2));
-}
-
-export {
-  RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
-  RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES,
-  FORCE_RLS_TABLES,
-  NON_RLS_RUNTIME_TABLES,
-  RUNTIME_FULL_DML_TABLES,
-  RUNTIME_READ_ONLY_TABLES,
-  RUNTIME_READ_UPDATE_TABLES,
-  RUNTIME_READ_INSERT_TABLES,
-  RUNTIME_READ_INSERT_UPDATE_TABLES,
-  PROTECTED_NO_DIRECT_DML_TABLES,
-  RUNTIME_TABLE_PRIVILEGES,
-  RUNTIME_DML_TABLES,
-  RuntimeDatabasePostureError,
-  inspectRuntimeDatabasePosture,
-  evaluateRuntimeDatabasePosture,
-  assertRuntimeDatabasePosture,
-  runtimeDatabaseReadyCheck,
-  provisionRoles
-};
-//# sourceMappingURL=chunk-NXAFLCQX.js.map