@opengeni/db 4.0.0-canary.0 → 4.0.0-canary.2

package/dist/canonical-human-identities.js

@@ -11,9 +11,9 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-NLFHMPUB.js";
-import "./chunk-UFAMOUWL.js";
-import "./chunk-QM6YOWHZ.js";
+} from "./chunk-NPKBYGAK.js";
+import "./chunk-XIYAXH47.js";
+import "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/{chunk-2XEZK4LF.js → chunk-7YZP2CSL.js}

@@ -3,6 +3,19 @@ import { readdir, readFile } from "fs/promises";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import postgres from "postgres";
+
+// src/migration-runner-settings.ts
+function batchedBackfillTransactionLocalSetting(file) {
+  if (file === "0411_new_session_draft_project_provenance_backfill.sql") {
+    return {
+      guc: "opengeni.new_session_draft_project_provenance_backfill_v1",
+      value: "1"
+    };
+  }
+  return null;
+}
+
+// src/migrate.ts
 var DEFAULT_DATABASE_URL = "postgres://opengeni:opengeni@127.0.0.1:5432/opengeni";
 var DEFAULT_MAX_NESTED_AGENT_DEPTH = 3;
 var MAX_NESTED_AGENT_DEPTH = 2147483647;
@@ -92,6 +105,7 @@ async function executeMigrationFile(sql, file, sqlText) {
     try {
       for (; ; ) {
         const result = await sql.begin(async (transaction) => {
+          const transactionLocalSetting = batchedBackfillTransactionLocalSetting(file);
           await transaction`select
             pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),
             pg_catalog.set_config(
@@ -99,6 +113,13 @@ async function executeMigrationFile(sql, file, sqlText) {
               '1',
               true
             )`;
+          if (transactionLocalSetting) {
+            await transaction`select pg_catalog.set_config(
+              ${transactionLocalSetting.guc},
+              ${transactionLocalSetting.value},
+              true
+            )`;
+          }
           return await transaction.unsafe(batchedBackfill.statement);
         });
         if (result.length === 0) break;
@@ -269,8 +290,9 @@ if (import.meta.main) {
 
 export {
   parseConcurrentIndexMigration,
+  parseBatchedBackfillMigration,
   migrationApplicationRoles,
   migrate,
   runMigrations
 };
-//# sourceMappingURL=chunk-2XEZK4LF.js.map
+//# sourceMappingURL=chunk-7YZP2CSL.js.map

package/dist/chunk-7YZP2CSL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrate.ts","../src/migration-runner-settings.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport postgres from \"postgres\";\nimport { batchedBackfillTransactionLocalSetting } from \"./migration-runner-settings\";\n\nconst DEFAULT_DATABASE_URL = \"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\";\nconst DEFAULT_MAX_NESTED_AGENT_DEPTH = 3;\nconst MAX_NESTED_AGENT_DEPTH = 2_147_483_647;\nconst DEFAULT_APPLICATION_DATABASE_ROLE = \"opengeni_app\";\nconst MIGRATION_APPLICATION_ROLES_SETTING = \"opengeni.migration_application_roles\";\nconst MAX_MIGRATION_APPLICATION_ROLES = 16;\nconst batchedBackfillDirective =\n  /^-- opengeni:batched-backfill batch-size=(\\d+) lock-timeout=(\\d+(?:ms|s|min)) statement-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexStatement =\n  /^CREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+CONCURRENTLY\\s+(?:(IF\\s+NOT\\s+EXISTS)\\s+)?(?:\"((?:[^\"]|\"\")+)\"|([A-Za-z_][A-Za-z0-9_]*))\\s+ON\\b/is;\nconst governedLegacyConcurrentIndexMigrations = new Set([\n  \"0066_session_interruption_attempt_lookup.sql\",\n  \"0070_session_event_type_sequence_lookup.sql\",\n  \"0071_session_event_monitoring_tail.sql\",\n  \"0072_sessions_workspace_created_id_idx.sql\",\n  \"0073_sessions_workspace_updated_id_idx.sql\",\n  \"0075_sessions_workspace_activity_revision_idx.sql\",\n  \"0077_session_attempt_latest_lookup.sql\",\n]);\nexport interface ConcurrentIndexMigration {\n  indexName: string;\n  lockTimeout: string;\n  skipWhenValid: boolean;\n  statement: string;\n}\n\nexport type MigrationRuntimeOptions = {\n  maxNestedAgentDepth?: number;\n  /**\n   * Exact database login roles that may run an OpenGeni API or worker against\n   * this target. Maintenance cutovers use this list to reject a live mixed-\n   * version fleet, and rolling ACL migrations use it to preserve old-binary\n   * readiness until later role provisioning converges. Dedicated-schema and\n   * custom-role deployments must supply it.\n   */\n  applicationDatabaseRoles?: string[];\n};\n\ntype DeploymentDepthPolicy = {\n  maxNestedAgentDepth: number;\n  source: \"deployment\" | \"default\";\n};\n\n/** A bare Postgres identifier (schema/role name) safe to interpolate into DDL. */\nfunction assertIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\n/**\n * Most migration files intentionally execute as one implicit transaction.\n * PostgreSQL forbids CREATE INDEX CONCURRENTLY there, so a migration may opt\n * into one narrowly validated transactionless statement with:\n *\n *   -- opengeni:concurrent-index lock-timeout=5s\n *   CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS ...;\n *\n * The directive is deliberately not a generic \"no transaction\" escape hatch:\n * only one idempotent concurrent-index statement is accepted, lock acquisition\n * is always bounded, and an invalid artifact left by a failed concurrent build\n * is removed before retry. Seven governed historical migrations predate the\n * IF NOT EXISTS rule; only those exact filenames may use their immutable bare\n * statements, and the runner makes their retries idempotent by skipping an\n * already-valid index. This keeps additive large-table indexes online without\n * rewriting shipped history or making arbitrary partially-applied migration\n * scripts possible.\n */\nexport function parseConcurrentIndexMigration(\n  file: string,\n  sqlText: string,\n): ConcurrentIndexMigration | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const firstLine = lines[0]?.trim() ?? \"\";\n  const deploymentPrefixed = /^-- deployment-mode: (?:rolling|maintenance)$/.test(firstLine);\n  const directiveIndex = deploymentPrefixed ? 1 : 0;\n  const directiveLine = lines[directiveIndex]?.trim() ?? \"\";\n  const directive = concurrentIndexDirective.exec(directiveLine);\n  if (!directive) {\n    if (directiveLine.startsWith(\"-- opengeni:\")) {\n      throw new Error(`Unsupported OpenGeni migration directive in ${file}`);\n    }\n    return null;\n  }\n\n  const lockTimeout = directive[1]!;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const parsedStatement = concurrentIndexStatement.exec(withoutTrailingSemicolon);\n  if (!parsedStatement || withoutTrailingSemicolon.includes(\";\")) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires exactly one CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS statement with an unqualified index name`,\n    );\n  }\n  const idempotentInSql = parsedStatement[1] !== undefined;\n  if (!idempotentInSql && !governedLegacyConcurrentIndexMigrations.has(file)) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires IF NOT EXISTS; bare statements are supported only for governed historical migrations`,\n    );\n  }\n  return {\n    indexName: (parsedStatement[2] ?? parsedStatement[3]!).replaceAll('\"\"', '\"'),\n    lockTimeout,\n    skipWhenValid: !idempotentInSql,\n    statement,\n  };\n}\n\nexport function parseBatchedBackfillMigration(\n  file: string,\n  sqlText: string,\n): { batchSize: number; lockTimeout: string; statementTimeout: string; statement: string } | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const directiveIndex = /^-- deployment-mode: (?:rolling|maintenance)$/.test(\n    lines[0]?.trim() ?? \"\",\n  )\n    ? 1\n    : 0;\n  const directive = batchedBackfillDirective.exec(lines[directiveIndex]?.trim() ?? \"\");\n  if (!directive) return null;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .filter((line) => !line.trim().startsWith(\"--\"))\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const batchSize = Number(directive[1]!);\n  if (\n    !Number.isSafeInteger(batchSize) ||\n    batchSize < 1 ||\n    batchSize > 10_000 ||\n    !/^WITH\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bUPDATE\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bRETURNING\\b/is.test(withoutTrailingSemicolon) ||\n    !new RegExp(`\\\\bLIMIT\\\\s+${batchSize}\\\\b`, \"i\").test(withoutTrailingSemicolon) ||\n    withoutTrailingSemicolon.includes(\";\")\n  ) {\n    throw new Error(\n      `${file}: opengeni:batched-backfill requires one bounded WITH ... UPDATE ... RETURNING statement whose LIMIT matches batch-size`,\n    );\n  }\n  return {\n    batchSize,\n    lockTimeout: directive[2]!,\n    statementTimeout: directive[3]!,\n    statement,\n  };\n}\n\nasync function executeMigrationFile(\n  sql: postgres.Sql,\n  file: string,\n  sqlText: string,\n): Promise<void> {\n  const batchedBackfill = parseBatchedBackfillMigration(file, sqlText);\n  if (batchedBackfill) {\n    await sql`select set_config('lock_timeout', ${batchedBackfill.lockTimeout}, false)`;\n    await sql`select set_config('statement_timeout', ${batchedBackfill.statementTimeout}, false)`;\n    try {\n      for (;;) {\n        const result = await sql.begin(async (transaction) => {\n          const transactionLocalSetting = batchedBackfillTransactionLocalSetting(file);\n          await transaction`select\n            pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),\n            pg_catalog.set_config(\n              'opengeni.session_variable_set_attachments_v1',\n              '1',\n              true\n            )`;\n          if (transactionLocalSetting) {\n            await transaction`select pg_catalog.set_config(\n              ${transactionLocalSetting.guc},\n              ${transactionLocalSetting.value},\n              true\n            )`;\n          }\n          return await transaction.unsafe(batchedBackfill.statement);\n        });\n        if (result.length === 0) break;\n      }\n    } finally {\n      await sql`select set_config('statement_timeout', '0', false)`;\n      await sql`select set_config('lock_timeout', '0', false)`;\n    }\n    return;\n  }\n  const concurrentIndex = parseConcurrentIndexMigration(file, sqlText);\n  if (!concurrentIndex) {\n    // Migration SQL is the only writer allowed to cross protocol generations.\n    // Keep the authority transaction-local and inside the same PostgreSQL simple\n    // query as the migration body: setting it in a prior statement would end\n    // that implicit transaction and silently lose the LOCAL value. This also\n    // makes a fresh database capable of applying maintenance migration 0138\n    // and later migrations capable of crossing the 0352 sessions policy\n    // without a process-global PGOPTIONS escape hatch.\n    await sql.unsafe(\n      `SELECT\n  pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),\n  pg_catalog.set_config('opengeni.session_variable_set_attachments_v1', '1', true);\\n${sqlText}`,\n    );\n    return;\n  }\n\n  await sql`select set_config('lock_timeout', ${concurrentIndex.lockTimeout}, false)`;\n  try {\n    const [existing] = await sql<Array<{ valid: boolean; ready: boolean }>>`\n      select i.indisvalid as valid, i.indisready as ready\n      from pg_catalog.pg_class c\n      join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n      join pg_catalog.pg_index i on i.indexrelid = c.oid\n      where n.nspname = current_schema() and c.relname = ${concurrentIndex.indexName}\n    `;\n    if (existing && (!existing.valid || !existing.ready)) {\n      const quotedIndexName = `\"${concurrentIndex.indexName.replaceAll('\"', '\"\"')}\"`;\n      await sql.unsafe(`DROP INDEX CONCURRENTLY ${quotedIndexName}`);\n    } else if (existing && concurrentIndex.skipWhenValid) {\n      return;\n    }\n    await sql.unsafe(concurrentIndex.statement);\n  } finally {\n    await sql`select set_config('lock_timeout', '0', false)`;\n  }\n}\n\nfunction deploymentDepthPolicy(\n  options: MigrationRuntimeOptions | undefined,\n): DeploymentDepthPolicy {\n  const raw =\n    options === undefined\n      ? process.env.OPENGENI_MAX_NESTED_AGENT_DEPTH?.trim() || undefined\n      : options.maxNestedAgentDepth;\n  if (raw === undefined) {\n    return { maxNestedAgentDepth: DEFAULT_MAX_NESTED_AGENT_DEPTH, source: \"default\" };\n  }\n  const value = typeof raw === \"number\" ? raw : Number(raw);\n  if (\n    !Number.isSafeInteger(value) ||\n    value < 0 ||\n    value > MAX_NESTED_AGENT_DEPTH ||\n    (typeof raw === \"string\" && !/^(0|[1-9][0-9]*)$/.test(raw))\n  ) {\n    throw new Error(\n      `OPENGENI_MAX_NESTED_AGENT_DEPTH must be a non-negative 32-bit integer: ${raw}`,\n    );\n  }\n  return { maxNestedAgentDepth: value, source: \"deployment\" };\n}\n\nexport function migrationApplicationRoles(\n  schema: string | undefined,\n  options: MigrationRuntimeOptions | undefined,\n): string[] {\n  const configured = options?.applicationDatabaseRoles;\n  const environment = process.env.OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES?.trim();\n  const explicit =\n    configured !== undefined\n      ? configured\n      : environment\n        ? environment.split(\",\").map((role) => role.trim())\n        : undefined;\n\n  if (!explicit) {\n    const configuredRuntimeRoles = [\n      process.env.OPENGENI_APP_DATABASE_USER?.trim(),\n      process.env.OPENGENI_RUNTIME_DATABASE_ROLE?.trim(),\n    ].filter((role): role is string => Boolean(role) && role !== DEFAULT_APPLICATION_DATABASE_ROLE);\n    if (schema || configuredRuntimeRoles.length > 0) {\n      throw new Error(\n        \"Pending migrations require the exact application database roles via \" +\n          \"MigrationRuntimeOptions.applicationDatabaseRoles or \" +\n          \"OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES for dedicated-schema or custom-role deployments\",\n      );\n    }\n    return [DEFAULT_APPLICATION_DATABASE_ROLE];\n  }\n\n  if (\n    configured !== undefined &&\n    configured.some((role) => typeof role !== \"string\" || role !== role.trim())\n  ) {\n    throw new Error(\n      \"MigrationRuntimeOptions.applicationDatabaseRoles must contain canonical Postgres role names without surrounding whitespace\",\n    );\n  }\n  if (explicit.length < 1 || explicit.length > MAX_MIGRATION_APPLICATION_ROLES) {\n    throw new Error(\n      `Migration application database roles must contain 1-${MAX_MIGRATION_APPLICATION_ROLES} entries`,\n    );\n  }\n  const normalized = [...new Set(explicit)].sort((left, right) =>\n    Buffer.compare(Buffer.from(left, \"utf8\"), Buffer.from(right, \"utf8\")),\n  );\n  if (\n    normalized.length !== explicit.length ||\n    normalized.some((role) => role.length === 0 || Buffer.byteLength(role, \"utf8\") > 63)\n  ) {\n    throw new Error(\n      \"Migration application database roles must be unique, non-empty Postgres role names of at most 63 UTF-8 bytes\",\n    );\n  }\n  return normalized;\n}\n\nasync function persistDeploymentDepthPolicy(\n  sql: postgres.Sql,\n  policy: DeploymentDepthPolicy,\n): Promise<void> {\n  const [relation] = await sql<{ exists: boolean }[]>`\n    select to_regclass('nested_agent_depth_configuration') is not null as exists\n  `;\n  if (!relation?.exists) return;\n  await sql`\n    insert into \"nested_agent_depth_configuration\" (\n      \"singleton\", \"max_nested_agent_depth\", \"policy_source\", \"updated_at\"\n    ) values (true, ${policy.maxNestedAgentDepth}, ${policy.source}, now())\n    on conflict (\"singleton\") do update\n    set \"max_nested_agent_depth\" = excluded.\"max_nested_agent_depth\",\n        \"policy_source\" = excluded.\"policy_source\",\n        \"updated_at\" = now()\n    where \"nested_agent_depth_configuration\".\"max_nested_agent_depth\"\n            is distinct from excluded.\"max_nested_agent_depth\"\n       or \"nested_agent_depth_configuration\".\"policy_source\"\n            is distinct from excluded.\"policy_source\"\n  `;\n}\n\n/**\n * Apply the OpenGeni SQL migration chain.\n *\n * STANDALONE (default, unchanged): `migrate()` / `migrate(databaseUrl)` runs the\n * whole chain with NO search_path manipulation, so every unqualified\n * table/index/policy lands in the server default schema (`public`). This is the\n * byte-for-byte historical behavior — the migration test suite calls\n * `migrate(DB_URL)` and is unaffected.\n *\n * EMBEDDED SCHEMA MODE: pass a `schema` (or set\n * `OPENGENI_DB_SCHEMA`). The migrate session then `CREATE SCHEMA IF NOT EXISTS`\n * for both `<schema>` and `opengeni_private`, and sets\n * `search_path = \"<schema>\", \"opengeni_private\", \"public\"`, so EVERY unqualified\n * DDL statement lands in the dedicated schema with NO per-statement SQL rewrite\n * (the schema-isolation contract). Two things make this work and stay idempotent:\n *   1. The policy-existence guards in the migration SQL use `current_schema()`\n *      (not a hardcoded `'public'`) — so a re-run finds the policy it already\n *      created in `<schema>` and DROP/CREATEs idempotently instead of failing\n *      with \"policy already exists\". (This guard substitution is the migrate-\n *      time enabler for the runtime search_path approach; without it the SDK\n *      entry point silently fails on re-run — the migration replay hazard.)\n *   2. `public` stays LAST on the path so `gen_random_uuid()` (pgcrypto) and the\n *      `vector` type — both installed into `public` by 0000 — still resolve. The\n *      `opengeni_private.*` helpers are always called with an absolute prefix.\n * Dedicated-schema callers must also pass the exact API/worker database login\n * identities in `applicationDatabaseRoles`; maintenance cutovers cannot infer\n * host-managed or scoped runtime roles from the admin connection.\n *\n * `OPENGENI_DB_SCHEMA` defaults UNSET → `public` → standalone, so the default\n * binding never regresses.\n */\nexport async function migrate(\n  databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_URL ??\n    DEFAULT_DATABASE_URL,\n  schema: string | undefined = process.env.OPENGENI_DB_SCHEMA?.trim() || undefined,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), \"../drizzle\");\n  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(\".sql\")).sort();\n  const depthPolicy = deploymentDepthPolicy(runtimeOptions);\n  const sql = postgres(databaseUrl, { max: 1 });\n  try {\n    // Serialize concurrent migrate() runs; the session-level lock is released\n    // when the connection closes.\n    await sql`SELECT pg_advisory_lock(727458)`;\n    if (schema) {\n      assertIdentifier(\"OPENGENI_DB_SCHEMA\", schema);\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"${schema}\"`);\n      // opengeni_private is also created by 0001 with an absolute prefix, but the\n      // session search_path must already resolve it for the policy predicates\n      // and the SECURITY DEFINER functions that inherit the caller's path.\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"opengeni_private\"`);\n      await sql.unsafe(`SET search_path = \"${schema}\", \"opengeni_private\", \"public\"`);\n    }\n    await sql`select set_config('opengeni.max_nested_agent_depth', ${String(depthPolicy.maxNestedAgentDepth)}, false)`;\n    await sql`select set_config('opengeni.nested_agent_depth_policy_source', ${depthPolicy.source}, false)`;\n    await sql.unsafe(\n      `CREATE TABLE IF NOT EXISTS \"schema_migrations\" (\"name\" text PRIMARY KEY, \"applied_at\" timestamptz NOT NULL DEFAULT now())`,\n    );\n    const appliedRows = await sql`SELECT \"name\" FROM \"schema_migrations\"`;\n    const applied = new Set(appliedRows.map((row) => row.name as string));\n    const pendingMigrationSources = new Map<string, string>();\n    for (const file of files) {\n      if (!applied.has(file)) {\n        pendingMigrationSources.set(file, await readFile(join(migrationsDir, file), \"utf8\"));\n      }\n    }\n    // Initialize this session GUC for every pending migration that consumes it,\n    // instead of maintaining a second filename list that can silently lag the\n    // shipped migration chain. The conservative source marker is intentional:\n    // setting the bounded role list for a migration that only mentions the GUC\n    // is harmless, while omitting it makes an otherwise valid upgrade fail.\n    if (\n      Array.from(pendingMigrationSources.values()).some((source) =>\n        source.includes(MIGRATION_APPLICATION_ROLES_SETTING),\n      )\n    ) {\n      const applicationRoles = migrationApplicationRoles(schema, runtimeOptions);\n      await sql`select set_config(\n        ${MIGRATION_APPLICATION_ROLES_SETTING},\n        ${JSON.stringify(applicationRoles)},\n        false\n      )`;\n    }\n    for (const file of files) {\n      if (applied.has(file)) {\n        continue;\n      }\n      const sqlText = pendingMigrationSources.get(file);\n      if (sqlText === undefined) {\n        throw new Error(`Pending migration source was not loaded: ${file}`);\n      }\n      await executeMigrationFile(sql, file, sqlText);\n      await sql`INSERT INTO \"schema_migrations\" (\"name\") VALUES (${file}) ON CONFLICT DO NOTHING`;\n    }\n    // Reconcile even when all migration names were already recorded. This is\n    // the only supported way to change deployment policy in a live database.\n    await persistDeploymentDepthPolicy(sql, depthPolicy);\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * SDK entry point (Step I): run the migration chain over a host-supplied admin\n * connection string against an explicit target schema. This is the embedded\n * topology's named entry — a host calls `runMigrations(adminConnection,\n * targetSchema, { applicationDatabaseRoles })` from its own provisioning code\n * instead of relying on env vars.\n * `targetSchema` undefined → `public` → standalone behavior. Thin wrapper over\n * `migrate` so there is one migration engine.\n */\nexport async function runMigrations(\n  adminConnection: string,\n  targetSchema?: string,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  await migrate(adminConnection, targetSchema, runtimeOptions);\n}\n\nif (import.meta.main) {\n  await migrate();\n  console.log(\"Applied Drizzle SQL migrations.\");\n}\n","export type BatchedBackfillTransactionLocalSetting = {\n  guc: `opengeni.${string}`;\n  value: string;\n};\n\n/**\n * Exact owner-capability settings established before one governed batched\n * backfill statement. Keep this closed by migration filename: these GUCs may\n * open a FORCE-RLS policy arm and must never become ambient migration state.\n */\nexport function batchedBackfillTransactionLocalSetting(\n  file: string,\n): BatchedBackfillTransactionLocalSetting | null {\n  if (file === \"0411_new_session_draft_project_provenance_backfill.sql\") {\n    return {\n      guc: \"opengeni.new_session_draft_project_provenance_backfill_v1\",\n      value: \"1\",\n    };\n  }\n  return null;\n}\n"],"mappings":";AAAA,SAAS,SAAS,gBAAgB;AAClC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,OAAO,cAAc;;;ACOd,SAAS,uCACd,MAC+C;AAC/C,MAAI,SAAS,0DAA0D;AACrE,WAAO;AAAA,MACL,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;;;ADdA,IAAM,uBAAuB;AAC7B,IAAM,iCAAiC;AACvC,IAAM,yBAAyB;AAC/B,IAAM,oCAAoC;AAC1C,IAAM,sCAAsC;AAC5C,IAAM,kCAAkC;AACxC,IAAM,2BACJ;AACF,IAAM,2BAA2B;AACjC,IAAM,2BACJ;AACF,IAAM,0CAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA0BD,SAAS,iBAAiB,MAAc,OAAuB;AAC7D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,wCAAwC,KAAK,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAoBO,SAAS,8BACd,MACA,SACiC;AACjC,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,YAAY,MAAM,CAAC,GAAG,KAAK,KAAK;AACtC,QAAM,qBAAqB,gDAAgD,KAAK,SAAS;AACzF,QAAM,iBAAiB,qBAAqB,IAAI;AAChD,QAAM,gBAAgB,MAAM,cAAc,GAAG,KAAK,KAAK;AACvD,QAAM,YAAY,yBAAyB,KAAK,aAAa;AAC7D,MAAI,CAAC,WAAW;AACd,QAAI,cAAc,WAAW,cAAc,GAAG;AAC5C,YAAM,IAAI,MAAM,+CAA+C,IAAI,EAAE;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,UAAU,CAAC;AAC/B,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,kBAAkB,yBAAyB,KAAK,wBAAwB;AAC9E,MAAI,CAAC,mBAAmB,yBAAyB,SAAS,GAAG,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,kBAAkB,gBAAgB,CAAC,MAAM;AAC/C,MAAI,CAAC,mBAAmB,CAAC,wCAAwC,IAAI,IAAI,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY,gBAAgB,CAAC,KAAK,gBAAgB,CAAC,GAAI,WAAW,MAAM,GAAG;AAAA,IAC3E;AAAA,IACA,eAAe,CAAC;AAAA,IAChB;AAAA,EACF;AACF;AAEO,SAAS,8BACd,MACA,SACgG;AAChG,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,iBAAiB,gDAAgD;AAAA,IACrE,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,EACtB,IACI,IACA;AACJ,QAAM,YAAY,yBAAyB,KAAK,MAAM,cAAc,GAAG,KAAK,KAAK,EAAE;AACnF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,WAAW,IAAI,CAAC,EAC9C,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,YAAY,OAAO,UAAU,CAAC,CAAE;AACtC,MACE,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAY,KACZ,YAAY,OACZ,CAAC,YAAY,KAAK,wBAAwB,KAC1C,CAAC,eAAe,KAAK,wBAAwB,KAC7C,CAAC,kBAAkB,KAAK,wBAAwB,KAChD,CAAC,IAAI,OAAO,eAAe,SAAS,OAAO,GAAG,EAAE,KAAK,wBAAwB,KAC7E,yBAAyB,SAAS,GAAG,GACrC;AACA,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,UAAU,CAAC;AAAA,IACxB,kBAAkB,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,eAAe,qBACb,KACA,MACA,SACe;AACf,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,iBAAiB;AACnB,UAAM,wCAAwC,gBAAgB,WAAW;AACzE,UAAM,6CAA6C,gBAAgB,gBAAgB;AACnF,QAAI;AACF,iBAAS;AACP,cAAM,SAAS,MAAM,IAAI,MAAM,OAAO,gBAAgB;AACpD,gBAAM,0BAA0B,uCAAuC,IAAI;AAC3E,gBAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAON,cAAI,yBAAyB;AAC3B,kBAAM;AAAA,gBACF,wBAAwB,GAAG;AAAA,gBAC3B,wBAAwB,KAAK;AAAA;AAAA;AAAA,UAGnC;AACA,iBAAO,MAAM,YAAY,OAAO,gBAAgB,SAAS;AAAA,QAC3D,CAAC;AACD,YAAI,OAAO,WAAW,EAAG;AAAA,MAC3B;AAAA,IACF,UAAE;AACA,YAAM;AACN,YAAM;AAAA,IACR;AACA;AAAA,EACF;AACA,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,CAAC,iBAAiB;AAQpB,UAAM,IAAI;AAAA,MACR;AAAA;AAAA;AAAA,EAEiF,OAAO;AAAA,IAC1F;AACA;AAAA,EACF;AAEA,QAAM,wCAAwC,gBAAgB,WAAW;AACzE,MAAI;AACF,UAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,2DAK8B,gBAAgB,SAAS;AAAA;AAEhF,QAAI,aAAa,CAAC,SAAS,SAAS,CAAC,SAAS,QAAQ;AACpD,YAAM,kBAAkB,IAAI,gBAAgB,UAAU,WAAW,KAAK,IAAI,CAAC;AAC3E,YAAM,IAAI,OAAO,2BAA2B,eAAe,EAAE;AAAA,IAC/D,WAAW,YAAY,gBAAgB,eAAe;AACpD;AAAA,IACF;AACA,UAAM,IAAI,OAAO,gBAAgB,SAAS;AAAA,EAC5C,UAAE;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,sBACP,SACuB;AACvB,QAAM,MACJ,YAAY,SACR,QAAQ,IAAI,iCAAiC,KAAK,KAAK,SACvD,QAAQ;AACd,MAAI,QAAQ,QAAW;AACrB,WAAO,EAAE,qBAAqB,gCAAgC,QAAQ,UAAU;AAAA,EAClF;AACA,QAAM,QAAQ,OAAO,QAAQ,WAAW,MAAM,OAAO,GAAG;AACxD,MACE,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ,0BACP,OAAO,QAAQ,YAAY,CAAC,oBAAoB,KAAK,GAAG,GACzD;AACA,UAAM,IAAI;AAAA,MACR,0EAA0E,GAAG;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,EAAE,qBAAqB,OAAO,QAAQ,aAAa;AAC5D;AAEO,SAAS,0BACd,QACA,SACU;AACV,QAAM,aAAa,SAAS;AAC5B,QAAM,cAAc,QAAQ,IAAI,+CAA+C,KAAK;AACpF,QAAM,WACJ,eAAe,SACX,aACA,cACE,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,IAChD;AAER,MAAI,CAAC,UAAU;AACb,UAAM,yBAAyB;AAAA,MAC7B,QAAQ,IAAI,4BAA4B,KAAK;AAAA,MAC7C,QAAQ,IAAI,gCAAgC,KAAK;AAAA,IACnD,EAAE,OAAO,CAAC,SAAyB,QAAQ,IAAI,KAAK,SAAS,iCAAiC;AAC9F,QAAI,UAAU,uBAAuB,SAAS,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,WAAO,CAAC,iCAAiC;AAAA,EAC3C;AAEA,MACE,eAAe,UACf,WAAW,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,SAAS,KAAK,KAAK,CAAC,GAC1E;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,SAAS,KAAK,SAAS,SAAS,iCAAiC;AAC5E,UAAM,IAAI;AAAA,MACR,uDAAuD,+BAA+B;AAAA,IACxF;AAAA,EACF;AACA,QAAM,aAAa,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE;AAAA,IAAK,CAAC,MAAM,UACpD,OAAO,QAAQ,OAAO,KAAK,MAAM,MAAM,GAAG,OAAO,KAAK,OAAO,MAAM,CAAC;AAAA,EACtE;AACA,MACE,WAAW,WAAW,SAAS,UAC/B,WAAW,KAAK,CAAC,SAAS,KAAK,WAAW,KAAK,OAAO,WAAW,MAAM,MAAM,IAAI,EAAE,GACnF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,6BACb,KACA,QACe;AACf,QAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAGzB,MAAI,CAAC,UAAU,OAAQ;AACvB,QAAM;AAAA;AAAA;AAAA,sBAGc,OAAO,mBAAmB,KAAK,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlE;AAiCA,eAAsB,QACpB,cAAc,QAAQ,IAAI,oCACxB,QAAQ,IAAI,yBACZ,sBACF,SAA6B,QAAQ,IAAI,oBAAoB,KAAK,KAAK,QACvE,gBACe;AACf,QAAM,gBAAgB,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,YAAY;AAChF,QAAM,SAAS,MAAM,QAAQ,aAAa,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AAC1F,QAAM,cAAc,sBAAsB,cAAc;AACxD,QAAM,MAAM,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AAC5C,MAAI;AAGF,UAAM;AACN,QAAI,QAAQ;AACV,uBAAiB,sBAAsB,MAAM;AAC7C,YAAM,IAAI,OAAO,gCAAgC,MAAM,GAAG;AAI1D,YAAM,IAAI,OAAO,gDAAgD;AACjE,YAAM,IAAI,OAAO,sBAAsB,MAAM,iCAAiC;AAAA,IAChF;AACA,UAAM,2DAA2D,OAAO,YAAY,mBAAmB,CAAC;AACxG,UAAM,qEAAqE,YAAY,MAAM;AAC7F,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,UAAU,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAc,CAAC;AACpE,UAAM,0BAA0B,oBAAI,IAAoB;AACxD,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,gCAAwB,IAAI,MAAM,MAAM,SAAS,KAAK,eAAe,IAAI,GAAG,MAAM,CAAC;AAAA,MACrF;AAAA,IACF;AAMA,QACE,MAAM,KAAK,wBAAwB,OAAO,CAAC,EAAE;AAAA,MAAK,CAAC,WACjD,OAAO,SAAS,mCAAmC;AAAA,IACrD,GACA;AACA,YAAM,mBAAmB,0BAA0B,QAAQ,cAAc;AACzE,YAAM;AAAA,UACF,mCAAmC;AAAA,UACnC,KAAK,UAAU,gBAAgB,CAAC;AAAA;AAAA;AAAA,IAGtC;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,IAAI,IAAI,GAAG;AACrB;AAAA,MACF;AACA,YAAM,UAAU,wBAAwB,IAAI,IAAI;AAChD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI,MAAM,4CAA4C,IAAI,EAAE;AAAA,MACpE;AACA,YAAM,qBAAqB,KAAK,MAAM,OAAO;AAC7C,YAAM,uDAAuD,IAAI;AAAA,IACnE;AAGA,UAAM,6BAA6B,KAAK,WAAW;AAAA,EACrD,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAWA,eAAsB,cACpB,iBACA,cACA,gBACe;AACf,QAAM,QAAQ,iBAAiB,cAAc,cAAc;AAC7D;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,QAAQ;AACd,UAAQ,IAAI,iCAAiC;AAC/C;","names":[]}

package/dist/{chunk-P6NSEG2S.js → chunk-B5Y3TCSP.js}

@@ -5,7 +5,7 @@ import {
   withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-UFAMOUWL.js";
+} from "./chunk-XIYAXH47.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -481,4 +481,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-P6NSEG2S.js.map
+//# sourceMappingURL=chunk-B5Y3TCSP.js.map

package/dist/{chunk-CJROYHSC.js → chunk-CQF6G4IF.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-UFAMOUWL.js";
+} from "./chunk-XIYAXH47.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-QM6YOWHZ.js";
+} from "./chunk-PWJJKCTF.js";
 
 // src/video-generation.ts
 import {
@@ -992,4 +992,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-CJROYHSC.js.map
+//# sourceMappingURL=chunk-CQF6G4IF.js.map