@opengeni/db 4.4.1 → 4.5.0

package/dist/chunk-JN2DIKGW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/provision-roles.ts","../src/runtime-posture.ts","../src/runtime-posture-legacy-routines.json","../src/role-relationships.ts"],"sourcesContent":["import postgres from \"postgres\";\nimport { databaseBootConnectOptions } from \"./boot-connect\";\nimport type { RlsStrategy } from \"./database\";\nimport {\n  RUNTIME_FULL_DML_TABLES,\n  RUNTIME_READ_INSERT_TABLES,\n  RUNTIME_READ_INSERT_UPDATE_TABLES,\n  RUNTIME_READ_ONLY_TABLES,\n  RUNTIME_READ_UPDATE_TABLES,\n  SUBSCRIPTION_CUTOVER_READ_ONLY_TABLES,\n  VAULT_RUNTIME_ROUTINES,\n  VAULT_TABLES,\n  WORK_CLAIM_CAPABILITY_ROUTINES,\n  SUBSCRIPTION_SNAPSHOT_VALIDATOR_ROUTINES,\n  SUBSCRIPTION_CODEX_TWIN_PRIVATE_ROUTINES,\n  SUBSCRIPTION_RETIRED_ROUTINES,\n  SUBSCRIPTION_RENAMED_ROUTINES,\n  SUBSCRIPTION_PLAN_RUNTIME_ROUTINES,\n  BILLING_SUBSCRIPTION_OPERATION_ROUTINES,\n  MAINTENANCE_PROBE_OWNER_ROUTINES,\n} from \"./runtime-posture\";\nimport {\n  classifyRoleRelationships,\n  roleRelationshipsCatalogQuery,\n  type RoleRelationshipCatalogRow,\n} from \"./role-relationships\";\n\nexport type ProvisionResult = {\n  appRole: string | null;\n  artifactOutboxDispatcherRole: string | null;\n  artifactMaterializerRole: string | null;\n  hostExportRole: string | null;\n  temporalRole: string | null;\n  temporalDatabases: string[];\n  schema: string;\n  rlsStrategy: RlsStrategy;\n};\n\nexport type ProvisionRolesOptions = {\n  /**\n   * The schema Opengeni's tables live in. The app-role GRANTs target this\n   * schema + `opengeni_private`. Defaults to `public` (standalone).\n   */\n  targetSchema?: string;\n  /**\n   * RLS posture (Step I). `\"force\"` (default) provisions the non-owner\n   * `opengeni_app` login role and GRANTs it table DML in the target schema —\n   * the role Opengeni connects as under FORCE-RLS. `\"scoped\"` SKIPS the app-role\n   * provisioning entirely: the embedded host runs Opengeni's queries over a role\n   * IT owns/manages (typically the schema owner), so Opengeni neither creates\n   * nor grants the `opengeni_app` role. Temporal-role provisioning is unaffected\n   * by strategy.\n   */\n  rlsStrategy?: RlsStrategy;\n  appRole?: string;\n  appPassword?: string;\n  /** Global, EXECUTE-only artifact live-hint dispatcher capability. */\n  artifactOutboxDispatcherRole?: string;\n  artifactOutboxDispatcherPassword?: string;\n  /** Global, EXECUTE-only artifact materialization worker capability. */\n  artifactMaterializerRole?: string;\n  artifactMaterializerPassword?: string;\n  /**\n   * Optional cross-workspace projection role. It receives schema USAGE and\n   * EXECUTE only on the host-export API; it receives no table privileges.\n   * Provision it after the first migration run so the schema exists. The\n   * provisioner also registers same-owner default privileges for future\n   * host-export functions; shipped migrations preserve existing exporter ACLs\n   * when a migration-only upgrade adds a function.\n   */\n  hostExportRole?: string;\n  hostExportPassword?: string;\n  temporalRole?: string;\n  temporalPassword?: string;\n  temporalDatabases?: string[];\n};\n\n/**\n * SDK entry point (Step I): provision the Opengeni database roles + grants over\n * a host-supplied admin connection. This is the named, parameterized form of the\n * historical env-driven `provision-roles` script (which still works as a CLI via\n * the `import.meta.main` block at the bottom — it just reads env into these\n * options).\n *\n * STANDALONE (default): `provisionRoles(adminConnection)` with no options →\n * `targetSchema: \"public\"`, `rlsStrategy: \"force\"`, reads `opengeni_app` creds\n * from env. Byte-for-byte the historical script behavior.\n *\n * EMBEDDED: `provisionRoles(adminConnection, { targetSchema, rlsStrategy })` lets\n * a host provision the app role over a dedicated schema (force) OR skip the\n * app role entirely and own the connection role itself (scoped).\n */\nexport async function provisionRoles(\n  adminConnection: string,\n  options: ProvisionRolesOptions = {},\n): Promise<ProvisionResult> {\n  const schema = validateIdentifier(\"targetSchema\", options.targetSchema ?? \"public\");\n  const rlsStrategy: RlsStrategy = options.rlsStrategy ?? \"force\";\n\n  const appRole = validateIdentifier(\n    \"appRole\",\n    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || \"opengeni_app\"),\n  );\n  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;\n  const artifactOutboxDispatcherRole = validateIdentifier(\n    \"artifactOutboxDispatcherRole\",\n    options.artifactOutboxDispatcherRole ??\n      (process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_USER?.trim() ||\n        \"opengeni_artifact_outbox_dispatcher\"),\n  );\n  const artifactOutboxDispatcherPassword =\n    options.artifactOutboxDispatcherPassword ??\n    process.env.OPENGENI_ARTIFACT_OUTBOX_DATABASE_PASSWORD;\n  const artifactMaterializerRole = validateIdentifier(\n    \"artifactMaterializerRole\",\n    options.artifactMaterializerRole ??\n      (process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_USER?.trim() ||\n        \"opengeni_artifact_materializer\"),\n  );\n  const artifactMaterializerPassword =\n    options.artifactMaterializerPassword ??\n    process.env.OPENGENI_ARTIFACT_MATERIALIZER_DATABASE_PASSWORD;\n  const hostExportRole = validateIdentifier(\n    \"hostExportRole\",\n    options.hostExportRole ??\n      (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || \"opengeni_host_exporter\"),\n  );\n  const hostExportPassword =\n    options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;\n  const temporalRole = validateIdentifier(\n    \"temporalRole\",\n    options.temporalRole ??\n      (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || \"opengeni_temporal\"),\n  );\n  const temporalPassword =\n    options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;\n  const temporalDatabases = (\n    options.temporalDatabases ??\n    commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? \"temporal,temporal_visibility\")\n  ).map((name) => validateIdentifier(\"temporalDatabases\", name));\n\n  const sql = postgres(adminConnection, { max: 1, ...databaseBootConnectOptions(adminConnection) });\n  try {\n    // Converge PUBLIC drift even for dedicated-only/scoped provisioning. The\n    // ordinary app grant below includes these policy predicates; dedicated\n    // artifact roles must only receive their explicit entry points.\n    await sql.unsafe(`DO $maintenance_predicates$\n      DECLARE signature text;\n      BEGIN\n        FOREACH signature IN ARRAY ARRAY[\n          'opengeni_private.maintenance_claim_active(text,text)',\n          'opengeni_private.maintenance_title_event_visible(text,uuid)'\n        ] LOOP\n          IF to_regprocedure(signature) IS NOT NULL THEN\n            EXECUTE format('REVOKE EXECUTE ON FUNCTION %s FROM PUBLIC',signature);\n          END IF;\n        END LOOP;\n      END $maintenance_predicates$;`);\n    // FORCE strategy provisions the non-owner app role Opengeni connects as.\n    // SCOPED strategy: the host owns the connection role; Opengeni provisions no\n    // app role (skipped here), only the optional Temporal role.\n    let provisionedAppRole: string | null = null;\n    if (rlsStrategy === \"force\") {\n      if (!appPassword) {\n        throw new Error(\n          \"OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'\",\n        );\n      }\n      // Ownership and privilege-bearing role-graph edges cannot be safely\n      // guessed away. Refuse to mutate an existing role until an operator has\n      // explicitly transferred objects/removed those memberships; role\n      // attributes and direct grants, however, are deterministic and are\n      // converged below on every run. PostgreSQL 16+'s exact non-runtime-bearing\n      // creator-management edge is classified separately.\n      await assertAppRoleSafeToNormalize(sql, appRole);\n      await ensureRestrictedAppLoginRole(sql, appRole, appPassword);\n      provisionedAppRole = appRole;\n    }\n\n    let provisionedArtifactOutboxDispatcherRole: string | null = null;\n    if (artifactOutboxDispatcherPassword) {\n      await assertAppRoleSafeToNormalize(sql, artifactOutboxDispatcherRole);\n      await ensureRestrictedAppLoginRole(\n        sql,\n        artifactOutboxDispatcherRole,\n        artifactOutboxDispatcherPassword,\n      );\n      await grantArtifactCapabilityRoleIfSchemaExists(\n        sql,\n        artifactOutboxDispatcherRole,\n        schema,\n        \"outbox\",\n      );\n      provisionedArtifactOutboxDispatcherRole = artifactOutboxDispatcherRole;\n    }\n\n    let provisionedArtifactMaterializerRole: string | null = null;\n    if (artifactMaterializerPassword) {\n      await assertAppRoleSafeToNormalize(sql, artifactMaterializerRole);\n      await ensureRestrictedAppLoginRole(\n        sql,\n        artifactMaterializerRole,\n        artifactMaterializerPassword,\n      );\n      await grantArtifactCapabilityRoleIfSchemaExists(\n        sql,\n        artifactMaterializerRole,\n        schema,\n        \"materializer\",\n      );\n      provisionedArtifactMaterializerRole = artifactMaterializerRole;\n    }\n\n    if (temporalPassword) {\n      await ensureLoginRole(sql, temporalRole, temporalPassword);\n      for (const database of temporalDatabases) {\n        await ensureDatabase(sql, database, temporalRole);\n        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);\n      }\n    }\n\n    if (hostExportPassword) {\n      await ensureLoginRole(sql, hostExportRole, hostExportPassword);\n      await grantHostExportRoleIfSchemaExists(sql, hostExportRole);\n    }\n\n    if (rlsStrategy === \"force\") {\n      await grantAppRoleIfSchemaExists(sql, appRole, schema);\n    }\n\n    return {\n      appRole: provisionedAppRole,\n      artifactOutboxDispatcherRole: provisionedArtifactOutboxDispatcherRole,\n      artifactMaterializerRole: provisionedArtifactMaterializerRole,\n      hostExportRole: hostExportPassword ? hostExportRole : null,\n      temporalRole: temporalPassword ? temporalRole : null,\n      temporalDatabases: temporalPassword ? temporalDatabases : [],\n      schema,\n      rlsStrategy,\n    };\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * The exporter is intentionally separate from `opengeni_app`: its functions\n * project every workspace into a host-owned sink and therefore cannot be made\n * available to the tenant-scoped application role.\n */\nasync function grantHostExportRoleIfSchemaExists(sql: postgres.Sql, role: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function grantArtifactCapabilityRoleIfSchemaExists(\n  sql: postgres.Sql,\n  role: string,\n  dataSchema: string,\n  capability: \"outbox\" | \"materializer\",\n): Promise<void> {\n  const routines =\n    capability === \"outbox\"\n      ? [\n          \"claim_editable_artifact_live_outbox(text,integer,integer,name)\",\n          \"mark_editable_artifact_live_outbox_published(text,text,integer,name)\",\n          \"renew_editable_artifact_live_outbox(text,text,integer,integer,name)\",\n          \"retry_editable_artifact_live_outbox(text,text,integer,integer,text,name)\",\n          \"dead_letter_editable_artifact_live_outbox(text,text,integer,text,name)\",\n          \"release_editable_artifact_live_outbox(text,text,integer,name)\",\n        ]\n      : [\n          \"claim_editable_artifact_materializations(text,integer,integer,name)\",\n          \"renew_editable_artifact_materialization(uuid,uuid,text,text,text,integer,integer,name)\",\n          \"succeed_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,text,text,bigint,text,text,timestamp with time zone,name)\",\n          \"fail_editable_artifact_materialization(uuid,uuid,text,text,text,integer,text,name)\",\n        ];\n  const routineArray = `ARRAY[${routines.map(literal).join(\", \")}]`;\n  await sql.unsafe(`\nDO $$\nDECLARE routine_signature text;\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(dataSchema)})\n    AND EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private')\n  THEN\n    EXECUTE format('GRANT CONNECT ON DATABASE %I TO %I', current_database(), ${literal(role)});\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(dataSchema)}, ${literal(role)});\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format(\n      'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I',\n      ${literal(dataSchema)}, ${literal(role)}\n    );\n    EXECUTE format(\n      'REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I FROM %I',\n      ${literal(dataSchema)}, ${literal(role)}\n    );\n    EXECUTE format(\n      'REVOKE ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA opengeni_private FROM %I',\n      ${literal(role)}\n    );\n    FOREACH routine_signature IN ARRAY ${routineArray} LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',\n          routine_signature, ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureLoginRole(sql: postgres.Sql, role: string, password: string): Promise<void> {\n  await executeRoleConvergence(\n    sql,\n    `\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  ELSE\n    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  END IF;\nEND $$;\n`,\n  );\n}\n\nasync function ensureRestrictedAppLoginRole(\n  sql: postgres.Sql,\n  role: string,\n  password: string,\n): Promise<void> {\n  await executeRoleConvergence(\n    sql,\n    `\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format(\n      'CREATE ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',\n      ${literal(role)},\n      ${literal(password)}\n    );\n  ELSIF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND rolsuper) THEN\n    EXECUTE format(\n      'ALTER ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',\n      ${literal(role)},\n      ${literal(password)}\n    );\n  ELSE\n    -- PostgreSQL requires elevated attributes merely to name SUPERUSER,\n    -- BYPASSRLS, REPLICATION, or CREATEDB in ALTER ROLE, even when setting them\n    -- false. The preflight has already proved those protected attributes are\n    -- false, so a managed CREATEROLE administrator converges only the\n    -- attributes it may change.\n    EXECUTE format(\n      'ALTER ROLE %I WITH LOGIN NOCREATEROLE NOINHERIT PASSWORD %L',\n      ${literal(role)},\n      ${literal(password)}\n    );\n  END IF;\nEND $$;\n`,\n  );\n}\n\nconst ROLE_CONVERGENCE_MAX_ATTEMPTS = 20;\n\nfunction isRetryableConcurrentRoleMutation(error: unknown): boolean {\n  const details = error as {\n    code?: unknown;\n    message?: unknown;\n    routine?: unknown;\n  };\n  return (\n    (details.code === \"XX000\" &&\n      details.message === \"tuple concurrently updated\" &&\n      details.routine === \"simple_heap_update\") ||\n    (details.code === \"42710\" &&\n      typeof details.message === \"string\" &&\n      /^role \".+\" already exists$/u.test(details.message))\n  );\n}\n\nasync function executeRoleConvergence(sql: postgres.Sql, statement: string): Promise<void> {\n  // Roles live in a cluster-global catalog. Two otherwise independent\n  // databases can therefore race an identical CREATE/ALTER during parallel\n  // deployment or test setup. PostgreSQL exposes no cross-database advisory\n  // lock, so retry only its exact concurrent-catalog outcomes and keep every\n  // other provisioning failure immediate.\n  for (let attempt = 1; attempt <= ROLE_CONVERGENCE_MAX_ATTEMPTS; attempt += 1) {\n    try {\n      await sql.unsafe(statement);\n      return;\n    } catch (error) {\n      if (!isRetryableConcurrentRoleMutation(error) || attempt === ROLE_CONVERGENCE_MAX_ATTEMPTS) {\n        throw error;\n      }\n      await new Promise((resolve) => setTimeout(resolve, Math.min(25 * attempt, 250)));\n    }\n  }\n}\n\n/**\n * Fail rather than silently revoking role relationships or transferring owned\n * objects. Those operations have effects outside Opengeni's runtime grant\n * contract and require an explicit, audited operator decision.\n */\nasync function assertAppRoleSafeToNormalize(sql: postgres.Sql, role: string): Promise<void> {\n  const exists = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_roles where rolname = ${role}) as exists\n  `;\n  if (!exists[0]?.exists) {\n    return;\n  }\n\n  const [roleAttributes] = await sql<\n    {\n      administrator_superuser: boolean;\n      app_superuser: boolean;\n      app_bypass_rls: boolean;\n      app_create_database: boolean;\n      app_replication: boolean;\n    }[]\n  >`\n    select\n      administrator.rolsuper as administrator_superuser,\n      app.rolsuper as app_superuser,\n      app.rolbypassrls as app_bypass_rls,\n      app.rolcreatedb as app_create_database,\n      app.rolreplication as app_replication\n    from pg_roles app\n    join pg_roles administrator on administrator.rolname = current_user\n    where app.rolname = ${role}\n  `;\n  if (roleAttributes && !roleAttributes.administrator_superuser) {\n    const protectedAttributes = [\n      roleAttributes.app_superuser ? \"SUPERUSER\" : null,\n      roleAttributes.app_bypass_rls ? \"BYPASSRLS\" : null,\n      roleAttributes.app_create_database ? \"CREATEDB\" : null,\n      roleAttributes.app_replication ? \"REPLICATION\" : null,\n    ].filter((attribute): attribute is string => attribute !== null);\n    if (protectedAttributes.length > 0) {\n      throw new Error(\n        `Refusing to normalize app role ${role}: a non-superuser administrator cannot clear protected attributes (${protectedAttributes.join(\", \")})`,\n      );\n    }\n  }\n\n  const relationshipRows = await sql.unsafe<RoleRelationshipCatalogRow[]>(\n    roleRelationshipsCatalogQuery(\"$1\"),\n    [role],\n  );\n  const { unsafeRelationships } = classifyRoleRelationships(relationshipRows);\n  if (unsafeRelationships.length > 0) {\n    throw new Error(\n      `Refusing to normalize app role ${role}: remove privilege-bearing role relationships first (${unsafeRelationships.join(\", \")})`,\n    );\n  }\n\n  const ownedObjects = await sql<{ object_name: string }[]>`\n    select ('database:' || d.datname)::text as object_name\n    from pg_database d\n    join pg_roles owner on owner.oid = d.datdba\n    where owner.rolname = ${role}\n    union all\n    select ('schema:' || n.nspname)::text as object_name\n    from pg_namespace n\n    join pg_roles owner on owner.oid = n.nspowner\n    where owner.rolname = ${role}\n      and n.nspname <> 'information_schema'\n      and n.nspname !~ '^pg_'\n    union all\n    select ('relation:' || n.nspname || '.' || c.relname)::text as object_name\n    from pg_class c\n    join pg_namespace n on n.oid = c.relnamespace\n    join pg_roles owner on owner.oid = c.relowner\n    where owner.rolname = ${role}\n      and n.nspname <> 'information_schema'\n      and n.nspname !~ '^pg_'\n    union all\n    select (\n      'routine:' || n.nspname || '.' || p.proname || '(' ||\n      pg_get_function_identity_arguments(p.oid) || ')'\n    )::text as object_name\n    from pg_proc p\n    join pg_namespace n on n.oid = p.pronamespace\n    join pg_roles owner on owner.oid = p.proowner\n    where owner.rolname = ${role}\n      and n.nspname <> 'information_schema'\n      and n.nspname !~ '^pg_'\n    order by object_name\n  `;\n  if (ownedObjects.length > 0) {\n    throw new Error(\n      `Refusing to normalize app role ${role}: transfer owned objects first (${ownedObjects\n        .map((row) => row.object_name)\n        .join(\", \")})`,\n    );\n  }\n}\n\nasync function ensureDatabase(sql: postgres.Sql, database: string, owner: string): Promise<void> {\n  const existing = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_database where datname = ${database}) as exists\n  `;\n  if (!existing[0]?.exists) {\n    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);\n  }\n  await sql.unsafe(\n    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`,\n  );\n}\n\nasync function grantTemporalRoleInDatabase(\n  adminConnection: string,\n  database: string,\n  role: string,\n): Promise<void> {\n  const databaseUrl = databaseUrlFor(adminConnection, database);\n  const databaseSql = postgres(databaseUrl, { max: 1, ...databaseBootConnectOptions(databaseUrl) });\n  try {\n    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);\n  } finally {\n    await databaseSql.end();\n  }\n}\n\n/**\n * Grant the app role table DML in the Opengeni data schema + EXECUTE on the\n * `opengeni_private` helper functions. Schema-parameterized (Step I): standalone\n * passes `public`; embedded passes the dedicated schema. The grants are guarded\n * on schema existence so provisioning before migrate is a safe no-op.\n */\nasync function grantAppRoleIfSchemaExists(\n  sql: postgres.Sql,\n  role: string,\n  schema: string,\n): Promise<void> {\n  const runtimeFullDmlTables = `ARRAY[${RUNTIME_FULL_DML_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadOnlyTables = `ARRAY[${RUNTIME_READ_ONLY_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadUpdateTables = `ARRAY[${RUNTIME_READ_UPDATE_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(\", \")}]`;\n  const runtimeReadInsertUpdateTables = `ARRAY[${RUNTIME_READ_INSERT_UPDATE_TABLES.map(literal).join(\", \")}]`;\n  // (provider, table) pairs: read-only once the provider's cutover receipt exists.\n  const cutoverReadOnlyTables = `ARRAY[${Object.entries(SUBSCRIPTION_CUTOVER_READ_ONLY_TABLES)\n    .flatMap(([provider, tables]) =>\n      tables.map((table) => `ARRAY[${literal(provider)}, ${literal(table)}]`),\n    )\n    .join(\", \")}]::text[][]`;\n  const workClaimCapabilityRoutines = `ARRAY[${WORK_CLAIM_CAPABILITY_ROUTINES.map(literal).join(\", \")}]`;\n  // Provisioning may run before retirement. Keep the old owner-only ACLs\n  // through the same atomic DO statement as the schema-wide EXECUTE grant;\n  // a later readiness failure cannot undo a committed privilege exposure.\n  // Derive the signatures from the retirement inventory, not a second list\n  // of dead names. After retirement these conditional revokes are no-ops.\n  const twins = new Set<string>(SUBSCRIPTION_CODEX_TWIN_PRIVATE_ROUTINES);\n  const retiringOwnerOnlyRoutines = `ARRAY[${[\n    ...SUBSCRIPTION_RETIRED_ROUTINES.filter(\n      ({ schema: home, signature }) =>\n        home !== \"target\" && !twins.has(signature) && !signature.endsWith(\"()\"),\n    ).map(({ schema: home, signature }) => `${home}.${signature}`),\n    ...SUBSCRIPTION_RENAMED_ROUTINES.map(({ schema: home, from }) => `${home}.${from}`),\n  ]\n    .map(literal)\n    .join(\", \")}]::text[]`;\n  const organizationMembershipLifecycleRoutines = `ARRAY[${[\n    \"maintain_usage_allowances(integer,integer)\",\n    \"usage_allowance_command(jsonb)\",\n    // Per-task usage limits: the runtime's only two entry points.\n    \"maintain_session_usage_limits(integer,integer)\",\n    \"session_usage_limit_command(jsonb)\",\n    \"ensure_external_identity(uuid,text,text)\",\n    \"lookup_external_identity(uuid,text,text,text)\",\n    \"prepare_external_workspace_membership_operation(jsonb)\",\n    \"record_external_workspace_membership_operation(jsonb,jsonb)\",\n    \"get_external_identity_link_reference(uuid,uuid,text)\",\n    \"get_external_identity_link_inventory_references(uuid,uuid[])\",\n    \"list_self_organization_memberships(text)\",\n    \"list_self_organization_invitations(text)\",\n    \"list_self_organization_invitations(text,uuid,integer)\",\n    \"get_self_organization_invitation(text,uuid)\",\n    \"list_organization_members(uuid,text)\",\n    \"list_organization_administration_members(uuid,text)\",\n    \"list_organization_invitations(uuid,text,uuid,integer)\",\n    \"get_organization_administration_overview(uuid,text)\",\n    \"get_workspace_kind(uuid,uuid)\",\n    \"resolve_workspace_codex_subscription_source(uuid,uuid)\",\n    \"capture_legacy_codex_turn_sources(uuid,uuid)\",\n    \"list_organization_workspace_ids(uuid)\",\n    \"list_organization_codex_workspace_ids(uuid)\",\n    \"list_organization_subscription_workspace_ids(uuid)\",\n    \"organization_workspace_command(jsonb)\",\n    \"authorize_organization_shared_workspace_administration(uuid,uuid,text)\",\n    \"resolve_organization_workspace_removal_subject(uuid,text,uuid)\",\n    \"prepare_organization_workspace_member_removal(jsonb)\",\n    \"record_organization_workspace_member_removal(jsonb,uuid,uuid)\",\n    \"create_additional_managed_organization(text,text,text,text,uuid)\",\n    \"create_managed_organization(text,text,text,uuid)\",\n    \"assert_organization_shared_workspace_administrator(uuid,uuid,text)\",\n    \"open_organization_shared_workspace_administration_capability(uuid,uuid,text)\",\n    \"close_organization_shared_workspace_administration_capability(uuid)\",\n    \"create_organization_shared_workspace(uuid,text,text,text,text,uuid)\",\n    \"upsert_organization_shared_workspace_member(uuid,uuid,text,uuid,text,text,jsonb,boolean)\",\n    \"update_organization_name(uuid,text,text,timestamptz,uuid)\",\n    \"create_organization_invitation_v2(jsonb)\",\n    \"bind_pending_organization_invitations_for_verified_email(text,text)\",\n    \"has_pending_organization_invitation_for_subject(text)\",\n    \"accept_organization_invitation_v2(jsonb)\",\n    \"complete_self_service_organization_setup(jsonb)\",\n    \"ensure_organization_user_setup_intent(jsonb)\",\n    \"claim_organization_user_setup_delivery(jsonb)\",\n    \"claim_organization_user_setup_delivery_v2(jsonb)\",\n    \"prepare_organization_user_setup_delivery(jsonb)\",\n    \"prepare_organization_user_setup_delivery_v2(jsonb)\",\n    \"settle_organization_user_setup_delivery(jsonb)\",\n    \"preview_organization_user_setup(text)\",\n    \"get_organization_invitation_for_administration(uuid,text,uuid)\",\n    \"preflight_organization_user_setup(text)\",\n    \"complete_organization_user_setup(jsonb)\",\n    \"organization_membership_command(jsonb)\",\n    \"prepare_organization_membership_protocol_settlements(jsonb)\",\n    \"assert_active_managed_human_organization_membership(uuid,text)\",\n    \"resolve_workspace_writer_grant_identity(uuid,text)\",\n    \"lock_live_native_original_origin_v2(jsonb)\",\n    \"modal_native_origin_member_read_active(uuid,text)\",\n    \"prepare_workspace_membership_removal_settlements(jsonb)\",\n    \"workspace_membership_removal_command(jsonb)\",\n    \"get_organization_retention_policy(uuid,text)\",\n    \"preview_organization_retention_deletions(uuid,integer)\",\n    \"claim_organization_retention_deletion(uuid,uuid,uuid[])\",\n    \"list_organization_retention_deletion_objects(uuid,uuid,uuid,text,integer)\",\n    \"record_organization_retention_object_deleted(uuid,uuid,uuid,text,text,text,text)\",\n    \"fail_organization_retention_deletion(uuid,uuid,uuid,text)\",\n    \"finalize_organization_retention_deletion(uuid,uuid,uuid,text)\",\n    \"complete_organization_retention_deletion(uuid,uuid,uuid,text)\",\n  ]\n    .map(literal)\n    .join(\", \")}]`;\n  const managedAuthSessionSetRoutines = `ARRAY[${[\n    \"assert_managed_sign_in_recovery(text,text,uuid,jsonb)\",\n    \"replay_managed_sign_in_method(text,text,jsonb)\",\n    \"claim_managed_sign_in_notification(uuid,text,text,integer)\",\n    \"settle_managed_sign_in_notification(uuid,uuid,text)\",\n    \"get_canonical_human_exact_login_binding(text,text)\",\n    \"managed_auth_session_set_authority_state(text)\",\n    \"managed_auth_session_set_snapshot(text,text,boolean,boolean,boolean)\",\n    \"managed_auth_session_set_bootstrap(text,text,text,text,uuid,text,bigint,bigint)\",\n    \"managed_auth_session_set_begin_transaction(text,text,text,uuid,text,bigint,uuid,bigint,text,text,uuid,uuid,text,timestamp with time zone)\",\n    \"managed_auth_session_set_complete_transaction(text,text,uuid,text,bigint,bigint,uuid,text,text,text)\",\n    \"managed_auth_session_set_mutate(text,text,uuid,text,bigint,bigint,text,uuid,uuid,uuid,text,text)\",\n    \"managed_auth_actor_mutation_fence(text,bigint,uuid)\",\n    \"managed_auth_actor_mutation_lease_acquire(text,bigint,uuid,integer)\",\n    \"managed_auth_actor_mutation_lease_release(text,uuid)\",\n    \"managed_auth_actor_mutation_lease_validate(text,bigint,uuid)\",\n    \"managed_auth_adopted_session_snapshot(text)\",\n    \"managed_auth_isolated_session_reap(integer)\",\n    \"managed_auth_expired_session_set_reap(integer)\",\n    \"managed_auth_session_set_operation_receipt(text,uuid,text,text)\",\n  ]\n    .map(literal)\n    .join(\", \")}]`;\n  const organizationRecoveryRoutines = `ARRAY[${[\n    \"get_organization_recovery_overview(uuid,text,jsonb,text,text)\",\n    \"organization_recovery_command(jsonb)\",\n  ]\n    .map(literal)\n    .join(\", \")}]`;\n  await sql.unsafe(`\nDO $$\nDECLARE\n  owner_role text := current_user;\n  runtime_table text;\n  cutover_pair text[];\n  cutover_committed boolean;\n  routine_signature text;\nBEGIN\n  EXECUTE format('REVOKE CREATE ON DATABASE %I FROM %I', current_database(), ${literal(role)});\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN\n    IF to_regprocedure(format('%I.mcp_operation_command(jsonb,text,jsonb)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.mcp_operation_command(jsonb,text,jsonb) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.mcp_operation_command(jsonb,text,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    IF to_regprocedure('opengeni_private.codex_credential_serves_turn(uuid,uuid,uuid,uuid)') IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.codex_credential_serves_turn(uuid,uuid,uuid,uuid) TO %I', ${literal(role)});\n    END IF;\n    EXECUTE format('REVOKE CREATE ON SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format('REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});\n    FOREACH runtime_table IN ARRAY ${runtimeFullDmlTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadOnlyTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadUpdateTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, UPDATE ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadInsertTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, INSERT ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH runtime_table IN ARRAY ${runtimeReadInsertUpdateTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT SELECT, INSERT, UPDATE ON TABLE %I.%I TO %I',\n          ${literal(schema)},\n          runtime_table,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- A provider's legacy subscription tables: full DML for an older binary\n    -- until its drained cutover receipt exists, then read-only forensics.\n    FOREACH cutover_pair SLICE 1 IN ARRAY ${cutoverReadOnlyTables} LOOP\n      IF to_regclass(format('%I.%I', ${literal(schema)}, cutover_pair[2])) IS NOT NULL THEN\n        -- Dynamic, so a database before 0712 (no receipt reader) plans this block.\n        cutover_committed := false;\n        IF to_regprocedure('opengeni_private.subscription_provider_cutover_committed(text)') IS NOT NULL THEN\n          EXECUTE 'SELECT opengeni_private.subscription_provider_cutover_committed($1)'\n            INTO cutover_committed USING cutover_pair[1];\n        END IF;\n        EXECUTE format(\n          CASE WHEN coalesce(cutover_committed, false)\n            THEN 'GRANT SELECT ON TABLE %I.%I TO %I'\n            ELSE 'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.%I TO %I' END,\n          ${literal(schema)},\n          cutover_pair[2],\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- Migration 0301 creates this target-schema capability before\n    -- opengeni_app exists on a fresh migrate-then-provision installation. Its\n    -- policy is evaluated for ordinary session-list snapshot writes, so the\n    -- runtime role must be able to execute the predicate even when no\n    -- visibility-transition capability is active. Re-converge the exact ACL\n    -- here and keep PUBLIC revoked.\n    IF to_regprocedure(\n      format('%I.session_visibility_lifecycle_capability_held()', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_visibility_lifecycle_capability_held() FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_visibility_lifecycle_capability_held() TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.usage_allowance_command(jsonb)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.usage_allowance_capability_active(uuid,uuid) TO PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.usage_allowance_period(jsonb,timestamptz), %I.count_workspace_allowance_debit() FROM %I', ${literal(schema)}, ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.capture_usage_allowance_attribution() FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.validate_usage_allowance_config(jsonb), %I.validate_usage_allowance_rule(jsonb), %I.emit_usage_allowance_notifications(uuid,uuid,jsonb,text,timestamptz,text) FROM %I', ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.capture_usage_allowance_period(uuid,uuid,jsonb,timestamptz) FROM %I',${literal(schema)},${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.usage_allowance_members(uuid,uuid), %I.usage_allowance_effective_period(uuid,jsonb,timestamptz) FROM %I',${literal(schema)},${literal(schema)},${literal(role)});\n      IF to_regprocedure(format('%I.reverse_video_allowance_refund()', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.reverse_video_allowance_refund() FROM %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      IF to_regprocedure(format('%I.count_unbilled_model_allowance_debit()', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.count_unbilled_model_allowance_debit() FROM %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      FOREACH runtime_table IN ARRAY ARRAY['workspace_usage_allowances','workspace_member_allowances',\n        'workspace_allowance_grants','workspace_allowance_counters','workspace_allowance_notifications','workspace_allowance_periods',\n        'workspace_video_allowance_allocations','usage_allowance_attribution_receipts',\n        'workspace_allowance_clear_receipts']\n      LOOP\n        EXECUTE format('REVOKE ALL ON TABLE opengeni_private.%I FROM %I',runtime_table,${literal(role)});\n        EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.%I FROM %I',\n          (SELECT string_agg(quote_ident(attname),',') FROM pg_attribute\n            WHERE attrelid=format('opengeni_private.%I',runtime_table)::regclass\n              AND attnum>0 AND NOT attisdropped),runtime_table,${literal(role)});\n      END LOOP;\n    END IF;\n    -- Per-task usage limits: only the command/maintenance entry\n    -- points are runtime-callable; helpers and private tables stay owner-only.\n    IF to_regprocedure(format('%I.session_usage_limit_command(jsonb)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.session_usage_limit_capability_active(uuid,uuid) TO PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.session_usage_limit_state(jsonb,boolean), %I.session_usage_limit_apply_receipt(uuid,uuid,uuid,text,uuid,uuid,bigint,text,text,text), %I.session_usage_limit_import_page(uuid,uuid,uuid,integer), %I.session_usage_limit_import_step(uuid,uuid,uuid,integer), %I.session_usage_limit_meter_amount(numeric,text,numeric,numeric), %I.session_usage_limit_event_amount(jsonb), %I.seed_session_usage_limit_root(), %I.meter_session_usage_limit_event() FROM %I',\n        ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)});\n      FOREACH runtime_table IN ARRAY ARRAY['session_usage_limit_roots','session_usage_limit_receipts',\n        'session_usage_limit_config_receipts','session_usage_limit_capabilities']\n      LOOP\n        EXECUTE format('REVOKE ALL ON TABLE opengeni_private.%I FROM %I',runtime_table,${literal(role)});\n        EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.%I FROM %I',\n          (SELECT string_agg(quote_ident(attname),',') FROM pg_attribute\n            WHERE attrelid=format('opengeni_private.%I',runtime_table)::regclass\n              AND attnum>0 AND NOT attisdropped),runtime_table,${literal(role)});\n      END LOOP;\n    END IF;\n    -- Migration 0300's tenancy backfill ledger seam has the same shape: its\n    -- own conditional GRANT block is skipped whenever opengeni_app does not\n    -- yet exist, and these three live in the data schema rather than\n    -- opengeni_private, so the blanket sweep above never reaches them.\n    -- Re-converge them here so migrate-then-provision matches the reverse\n    -- order; without this the \"only write path\" seam is unreachable on a\n    -- green-field database.\n    FOR routine_signature IN\n      SELECT unnest(ARRAY[\n        'open_tenancy_backfill_receipt(uuid, text, text)',\n        'record_tenancy_backfill_unresolved(uuid, uuid, text)',\n        'complete_tenancy_backfill_receipt(uuid, bigint, bigint, text)'\n      ])\n    LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature))\n        IS NOT NULL\n      THEN\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',\n          ${literal(schema)},\n          routine_signature,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- Migration 0291's classification assertion seam has the same shape: its\n    -- own conditional GRANT block is skipped whenever opengeni_app does not yet\n    -- exist, and it lives in the data schema rather than opengeni_private, so\n    -- the blanket sweep above never reaches it. (Its inner capability predicate\n    -- IS in opengeni_private and is covered by that sweep.)\n    IF to_regprocedure(\n      format(\n        '%I.verify_organization_resource_classification(uuid,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.verify_organization_resource_classification(uuid, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0297's session ownership seams have the same shape: their own\n    -- conditional GRANT block is skipped whenever opengeni_app does not yet\n    -- exist, and they live in the data schema rather than opengeni_private, so\n    -- the blanket sweep above never reaches them. (Their inner capability\n    -- predicate IS in opengeni_private and is covered by that sweep.)\n    IF to_regprocedure(\n      format(\n        '%I.classify_organization_session_ownership(uuid,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.classify_organization_session_ownership(uuid, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.backfill_organization_session_ownership(uuid,integer,boolean,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.backfill_organization_session_ownership(uuid, integer, boolean, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0340's bounded connection convergence and repaired parity\n    -- seams also live in the data schema. Converge their exact grants for the\n    -- supported migrate-then-provision order.\n    FOREACH routine_signature IN ARRAY ARRAY[\n      'classify_organization_connection_authority(uuid,text)',\n      'backfill_organization_connection_authority(uuid,integer,boolean)',\n      'inspect_organization_connection_authority_convergence(uuid,integer,uuid)',\n      'check_organization_tenancy_parity(uuid,integer,integer)'\n    ] LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature))\n        IS NOT NULL\n      THEN\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',\n          ${literal(schema)},\n          routine_signature,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    IF to_regclass(\n      format(\n        '%I.connection_authority_convergence_audit_capabilities',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL PRIVILEGES ON TABLE %I.connection_authority_convergence_audit_capabilities FROM %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0110 creates this target-schema-local SECURITY DEFINER\n    -- capability before opengeni_app may exist. Re-converge its exact EXECUTE\n    -- grant here so the supported migrate-then-provision order is equivalent to\n    -- provisioning the role before that migration.\n    IF to_regprocedure(\n      format('%I.lock_nested_agent_depth_configuration()', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.lock_nested_agent_depth_configuration() TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.preference_registry_apply_lifecycle(text,uuid,integer,uuid,uuid,text,uuid,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_apply_lifecycle(text, uuid, integer, uuid, uuid, text, uuid, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.skill_apply_lifecycle(uuid,uuid,jsonb,jsonb)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.skill_apply_lifecycle(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.skill_files_valid(jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(format('%I.knowledge_entry_apply(uuid,uuid,jsonb,jsonb)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_claim(text,integer,integer) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_work(uuid,uuid,uuid,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      IF to_regprocedure(format('%I.knowledge_index_billing_policy(uuid,uuid,uuid,text,timestamptz,bigint)', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_billing_policy(uuid,uuid,uuid,text,timestamptz,bigint) TO %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      IF to_regprocedure(format('%I.knowledge_index_wait_for_funding(uuid,uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_wait_for_funding(uuid,uuid,uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      IF to_regprocedure(format('%I.knowledge_index_paid_publication_guard(uuid,uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_paid_publication_guard(uuid,uuid,uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      IF to_regprocedure(format('%I.knowledge_visible_index_status(uuid,uuid,jsonb,jsonb,text)', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_visible_index_status(uuid,uuid,jsonb,jsonb,text) TO %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.agent_instruction_apply(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_apply(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_confirm_legacy(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_read(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_prepare_file(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_document_prepare(uuid,uuid,uuid,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.agent_learning_manage(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(\n      format('%I.preference_registry_lock_heads(uuid[])', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_lock_heads(uuid[]) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n\n\n    IF to_regprocedure(\n      format(\n        '%I.preference_registry_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0289 creates this definer accessor before opengeni_app may\n    -- exist, so its migration-time GRANT is skipped on the supported\n    -- migrate-then-provision order. Re-converge it here.\n    IF to_regprocedure(\n      format(\n        '%I.preference_registry_activation_authority(uuid,uuid[])',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_activation_authority(uuid, uuid[]) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.preference_registry_create_knowledge_proposal_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,uuid,text,text,text,text,integer,text,jsonb,timestamptz,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamptz, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.create_task_note_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.company_brain_context_get_or_create_selection(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.company_brain_inspect_context_receipts(uuid,uuid,text,uuid,timestamptz,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamptz, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Older-schema fixtures and the maintenance conversion can still prepare\n    -- historical evidence; current runtimes receive only the undo/read seam.\n    IF to_regclass(format('%I.knowledge_entries', ${literal(schema)})) IS NULL THEN\n    IF to_regprocedure(\n      format(\n        '%I.evaluate_governed_learning_proposal(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid,uuid,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.activate_governed_learning_decision(uuid,uuid,uuid,uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.activate_governed_learning_decision(uuid, uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.activate_human_confirmed_learning_decision(uuid,uuid,uuid,uuid,uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n\n\n    END IF;\n\n    IF to_regprocedure(\n      format('%I.undo_governed_learning_activation(uuid,uuid,uuid,uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.undo_governed_learning_activation(uuid, uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.inspect_governed_learning_decisions(uuid,uuid,text,integer)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.inspect_governed_learning_decisions(uuid, uuid, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.inspect_governed_learning_activations(uuid,uuid,text,integer)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.inspect_governed_learning_activations(uuid, uuid, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.inspect_governed_learning_activation_undos(uuid,uuid,text,integer)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.inspect_governed_learning_activation_undos(uuid, uuid, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.replace_task_note_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid,uuid,integer,text,text,integer,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.resolve_task_note_knowledge_promotion_source(uuid,uuid,uuid,uuid,uuid,integer,uuid,integer,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0365 creates the advisory work-claim mutation capabilities\n    -- before a custom runtime role may exist. Re-converge their exact grants\n    -- for migrate-then-provision installs without exposing claim history or\n    -- the write-capability ledger to direct runtime DML.\n    FOREACH routine_signature IN ARRAY ${workClaimCapabilityRoutines} LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',\n          ${literal(schema)}, routine_signature\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',\n          ${literal(schema)}, routine_signature, ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    IF to_regprocedure(\n      format(\n        '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_instruction_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.company_profile_apply_activation(uuid,text,uuid,uuid,uuid,uuid,bigint,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.company_profile_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.company_profile_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.company_profile_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.propose_company_profile_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.propose_company_profile_for_attempt_v2(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.confirm_company_profile_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.get_company_profile_agent_policy(uuid,uuid,text)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.get_company_profile_agent_policy(uuid, uuid, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.update_company_profile_agent_policy(uuid,uuid,text,text,bigint,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n\n    IF to_regprocedure(\n      format('%I.workspace_learning_policy_source_overrides_valid(jsonb)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_source_overrides_valid(jsonb) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.workspace_learning_policy_hash(text,jsonb)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_hash(text, jsonb) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.workspace_learning_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.workspace_learning_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.slack_task_policy_update(uuid,text,uuid,uuid,jsonb,uuid,bigint,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.slack_task_policy_update(uuid, text, uuid, uuid, jsonb, uuid, bigint, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_apply_lifecycle(uuid, text, uuid, text, bigint, text, text, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0197 creates this target-schema-local SECURITY DEFINER lock\n    -- before opengeni_app may exist. Re-converge only its exact EXECUTE grant\n    -- for the supported migrate-then-provision install order; keep PUBLIC\n    -- revoked and do not widen table privileges.\n    IF to_regprocedure(\n      format(\n        '%I.knowledge_source_sync_lock_authority(uuid,uuid,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.knowledge_source_sync_lock_authority(uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    -- Migration 0243 adds the exact Google Drive object authorization and\n    -- safe-citation projections. Re-converge both capabilities for the same\n    -- supported migrate-then-provision order without granting direct mutation\n    -- of their append-only ACL evidence tables.\n    IF to_regprocedure(\n      format(\n        '%I.google_drive_file_authorized(uuid,uuid,text,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.google_drive_file_authorized(uuid, uuid, text, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.google_drive_file_authorized(uuid, uuid, text, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.google_drive_document_citation(uuid,uuid,text,uuid,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.google_drive_document_citation(uuid, uuid, text, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.google_drive_document_citation(uuid, uuid, text, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.ensure_managed_human_personal_workspace(uuid,text,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    FOREACH routine_signature IN ARRAY ${organizationMembershipLifecycleRoutines} LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',\n          ${literal(schema)}, routine_signature\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',\n          ${literal(schema)}, routine_signature, ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    IF to_regprocedure(format('%I.ensure_canonical_human_identity(text,text)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.ensure_canonical_human_identity(text, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.ensure_canonical_human_identity(text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.validate_canonical_human_session(text,text,boolean)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.get_canonical_human_identity_projection(text)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.get_canonical_human_identity_projection(text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.get_canonical_human_identity_projection(text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.apply_canonical_human_identity_operation(uuid,text,bigint,text,uuid,text,text,text)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.mutate_managed_sign_in_method(text,text,jsonb)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.mutate_managed_sign_in_method(text,text,jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    FOREACH routine_signature IN ARRAY ${managedAuthSessionSetRoutines} LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',\n          ${literal(schema)}, routine_signature\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',\n          ${literal(schema)}, routine_signature, ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    FOREACH routine_signature IN ARRAY ${organizationRecoveryRoutines} LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',\n          ${literal(schema)}, routine_signature\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',\n          ${literal(schema)}, routine_signature, ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- Migration 0225 creates these target-schema-local session visibility\n    -- capabilities before opengeni_app may exist. Re-converge their exact\n    -- EXECUTE grants for migrate-then-provision installs without granting\n    -- blanket execution on target-schema routines.\n    IF to_regprocedure(\n      format(\n        '%I.session_private_actor_visible(uuid,uuid,uuid,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.session_reference_visible(uuid,uuid,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.session_private_actor_visible_keys()',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_private_actor_visible_keys() FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_private_actor_visible_keys() TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.transition_session_visibility(uuid,uuid,uuid,text,text,integer,text,text,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.session_visibility_change_blocker(uuid,uuid,uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_visibility_change_blocker(uuid, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_visibility_change_blocker(uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.session_visibility_foreign_authority_items(uuid,uuid,uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_visibility_foreign_authority_items(uuid, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_visibility_foreign_authority_items(uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,text,text,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.replay_applied_session_fork(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.fork_session_content_with_runtime(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,jsonb,uuid,uuid,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.fork_session_content_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, jsonb, uuid, uuid, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.fork_session_content_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, jsonb, uuid, uuid, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.replay_applied_session_fork_with_runtime(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.replay_applied_session_fork_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.replay_applied_session_fork_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.session_tenancy_product_activated(uuid,integer)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_tenancy_product_activated(uuid, integer) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_tenancy_product_activated(uuid, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.session_tenancy_any_product_activation() FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.session_tenancy_any_product_activation() TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean) FROM %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.get_private_session_create_policy(uuid,uuid,text)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.get_private_session_create_policy(uuid, uuid, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.get_private_session_create_policy(uuid, uuid, text) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.get_organization_private_session_settings(uuid,text)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.get_organization_private_session_settings(uuid, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.get_organization_private_session_settings(uuid, text) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.update_organization_private_session_settings(uuid,text,boolean,bigint,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.update_organization_private_session_settings(uuid, text, boolean, bigint, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.update_organization_private_session_settings(uuid, text, boolean, bigint, uuid) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.organization_private_sessions_enabled(uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.organization_private_sessions_enabled(uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.organization_private_sessions_enabled(uuid) FROM %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    -- The trial-credit kill switch setter is operator-only (migration owner).\n    -- Reprovisioning repairs any accidental runtime or PUBLIC grant.\n    IF to_regprocedure(format('%I.set_subscription_plan_catalog(jsonb,text,text)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.set_subscription_plan_catalog(jsonb,text,text) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.set_subscription_plan_catalog(jsonb,text,text) FROM %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    FOREACH routine_signature IN ARRAY ARRAY[${[...SUBSCRIPTION_PLAN_RUNTIME_ROUTINES, ...BILLING_SUBSCRIPTION_OPERATION_ROUTINES].map(literal).join(\", \")}] LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC', ${literal(schema)}, routine_signature);\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.%s TO %I', ${literal(schema)}, routine_signature, ${literal(role)});\n      END IF;\n    END LOOP;\n    FOREACH routine_signature IN ARRAY ARRAY['subscription_plan_definition(text)', 'plan_period_usage(' || quote_ident(${literal(schema)}) || '.plan_credit_periods,timestamptz)', 'plan_general_balance(uuid)', 'expire_refunded_plan_credit()', 'enforce_organization_plan_seats()'] LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.%s FROM PUBLIC', routine_signature);\n        EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.%s FROM %I', routine_signature, ${literal(role)});\n      END IF;\n    END LOOP;\n    IF to_regprocedure(format('%I.set_credit_promotion_policy(jsonb,text,text)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.set_credit_promotion_policy(jsonb,text,text) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.set_credit_promotion_policy(jsonb,text,text) FROM %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(\n      format('%I.set_verified_signup_trial_credits_enabled(boolean,text,text)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.set_verified_signup_trial_credits_enabled(boolean, text, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.set_verified_signup_trial_credits_enabled(boolean, text, text) FROM %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    -- The new-account sign-up switch setter is operator-only (migration owner).\n    IF to_regprocedure(\n      format('%I.set_managed_auth_new_signups_enabled(boolean,text,text)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.set_managed_auth_new_signups_enabled(boolean, text, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.set_managed_auth_new_signups_enabled(boolean, text, text) FROM %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.open_private_session_create_capability(uuid,uuid,uuid,text)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.open_private_session_create_capability(uuid, uuid, uuid, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.open_private_session_create_capability(uuid, uuid, uuid, text) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.close_private_session_create_capability(uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.close_private_session_create_capability(uuid) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.open_private_child_session_create_capability(uuid,uuid,uuid,uuid,uuid,uuid,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.open_private_child_session_create_capability(uuid,uuid,uuid,uuid,uuid,uuid,integer) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.open_private_child_session_create_capability(uuid,uuid,uuid,uuid,uuid,uuid,integer) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    -- 0851's migration grants the atomic agent-child creation seam only to\n    -- roles that existed then; a role provisioned later needs it here too.\n    IF to_regprocedure(\n      format(\n        '%I.create_agent_child_session(uuid,uuid,uuid,uuid,uuid,integer,jsonb)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.create_agent_child_session(uuid,uuid,uuid,uuid,uuid,integer,jsonb) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.create_agent_child_session(uuid,uuid,uuid,uuid,uuid,integer,jsonb) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    FOREACH routine_signature IN ARRAY ARRAY[${SUBSCRIPTION_SNAPSHOT_VALIDATOR_ROUTINES.map(literal).join(\", \")}] LOOP\n      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC', ${literal(schema)}, routine_signature);\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.%s TO %I', ${literal(schema)}, routine_signature, ${literal(role)});\n      END IF;\n    END LOOP;\n    IF to_regprocedure(\n      format(\n        '%I.resolve_session_attempt_personal_resources(uuid,uuid,uuid)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.resolve_session_attempt_personal_resources(uuid, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.resolve_session_attempt_personal_resources(uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.accept_turn_personal_resource_attachment(uuid,uuid,uuid,uuid,text,integer,boolean,integer)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.list_owned_connection_accounts(uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_owned_connection_accounts(uuid,uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_owned_connection_accounts(uuid,uuid) TO %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(format('%I.list_self_user_resource_authorities(uuid,uuid,text,uuid,integer)', ${literal(schema)}))\n      IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_user_resource_authorities(uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_user_resource_authorities(uuid) FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, boolean) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, boolean) FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid) FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_self_user_resource_authorities(uuid, uuid, text, uuid, integer) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_self_user_resource_authorities(uuid, uuid, text, uuid, integer) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.revoke_self_user_resource_grant(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(format('%I.resolve_accepted_connection_use(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,uuid,text,text,text,text)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text) TO %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(\n      format('%I.get_self_personal_github_repository_selection(uuid,uuid,text,uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.get_self_personal_github_repository_selection(uuid,uuid,text,uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.get_self_personal_github_repository_selection(uuid,uuid,text,uuid) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.mutate_self_personal_github_repository_selection(uuid,uuid,text,uuid,bigint,bigint,text,jsonb,boolean) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.mutate_self_personal_github_repository_selection(uuid,uuid,text,uuid,bigint,bigint,text,jsonb,boolean) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL PRIVILEGES ON TABLE %I.personal_github_repository_selection_heads, %I.personal_github_repository_selections, %I.personal_github_repository_selection_operations FROM %I',\n        ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format('%I.create_personal_document_authority(uuid,uuid,uuid)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.create_personal_document_authority(uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.create_personal_document_authority(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_document_original_file(uuid, uuid, text, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_document_original_file(uuid, uuid, text, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.prepare_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.prepare_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.personal_document_authority_capability_active(text) FROM PUBLIC');\n      EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.personal_document_authority_capability_active(text) TO %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE opengeni_private.personal_document_authority_capabilities FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.session_attempt_personal_document_admissions FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.session_attempt_personal_document_snapshots FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.personal_document_once_consumption_receipts FROM %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(\n      format('%I.reclassify_document_authority(jsonb)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.reclassify_document_authority(jsonb) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.reclassify_document_authority(jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamptz, uuid) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamptz, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.run_document_default_collection_backfill(jsonb) FROM PUBLIC', ${literal(schema)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.run_document_default_collection_backfill(jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.document_migration_capability_active(text) FROM PUBLIC');\n      EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.document_migration_capability_active(text) TO %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE opengeni_private.document_migration_capabilities FROM %I', ${literal(role)});\n      EXECUTE format('GRANT SELECT ON TABLE %I.document_authority_reclassifications TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE INSERT, UPDATE, DELETE ON TABLE %I.document_authority_reclassifications FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.document_default_collection_backfill_runs, %I.document_default_collection_backfill_operations, %I.document_default_collection_backfill_receipts FROM %I', ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)});\n      IF to_regprocedure(\n        format('%I.list_document_default_collection_backfill_runs(jsonb)', ${literal(schema)})\n      ) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.list_document_default_collection_backfill_runs(jsonb) FROM PUBLIC', ${literal(schema)});\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_document_default_collection_backfill_runs(jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.get_document_default_collection_backfill_audit(jsonb) FROM PUBLIC', ${literal(schema)});\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.get_document_default_collection_backfill_audit(jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.list_organization_document_authority_reclassifications(jsonb) FROM PUBLIC', ${literal(schema)});\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_organization_document_authority_reclassifications(jsonb) TO %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.document_migration_audit_capability_active(text) FROM PUBLIC', ${literal(schema)});\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.document_migration_audit_capability_active(text) FROM %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.assert_document_migration_audit_authority(jsonb) FROM PUBLIC', ${literal(schema)});\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.assert_document_migration_audit_authority(jsonb) FROM %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.document_migration_audit_capabilities FROM %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n    END IF;\n    IF to_regprocedure(\n      format('%I.create_scoped_variable_set(uuid,uuid,text,text,text,jsonb,boolean)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_variable_sets(uuid, uuid, uuid, text, text) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.count_scoped_variable_sets(uuid, uuid, text) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.workspace_variable_sets FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.workspace_variable_set_variables FROM %I', ${literal(schema)}, ${literal(role)});\n    END IF;\n    IF to_regprocedure(\n      format('%I.list_vaults_for_subject(uuid,jsonb)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      -- Vaults (0739): the routines are the only way in; no table privileges.\n      DECLARE\n        vault_routine text;\n        vault_table text;\n      BEGIN\n        FOREACH vault_routine IN ARRAY ARRAY[${VAULT_RUNTIME_ROUTINES.map((routine) => literal(routine)).join(\", \")}] LOOP\n          -- Later vault routines arrive with later migrations; runtime posture\n          -- reports any that are missing.\n          IF to_regprocedure(format('%I.%s', ${literal(schema)}, vault_routine)) IS NOT NULL THEN\n            EXECUTE format('REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC', ${literal(schema)}, vault_routine);\n            EXECUTE format('GRANT EXECUTE ON FUNCTION %I.%s TO %I', ${literal(schema)}, vault_routine, ${literal(role)});\n          END IF;\n        END LOOP;\n        FOREACH vault_table IN ARRAY ARRAY[${VAULT_TABLES.map((table) => literal(table)).join(\", \")}] LOOP\n          EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.%I FROM %I', ${literal(schema)}, vault_table, ${literal(role)});\n        END LOOP;\n        EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE opengeni_private.vault_authority_capabilities FROM %I', ${literal(role)});\n      END;\n    END IF;\n    IF to_regprocedure(\n      format('%I.create_scoped_rig(uuid,uuid,text,text,text,text,jsonb,boolean)', ${literal(schema)})\n    ) IS NOT NULL THEN\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_rigs(uuid, uuid, uuid, text, text) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.count_scoped_rigs(uuid, uuid, text) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_enrollments(uuid, uuid, uuid, text) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.get_scoped_sandbox(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      IF to_regprocedure(format('%I.get_session_machine_access(uuid,uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.get_session_machine_access(uuid,uuid,uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_scoped_sandbox_attach(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_scoped_machine_dependent_sessions(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('GRANT EXECUTE ON FUNCTION %I.detach_scoped_machine_dependent_sessions(uuid, uuid, uuid) TO %I', ${literal(schema)}, ${literal(role)});\n      IF to_regprocedure(\n        format('%I.change_connected_machine_audience(uuid,uuid,uuid,bigint,text,text,boolean)', ${literal(schema)})\n      ) IS NOT NULL THEN\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.preview_connected_machine_audience_change(uuid, uuid, uuid, text, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.change_connected_machine_audience(uuid, uuid, uuid, bigint, text, text, boolean) TO %I', ${literal(schema)}, ${literal(role)});\n      END IF;\n      EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.session_attempt_connected_machine_authorizations FROM %I', ${literal(schema)}, ${literal(role)});\n      IF to_regprocedure(format('%I.consent_session_turn_personal_machine(uuid,uuid,uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.consent_session_turn_personal_machine(uuid,uuid,uuid,uuid) TO %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.get_session_attempt_machine(uuid,uuid,uuid,uuid,uuid,integer,uuid,uuid,boolean,boolean) TO %I', ${literal(schema)}, ${literal(role)});\n        EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.session_turn_machine_consents, %I.session_attempt_machine_consents FROM %I', ${literal(schema)}, ${literal(schema)}, ${literal(role)});\n        EXECUTE format('REVOKE ALL ON FUNCTION %I.live_session_turn_machine_consent(uuid), %I.bind_session_attempt_machine_consent(uuid,uuid,uuid), %I.assert_session_attempt_machine_consent(uuid,uuid,uuid,uuid,uuid,integer,uuid,boolean,boolean) FROM %I', ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)});\n      END IF;\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.freeze_scheduled_task_personal_resources(uuid,uuid,uuid,bigint)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n      IF to_regprocedure(format('%I.create_scheduled_agent_run_with_admission(uuid,uuid,uuid,uuid,bigint,text,text,text,timestamp with time zone,timestamp with time zone,jsonb)', ${literal(schema)})) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.scheduled_task_run_connection_authority_subject(uuid, uuid, uuid) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_run_connection_authority_subject(uuid, uuid, uuid) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.validate_scheduled_agent_run_live_authority(uuid, uuid, uuid) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.validate_scheduled_agent_run_live_authority(uuid, uuid, uuid) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.bind_scheduled_task_run_session(uuid, uuid, uuid, uuid) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.bind_scheduled_task_run_session(uuid, uuid, uuid, uuid) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION %I.transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text) FROM PUBLIC',\n          ${literal(schema)}\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION %I.transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text) TO %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE DELETE ON TABLE %I.scheduled_tasks, %I.scheduled_task_runs FROM %I',\n          ${literal(schema)}, ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_connection_authority_snapshots FROM %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_run_connection_authority_snapshots FROM %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_reusable_connection_materializations FROM %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n        EXECUTE format(\n          'REVOKE ALL PRIVILEGES ON TABLE %I.scheduled_task_revision_authorities FROM %I',\n          ${literal(schema)}, ${literal(role)}\n        );\n      END IF;\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL ON FUNCTION %I.scheduled_task_run_personal_resource_authority(uuid, uuid, uuid) FROM PUBLIC',\n        ${literal(schema)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scheduled_task_run_personal_resource_authority(uuid, uuid, uuid) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_source_acl(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_complete_sync(uuid,uuid,text,text,timestamptz,jsonb,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_complete_sync(uuid, uuid, text, text, timestamptz, jsonb, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(\n      format(\n        '%I.scoped_knowledge_advance_object_version(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',\n        ${literal(schema)}\n      )\n    ) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.scoped_knowledge_advance_object_version(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text) TO %I',\n        ${literal(schema)},\n        ${literal(role)}\n      );\n    END IF;\n    EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format(\n      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',\n      owner_role,\n      ${literal(schema)},\n      ${literal(role)}\n    );\n    EXECUTE format(\n      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I GRANT USAGE, SELECT ON SEQUENCES TO %I',\n      owner_role,\n      ${literal(schema)},\n      ${literal(role)}\n    );\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});\n    FOREACH routine_signature IN ARRAY ARRAY[${MAINTENANCE_PROBE_OWNER_ROUTINES.map(literal).join(\",\")} ] LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format('REVOKE EXECUTE ON FUNCTION opengeni_private.%s FROM PUBLIC, %I',\n          routine_signature, ${literal(role)});\n      END IF;\n    END LOOP;\n    FOREACH routine_signature IN ARRAY ${retiringOwnerOnlyRoutines} LOOP\n      IF to_regprocedure(routine_signature) IS NOT NULL THEN\n        EXECUTE format('REVOKE EXECUTE ON FUNCTION %s FROM PUBLIC, %I',\n          routine_signature, ${literal(role)});\n      END IF;\n    END LOOP;\n    FOREACH routine_signature IN ARRAY ARRAY[\n      'subscription_connection_visible(uuid,uuid,uuid,text,text,uuid,text,text)',\n      'authorize_subscription_ownerless_session_access(uuid,uuid,uuid,uuid)',\n      'authorize_subscription_personal_placement_access(uuid,uuid,uuid,uuid,text,uuid,bigint,text,text)',\n      'subscription_codex_refresh_write_allowed(uuid,uuid,uuid)',\n      'resolve_subscription_codex_apps_designation(uuid,uuid)',\n      'read_subscription_codex_apps_credential(uuid,uuid,uuid)',\n      'begin_subscription_codex_apps_refresh(uuid,uuid,uuid)',\n      'persist_subscription_codex_apps_refresh(uuid,uuid,uuid,bigint,text,timestamptz,timestamptz)',\n      'fail_subscription_codex_apps_refresh(uuid,uuid,uuid,bigint,text)',\n      'subscription_codex_reset_authority(uuid,uuid,uuid,text)',\n      'subscription_codex_reset_credit_fence(uuid,uuid,uuid,text,text,uuid)',\n      'subscription_codex_owner_capability_held(uuid,text[],text,uuid,boolean)',\n      'subscription_codex_owner_membership_held(uuid,uuid)',\n      'subscription_core_owner_capability_held(text,uuid,text[],text,uuid,boolean)',\n      'subscription_core_owner_membership_held(uuid,uuid)',\n      'subscription_core_refresh_write_allowed(text,uuid,uuid,uuid)',\n      'begin_subscription_core_refresh(text,uuid,uuid,uuid,uuid,text,text,uuid,text,bigint)',\n      'persist_subscription_core_refresh(text,uuid,uuid,uuid,uuid,uuid,bigint,text,timestamptz,timestamptz)',\n      'persist_subscription_core_refresh_with_plan(text,uuid,uuid,uuid,uuid,uuid,bigint,text,timestamptz,timestamptz,text)',\n      'fail_subscription_core_refresh(text,uuid,uuid,uuid,uuid,uuid,bigint,text)',\n      'quarantine_subscription_core_connection(text,uuid,uuid,uuid,uuid,uuid,text,bigint,bigint,text,text,timestamptz)',\n      'recover_subscription_core_connection_health(text,uuid,uuid,uuid,uuid)',\n      'subscription_core_acceptance_authority_v2(text,uuid,uuid,uuid,text)',\n      'subscription_core_task_authority_v2(text,uuid,uuid,uuid,text)',\n      'subscription_core_revision_authority_v2(uuid,uuid,uuid,bigint)',\n      'read_subscription_core_connection_credential(text,uuid,uuid,uuid,uuid,uuid,text,bigint)',\n      'begin_subscription_core_connection_refresh(text,uuid,uuid,uuid,uuid,uuid,text,bigint)',\n      'persist_subscription_core_connection_refresh(text,uuid,uuid,uuid,bigint,text,timestamptz,timestamptz)',\n      'fail_subscription_core_connection_refresh(text,uuid,uuid,uuid,bigint,text)',\n      'connect_subscription_core_personal(text,uuid,uuid,text,text,text,text,text,jsonb,timestamptz,timestamptz,text,text,text)',\n      'connect_subscription_core_personal(text,uuid,uuid,text,text,text,text,text,jsonb,timestamptz,timestamptz,text,text,text,text)',\n      'subscription_authority_carrier_inserted_now(text,uuid,uuid,bigint)',\n      'disconnect_subscription_core_connection(text,uuid,uuid,text,uuid)',\n      'manage_subscription_core_personal(text,uuid,uuid,text,uuid,text,text,boolean,integer)',\n      'subscription_core_personal_connections(text,uuid,uuid,text)',\n      'subscription_core_personal_connection_versions(text,uuid,uuid,text)',\n      'subscription_core_personal_sharing(text,uuid,text,uuid,integer)',\n      'read_subscription_core_owned_connection_credential(text,uuid,uuid,text,uuid)',\n      'begin_subscription_core_owned_connection_refresh(text,uuid,uuid,text,uuid)',\n      'record_subscription_core_owned_connection_quota(text,uuid,uuid,text,uuid,bigint,bigint,jsonb,timestamptz)',\n      'subscription_core_reach(text,uuid,uuid)',\n      'set_subscription_core_reach(text,uuid,uuid,boolean,boolean)',\n      'set_subscription_core_reach_allocator(text,uuid,uuid,boolean)',\n      'subscription_provider_cutover_committed(text)',\n      'copy_subscription_authority_compat(text,text,uuid,uuid,bigint)',\n      'read_subscription_authority_compat(text,text,uuid,uuid,bigint)',\n      'subscription_authority_compat_providers()',\n      'subscription_organization_admin(uuid)',\n      'subscription_people_assignment_visible(uuid,uuid,uuid,text,text)',\n      'subscription_person_preference_visible(uuid,uuid,text,text)',\n      'subscription_apps_designation_allowed(uuid,uuid,uuid)',\n      'subscription_apps_designation_manage_allowed(uuid,uuid,uuid)',\n      'guard_subscription_connection_scope()',\n      'guard_subscription_turn_session_reference()',\n      'guard_subscription_connection_reference()',\n      'reset_subscription_binding_cache_clock()',\n      'guard_subscription_binding_provider()',\n      'authorize_subscription_service_session_access(uuid,uuid,uuid,uuid,text)'\n    ] LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',\n          routine_signature,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- The Codex Apps designation target helper returns a full connection row;\n    -- only its owner-run callers may execute it, never the runtime role.\n    IF to_regprocedure('opengeni_private.subscription_codex_apps_designation_target(uuid,uuid)') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.subscription_codex_apps_designation_target(uuid,uuid) FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    -- M3 PR 3b: the capability internals and the revision-authority trigger\n    -- function are owner-only. Migration 0707: the neutral writers' caller\n    -- check, capability internals and connection target are owner-only.\n    -- Migration 0713: the provider-keyed auto-assignment apply path is\n    -- owner-only.\n    -- Triggers fire without the caller holding EXECUTE.\n    FOREACH routine_signature IN ARRAY ARRAY[\n      'grant_subscription_codex_owner_capability(text,uuid,uuid,text,uuid)',\n      'drop_subscription_codex_owner_capabilities(uuid)',\n      'derive_scheduled_revision_subscription_authority()',\n      'subscription_core_writer_context(text,uuid,uuid,text)',\n      'grant_subscription_core_owner_capability(text,text,uuid,uuid,text,uuid)',\n      'drop_subscription_core_owner_capabilities(text,uuid)',\n      'subscription_core_connection_target(text,uuid,uuid,uuid,uuid,uuid,text,bigint)',\n      'apply_subscription_core_auto_assignments(text,uuid,uuid,boolean)',\n      -- Migration 0716: the authority marker and compatibility guards,\n      -- resolvers and deferred check are owner-only.\n      'stamp_subscription_authority_inserted_at()',\n      'keep_subscription_authority_inserted_at()',\n      'subscription_authority_compat_entry_valid(jsonb)',\n      'guard_subscription_authority_compat()',\n      'subscription_compat_turn_human(uuid,uuid)',\n      'subscription_compat_v2_has_entry(jsonb,text)',\n      'subscription_compat_receiver_source(uuid,uuid)',\n      'subscription_compat_delivery_sources(uuid,uuid,uuid,uuid,text)',\n      'subscription_compat_compaction_source(uuid,uuid)',\n      'subscription_compat_scheduled_source(uuid,uuid)',\n      'subscription_compat_carrier_sources(text,uuid,uuid,bigint)',\n      'subscription_compat_carrier_state(text,uuid,uuid,bigint)',\n      'subscription_compat_record(text,text,uuid,uuid,bigint)',\n      'subscription_compat_expected(text,timestamptz,uuid,text,uuid,bigint,text)',\n      'subscription_compat_carrier_expected(text,timestamptz,text,uuid,uuid,bigint)',\n      'subscription_compat_enter_scope(uuid,uuid)',\n      'subscription_compat_leave_scope(text[])',\n      'subscription_compat_effective(text,text,uuid,uuid,bigint)',\n      'enforce_subscription_authority_compat()',\n      -- Migration 0717: the fences' helpers are owner-only.\n      'subscription_v2_copy_matches(jsonb,jsonb)',\n      'subscription_scheduled_firing_v2(uuid,uuid,uuid,bigint)',\n      'subscription_personal_entry_serviceable(uuid,jsonb)',\n      'subscription_scheduled_run_personal_entries(uuid,uuid,uuid)'\n    ] LOOP\n      IF to_regprocedure('opengeni_subscription_internal.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE EXECUTE ON FUNCTION opengeni_subscription_internal.%s FROM %I',\n          routine_signature, ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- The drained cutover uses private routines: no previous binary remains.\n    -- Migration 0751 gives the plan-change and auto-assignment trigger\n    -- functions provider-free names.\n    FOREACH routine_signature IN ARRAY ARRAY[\n      'subscription_codex_cutover_v1_active()',\n      'seed_subscription_codex_cutover()',\n      'record_subscription_core_plan_change()',\n      'keep_subscription_codex_cutover_identity()',\n      'auto_assign_subscription_core_workspace()',\n      'auto_assign_subscription_core_personal_workspace()'\n    ] LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE EXECUTE ON FUNCTION opengeni_private.%s FROM %I',\n          routine_signature,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n    -- This exact content-free repair inventory shares the existing global\n    -- wake dispatcher's authority. Converge custom-role and migrate-then-\n    -- provision installs without opening a generic owner/posture exception.\n    IF to_regprocedure('opengeni_private.list_pending_child_terminal_wake_repairs_v1(integer,uuid,uuid)') IS NOT NULL THEN\n      EXECUTE format('ALTER FUNCTION opengeni_private.list_pending_child_terminal_wake_repairs_v1(integer,uuid,uuid) OWNER TO %I',\n        (SELECT pg_get_userbyid(proowner) FROM pg_proc\n          WHERE oid = 'opengeni_private.claim_session_workflow_wakes(integer)'::regprocedure));\n      REVOKE ALL ON FUNCTION opengeni_private.list_pending_child_terminal_wake_repairs_v1(integer,uuid,uuid) FROM PUBLIC;\n      EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.list_pending_child_terminal_wake_repairs_v1(integer,uuid,uuid) TO %I', ${literal(role)});\n    END IF;\n    IF to_regprocedure('opengeni_private.list_quiescence_receipt_wake_repairs_v1(integer,uuid,uuid)') IS NOT NULL THEN\n      EXECUTE format('ALTER FUNCTION opengeni_private.list_quiescence_receipt_wake_repairs_v1(integer,uuid,uuid) OWNER TO %I',\n        (SELECT pg_get_userbyid(proowner) FROM pg_proc\n          WHERE oid = 'opengeni_private.claim_session_workflow_wakes(integer)'::regprocedure));\n      REVOKE ALL ON FUNCTION opengeni_private.list_quiescence_receipt_wake_repairs_v1(integer,uuid,uuid) FROM PUBLIC;\n      EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.list_quiescence_receipt_wake_repairs_v1(integer,uuid,uuid) TO %I', ${literal(role)});\n    END IF;\n    FOREACH routine_signature IN ARRAY ARRAY[\n      'opengeni_private.list_subscription_plan_maintenance_accounts(integer)',\n      'opengeni_private.subscription_plan_free_anniversary(timestamp with time zone,timestamp with time zone)',\n      'opengeni_private.list_exhausted_scheduled_tasks(integer)',\n      'opengeni_private.list_scheduled_task_schedule_reconciliations(integer)',\n      format('%I.scheduled_task_is_exhausted(uuid)', ${literal(schema)})\n    ] LOOP\n      IF to_regprocedure(routine_signature) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC', routine_signature);\n        EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO %I', routine_signature, ${literal(role)});\n      END IF;\n    END LOOP;\n    -- Read-only maintenance work checks (0730, 0732) carry exactly the authority of\n    -- the claim each one previews: same owner, no PUBLIC, runtime EXECUTE.\n    DECLARE\n      work_probe record;\n    BEGIN\n      FOR work_probe IN\n        SELECT * FROM (VALUES\n          ('opengeni_private.session_workflow_wakes_due_v1()',\n            'opengeni_private.claim_session_workflow_wakes(integer)'),\n          ('opengeni_private.automatic_session_title_fanout_due_v1()',\n            'opengeni_private.claim_automatic_session_title_fanout_v1(integer)'),\n          ('opengeni_private.knowledge_index_due_v1(text,integer)',\n            format('%I.knowledge_index_claim(text,integer,integer)', ${literal(schema)})),\n          ('opengeni_private.site_auth_maintenance_due_v1(bigint)',\n            'opengeni_private.claim_site_auth_maintenance(bigint,integer)'),\n          ('opengeni_private.sandbox_lease_reaper_due_v1()',\n            'opengeni_private.reap_sandbox_leases(bigint,bigint,bigint,bigint)'),\n          ('opengeni_private.sandbox_idle_checkpoint_due_v1(bigint)',\n            'opengeni_private.list_idle_checkpoint_candidates(integer,bigint)'),\n          ('opengeni_private.browser_deadline_checkpoint_due_v1()',\n            'opengeni_private.list_browser_deadline_checkpoints(integer)'),\n          ('opengeni_private.session_system_update_outbox_due_v1()',\n            'opengeni_private.claim_session_system_update_outbox_v2(integer)'),\n          ('opengeni_private.session_list_snapshots_expired_v1()',\n            'opengeni_private.reap_expired_session_list_snapshots(integer)'),\n          ('opengeni_private.connected_command_reconciliation_due_v1()',\n            'opengeni_private.claim_connected_machine_background_commands(uuid,integer,bigint,timestamp with time zone)'),\n          ('opengeni_private.connected_command_output_release_due_v1()',\n            'opengeni_private.claim_connected_command_output_releases(uuid,integer,bigint,timestamp with time zone)'),\n          ('opengeni_private.terminal_retained_processes_due_v1()',\n            'opengeni_private.claim_terminal_retained_processes(uuid,integer,bigint)'),\n          ('opengeni_private.sandbox_ended_epoch_blockers_due_v1()',\n            'opengeni_private.list_sandbox_ended_epoch_blockers(integer)'),\n          ('opengeni_private.sandbox_checkpoint_artifact_gc_due_v1(bigint)',\n            'opengeni_private.claim_sandbox_checkpoint_artifacts(uuid,integer,bigint)')\n        ) AS probes(signature, claim)\n      LOOP\n        IF to_regprocedure(work_probe.signature) IS NOT NULL\n          AND to_regprocedure(work_probe.claim) IS NOT NULL THEN\n          EXECUTE format('ALTER FUNCTION %s OWNER TO %I', work_probe.signature,\n            (SELECT pg_get_userbyid(proowner) FROM pg_proc\n              WHERE oid = to_regprocedure(work_probe.claim)));\n          EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC', work_probe.signature);\n          EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO %I', work_probe.signature, ${literal(role)});\n        END IF;\n      END LOOP;\n    END;\n    IF to_regclass('opengeni_private.session_import_batches') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.session_import_batches FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.session_import_batches FROM %I',\n        (SELECT string_agg(quote_ident(attname),',') FROM pg_attribute\n          WHERE attrelid='opengeni_private.session_import_batches'::regclass AND attnum>0 AND NOT attisdropped),\n        ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.session_import_batches FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.modal_inventory_read_capabilities') IS NOT NULL THEN\n      -- Inventory is the only capability mint. Reprovisioning must repair\n      -- accidental table and column grants, never expose its private ledger.\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.modal_inventory_read_capabilities FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (backend_pid, transaction_id, data_schema) ON TABLE opengeni_private.modal_inventory_read_capabilities FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.modal_inventory_read_capabilities FROM PUBLIC;\n      REVOKE ALL (backend_pid, transaction_id, data_schema) ON TABLE opengeni_private.modal_inventory_read_capabilities FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.list_live_modal_sandbox_leases() FROM PUBLIC;\n      IF to_regprocedure('opengeni_private.list_pending_modal_provider_creates()') IS NOT NULL THEN\n        REVOKE ALL ON FUNCTION opengeni_private.list_pending_modal_provider_creates() FROM PUBLIC;\n      END IF;\n      IF to_regprocedure('opengeni_private.list_stale_compute_sandbox_enrollments(uuid)') IS NOT NULL THEN\n        REVOKE ALL ON FUNCTION opengeni_private.list_stale_compute_sandbox_enrollments(uuid) FROM PUBLIC;\n      END IF;\n    END IF;\n    IF to_regclass('opengeni_private.modal_native_origin_read_capabilities') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM %I',\n        (SELECT string_agg(quote_ident(attname), ',') FROM pg_attribute\n          WHERE attrelid='opengeni_private.modal_native_origin_read_capabilities'::regclass AND attnum>0 AND NOT attisdropped), ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM PUBLIC;\n      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.modal_native_origin_read_capabilities FROM PUBLIC',\n        (SELECT string_agg(quote_ident(attname), ',') FROM pg_attribute\n          WHERE attrelid='opengeni_private.modal_native_origin_read_capabilities'::regclass AND attnum>0 AND NOT attisdropped));\n    END IF;\n    IF to_regclass('opengeni_private.sandbox_recovery_rollout') IS NOT NULL THEN\n      -- Migration may precede this role's creation. Converge only read access;\n      -- runtime identities and PUBLIC never receive recovery activation writes.\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.sandbox_recovery_rollout FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (singleton, consent_enabled, release_evidence) ON TABLE opengeni_private.sandbox_recovery_rollout FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.sandbox_recovery_rollout FROM PUBLIC;\n      REVOKE ALL (singleton, consent_enabled, release_evidence) ON TABLE opengeni_private.sandbox_recovery_rollout FROM PUBLIC;\n      EXECUTE format('GRANT SELECT ON TABLE opengeni_private.sandbox_recovery_rollout TO %I', ${literal(role)});\n    END IF;\n    IF to_regclass('opengeni_private.credit_promotion_policy_revisions') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.credit_promotion_policy_revisions FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.credit_promotion_policy_revisions FROM PUBLIC;\n      EXECUTE format('GRANT SELECT ON TABLE opengeni_private.credit_promotion_policy_revisions TO %I', ${literal(role)});\n    END IF;\n    IF to_regclass('opengeni_private.subscription_plan_catalog_revisions') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.subscription_plan_catalog_revisions FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.subscription_plan_catalog_revisions FROM PUBLIC;\n      EXECUTE format('GRANT SELECT ON TABLE opengeni_private.subscription_plan_catalog_revisions TO %I', ${literal(role)});\n    END IF;\n    IF to_regclass('opengeni_private.verified_signup_trial_switch_revisions') IS NOT NULL THEN\n      -- Read-only for the operator gauge. Only the owner-only audited setter\n      -- appends revisions; runtime identities and PUBLIC never write them.\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.verified_signup_trial_switch_revisions FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.verified_signup_trial_switch_revisions FROM PUBLIC;\n      EXECUTE format('GRANT SELECT ON TABLE opengeni_private.verified_signup_trial_switch_revisions TO %I', ${literal(role)});\n    END IF;\n    IF to_regclass('opengeni_private.managed_auth_new_signups_switch_revisions') IS NOT NULL THEN\n      -- Read-only so the API can decide each sign-up. Only the owner-only\n      -- audited setter appends revisions; runtime identities and PUBLIC never write them.\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.managed_auth_new_signups_switch_revisions FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.managed_auth_new_signups_switch_revisions FROM PUBLIC;\n      EXECUTE format('GRANT SELECT ON TABLE opengeni_private.managed_auth_new_signups_switch_revisions TO %I', ${literal(role)});\n    END IF;\n    IF to_regclass('opengeni_private.organization_usage_read_capabilities') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.organization_usage_read_capabilities FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.organization_usage_read_capabilities FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.organization_usage_summary(uuid,timestamptz,timestamptz,text,uuid,boolean) FROM PUBLIC;\n    END IF;\n    IF to_regprocedure('opengeni_private.organization_model_usage_summary(uuid,timestamptz,timestamptz,uuid)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.organization_model_usage_summary(uuid,timestamptz,timestamptz,uuid) FROM PUBLIC;\n    END IF;\n    IF to_regprocedure('opengeni_private.visible_workspace_insights_model_fact_rows(uuid,timestamptz,timestamptz,text,text,uuid,uuid)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.visible_workspace_insights_model_fact_rows(uuid,timestamptz,timestamptz,text,text,uuid,uuid) FROM PUBLIC;\n    END IF;\n    IF to_regprocedure('opengeni_private.complete_workspace_insights_usage_projection(uuid,timestamptz,timestamptz,text[])') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.complete_workspace_insights_usage_projection(uuid,timestamptz,timestamptz,text[]) FROM PUBLIC;\n    END IF;\n    IF to_regprocedure('opengeni_private.workspace_insights_amount_fact_rows(uuid,timestamptz,timestamptz,text,text,uuid,uuid)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.workspace_insights_amount_fact_rows(uuid,timestamptz,timestamptz,text,text,uuid,uuid) FROM PUBLIC;\n    END IF;\n    IF to_regprocedure('opengeni_private.private_scheduled_task_summaries(uuid,uuid,text,uuid,timestamptz,integer)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.private_scheduled_task_summaries(uuid,uuid,text,uuid,timestamptz,integer) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.pause_private_scheduled_task(uuid,uuid,text,uuid) FROM PUBLIC;\n    END IF;\n    IF to_regprocedure('opengeni_private.insights_scoped_usage_rows(uuid,uuid,timestamptz,timestamptz,text,uuid[],boolean)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.insights_scoped_usage_rows(uuid,uuid,timestamptz,timestamptz,text,uuid[],boolean) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.insights_scoped_calls_rows(uuid,uuid,timestamptz,timestamptz,jsonb,timestamptz,uuid,integer,uuid[],boolean) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.insights_raw_amount_inputs(uuid,uuid,timestamptz,timestamptz) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.insights_usage_payer(text,text), opengeni_private.insights_usage_filter(jsonb,jsonb) FROM PUBLIC;\n    END IF;\n    IF to_regprocedure('opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text) FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.site_session_cancellation_capabilities') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.site_session_cancellation_capabilities FROM %I',\n        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute\n          WHERE attrelid='opengeni_private.site_session_cancellation_capabilities'::regclass AND attnum>0 AND NOT attisdropped), ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM PUBLIC;\n      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.site_session_cancellation_capabilities FROM PUBLIC',\n        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute\n          WHERE attrelid='opengeni_private.site_session_cancellation_capabilities'::regclass AND attnum>0 AND NOT attisdropped));\n      REVOKE ALL ON FUNCTION opengeni_private.begin_site_session_cancellation(uuid,uuid,uuid,uuid),\n        opengeni_private.end_site_session_cancellation(uuid) FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.usage_allowance_capabilities') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.usage_allowance_capabilities FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (backend_pid,transaction_id,data_schema,account_id,workspace_id) ON TABLE opengeni_private.usage_allowance_capabilities FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.usage_allowance_capabilities FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.usage_maintenance_due') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.usage_maintenance_due FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (data_schema,kind,workspace_id,source_id,due_at,account_id,seen_membership_revision,membership_ready) ON TABLE opengeni_private.usage_maintenance_due FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.usage_maintenance_due FROM PUBLIC;\n      REVOKE ALL (data_schema,kind,workspace_id,source_id,due_at,account_id,seen_membership_revision,membership_ready) ON TABLE opengeni_private.usage_maintenance_due FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.usage_allowance_membership_changes') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.usage_allowance_membership_changes FROM %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL (data_schema,account_id,revision,changed_at) ON TABLE opengeni_private.usage_allowance_membership_changes FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.usage_allowance_membership_changes FROM PUBLIC;\n      REVOKE ALL (data_schema,account_id,revision,changed_at) ON TABLE opengeni_private.usage_allowance_membership_changes FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.session_file_attachments') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.session_file_attachments, opengeni_private.session_file_read_capabilities FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.session_file_attachments, opengeni_private.session_file_read_capabilities FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.session_file_read_allowed(uuid,uuid,uuid), opengeni_private.accept_session_file_attachments(uuid,uuid,uuid,uuid,text,uuid[]), opengeni_private.read_session_file_attachments(uuid,uuid,uuid,integer,uuid[],jsonb) FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.sandbox_file_publications') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.sandbox_file_publications FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.sandbox_file_publications FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.record_sandbox_file_publication(uuid,uuid,uuid,uuid) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.list_sandbox_file_publications(uuid,uuid,jsonb) FROM PUBLIC;\n      IF to_regprocedure('opengeni_private.file_private_to_another(uuid,uuid,uuid)') IS NOT NULL THEN\n        REVOKE ALL ON FUNCTION opengeni_private.file_private_to_another(uuid,uuid,uuid) FROM PUBLIC;\n      END IF;\n    END IF;\n    IF to_regclass('opengeni_private.artifact_catalog_pins') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM %I', ${literal(role)});\n      -- Table revocation does not remove column ACLs. Reconcile every current\n      -- column for both the runtime and PUBLIC, including future additions.\n      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.artifact_catalog_pins FROM %I',\n        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute\n          WHERE attrelid='opengeni_private.artifact_catalog_pins'::regclass AND attnum>0 AND NOT attisdropped),\n        ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC;\n      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC',\n        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute\n          WHERE attrelid='opengeni_private.artifact_catalog_pins'::regclass AND attnum>0 AND NOT attisdropped));\n      REVOKE ALL ON FUNCTION opengeni_private.update_artifact_pin(uuid,uuid,text,text,boolean),\n        opengeni_private.list_artifact_pins(uuid,uuid),\n        opengeni_private.list_sandbox_file_publications_pinned(uuid,uuid,jsonb) FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.slack_file_upload_operations') IS NOT NULL THEN\n      -- Ordinary RLS repositories own the upload CAS, not owner capabilities.\n      -- Never allow deletion/truncation to erase its durable completion fence.\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.slack_file_upload_operations FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.slack_file_upload_operations FROM PUBLIC;\n      EXECUTE format('GRANT SELECT, INSERT, UPDATE ON TABLE opengeni_private.slack_file_upload_operations TO %I', ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.guard_slack_file_upload_operation() FROM %I', ${literal(schema)}, ${literal(role)});\n      EXECUTE format('REVOKE ALL ON FUNCTION %I.guard_slack_file_upload_operation() FROM PUBLIC', ${literal(schema)});\n    END IF;\n    IF to_regclass('opengeni_private.scheduled_slack_bot_messages') IS NOT NULL THEN\n      -- Prepared scheduled bot posts are reachable only through their two\n      -- capabilities, so a saved destination can never be rewritten directly.\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.scheduled_slack_bot_messages FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.scheduled_slack_bot_messages FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.prepare_scheduled_slack_bot_message(uuid,uuid,uuid,uuid,uuid,integer,text,text,text) FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.read_scheduled_slack_bot_message(uuid,uuid,uuid,uuid) FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.organization_signup_use_cases') IS NOT NULL THEN\n      -- A signup answer is reachable only through its record capability, so a\n      -- stored answer can be neither rewritten nor read for another tenant.\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.organization_signup_use_cases FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.organization_signup_use_cases FROM PUBLIC;\n      REVOKE ALL ON FUNCTION opengeni_private.record_organization_signup_use_case(uuid,text,text) FROM PUBLIC;\n    END IF;\n    IF to_regclass('opengeni_private.organization_slack_bot_access') IS NOT NULL THEN\n      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.organization_slack_bot_access FROM %I', ${literal(role)});\n      REVOKE ALL ON TABLE opengeni_private.organization_slack_bot_access FROM PUBLIC;\n      REVOKE ALL ON FUNCTION\n        opengeni_private.set_organization_slack_bot_access(uuid,uuid,uuid,text,boolean),\n        opengeni_private.read_organization_slack_bot_access(uuid,uuid,uuid),\n        opengeni_private.list_organization_slack_bots(uuid,uuid),\n        opengeni_private.prepare_organization_slack_bot_message(uuid,uuid,uuid,uuid,uuid,integer,uuid,bigint,text,text,text),\n        opengeni_private.read_organization_slack_bot_message(uuid,uuid,uuid,uuid) FROM PUBLIC;\n      -- Selected-workspace access arrived after the base organization bot\n      -- table. Historical schema provisioning must use the installed routine\n      -- inventory, not migration receipts (upgrade fixtures withhold bodies).\n      FOREACH routine_signature IN ARRAY ARRAY[\n        'set_slack_bot_workspace_access(uuid,uuid,uuid,text,boolean,uuid[])',\n        'read_slack_bot_workspace_access(uuid,uuid,uuid)'\n      ] LOOP\n        IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n          EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.%s FROM PUBLIC', routine_signature);\n        END IF;\n      END LOOP;\n    END IF;\n    FOREACH routine_signature IN ARRAY ARRAY[\n      'sync_usage_maintenance_due()',\n      'arm_usage_allowances_for_membership()',\n      'read_sender_connection(uuid,uuid,uuid,text)',\n      'validate_mcp_account_bindings(jsonb,jsonb)',\n      'fence_mcp_account_bindings()',\n      'guard_mcp_operation_immutable()',\n      'mcp_operation_command_scoped(jsonb,text,jsonb)',\n      'guard_workspace_owned_skill_head_delete()',\n      'guard_workspace_owned_skill_history_delete()'\n    ] LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.%s FROM PUBLIC', routine_signature);\n        EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.%s FROM %I', routine_signature, ${literal(role)});\n      END IF;\n    END LOOP;\n    EXECUTE format(\n      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private REVOKE EXECUTE ON FUNCTIONS FROM %I',\n      owner_role,\n      ${literal(role)}\n    );\n    IF to_regprocedure('opengeni_private.personal_resource_delegation_capability_active(text)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION\n        opengeni_private.personal_resource_delegation_capability_active(text)\n        FROM PUBLIC;\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.personal_resource_delegation_capability_active(text) TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.scheduled_personal_resource_capability_active(text)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION\n        opengeni_private.scheduled_personal_resource_capability_active(text)\n        FROM PUBLIC;\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.scheduled_personal_resource_capability_active(text) TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.variable_set_authority_capability_active(text)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION\n        opengeni_private.variable_set_authority_capability_active(text)\n        FROM PUBLIC;\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.variable_set_authority_capability_active(text) TO %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.variable_set_authority_capabilities FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.vault_authority_capability_active(text)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION\n        opengeni_private.vault_authority_capability_active(text)\n        FROM PUBLIC;\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.vault_authority_capability_active(text) TO %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.vault_authority_capabilities FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.session_variable_set_attachments_protocol_v1_active()') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION\n        opengeni_private.session_variable_set_attachments_protocol_v1_active()\n        FROM PUBLIC;\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.session_variable_set_attachments_protocol_v1_active() TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.scoped_compute_capability_active(text)') IS NOT NULL THEN\n      REVOKE ALL ON FUNCTION opengeni_private.scoped_compute_capability_active(text) FROM PUBLIC;\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.scoped_compute_capability_active(text) TO %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.scoped_compute_capabilities FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    -- The automatic-title migration helper and policy trigger deliberately\n    -- retain role-scoped EXECUTE for pre-policy startup/readiness\n    -- compatibility. Both are SECURITY INVOKER and PUBLIC remains revoked; RLS\n    -- and the private-table ACL deny app-role enqueue writes, while PostgreSQL\n    -- refuses direct trigger calls, so neither grant conveys data authority.\n    IF to_regclass('opengeni_private.automatic_session_title_fanout_outbox_v1') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE ALL PRIVILEGES ON TABLE opengeni_private.automatic_session_title_fanout_outbox_v1 FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.enqueue_automatic_session_title_fanout_v1(uuid,uuid,uuid,uuid)') IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.enqueue_automatic_session_title_fanout_v1(uuid, uuid, uuid, uuid) TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.enforce_automatic_session_title_policy_v1()') IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.enforce_automatic_session_title_policy_v1() TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    -- Global cross-workspace artifact workers are separate capabilities. Never\n    -- let the generic tenant-scoped app role inherit them from the historical\n    -- blanket grant of already-installed helpers.\n    IF to_regprocedure('opengeni_private.claim_editable_artifact_live_outbox(text,integer,integer,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_live_outbox(text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.mark_editable_artifact_live_outbox_published(text, text, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_live_outbox(text, text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.retry_editable_artifact_live_outbox(text, text, integer, integer, text, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.dead_letter_editable_artifact_live_outbox(text, text, integer, text, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.release_editable_artifact_live_outbox(text, text, integer, name) FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.claim_editable_artifact_materializations(text,integer,integer,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.claim_editable_artifact_materializations(text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamptz, name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name) FROM %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.consume_editable_artifact_live_ticket(text,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'REVOKE EXECUTE ON FUNCTION opengeni_private.resolve_editable_artifact_ticket_data_schema(name) FROM %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamptz, timestamptz, name) TO %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.consume_editable_artifact_live_ticket(text, name) TO %I',\n        ${literal(role)}\n      );\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.cleanup_expired_editable_artifact_live_tickets(integer, name) TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure('opengeni_private.authorize_editable_artifact_actor(uuid,uuid,text,text,text,text,text,text,integer,text,text,name)') IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION opengeni_private.authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name) TO %I',\n        ${literal(role)}\n      );\n    END IF;\n    IF to_regprocedure(format('%I.subscription_effective_settings(uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN\n      EXECUTE format(\n        'GRANT EXECUTE ON FUNCTION %I.subscription_effective_settings(uuid,uuid) TO %I',\n        ${literal(schema)}, ${literal(role)}\n      );\n    END IF;\n    FOREACH routine_signature IN ARRAY ARRAY[\n      'complete_temporal_schedule_connector_cleanup(uuid,uuid)',\n      'upgrade_temporal_schedule_connector_cleanup(uuid,uuid,text,uuid,text,jsonb,uuid)',\n      'complete_workspace_temporal_connector_cleanups(uuid,uuid)'\n    ] LOOP\n      IF to_regprocedure('opengeni_private.' || routine_signature) IS NOT NULL THEN\n        EXECUTE format(\n          'REVOKE ALL ON FUNCTION opengeni_private.%s FROM PUBLIC',\n          routine_signature\n        );\n        EXECUTE format(\n          'GRANT EXECUTE ON FUNCTION opengeni_private.%s TO %I',\n          routine_signature,\n          ${literal(role)}\n        );\n      END IF;\n    END LOOP;\n  END IF;\nEND $$;\n`);\n}\n\nfunction commaSeparated(value: string): string[] {\n  return value\n    .split(\",\")\n    .map((item) => item.trim())\n    .filter(Boolean);\n}\n\nfunction validateIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\nfunction identifier(value: string): string {\n  return `\"${value.replace(/\"/g, '\"\"')}\"`;\n}\n\nfunction literal(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`;\n}\n\nfunction databaseUrlFor(value: string, database: string): string {\n  const url = new URL(value);\n  url.pathname = `/${database}`;\n  return url.toString();\n}\n\n// CLI form (unchanged behavior): read env into the SDK options and run. This is\n// what `bun src/provision-roles.ts` / the `provision-roles` package script\n// invokes — standalone byte-for-byte the historical script (public schema,\n// force strategy, env-driven creds).\n/** Command-line entry. Bundled release images call this explicitly; see\n * scripts/assemble-server-runtime.ts. */\nexport async function runProvisionRolesCli(): Promise<void> {\n  const adminUrl =\n    process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_ADMIN_URL ??\n    process.env.OPENGENI_DATABASE_URL;\n  if (!adminUrl) {\n    throw new Error(\n      \"OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required\",\n    );\n  }\n  const result = await provisionRoles(adminUrl, {\n    ...(process.env.OPENGENI_DB_SCHEMA?.trim()\n      ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() }\n      : {}),\n  });\n  console.log(JSON.stringify(result, null, 2));\n}\n\nif (import.meta.main) await runProvisionRolesCli();\n","import { sql } from \"drizzle-orm\";\nimport legacyRoutines from \"./runtime-posture-legacy-routines.json\";\nimport type { Database, RlsStrategy } from \"./database\";\nimport {\n  classifyRoleRelationships,\n  roleRelationshipsCatalogQuery,\n  type RoleRelationshipCatalogRow,\n} from \"./role-relationships\";\n\nconst ARTIFACT_OUTBOX_CAPABILITY_ROUTINES = [\n  \"claim_editable_artifact_live_outbox(text, integer, integer, name)\",\n  \"mark_editable_artifact_live_outbox_published(text, text, integer, name)\",\n  \"renew_editable_artifact_live_outbox(text, text, integer, integer, name)\",\n  \"retry_editable_artifact_live_outbox(text, text, integer, integer, text, name)\",\n  \"dead_letter_editable_artifact_live_outbox(text, text, integer, text, name)\",\n  \"release_editable_artifact_live_outbox(text, text, integer, name)\",\n] as const;\n\nconst ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES = [\n  \"claim_editable_artifact_materializations(text, integer, integer, name)\",\n  \"renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name)\",\n  \"succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamp with time zone, name)\",\n  \"fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name)\",\n] as const;\n\nconst ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES = [\n  \"put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamp with time zone, timestamp with time zone, name)\",\n  \"consume_editable_artifact_live_ticket(text, name)\",\n  \"cleanup_expired_editable_artifact_live_tickets(integer, name)\",\n] as const;\n\nconst ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES = [\n  \"resolve_editable_artifact_ticket_data_schema(name)\",\n] as const;\n\nconst ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES = [\n  \"authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name)\",\n] as const;\n\nconst AUTOMATIC_SESSION_TITLE_FANOUT_RUNTIME_ROUTINES = [\n  \"claim_automatic_session_title_fanout_v1(integer)\",\n  \"mark_automatic_session_title_fanout_delivered_v1(uuid, uuid)\",\n  \"mark_automatic_session_title_fanout_failed_v1(uuid, uuid, text)\",\n] as const;\n\nexport const SUBSCRIPTION_PLAN_MAINTENANCE_INVENTORY_ROUTINE =\n  \"list_subscription_plan_maintenance_accounts(integer)\";\nexport const SUBSCRIPTION_PLAN_FREE_ANNIVERSARY_ROUTINE =\n  \"subscription_plan_free_anniversary(timestamp with time zone, timestamp with time zone)\";\n\n/** Read-only maintenance work checks (migrations 0730 and 0732) and the claim\n * each one previews, which fixes its owner and runtime grant. */\nexport const MAINTENANCE_WORK_PROBE_ROUTINES = [\n  [\"session_workflow_wakes_due_v1()\", \"claim_session_workflow_wakes(integer)\", \"private\"],\n  [\n    \"automatic_session_title_fanout_due_v1()\",\n    \"claim_automatic_session_title_fanout_v1(integer)\",\n    \"private\",\n  ],\n  [\n    \"knowledge_index_due_v1(text, integer)\",\n    \"knowledge_index_claim(text, integer, integer)\",\n    \"target\",\n  ],\n  [\n    \"site_auth_maintenance_due_v1(bigint)\",\n    \"claim_site_auth_maintenance(bigint, integer)\",\n    \"private\",\n  ],\n  [\n    \"sandbox_lease_reaper_due_v1()\",\n    \"reap_sandbox_leases(bigint, bigint, bigint, bigint)\",\n    \"private\",\n  ],\n  [\n    \"sandbox_idle_checkpoint_due_v1(bigint)\",\n    \"list_idle_checkpoint_candidates(integer, bigint)\",\n    \"private\",\n  ],\n  [\"browser_deadline_checkpoint_due_v1()\", \"list_browser_deadline_checkpoints(integer)\", \"private\"],\n  [\n    \"session_system_update_outbox_due_v1()\",\n    \"claim_session_system_update_outbox_v2(integer)\",\n    \"private\",\n  ],\n  [\n    \"session_list_snapshots_expired_v1()\",\n    \"reap_expired_session_list_snapshots(integer)\",\n    \"private\",\n  ],\n  [\n    \"connected_command_reconciliation_due_v1()\",\n    \"claim_connected_machine_background_commands(uuid, integer, bigint, timestamp with time zone)\",\n    \"private\",\n  ],\n  [\n    \"connected_command_output_release_due_v1()\",\n    \"claim_connected_command_output_releases(uuid, integer, bigint, timestamp with time zone)\",\n    \"private\",\n  ],\n  [\n    \"terminal_retained_processes_due_v1()\",\n    \"claim_terminal_retained_processes(uuid, integer, bigint)\",\n    \"private\",\n  ],\n  [\n    \"sandbox_ended_epoch_blockers_due_v1()\",\n    \"list_sandbox_ended_epoch_blockers(integer)\",\n    \"private\",\n  ],\n  [\n    \"sandbox_checkpoint_artifact_gc_due_v1(bigint)\",\n    \"claim_sandbox_checkpoint_artifacts(uuid, integer, bigint)\",\n    \"private\",\n  ],\n] as const;\n\n/** Private predicate projections; never runtime-readable or writable. */\nexport const MAINTENANCE_PROBE_SOURCES = [\n  \"session_workflow_wake_outbox\",\n  \"site_auth_connections\",\n  \"sandbox_leases\",\n  \"sandbox_lease_holders\",\n  \"browser_sessions\",\n  \"session_system_update_outbox\",\n  \"session_list_snapshots\",\n  \"session_background_commands\",\n  \"sandbox_retained_processes\",\n  \"sandbox_workspace_mutation_admissions\",\n  \"sandbox_checkpoint_artifacts\",\n  \"rig_versions\",\n  \"rig_changes\",\n  \"enrollments\",\n  \"sessions\",\n  \"session_turns\",\n] as const;\nexport const MAINTENANCE_PROBE_TABLES = MAINTENANCE_PROBE_SOURCES.map(\n  (name) => `maintenance_probe_${name}`,\n);\nexport const MAINTENANCE_PRIVATE_TABLES = [\n  ...MAINTENANCE_PROBE_TABLES,\n  \"maintenance_claim_capabilities\",\n];\nexport const MAINTENANCE_PROBE_OWNER_ROUTINES = [\n  ...MAINTENANCE_PROBE_TABLES.map((name) => `${name}_sync()`),\n  \"maintenance_probe_output_runner_eligible_v1(uuid, uuid, text)\",\n  \"maintenance_claim_wakes_inner(integer)\",\n  \"maintenance_claim_snapshots_inner(integer)\",\n  \"maintenance_claim_titles_inner(integer)\",\n  \"maintenance_claim_site_auth_inner(bigint, integer)\",\n  \"maintenance_claim_updates_inner(integer)\",\n  \"maintenance_claim_checkpoint_gc_inner(uuid, integer, bigint)\",\n  \"maintenance_claim_checkpoint_settle_inner(uuid, uuid, boolean, text, bigint)\",\n  \"maintenance_claim_checkpoint_prune_inner(bigint, integer)\",\n  \"maintenance_claim_output_release_inner(uuid, integer, bigint, timestamp with time zone)\",\n  \"maintenance_claim_ended_blockers_inner(integer)\",\n  \"maintenance_claim_ended_setup_inner(integer)\",\n  \"maintenance_inventory_retained_inner()\",\n  \"maintenance_inventory_draining_inner()\",\n  \"maintenance_workspace_commands_prepare_inner(uuid, uuid)\",\n  \"maintenance_workspace_commands_prune_inner(uuid, uuid)\",\n  \"maintenance_schedule_cleanup_claim_inner(uuid, integer, integer)\",\n  \"maintenance_schedule_cleanup_settle_inner(uuid, uuid, text)\",\n  \"maintenance_schedule_cleanup_connector_inner(uuid, uuid)\",\n  \"validate_sandbox_checkpoint_refs()\",\n  \"validate_sandbox_checkpoint_artifact_refs()\",\n];\n\nconst MODEL_FACT_CAPABILITY_ROUTINES = [\n  [\n    \"insights_scoped_usage_rows(uuid, uuid, timestamp with time zone, timestamp with time zone, text, uuid[], boolean)\",\n    \"Insights unified usage projection is missing or unsafe\",\n  ],\n  [\n    \"insights_scoped_calls_rows(uuid, uuid, timestamp with time zone, timestamp with time zone, jsonb, timestamp with time zone, uuid, integer, uuid[], boolean)\",\n    \"Insights unified visible calls projection is missing or unsafe\",\n  ],\n  [\n    \"complete_workspace_insights_usage_projection(uuid, timestamp with time zone, timestamp with time zone, text[])\",\n    \"Insights complete usage amount projection is missing or unsafe\",\n  ],\n  [\n    \"workspace_insights_amount_fact_rows(uuid, timestamp with time zone, timestamp with time zone, text, text, uuid, uuid)\",\n    \"Insights amount fact projection is missing or unsafe\",\n  ],\n  [\n    \"organization_model_usage_summary(uuid, timestamp with time zone, timestamp with time zone, uuid)\",\n    \"organization model usage aggregate is missing or unsafe\",\n  ],\n  [\n    \"visible_workspace_insights_model_fact_rows(uuid, timestamp with time zone, timestamp with time zone, text, text, uuid, uuid)\",\n    \"Insights scoped fact projection is missing or unsafe\",\n  ],\n  [\n    \"private_scheduled_task_summaries(uuid, uuid, text, uuid, timestamp with time zone, integer)\",\n    \"private schedule summary capability is missing or unsafe\",\n  ],\n  [\n    \"pause_private_scheduled_task(uuid, uuid, text, uuid)\",\n    \"private schedule pause capability is missing or unsafe\",\n  ],\n] as const;\n\nconst AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE =\n  \"enqueue_automatic_session_title_fanout_v1(uuid, uuid, uuid, uuid)\";\n\nconst AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE =\n  \"enforce_automatic_session_title_policy_v1()\";\nconst AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE = \"automatic_session_title_fanout_outbox_v1\";\nexport const SANDBOX_FILE_PUBLICATION_RUNTIME_ROUTINES = [\n  \"record_sandbox_file_publication(uuid, uuid, uuid, uuid)\",\n  \"list_sandbox_file_publications(uuid, uuid, jsonb)\",\n  \"file_private_to_another(uuid, uuid, uuid)\",\n] as const;\nconst SANDBOX_FILE_PUBLICATIONS_TABLE = \"sandbox_file_publications\";\nexport const ARTIFACT_PIN_RUNTIME_ROUTINES = [\n  \"update_artifact_pin(uuid, uuid, text, text, boolean)\",\n  \"list_artifact_pins(uuid, uuid)\",\n  \"list_sandbox_file_publications_pinned(uuid, uuid, jsonb)\",\n] as const;\nconst ARTIFACT_PINS_TABLE = \"artifact_catalog_pins\";\nexport const SCHEDULED_SLACK_BOT_MESSAGE_RUNTIME_ROUTINES = [\n  \"prepare_scheduled_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, text, text, text)\",\n  \"read_scheduled_slack_bot_message(uuid, uuid, uuid, uuid)\",\n  \"set_organization_slack_bot_access(uuid, uuid, uuid, text, boolean)\",\n  \"set_slack_bot_workspace_access(uuid, uuid, uuid, text, boolean, uuid[])\",\n  \"read_slack_bot_workspace_access(uuid, uuid, uuid)\",\n  \"read_organization_slack_bot_access(uuid, uuid, uuid)\",\n  \"list_organization_slack_bots(uuid, uuid)\",\n  \"prepare_organization_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, uuid, bigint, text, text, text)\",\n  \"read_organization_slack_bot_message(uuid, uuid, uuid, uuid)\",\n] as const;\nconst SCHEDULED_SLACK_BOT_MESSAGES_TABLE = \"scheduled_slack_bot_messages\";\nconst ORGANIZATION_SLACK_BOT_ACCESS_TABLE = \"organization_slack_bot_access\";\nexport const ORGANIZATION_SIGNUP_USE_CASE_RUNTIME_ROUTINES = [\n  \"record_organization_signup_use_case(uuid, text, text)\",\n] as const;\nconst ORGANIZATION_SIGNUP_USE_CASES_TABLE = \"organization_signup_use_cases\";\nexport const SLACK_FILE_UPLOAD_OPERATIONS_TABLE = \"slack_file_upload_operations\";\nconst AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE =\n  \"acquire_automatic_session_title_quarantine_fences_v1(integer)\";\n\nconst MCP_OPERATION_CAPABILITY_ROUTINE = \"mcp_operation_command(jsonb, text, jsonb)\";\nconst MCP_OPERATION_AUTHORITY_TABLES = [\n  \"mcp_operations\",\n  \"sessions\",\n  \"session_turns\",\n  \"session_turn_attempts\",\n  \"workspaces\",\n  \"workspace_inference_controls\",\n  \"organization_memberships\",\n  \"workspace_memberships\",\n  \"external_identity_links\",\n  \"external_link_turn_authorities\",\n  \"host_mcp_turn_authorities\",\n  \"scheduled_task_runs\",\n] as const;\nconst OWNER_INTERNAL_PRIVATE_ROUTINES = new Set<string>([\n  \"sync_usage_maintenance_due()\",\n  \"arm_usage_allowances_for_membership()\",\n  ...MAINTENANCE_PROBE_OWNER_ROUTINES,\n  \"guard_session_title_operation()\",\n  \"subscription_plan_definition(text)\",\n  \"plan_period_usage(plan_credit_periods, timestamp with time zone)\",\n  \"plan_general_balance(uuid)\",\n  \"expire_refunded_plan_credit()\",\n  \"enforce_organization_plan_seats()\",\n  // Migration 0598's Claude pool activation receipt. Readiness no longer\n  // requires it (the retirement migration 0751 dropped the pool routines);\n  // it stays as a receipt the runtime need not execute.\n  \"claude_subscription_pool_protocol_v1_active()\",\n  // M3 PR 2b: run only by the Codex Apps routines as their owner.\n  \"subscription_codex_apps_designation_target(uuid, uuid)\",\n  // M3 PR 3b: the owner capability internals the reset-credit fence calls\n  // and the revision-authority trigger function (triggers fire without the\n  // inserting role holding EXECUTE).\n  \"grant_subscription_codex_owner_capability(text, uuid, uuid, text, uuid)\",\n  \"drop_subscription_codex_owner_capabilities(uuid)\",\n  \"derive_scheduled_revision_subscription_authority()\",\n  // Migration 0707: the provider-neutral writers' owner-only internals.\n  \"subscription_core_writer_context(text, uuid, uuid, text)\",\n  \"grant_subscription_core_owner_capability(text, text, uuid, uuid, text, uuid)\",\n  \"drop_subscription_core_owner_capabilities(text, uuid)\",\n  \"subscription_core_connection_target(text, uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n  // Migration 0871: the usage-history capture triggers and the appender they\n  // run as their owner (triggers fire without the writing role holding EXECUTE).\n  \"capture_usage_reading()\",\n  \"append_usage_reading(uuid, uuid, jsonb)\",\n  \"capture_usage_call()\",\n  // Migration 0712: owner-only trigger functions of the provider cutover\n  // receipts and the provider-neutral cutover-row identity.\n  \"guard_subscription_provider_cutover_receipts()\",\n  \"keep_subscription_cutover_identity()\",\n  // Migration 0907: the invoker-rights trigger that keeps a workspace's own\n  // subscription connection serving only that workspace.\n  \"guard_subscription_workspace_owner_reach()\",\n  // Migration 0716: the authority marker and compatibility guards, the\n  // per-path source resolvers and the deferred compatibility check. The\n  // triggers fire without the writing role holding EXECUTE.\n  \"stamp_subscription_authority_inserted_at()\",\n  \"keep_subscription_authority_inserted_at()\",\n  \"subscription_authority_compat_entry_valid(jsonb)\",\n  \"guard_subscription_authority_compat()\",\n  \"subscription_compat_turn_human(uuid, uuid)\",\n  \"subscription_compat_v2_has_entry(jsonb, text)\",\n  \"subscription_compat_receiver_source(uuid, uuid)\",\n  \"subscription_compat_delivery_sources(uuid, uuid, uuid, uuid, text)\",\n  \"subscription_compat_compaction_source(uuid, uuid)\",\n  \"subscription_compat_scheduled_source(uuid, uuid)\",\n  \"subscription_compat_carrier_sources(text, uuid, uuid, bigint)\",\n  \"subscription_compat_carrier_state(text, uuid, uuid, bigint)\",\n  \"subscription_compat_record(text, text, uuid, uuid, bigint)\",\n  \"subscription_compat_expected(text, timestamp with time zone, uuid, text, uuid, bigint, text)\",\n  \"subscription_compat_carrier_expected(text, timestamp with time zone, text, uuid, uuid, bigint)\",\n  \"subscription_compat_enter_scope(uuid, uuid)\",\n  \"subscription_compat_leave_scope(text[])\",\n  \"subscription_compat_effective(text, text, uuid, uuid, bigint)\",\n  \"enforce_subscription_authority_compat()\",\n  // Migration 0717: the fences' helpers (the v2 copy rule, a scheduled\n  // firing's v2 value and the personal-entry liveness check), called only by\n  // owner-run fences and functions.\n  \"subscription_v2_copy_matches(jsonb, jsonb)\",\n  \"subscription_scheduled_firing_v2(uuid, uuid, uuid, bigint)\",\n  \"subscription_personal_entry_serviceable(uuid, jsonb)\",\n  \"subscription_scheduled_run_personal_entries(uuid, uuid, uuid)\",\n  // Migration 0689: the owner-only Codex cutover receipt and the trigger that\n  // seeds organizations created later onto the shared core.\n  \"subscription_codex_cutover_v1_active()\",\n  \"seed_subscription_codex_cutover()\",\n  \"keep_subscription_codex_cutover_identity()\",\n  // 0689's plan-change and auto-assignment trigger functions, under the\n  // provider-free names migration 0751 gives them.\n  \"record_subscription_core_plan_change()\",\n  \"auto_assign_subscription_core_workspace()\",\n  \"auto_assign_subscription_core_personal_workspace()\",\n  \"read_sender_connection(uuid, uuid, uuid, text)\",\n  // Migration 0713: the provider-keyed auto-assignment apply path, run by\n  // the two auto-assignment trigger functions as their owner.\n  \"apply_subscription_core_auto_assignments(text, uuid, uuid, boolean)\",\n  // Lifecycle fact writers (migrations 0532 and 0565): owner-run trigger\n  // functions and the migration-owner backfill. Runtime roles may still hold\n  // EXECUTE until a follow-up migration revokes it once no pre-0565 binary\n  // can run; this binary no longer requires it.\n  \"capture_product_lifecycle_fact()\",\n  \"observe_credit_grant()\",\n  \"backfill_product_lifecycle_facts(text, integer)\",\n  \"validate_mcp_account_bindings(jsonb, jsonb)\",\n  \"fence_mcp_account_bindings()\",\n  \"guard_mcp_operation_immutable()\",\n  \"mcp_operation_command_scoped(jsonb, text, jsonb)\",\n  \"guard_workspace_owned_skill_head_delete()\",\n  \"guard_workspace_owned_skill_history_delete()\",\n  // Migration 0782: the owner-run trigger that leaves a release hold when a\n  // published Site's hostname row is deleted (the app cannot write holds).\n  \"hold_deleted_site_hostname()\",\n  ...ARTIFACT_OUTBOX_CAPABILITY_ROUTINES,\n  ...ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES,\n  ...ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES,\n]);\n\nconst KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE =\n  \"knowledge_source_sync_lock_authority(uuid, uuid, uuid)\";\nconst GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE =\n  \"google_drive_file_authorized(uuid, uuid, text, uuid)\";\nconst GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE =\n  \"google_drive_document_citation(uuid, uuid, text, uuid, uuid)\";\nconst GOOGLE_DRIVE_AUTHORITY_TABLES = [\n  \"connections\",\n  \"files\",\n  \"google_drive_object_acl_evidence\",\n  \"google_drive_object_acl_principals\",\n  \"knowledge_document_versions\",\n  \"knowledge_providers\",\n  \"knowledge_source_objects\",\n  \"knowledge_source_sync_index_obligations\",\n  \"knowledge_source_sync_states\",\n  \"knowledge_sources\",\n] as const;\nconst KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES = [\n  \"knowledge_sources\",\n  \"knowledge_source_objects\",\n] as const;\nconst MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE =\n  \"ensure_managed_human_personal_workspace(uuid, text, uuid)\";\nconst ADDITIONAL_ORGANIZATION_CREATION_ROUTINE =\n  \"create_additional_managed_organization(text, text, text, text, uuid)\";\nconst ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES = [\n  \"get_external_identity_link_reference(uuid, uuid, text)\",\n  \"get_external_identity_link_inventory_references(uuid, uuid[])\",\n  \"ensure_external_identity(uuid, text, text)\",\n  \"lookup_external_identity(uuid, text, text, text)\",\n  \"prepare_external_workspace_membership_operation(jsonb)\",\n  \"record_external_workspace_membership_operation(jsonb, jsonb)\",\n  \"list_self_organization_memberships(text)\",\n  \"list_self_organization_invitations(text)\",\n  \"list_self_organization_invitations(text, uuid, integer)\",\n  \"get_self_organization_invitation(text, uuid)\",\n  \"list_organization_invitations(uuid, text, uuid, integer)\",\n  \"list_organization_members(uuid, text)\",\n  \"list_organization_administration_members(uuid, text)\",\n  \"get_organization_administration_overview(uuid, text)\",\n  \"get_workspace_kind(uuid, uuid)\",\n  \"resolve_workspace_codex_subscription_source(uuid, uuid)\",\n  \"capture_legacy_codex_turn_sources(uuid, uuid)\",\n  \"list_organization_workspace_ids(uuid)\",\n  \"list_organization_codex_workspace_ids(uuid)\",\n  \"list_organization_subscription_workspace_ids(uuid)\",\n  \"organization_workspace_command(jsonb)\",\n  \"authorize_organization_shared_workspace_administration(uuid, uuid, text)\",\n  \"resolve_organization_workspace_removal_subject(uuid, text, uuid)\",\n  \"prepare_organization_workspace_member_removal(jsonb)\",\n  \"record_organization_workspace_member_removal(jsonb, uuid, uuid)\",\n  ADDITIONAL_ORGANIZATION_CREATION_ROUTINE,\n  \"create_managed_organization(text, text, text, uuid)\",\n  \"assert_organization_shared_workspace_administrator(uuid, uuid, text)\",\n  \"open_organization_shared_workspace_administration_capability(uuid, uuid, text)\",\n  \"close_organization_shared_workspace_administration_capability(uuid)\",\n  \"create_organization_shared_workspace(uuid, text, text, text, text, uuid)\",\n  \"upsert_organization_shared_workspace_member(uuid, uuid, text, uuid, text, text, jsonb, boolean)\",\n  \"update_organization_name(uuid, text, text, timestamp with time zone, uuid)\",\n  \"create_organization_invitation_v2(jsonb)\",\n  \"bind_pending_organization_invitations_for_verified_email(text, text)\",\n  \"has_pending_organization_invitation_for_subject(text)\",\n  \"accept_organization_invitation_v2(jsonb)\",\n  \"complete_self_service_organization_setup(jsonb)\",\n  \"ensure_organization_user_setup_intent(jsonb)\",\n  \"claim_organization_user_setup_delivery(jsonb)\",\n  \"claim_organization_user_setup_delivery_v2(jsonb)\",\n  \"prepare_organization_user_setup_delivery(jsonb)\",\n  \"prepare_organization_user_setup_delivery_v2(jsonb)\",\n  \"settle_organization_user_setup_delivery(jsonb)\",\n  \"preview_organization_user_setup(text)\",\n  \"get_organization_invitation_for_administration(uuid, text, uuid)\",\n  \"preflight_organization_user_setup(text)\",\n  \"complete_organization_user_setup(jsonb)\",\n  \"organization_membership_command(jsonb)\",\n  \"prepare_organization_membership_protocol_settlements(jsonb)\",\n  \"assert_active_managed_human_organization_membership(uuid, text)\",\n  \"resolve_workspace_writer_grant_identity(uuid, text)\",\n  \"prepare_workspace_membership_removal_settlements(jsonb)\",\n  \"workspace_membership_removal_command(jsonb)\",\n  \"get_organization_retention_policy(uuid, text)\",\n  \"preview_organization_retention_deletions(uuid, integer)\",\n  \"claim_organization_retention_deletion(uuid, uuid, uuid[])\",\n  \"list_organization_retention_deletion_objects(uuid, uuid, uuid, text, integer)\",\n  \"record_organization_retention_object_deleted(uuid, uuid, uuid, text, text, text, text)\",\n  \"fail_organization_retention_deletion(uuid, uuid, uuid, text)\",\n  \"finalize_organization_retention_deletion(uuid, uuid, uuid, text)\",\n  \"complete_organization_retention_deletion(uuid, uuid, uuid, text)\",\n] as const;\nconst ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES = [\n  \"organization_invitation_binding_events\",\n  \"organization_membership_invitations\",\n  \"organization_membership_lifecycle_events\",\n  \"organization_membership_operation_receipts\",\n  \"organization_memberships\",\n  \"organization_profile_events\",\n  \"organization_shared_workspace_administration_capabilities\",\n  \"organization_user_setup_deliveries\",\n  \"organization_user_setup_delivery_attempts\",\n  \"organization_user_setup_intents\",\n  \"organization_user_resource_authorities\",\n  \"organization_user_resource_grants\",\n  \"organization_user_retention_deletion_events\",\n  \"organization_user_retention_deletions\",\n  \"organization_user_retention_object_deletion_receipts\",\n  \"organization_user_retention_object_obligations\",\n  \"organization_user_retention_policies\",\n  \"organization_workspace_lifecycle_events\",\n  \"organization_workspace_operation_receipts\",\n  \"self_service_organization_setup_receipts\",\n] as const;\nconst ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES = [\n  ...ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES,\n  \"additional_organization_creation_receipts\",\n] as const;\nconst PRIVATE_SESSION_CREATE_POLICY_ROUTINE = \"get_private_session_create_policy(uuid, uuid, text)\";\nconst ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE =\n  \"get_organization_private_session_settings(uuid, text)\";\nconst ORGANIZATION_PRIVATE_SESSION_SETTINGS_UPDATE_ROUTINE =\n  \"update_organization_private_session_settings(uuid, text, boolean, bigint, uuid)\";\nconst ORGANIZATION_PRIVATE_SESSION_ROUTINE_AUTHORITY_TABLES = {\n  [PRIVATE_SESSION_CREATE_POLICY_ROUTINE]: [\n    \"organization_memberships\",\n    \"organization_private_session_settings\",\n    \"session_tenancy_activations\",\n    \"workspace_memberships\",\n    \"workspaces\",\n  ],\n  [ORGANIZATION_PRIVATE_SESSION_SETTINGS_READ_ROUTINE]: [\n    \"managed_accounts\",\n    \"organization_memberships\",\n    \"organization_private_session_settings\",\n    \"session_tenancy_activations\",\n  ],\n  [ORGANIZATION_PRIVATE_SESSION_SETTINGS_UPDATE_ROUTINE]: [\n    \"managed_accounts\",\n    \"organization_memberships\",\n    \"organization_private_session_setting_events\",\n    \"organization_private_session_settings\",\n    \"session_tenancy_activations\",\n  ],\n} as const;\nconst ORGANIZATION_PRIVATE_SESSION_ROUTINES = Object.keys(\n  ORGANIZATION_PRIVATE_SESSION_ROUTINE_AUTHORITY_TABLES,\n);\nconst ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE = \"organization_private_sessions_enabled(uuid)\";\n/** Operator-only audited setter for the trial-credit kill switch (migration 0521). */\nconst VERIFIED_SIGNUP_TRIAL_SWITCH_SETTER_ROUTINE =\n  \"set_verified_signup_trial_credits_enabled(boolean, text, text)\";\nconst VERIFIED_SIGNUP_TRIAL_SWITCH_TABLE = \"verified_signup_trial_switch_revisions\";\n/** Operator-only audited setter for the new-account sign-up switch (migration 0585). */\nconst MANAGED_AUTH_NEW_SIGNUPS_SWITCH_SETTER_ROUTINE =\n  \"set_managed_auth_new_signups_enabled(boolean, text, text)\";\nconst MANAGED_AUTH_NEW_SIGNUPS_SWITCH_TABLE = \"managed_auth_new_signups_switch_revisions\";\nconst PREFERENCE_KNOWLEDGE_PROPOSAL_ROUTINE =\n  \"preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamp with time zone, text)\";\nconst PREFERENCE_KNOWLEDGE_PROPOSAL_AUTHORITY_TABLES = [\n  \"company_brain_preference_proposal_receipts\",\n  \"knowledge_change_proposals\",\n  \"knowledge_claim_evidence\",\n  \"knowledge_claim_reviews\",\n  \"knowledge_claims\",\n  \"preference_registry_events\",\n  \"preference_registry_preferences\",\n  \"preference_registry_revisions\",\n  \"session_attempt_interruptions\",\n  \"session_turn_attempts\",\n  \"session_turns\",\n  \"sessions\",\n  \"workspaces\",\n] as const;\nconst MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES = [\n  \"organization_memberships\",\n  \"organization_user_retention_policies\",\n  \"organization_user_resource_authorities\",\n  \"organization_user_resource_grants\",\n] as const;\nconst PERSONAL_RESOURCE_ATTEMPT_RESOLVER_ROUTINE =\n  \"resolve_session_attempt_personal_resources(uuid, uuid, uuid)\";\nconst USER_RESOURCE_LIFECYCLE_ROUTINES = [\n  \"list_owned_connection_accounts(uuid, uuid)\",\n  \"accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)\",\n  \"list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)\",\n  \"issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)\",\n  \"revoke_self_user_resource_grant(uuid, uuid, uuid)\",\n  \"authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)\",\n] as const;\nconst CONNECTION_CONVERGENCE_AUDIT_CAPABILITY_ROUTINE =\n  \"connection_authority_convergence_audit_capability_active(uuid)\";\nconst CONNECTION_AUTHORITY_ROUTINES = [\n  CONNECTION_CONVERGENCE_AUDIT_CAPABILITY_ROUTINE,\n  \"resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)\",\n  \"inspect_organization_connection_authority_convergence(uuid, integer, uuid)\",\n] as const;\nconst PERSONAL_GITHUB_REPOSITORY_AUTHORITY_ROUTINES = [\n  \"get_self_personal_github_repository_selection(uuid, uuid, text, uuid)\",\n  \"mutate_self_personal_github_repository_selection(uuid, uuid, text, uuid, bigint, bigint, text, jsonb, boolean)\",\n] as const;\nconst PERSONAL_GITHUB_REPOSITORY_AUTHORITY_TABLES = [\n  \"personal_github_repository_selection_heads\",\n  \"personal_github_repository_selection_operations\",\n  \"personal_github_repository_selections\",\n] as const;\nconst SCHEDULED_PERSONAL_RESOURCE_ROUTINES = [\n  \"freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint)\",\n  \"clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint)\",\n  \"create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb)\",\n  \"materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text)\",\n  \"scheduled_task_run_personal_resource_authority(uuid, uuid, uuid)\",\n  \"scheduled_task_run_connection_authority_subject(uuid, uuid, uuid)\",\n  \"scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint)\",\n  \"record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint)\",\n  \"clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint)\",\n  \"scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint)\",\n  \"scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint)\",\n  \"validate_scheduled_agent_run_live_authority(uuid, uuid, uuid)\",\n  \"scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid)\",\n  \"scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)\",\n  \"bind_scheduled_task_run_session(uuid, uuid, uuid, uuid)\",\n  \"transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text)\",\n] as const;\nconst PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE =\n  \"personal_resource_delegation_capability_active(text)\";\nconst PERSONAL_RESOURCE_CAPABILITY_TABLE = \"personal_resource_delegation_capabilities\";\nconst SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE =\n  \"scheduled_personal_resource_capability_active(text)\";\nconst SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE = \"scheduled_personal_resource_capabilities\";\nconst VARIABLE_SET_CAPABILITY_PREDICATE_ROUTINE = \"variable_set_authority_capability_active(text)\";\nconst VARIABLE_SET_CAPABILITY_TABLE = \"variable_set_authority_capabilities\";\nconst SITE_CANCELLATION_CAPABILITY_TABLE = \"site_session_cancellation_capabilities\";\nconst SITE_CANCELLATION_PREDICATE =\n  \"site_session_cancellation_capability_active(uuid, uuid, uuid, uuid)\";\nconst SITE_CANCELLATION_PRIVATE_ROUTINES = [\n  \"begin_site_session_cancellation(uuid, uuid, uuid, uuid)\",\n  \"end_site_session_cancellation(uuid)\",\n] as const;\nconst PERSONAL_DOCUMENT_CAPABILITY_PREDICATE_ROUTINE =\n  \"personal_document_authority_capability_active(text)\";\nconst PERSONAL_DOCUMENT_CAPABILITY_TABLE = \"personal_document_authority_capabilities\";\nconst PERSONAL_DOCUMENT_AUTHORITY_ROUTINES = [\n  \"create_personal_document_authority(uuid, uuid, uuid)\",\n  \"resolve_document_original_file(uuid, uuid, text, uuid)\",\n  \"resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)\",\n] as const;\nconst DOCUMENT_MIGRATION_CAPABILITY_PREDICATE_ROUTINE =\n  \"document_migration_capability_active(text)\";\nconst DOCUMENT_MIGRATION_CAPABILITY_TABLE = \"document_migration_capabilities\";\nconst DOCUMENT_MIGRATION_AUTHORITY_ROUTINES = [\n  \"list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)\",\n  \"reclassify_document_authority(jsonb)\",\n  \"run_document_default_collection_backfill(jsonb)\",\n  \"list_document_default_collection_backfill_runs(jsonb)\",\n  \"get_document_default_collection_backfill_audit(jsonb)\",\n  \"list_organization_document_authority_reclassifications(jsonb)\",\n] as const;\nconst DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES = [\n  \"document_migration_audit_capability_active(text)\",\n  \"assert_document_migration_audit_authority(jsonb)\",\n] as const;\nconst VARIABLE_SET_AUTHORITY_ROUTINES = [\n  \"create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)\",\n  \"list_scoped_variable_sets(uuid, uuid, uuid, text, text)\",\n  \"count_scoped_variable_sets(uuid, uuid, text)\",\n  \"mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean)\",\n  \"read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer)\",\n  \"materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)\",\n  \"materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid)\",\n] as const;\nconst VAULT_CAPABILITY_PREDICATE_ROUTINE = \"vault_authority_capability_active(text)\";\nconst VAULT_CAPABILITY_TABLE = \"vault_authority_capabilities\";\n/** Vault routines (0739): the application role's only way into the vault tables. */\nexport const VAULT_RUNTIME_ROUTINES = [\n  \"list_vaults_for_subject(uuid, jsonb)\",\n  \"get_vault_for_subject(uuid, jsonb)\",\n  \"create_vault(jsonb, jsonb)\",\n  \"update_vault(uuid, bigint, jsonb, jsonb)\",\n  \"delete_vault(uuid, text, boolean, jsonb)\",\n  \"ensure_default_vault(uuid, text, jsonb)\",\n  \"ensure_task_vault(uuid, uuid, jsonb)\",\n  \"list_vault_items(uuid, text, text, boolean, text, integer, jsonb)\",\n  \"get_vault_item(uuid, jsonb)\",\n  \"upsert_vault_item(jsonb, jsonb)\",\n  \"archive_vault_item(uuid, jsonb)\",\n  \"restore_vault_item(uuid, jsonb)\",\n  \"delete_vault_item_permanently(uuid, jsonb)\",\n  \"move_vault_item(uuid, uuid, text, text, jsonb)\",\n  \"read_vault_field_ciphertext(uuid, integer, text, jsonb, jsonb)\",\n  \"list_vault_field_versions(uuid, jsonb)\",\n  \"resolve_secret_reference_candidates(jsonb, jsonb)\",\n  \"record_vault_secret_use(jsonb, jsonb, jsonb)\",\n  \"set_session_vault_policy(uuid, jsonb, jsonb)\",\n  \"session_secrets_view(uuid, jsonb)\",\n  \"update_passkey_sign_count(uuid, bigint, jsonb)\",\n  \"lease_vault_passkeys(jsonb, text, integer)\",\n  \"release_vault_passkey_leases(text, jsonb)\",\n  \"upsert_provider_vault_items(uuid, text, jsonb, jsonb)\",\n  \"set_vault_sync_status(uuid, jsonb, jsonb)\",\n  \"apply_secret_answers(uuid, uuid, jsonb, jsonb)\",\n  \"link_provider_vault(jsonb, jsonb)\",\n  \"provider_vault_sync_target(uuid, jsonb)\",\n  \"provider_vault_item_ref(uuid, uuid, text, jsonb)\",\n  \"provider_connection_home_workspace(uuid)\",\n] as const;\n/** Vault tables (0739): FORCE row security, no application-role privileges. */\nexport const VAULT_TABLES = [\n  \"vaults\",\n  \"vault_items\",\n  \"vault_item_fields\",\n  \"vault_field_versions\",\n  \"vault_item_name_aliases\",\n  \"vault_name_aliases\",\n  \"vault_passkey_leases\",\n] as const;\nconst SCOPED_COMPUTE_CAPABILITY_PREDICATE_ROUTINE = \"scoped_compute_capability_active(text)\";\nconst SCOPED_COMPUTE_CAPABILITY_TABLE = \"scoped_compute_capabilities\";\nconst CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE = \"connection_tenancy_backfill_capabilities\";\nconst CONNECTION_TENANCY_BACKFILL_CAPABILITY_PREDICATE_ROUTINE =\n  \"connection_tenancy_backfill_capability_active(uuid)\";\nconst SCOPED_COMPUTE_AUTHORITY_ROUTINES = [\n  \"create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean)\",\n  \"list_scoped_rigs(uuid, uuid, uuid, text, text)\",\n  \"count_scoped_rigs(uuid, uuid, text)\",\n  \"mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean)\",\n  \"finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean)\",\n  \"list_scoped_enrollments(uuid, uuid, uuid, text)\",\n  \"get_scoped_sandbox(uuid, uuid, uuid)\",\n  \"get_session_machine_access(uuid, uuid, uuid)\",\n  \"authorize_scoped_sandbox_attach(uuid, uuid, uuid)\",\n  \"materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer)\",\n  \"authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid)\",\n  \"assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean)\",\n  \"consent_session_turn_personal_machine(uuid, uuid, uuid, uuid)\",\n  \"get_session_attempt_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, boolean, boolean)\",\n  \"list_scoped_machine_dependent_sessions(uuid, uuid, uuid)\",\n  \"detach_scoped_machine_dependent_sessions(uuid, uuid, uuid)\",\n  \"preview_connected_machine_audience_change(uuid, uuid, uuid, text, text, boolean)\",\n  \"change_connected_machine_audience(uuid, uuid, uuid, bigint, text, text, boolean)\",\n] as const;\nconst CANONICAL_HUMAN_IDENTITY_ROUTINES = [\n  \"mutate_managed_sign_in_method(text, text, jsonb)\",\n  \"assert_managed_sign_in_recovery(text, text, uuid, jsonb)\",\n  \"replay_managed_sign_in_method(text, text, jsonb)\",\n  \"claim_managed_sign_in_notification(uuid, text, text, integer)\",\n  \"settle_managed_sign_in_notification(uuid, uuid, text)\",\n  \"ensure_canonical_human_identity(text, text)\",\n  \"validate_canonical_human_session(text, text, boolean)\",\n  \"get_canonical_human_identity_projection(text)\",\n  \"apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)\",\n] as const;\nconst CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES = [\n  \"canonical_human_identities\",\n  \"canonical_human_identity_subjects\",\n  \"canonical_human_login_bindings\",\n  \"canonical_human_identity_operations\",\n] as const;\nconst MANAGED_AUTH_SESSION_SET_ROUTINES = [\n  \"get_canonical_human_exact_login_binding(text, text)\",\n  \"managed_auth_session_set_authority_state(text)\",\n  \"managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)\",\n  \"managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)\",\n  \"managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)\",\n  \"managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)\",\n  \"managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)\",\n  \"managed_auth_actor_mutation_fence(text, bigint, uuid)\",\n  \"managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)\",\n  \"managed_auth_actor_mutation_lease_release(text, uuid)\",\n  \"managed_auth_actor_mutation_lease_validate(text, bigint, uuid)\",\n  \"managed_auth_adopted_session_snapshot(text)\",\n  \"managed_auth_isolated_session_reap(integer)\",\n  \"managed_auth_expired_session_set_reap(integer)\",\n  \"managed_auth_session_set_operation_receipt(text, uuid, text, text)\",\n] as const;\nconst MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES = [\n  \"managed_auth_actor_mutation_leases\",\n  \"managed_auth_browser_installations\",\n  \"managed_auth_session_sets\",\n  \"managed_auth_login_slots\",\n  \"managed_auth_login_return_intents\",\n  \"managed_auth_login_transaction_rate_limits\",\n  \"managed_auth_login_transactions\",\n  \"managed_auth_session_set_operations\",\n] as const;\nconst ORGANIZATION_RECOVERY_ROUTINES = [\n  \"get_organization_recovery_overview(uuid, text, jsonb, text, text)\",\n  \"organization_recovery_command(jsonb)\",\n] as const;\nconst ORGANIZATION_RECOVERY_AUTHORITY_TABLES = [\n  \"organization_recovery_approvals\",\n  \"organization_recovery_command_receipts\",\n  \"organization_recovery_custodian_acceptances\",\n  \"organization_recovery_custodians\",\n  \"organization_recovery_events\",\n  \"organization_recovery_notification_attempts\",\n  \"organization_recovery_notification_outbox\",\n  \"organization_recovery_operations\",\n  \"organization_recovery_policies\",\n  \"organization_recovery_policy_heads\",\n] as const;\nconst SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE =\n  \"session_private_actor_visible(uuid, uuid, uuid, text)\";\nconst SESSION_PRIVATE_ACTOR_VISIBLE_KEYS_ROUTINE = \"session_private_actor_visible_keys()\";\nconst SESSION_REFERENCE_VISIBLE_ROUTINE = \"session_reference_visible(uuid, uuid, uuid)\";\nconst TASK_NOTE_CAPABILITY_ROUTINES = [\n  \"create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)\",\n  \"archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)\",\n  \"list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)\",\n  \"replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)\",\n  \"resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)\",\n] as const;\nexport const WORK_CLAIM_CAPABILITY_ROUTINES = [\n  \"upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)\",\n  \"release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)\",\n] as const;\nconst COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE =\n  \"company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer)\";\nconst COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE =\n  \"company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamp with time zone, uuid, integer)\";\nconst GOVERNED_LEARNING_EVALUATION_ROUTINE =\n  \"evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)\";\nconst GOVERNED_LEARNING_ACTIVATION_ROUTINES = [\n  \"undo_governed_learning_activation(uuid, uuid, uuid, uuid)\",\n] as const;\nconst GOVERNED_LEARNING_INSPECTION_ROUTINES = [\n  \"inspect_governed_learning_decisions(uuid, uuid, text, integer)\",\n  \"inspect_governed_learning_activations(uuid, uuid, text, integer)\",\n  \"inspect_governed_learning_activation_undos(uuid, uuid, text, integer)\",\n] as const;\nconst GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES = [\n  \"governed_learning_decision_receipts\",\n  \"governed_learning_activation_receipts\",\n  \"governed_learning_activation_undo_receipts\",\n  \"sessions\",\n] as const;\nconst COMPANY_PROFILE_AGENT_ADMIN_ROUTINES = [\n  \"propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)\",\n  \"propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text)\",\n  \"confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)\",\n  \"get_company_profile_agent_policy(uuid, uuid, text)\",\n  \"update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid)\",\n] as const;\nconst COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES = [\n  \"company_profile_activation_events\",\n  \"company_profile_agent_automatic_activation_receipts\",\n  \"company_profile_agent_confirmation_receipts\",\n  \"company_profile_agent_proposal_receipts\",\n  \"company_profile_heads\",\n  \"company_profile_revisions\",\n  \"managed_accounts\",\n  \"organization_company_profile_agent_policies\",\n  \"organization_company_profile_agent_policy_events\",\n  \"organization_memberships\",\n  \"session_human_input_requests\",\n  \"session_turn_attempts\",\n  \"session_turns\",\n  \"sessions\",\n  \"workspaces\",\n] as const;\nconst GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES = [\n  \"document_chunks\",\n  \"documents\",\n  \"governed_learning_decision_receipts\",\n  \"knowledge_change_proposals\",\n  \"knowledge_claim_evidence\",\n  \"knowledge_claim_relations\",\n  \"knowledge_claim_reviews\",\n  \"knowledge_claims\",\n  \"knowledge_document_versions\",\n  \"knowledge_providers\",\n  \"knowledge_source_acl_versions\",\n  \"knowledge_source_objects\",\n  \"knowledge_sources\",\n  \"session_attempt_interruptions\",\n  \"session_turn_attempts\",\n  \"session_turns\",\n  \"sessions\",\n  \"task_notes\",\n  \"workspace_learning_policy_snapshots\",\n  \"workspaces\",\n] as const;\nconst GOVERNED_LEARNING_ACTIVATION_AUTHORITY_TABLES = [\n  ...GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES,\n  \"company_brain_preference_proposal_receipts\",\n  \"governed_learning_activation_receipts\",\n  \"governed_learning_activation_undo_receipts\",\n  \"preference_registry_events\",\n  \"preference_registry_preferences\",\n  \"preference_registry_revisions\",\n  \"remember_knowledge_confirmation_receipts\",\n  \"remember_knowledge_memory_materializations\",\n  \"session_human_input_requests\",\n  \"workspace_instruction_policy_activation_events\",\n  \"workspace_instruction_policy_deactivation_events\",\n  \"workspace_instruction_policy_heads\",\n  \"workspace_instruction_policy_onboarding_proposals\",\n  \"workspace_instruction_policy_revisions\",\n  \"workspace_learning_policy_heads\",\n  \"workspace_learning_policy_revisions\",\n] as const;\nconst TRANSITION_SESSION_VISIBILITY_ROUTINE =\n  \"transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer)\";\n/** Migration 0768: owner-only read of what a private change would still refuse. */\nconst SESSION_VISIBILITY_CHANGE_BLOCKER_ROUTINE =\n  \"session_visibility_change_blocker(uuid, uuid, uuid)\";\n/** Migration 0769: owner-only counts of other people's access a private change drops. */\nconst SESSION_VISIBILITY_FOREIGN_AUTHORITY_ITEMS_ROUTINE =\n  \"session_visibility_foreign_authority_items(uuid, uuid, uuid)\";\nconst LEGACY_FORK_SESSION_CONTENT_ROUTINE =\n  \"fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer)\";\nconst FORK_SESSION_CONTENT_ROUTINE =\n  \"fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)\";\nconst MESSAGE_FORK_SESSION_CONTENT_ROUTINE =\n  \"fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, uuid)\";\nconst REPLAY_APPLIED_SESSION_FORK_ROUTINE =\n  \"replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)\";\nconst SESSION_TENANCY_ACTIVATED_ROUTINE = \"session_tenancy_product_activated(uuid, integer)\";\nconst SESSION_TENANCY_ANY_ACTIVATION_ROUTINE = \"session_tenancy_any_product_activation()\";\nconst SESSION_TENANCY_QUIESCENCE_ROUTINE =\n  \"assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean)\";\nconst TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE =\n  \"check_tenancy_backfill_activation_evidence(uuid)\";\nconst GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE =\n  \"activate_greenfield_session_tenancy_from_setup(text)\";\nconst ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE =\n  \"activate_session_tenancy_from_additional_organization(uuid)\";\nconst SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE =\n  \"session_visibility_lifecycle_capability_held()\";\nconst PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES = [\n  \"open_private_session_create_capability(uuid, uuid, uuid, text)\",\n  \"open_private_child_session_create_capability(uuid, uuid, uuid, uuid, uuid, uuid, integer)\",\n  \"close_private_session_create_capability(uuid)\",\n] as const;\nconst SESSION_AUTHORITY_ROUTINES = new Set<string>([\n  \"create_agent_child_session(uuid, uuid, uuid, uuid, uuid, integer, jsonb)\",\n  \"lock_live_native_original_origin_v2(jsonb)\",\n  \"modal_native_origin_member_read_active(uuid, text)\",\n  LEGACY_FORK_SESSION_CONTENT_ROUTINE,\n  FORK_SESSION_CONTENT_ROUTINE,\n  MESSAGE_FORK_SESSION_CONTENT_ROUTINE,\n  REPLAY_APPLIED_SESSION_FORK_ROUTINE,\n  SESSION_TENANCY_ACTIVATED_ROUTINE,\n  SESSION_TENANCY_ANY_ACTIVATION_ROUTINE,\n  SESSION_TENANCY_QUIESCENCE_ROUTINE,\n  PERSONAL_RESOURCE_ATTEMPT_RESOLVER_ROUTINE,\n  ...USER_RESOURCE_LIFECYCLE_ROUTINES,\n  ...CONNECTION_AUTHORITY_ROUTINES,\n  ...SCHEDULED_PERSONAL_RESOURCE_ROUTINES,\n  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,\n  SESSION_PRIVATE_ACTOR_VISIBLE_KEYS_ROUTINE,\n  SESSION_REFERENCE_VISIBLE_ROUTINE,\n  SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE,\n  ...PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES,\n  TRANSITION_SESSION_VISIBILITY_ROUTINE,\n  SESSION_VISIBILITY_CHANGE_BLOCKER_ROUTINE,\n  SESSION_VISIBILITY_FOREIGN_AUTHORITY_ITEMS_ROUTINE,\n  ...TASK_NOTE_CAPABILITY_ROUTINES,\n  ...WORK_CLAIM_CAPABILITY_ROUTINES,\n  COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE,\n  COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE,\n]);\nconst XAI_SNAPSHOT_VALIDATOR_ROUTINE = \"xai_provider_account_authority_snapshot_v1_valid(jsonb)\";\nconst CLAUDE_SNAPSHOT_VALIDATOR_ROUTINE =\n  \"claude_provider_account_authority_snapshot_v1_valid(jsonb)\";\n/**\n * The immutable v1 snapshot CHECK validators. They outlive the retired pool\n * routines (migration 0751): the v1 columns and their constraints stay until\n * M6, so the runtime role keeps EXECUTE and PUBLIC does not.\n */\nexport const SUBSCRIPTION_SNAPSHOT_VALIDATOR_ROUTINES = [\n  XAI_SNAPSHOT_VALIDATOR_ROUTINE,\n  CLAUDE_SNAPSHOT_VALIDATOR_ROUTINE,\n] as const;\n/**\n * Migration 0707: the provider-neutral subscription-core routines (the\n * provider is their first argument). The runtime requires them; each is a\n * SECURITY DEFINER routine the runtime role executes and PUBLIC does not.\n */\nexport const SUBSCRIPTION_CORE_NEUTRAL_PRIVATE_ROUTINES = [\n  \"subscription_core_owner_capability_held(text, uuid, text[], text, uuid, boolean)\",\n  \"subscription_core_owner_membership_held(uuid, uuid)\",\n  \"subscription_core_refresh_write_allowed(text, uuid, uuid, uuid)\",\n  \"begin_subscription_core_refresh(text, uuid, uuid, uuid, uuid, text, text, uuid, text, bigint)\",\n  \"persist_subscription_core_refresh(text, uuid, uuid, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n  \"persist_subscription_core_refresh_with_plan(text, uuid, uuid, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone, text)\",\n  \"fail_subscription_core_refresh(text, uuid, uuid, uuid, uuid, uuid, bigint, text)\",\n  \"quarantine_subscription_core_connection(text, uuid, uuid, uuid, uuid, uuid, text, bigint, bigint, text, text, timestamp with time zone)\",\n  \"recover_subscription_core_connection_health(text, uuid, uuid, uuid, uuid)\",\n  \"subscription_core_acceptance_authority_v2(text, uuid, uuid, uuid, text)\",\n  \"subscription_core_task_authority_v2(text, uuid, uuid, uuid, text)\",\n  \"subscription_core_revision_authority_v2(uuid, uuid, uuid, bigint)\",\n  \"read_subscription_core_connection_credential(text, uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n  \"begin_subscription_core_connection_refresh(text, uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n  \"persist_subscription_core_connection_refresh(text, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n  \"fail_subscription_core_connection_refresh(text, uuid, uuid, uuid, bigint, text)\",\n  \"connect_subscription_core_personal(text, uuid, uuid, text, text, text, text, text, jsonb, timestamp with time zone, timestamp with time zone, text, text, text)\",\n  \"disconnect_subscription_core_connection(text, uuid, uuid, text, uuid)\",\n  \"manage_subscription_core_personal(text, uuid, uuid, text, uuid, text, text, boolean, integer)\",\n  \"subscription_core_personal_connections(text, uuid, uuid, text)\",\n  // Migration 0713: an organization connection's reach for workspaces\n  // created later, read and replaced by organization administrators.\n  \"subscription_core_reach(text, uuid, uuid)\",\n  \"set_subscription_core_reach(text, uuid, uuid, boolean, boolean)\",\n  // Migration 0714: the organization's rotation switch on the reach row alone.\n  \"set_subscription_core_reach_allocator(text, uuid, uuid, boolean)\",\n  // Migration 0728: the personal connect writer with the credential's format.\n  \"connect_subscription_core_personal(text, uuid, uuid, text, text, text, text, text, jsonb, timestamp with time zone, timestamp with time zone, text, text, text, text)\",\n  // Migration 0730: the owner's personal connections with their row version.\n  \"subscription_core_personal_connection_versions(text, uuid, uuid, text)\",\n  \"subscription_core_personal_sharing(text, uuid, text, uuid, integer)\",\n  // Migration 0735: the owner's live usage read of their own personal\n  // connection (credential, refresh begin, quota write).\n  \"read_subscription_core_owned_connection_credential(text, uuid, uuid, text, uuid)\",\n  \"begin_subscription_core_owned_connection_refresh(text, uuid, uuid, text, uuid)\",\n  \"record_subscription_core_owned_connection_quota(text, uuid, uuid, text, uuid, bigint, bigint, jsonb, timestamp with time zone)\",\n  \"read_subscription_usage_history(uuid, uuid, text, text, uuid[])\",\n  \"append_subscription_usage_reading(uuid, uuid, text, jsonb)\",\n  \"prune_subscription_usage_history()\",\n  \"subscription_usage_history_prune_due()\",\n] as const;\n\n/** Migration 0707: the neutral writers' owner-only internals. */\nexport const SUBSCRIPTION_CORE_NEUTRAL_OWNER_ROUTINES = [\n  \"capture_usage_reading()\",\n  \"append_usage_reading(uuid, uuid, jsonb)\",\n  \"capture_usage_call()\",\n  \"subscription_core_writer_context(text, uuid, uuid, text)\",\n  \"grant_subscription_core_owner_capability(text, text, uuid, uuid, text, uuid)\",\n  \"drop_subscription_core_owner_capabilities(text, uuid)\",\n  \"subscription_core_connection_target(text, uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n  // Migration 0713: the auto-assignment apply path, run only by 0689's two\n  // auto-assignment trigger functions (triggers fire without the caller\n  // holding EXECUTE).\n  \"apply_subscription_core_auto_assignments(text, uuid, uuid, boolean)\",\n] as const;\n\n/**\n * The Codex-named twins of the migration 0707 neutral routines. Migration\n * 0707 kept them for binaries that still called them; the retirement\n * migration 0751 drops them (with the owner-only writer context and\n * connection target only they called), and the runtime posture requires them\n * absent through SUBSCRIPTION_RETIRED_ROUTINES.\n */\nexport const SUBSCRIPTION_CODEX_TWIN_PRIVATE_ROUTINES = [\n  \"begin_subscription_codex_refresh(uuid, uuid, uuid, uuid, text, text, uuid, text, bigint)\",\n  \"persist_subscription_codex_refresh(uuid, uuid, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n  \"fail_subscription_codex_refresh(uuid, uuid, uuid, uuid, uuid, bigint, text)\",\n  \"quarantine_subscription_codex_connection(uuid, uuid, uuid, uuid, uuid, text, bigint, bigint, text, text, timestamp with time zone)\",\n  \"recover_subscription_codex_connection_health(uuid, uuid, uuid, uuid)\",\n  \"persist_subscription_codex_refresh_with_plan(uuid, uuid, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone, text)\",\n  \"subscription_codex_acceptance_authority_v2(uuid, uuid, uuid, text)\",\n  \"read_subscription_codex_connection_credential(uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n  \"begin_subscription_codex_connection_refresh(uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n  \"persist_subscription_codex_connection_refresh(uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n  \"fail_subscription_codex_connection_refresh(uuid, uuid, uuid, bigint, text)\",\n  \"connect_subscription_codex_personal(uuid, uuid, text, text, text, text, text, jsonb, timestamp with time zone, timestamp with time zone, text, text, text)\",\n  \"disconnect_subscription_codex_connection(uuid, uuid, text, uuid)\",\n  \"subscription_codex_personal_connections(uuid, uuid, text)\",\n  \"subscription_codex_task_authority_v2(uuid, uuid, uuid, text)\",\n  \"subscription_codex_revision_authority_v2(uuid, uuid, uuid, bigint)\",\n  \"manage_subscription_codex_personal(uuid, uuid, text, uuid, text, text, boolean, integer)\",\n  \"subscription_codex_reach(uuid, uuid)\",\n  \"set_subscription_codex_reach(uuid, uuid, boolean, boolean)\",\n] as const;\n\n/** Where a retired routine lived: the data (target) schema or an owner schema. */\nexport type RetiredSubscriptionRoutineSchema =\n  | \"target\"\n  | \"opengeni_private\"\n  | \"opengeni_subscription_internal\";\n\n/**\n * M4 retirement (migration 0751, design 5.3 \"R. Retirement\"): every routine\n * the drained retirement migration drops, by exact signature in\n * `oidvectortypes` form. The SuperGrok and Claude pool writers, resolvers,\n * revalidators, policy predicates and trigger functions, the Codex twins and\n * their owner-only internals, and 0689's Codex auto-assignment apply path.\n * The runtime posture requires every one absent, the real-PostgreSQL\n * migration test checks the drop against it, and the no-legacy guard forbids\n * runtime code from naming one.\n */\nexport const SUBSCRIPTION_RETIRED_ROUTINES: readonly {\n  schema: RetiredSubscriptionRoutineSchema;\n  signature: string;\n}[] = [\n  ...([\"xai\", \"claude\"] as const).flatMap((provider) => [\n    ...[\n      `create_${provider}_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamp with time zone)`,\n      `disconnect_${provider}_subscription_credential(uuid, uuid, text, uuid, jsonb)`,\n      `resolve_${provider}_authority_pool(uuid, uuid, text, jsonb)`,\n      `revalidate_${provider}_subscription_authority(uuid, text, uuid, jsonb)`,\n      `${provider}_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint)`,\n      `${provider}_subscription_pool_visible(uuid, uuid, text, text, uuid)`,\n      `prevent_${provider}_authority_mutation()`,\n    ].map((signature) => ({ schema: \"target\" as const, signature })),\n    ...[\n      `enforce_${provider}_credential_pool_reference()`,\n      `enforce_${provider}_organization_runtime_update()`,\n      `prevent_organization_${provider}_live_disconnect()`,\n    ].map((signature) => ({ schema: \"opengeni_private\" as const, signature })),\n  ]),\n  ...[\n    ...SUBSCRIPTION_CODEX_TWIN_PRIVATE_ROUTINES,\n    \"subscription_codex_connection_target(uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n    \"apply_subscription_codex_auto_assignments(uuid, uuid, boolean)\",\n  ].map((signature) => ({ schema: \"opengeni_private\" as const, signature })),\n  {\n    schema: \"opengeni_subscription_internal\",\n    signature: \"subscription_codex_writer_context(uuid, uuid, text)\",\n  },\n];\n\n/**\n * Migration 0751: the policies the retirement drops, all in the data schema.\n * The pool and credential scopes on the legacy factory tables, the Claude\n * usage scope, and the legacy routines' runtime-capability policies on the\n * shared membership and authority tables.\n */\nexport const SUBSCRIPTION_RETIRED_POLICIES: readonly { table: string; policy: string }[] = [\n  ...([\"xai\", \"claude\"] as const).flatMap((provider) => [\n    { table: `${provider}_subscription_credentials`, policy: `${provider}_subscription_scope` },\n    ...[\"rotation_settings\", \"credential_leases\", \"session_account_pins\", \"capacity_waiters\"].map(\n      (table) => ({\n        table: `${provider}_${table}`,\n        policy: `${provider}_subscription_pool_scope`,\n      }),\n    ),\n    ...[\"capability_read\", \"membership_lock\"].map((suffix) => ({\n      table: \"organization_memberships\",\n      policy: `${provider}_subscription_${suffix}`,\n    })),\n    ...[\"capability_insert\", \"capability_read\", \"capability_revoke\"].map((suffix) => ({\n      table: \"organization_user_resource_authorities\",\n      policy: `${provider}_subscription_${suffix}`,\n    })),\n    // Only Claude kept per-credential usage (0598).\n    ...(provider === \"claude\"\n      ? [\n          {\n            table: `${provider}_subscription_account_usage`,\n            policy: `${provider}_usage_account_scope`,\n          },\n        ]\n      : []),\n  ]),\n];\n\n/** Migration 0751: the legacy factory triggers the retirement drops (data schema). */\nexport const SUBSCRIPTION_RETIRED_TRIGGERS: readonly { table: string; trigger: string }[] = (\n  [\"xai\", \"claude\"] as const\n).flatMap((provider) => [\n  {\n    table: `${provider}_subscription_credentials`,\n    trigger: `${provider}_subscription_credentials_authority_immutable_trg`,\n  },\n  {\n    table: `${provider}_subscription_credentials`,\n    trigger: `${provider}_organization_runtime_update_guard`,\n  },\n  {\n    table: `${provider}_subscription_credentials`,\n    trigger: `${provider}_organization_live_disconnect_guard`,\n  },\n  {\n    table: `${provider}_rotation_settings`,\n    trigger: `${provider}_organization_rotation_update_guard`,\n  },\n  { table: `${provider}_rotation_settings`, trigger: `${provider}_rotation_credential_pool_guard` },\n  { table: `${provider}_credential_leases`, trigger: `${provider}_lease_credential_pool_guard` },\n  { table: `${provider}_session_account_pins`, trigger: `${provider}_pin_credential_pool_guard` },\n]);\n\n/**\n * Migration 0751's reach finalization (design 0713 note \"Kept until\n * retirement\"): 0689's trigger functions in opengeni_private that take\n * provider-free names. Their Codex names are retired with the dropped\n * objects.\n */\nexport const SUBSCRIPTION_RENAMED_ROUTINES: readonly {\n  schema: \"opengeni_private\";\n  from: string;\n  to: string;\n}[] = [\n  [\"auto_assign_subscription_codex_workspace()\", \"auto_assign_subscription_core_workspace()\"],\n  [\n    \"auto_assign_subscription_codex_personal_workspace()\",\n    \"auto_assign_subscription_core_personal_workspace()\",\n  ],\n  [\"record_subscription_codex_plan_change()\", \"record_subscription_core_plan_change()\"],\n].map(([from, to]) => ({ schema: \"opengeni_private\" as const, from: from!, to: to! }));\n\n/** Migration 0751: 0689's triggers that take provider-free names (data schema). */\nexport const SUBSCRIPTION_RENAMED_TRIGGERS: readonly { table: string; from: string; to: string }[] =\n  [\n    {\n      table: \"workspaces\",\n      from: \"workspaces_subscription_codex_auto_assign\",\n      to: \"workspaces_subscription_core_auto_assign\",\n    },\n    {\n      table: \"organization_memberships\",\n      from: \"organization_memberships_subscription_codex_auto_assign\",\n      to: \"organization_memberships_subscription_core_auto_assign\",\n    },\n    {\n      table: \"subscription_connections\",\n      from: \"subscription_connections_codex_plan_change_trg\",\n      to: \"subscription_connections_core_plan_change_trg\",\n    },\n  ];\n\n/**\n * Migration 0751: 0689's two owner-only auto-assignment policies (data\n * schema), which take provider-free names and read the provider-free\n * setting SUBSCRIPTION_AUTO_ASSIGN_SETTING.\n */\nexport const SUBSCRIPTION_RENAMED_POLICIES: readonly { table: string; from: string; to: string }[] =\n  [\n    {\n      table: \"subscription_connection_workspaces\",\n      from: \"subscription_connection_workspaces_codex_auto_assign\",\n      to: \"subscription_connection_workspaces_core_auto_assign\",\n    },\n    {\n      table: \"subscription_connection_assignment_policies\",\n      from: \"subscription_connection_assignment_policies_codex_auto_assign\",\n      to: \"subscription_connection_assignment_policies_core_auto_assign\",\n    },\n  ];\n\n/** Migration 0751: the reach table takes the name of 0713's view over it. */\nexport const SUBSCRIPTION_RENAMED_RELATIONS: readonly {\n  schema: \"opengeni_private\";\n  from: string;\n  to: string;\n}[] = [\n  {\n    schema: \"opengeni_private\",\n    from: \"subscription_codex_auto_assignments\",\n    to: \"subscription_core_auto_assignments\",\n  },\n];\n\n/**\n * The setting the auto-assignment trigger functions set to the organization\n * around each provider's apply, admitting their owner-only writes through the\n * renamed policies (0689's `opengeni.subscription_codex_auto_assign` before\n * migration 0751).\n */\nexport const SUBSCRIPTION_AUTO_ASSIGN_SETTING = \"opengeni.subscription_core_auto_assign\";\n\n/**\n * Every retired routine: dropped by migration 0751, or renamed by it (the\n * Codex name is retired). What the runtime posture requires absent.\n */\nconst RETIRED_ROUTINE_ENTRIES: readonly {\n  schema: RetiredSubscriptionRoutineSchema;\n  signature: string;\n}[] = [\n  ...SUBSCRIPTION_RETIRED_ROUTINES,\n  ...SUBSCRIPTION_RENAMED_ROUTINES.map(({ schema, from }) => ({ schema, signature: from })),\n];\nconst RETIRED_POLICY_ENTRIES: readonly { table: string; policy: string }[] = [\n  ...SUBSCRIPTION_RETIRED_POLICIES,\n  ...SUBSCRIPTION_RENAMED_POLICIES.map(({ table, from }) => ({ table, policy: from })),\n];\nconst RETIRED_TRIGGER_ENTRIES: readonly { table: string; trigger: string }[] = [\n  ...SUBSCRIPTION_RETIRED_TRIGGERS,\n  ...SUBSCRIPTION_RENAMED_TRIGGERS.map(({ table, from }) => ({ table, trigger: from })),\n];\n/** Retired opengeni_private routines still present are reported once, as retired. */\nconst RETIRED_PRIVATE_ROUTINES = new Set(\n  RETIRED_ROUTINE_ENTRIES.filter(({ schema }) => schema === \"opengeni_private\").map(\n    ({ signature }) => signature,\n  ),\n);\n\n/**\n * The bare names of every retired routine, dropped or renamed (the\n * no-legacy guard's identifiers).\n */\nexport const SUBSCRIPTION_RETIRED_ROUTINE_NAMES: readonly string[] = [\n  ...new Set(\n    RETIRED_ROUTINE_ENTRIES.map(({ signature }) => signature.slice(0, signature.indexOf(\"(\"))),\n  ),\n];\n\n/**\n * Every retired subscription object as the posture inspection describes it\n * (`routine schema.name(args)`, `policy table.name`, `trigger table.name`,\n * `relation schema.name`), in the byte order inspection reports them: what a\n * database that has not applied SUBSCRIPTION_RETIREMENT_MIGRATION still\n * holds, dropped objects and the Codex names of renamed ones alike.\n */\nexport function retiredSubscriptionObjectDescriptions(targetSchema = \"public\"): string[] {\n  return [\n    ...RETIRED_ROUTINE_ENTRIES.map(\n      ({ schema, signature }) =>\n        `routine ${schema === \"target\" ? targetSchema : schema}.${signature}`,\n    ),\n    ...RETIRED_POLICY_ENTRIES.map(({ table, policy }) => `policy ${table}.${policy}`),\n    ...RETIRED_TRIGGER_ENTRIES.map(({ table, trigger }) => `trigger ${table}.${trigger}`),\n    ...SUBSCRIPTION_RENAMED_RELATIONS.map(({ schema, from }) => `relation ${schema}.${from}`),\n  ].sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));\n}\n\n/** The posture violation for a retired subscription object that is still present. */\nexport function retiredSubscriptionObjectViolation(object: string): string {\n  return `retired subscription ${object} is present; apply the drained retirement migration ${SUBSCRIPTION_RETIREMENT_MIGRATION}`;\n}\n\n/**\n * Migration 0712 (M4 generic precursor): the per-provider cutover receipt\n * reader. The runtime calls it for readiness and its RLS policies call it.\n */\nexport const SUBSCRIPTION_CORE_PRECURSOR_PRIVATE_ROUTINES = [\n  \"subscription_provider_cutover_committed(text)\",\n] as const;\n\n/** Migration 0712: owner-only trigger functions in opengeni_subscription_internal. */\nexport const SUBSCRIPTION_CORE_PRECURSOR_OWNER_ROUTINES = [\n  \"guard_subscription_provider_cutover_receipts()\",\n  \"keep_subscription_cutover_identity()\",\n] as const;\n\n/**\n * Every provider whose drained subscription-core cutover migration is in this\n * binary's ledger. The binary refuses to start unless each has its receipt\n * (`opengeni_private.subscription_provider_cutover_committed`). A provider's\n * cutover PR adds its entry.\n */\nexport const SUBSCRIPTION_PROVIDER_CUTOVER_MIGRATIONS: Readonly<Record<string, string>> = {\n  codex: \"0689_subscription_core_codex_cutover.sql\",\n  xai: \"0747_subscription_core_xai_cutover.sql\",\n  claude: \"0748_subscription_core_claude_cutover.sql\",\n};\n\n/**\n * The drained M4 retirement migration (design 5.3 \"R. Retirement\"): it drops\n * SUBSCRIPTION_RETIRED_ROUTINES, _POLICIES and _TRIGGERS and refuses unless\n * every provider's cutover receipt is committed. A test database that\n * withholds a provider cutover to characterize a legacy runtime withholds\n * this migration too.\n */\nexport const SUBSCRIPTION_RETIREMENT_MIGRATION = \"0751_subscription_core_legacy_retirement.sql\";\n\n/**\n * Migration 0716 (M4 PR 0b): accepted authority across a provider's cutover.\n * The runtime role may call the copy routine (inert until a provider's\n * writers call it), the reader, and the list of providers whose records can\n * exist; it holds no privilege on the compatibility relation itself.\n */\nexport const SUBSCRIPTION_AUTHORITY_COMPAT_PRIVATE_ROUTINES = [\n  \"copy_subscription_authority_compat(text, text, uuid, uuid, bigint)\",\n  \"read_subscription_authority_compat(text, text, uuid, uuid, bigint)\",\n  \"subscription_authority_compat_providers()\",\n  // Migration 0728: whether this transaction inserted a carrier the runtime\n  // role cannot read (a scheduled task revision).\n  \"subscription_authority_carrier_inserted_now(text, uuid, uuid, bigint)\",\n] as const;\n\n/**\n * Migration 0716: owner-only marker and guard triggers, the per-path source\n * resolvers and the deferred compatibility check, in\n * opengeni_subscription_internal.\n */\nexport const SUBSCRIPTION_AUTHORITY_COMPAT_OWNER_ROUTINES = [\n  \"stamp_subscription_authority_inserted_at()\",\n  \"keep_subscription_authority_inserted_at()\",\n  \"subscription_authority_compat_entry_valid(jsonb)\",\n  \"guard_subscription_authority_compat()\",\n  \"subscription_compat_turn_human(uuid, uuid)\",\n  \"subscription_compat_v2_has_entry(jsonb, text)\",\n  \"subscription_compat_receiver_source(uuid, uuid)\",\n  \"subscription_compat_delivery_sources(uuid, uuid, uuid, uuid, text)\",\n  \"subscription_compat_compaction_source(uuid, uuid)\",\n  \"subscription_compat_scheduled_source(uuid, uuid)\",\n  \"subscription_compat_carrier_sources(text, uuid, uuid, bigint)\",\n  \"subscription_compat_carrier_state(text, uuid, uuid, bigint)\",\n  \"subscription_compat_record(text, text, uuid, uuid, bigint)\",\n  \"subscription_compat_expected(text, timestamp with time zone, uuid, text, uuid, bigint, text)\",\n  \"subscription_compat_carrier_expected(text, timestamp with time zone, text, uuid, uuid, bigint)\",\n  \"subscription_compat_enter_scope(uuid, uuid)\",\n  \"subscription_compat_leave_scope(text[])\",\n  \"subscription_compat_effective(text, text, uuid, uuid, bigint)\",\n  \"enforce_subscription_authority_compat()\",\n] as const;\n\n/**\n * Migration 0717: the fences' owner-only helpers in\n * opengeni_subscription_internal (the v2 copy rule, a scheduled firing's v2\n * value and the personal-entry liveness check). Only owner-run fences and\n * functions call them.\n */\nexport const SUBSCRIPTION_AUTHORITY_FENCE_OWNER_ROUTINES = [\n  \"subscription_v2_copy_matches(jsonb, jsonb)\",\n  \"subscription_scheduled_firing_v2(uuid, uuid, uuid, bigint)\",\n  \"subscription_personal_entry_serviceable(uuid, jsonb)\",\n  \"subscription_scheduled_run_personal_entries(uuid, uuid, uuid)\",\n] as const;\n\nexport const SUBSCRIPTION_M3_PRECURSOR_PRIVATE_ROUTINES = [\n  \"authorize_subscription_ownerless_session_access(uuid, uuid, uuid, uuid)\",\n  \"authorize_subscription_personal_placement_access(uuid, uuid, uuid, uuid, text, uuid, bigint, text, text)\",\n  // The Codex refresh-write capability check stays: the Codex refresh\n  // policies on subscription_connections call it.\n  \"subscription_codex_refresh_write_allowed(uuid, uuid, uuid)\",\n  // M3 PR 2b: the Codex Apps designation on the core.\n  \"resolve_subscription_codex_apps_designation(uuid, uuid)\",\n  \"read_subscription_codex_apps_credential(uuid, uuid, uuid)\",\n  \"begin_subscription_codex_apps_refresh(uuid, uuid, uuid)\",\n  \"persist_subscription_codex_apps_refresh(uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n  \"fail_subscription_codex_apps_refresh(uuid, uuid, uuid, bigint, text)\",\n  // M3 PR 2c: the Codex reset-credit authority.\n  \"subscription_codex_reset_authority(uuid, uuid, uuid, text)\",\n  // M3 PR 3b: the cross-workspace reset-credit fence and the owner-only\n  // policies' capability helpers.\n  \"subscription_codex_reset_credit_fence(uuid, uuid, uuid, text, text, uuid)\",\n  \"subscription_codex_owner_capability_held(uuid, text[], text, uuid, boolean)\",\n  \"subscription_codex_owner_membership_held(uuid, uuid)\",\n  // Migration 0707: the provider-neutral equivalents the runtime calls.\n  ...SUBSCRIPTION_CORE_NEUTRAL_PRIVATE_ROUTINES,\n  ...SUBSCRIPTION_CORE_PRECURSOR_PRIVATE_ROUTINES,\n  ...SUBSCRIPTION_AUTHORITY_COMPAT_PRIVATE_ROUTINES,\n] as const;\n\n/** Owner-only private helpers the runtime role must never be able to execute. */\nexport const SUBSCRIPTION_M3_OWNER_ONLY_PRIVATE_ROUTINES = [\n  // M3 PR 2b: returns a full connection row to the Apps routines that run as its owner.\n  \"subscription_codex_apps_designation_target(uuid, uuid)\",\n  // M3 PR 3b: the capability internals and the revision-authority trigger\n  // function (the writers' caller check and the connection-seam target went\n  // with the Codex twins in migration 0751).\n  \"grant_subscription_codex_owner_capability(text, uuid, uuid, text, uuid)\",\n  \"drop_subscription_codex_owner_capabilities(uuid)\",\n  \"derive_scheduled_revision_subscription_authority()\",\n  // Migration 0689: the cutover receipt and the two owner-run trigger\n  // functions. Readiness only looks the receipt up; triggers fire without\n  // the caller holding EXECUTE. The plan-change and auto-assignment trigger\n  // functions carry the provider-free names migration 0751 gives them.\n  \"subscription_codex_cutover_v1_active()\",\n  \"seed_subscription_codex_cutover()\",\n  \"record_subscription_core_plan_change()\",\n  \"keep_subscription_codex_cutover_identity()\",\n  \"auto_assign_subscription_core_workspace()\",\n  \"auto_assign_subscription_core_personal_workspace()\",\n  ...SUBSCRIPTION_CORE_NEUTRAL_OWNER_ROUTINES,\n  ...SUBSCRIPTION_CORE_PRECURSOR_OWNER_ROUTINES,\n  ...SUBSCRIPTION_AUTHORITY_COMPAT_OWNER_ROUTINES,\n  ...SUBSCRIPTION_AUTHORITY_FENCE_OWNER_ROUTINES,\n] as const;\n\nconst UNIFIED_KNOWLEDGE_ROUTINES = [\n  \"knowledge_index_claim(text, integer, integer)\",\n  \"knowledge_index_work(uuid, uuid, uuid, jsonb)\",\n  \"knowledge_index_billing_policy(uuid, uuid, uuid, text, timestamp with time zone, bigint)\",\n  \"knowledge_index_wait_for_funding(uuid, uuid, uuid)\",\n  \"knowledge_index_paid_publication_guard(uuid, uuid, uuid)\",\n  \"knowledge_visible_index_status(uuid, uuid, jsonb, jsonb, text)\",\n  \"knowledge_entry_apply(uuid, uuid, jsonb, jsonb)\",\n  \"knowledge_entry_confirm_legacy(uuid, uuid, jsonb, jsonb)\",\n  \"agent_instruction_apply(uuid, uuid, jsonb, jsonb)\",\n  \"knowledge_entry_read(uuid, uuid, jsonb, jsonb)\",\n  \"knowledge_entry_prepare_file(uuid, uuid, jsonb, jsonb)\",\n  \"knowledge_document_prepare(uuid, uuid, uuid, jsonb)\",\n  \"agent_learning_manage(uuid, uuid, jsonb, jsonb)\",\n] as const;\nconst UNIFIED_KNOWLEDGE_ROUTINE_SET = new Set<string>(UNIFIED_KNOWLEDGE_ROUTINES);\nconst UNIFIED_KNOWLEDGE_AUTHORITY_TABLES = [\n  \"knowledge_entries\",\n  \"knowledge_entry_revisions\",\n  \"knowledge_entry_decisions\",\n  \"knowledge_entry_links\",\n  \"knowledge_entry_operations\",\n  \"knowledge_entry_search\",\n  \"knowledge_index_jobs\",\n  \"knowledge_entry_vectors\",\n  \"knowledge_review_batches\",\n  \"agent_learning_revisions\",\n  \"agent_learning_snapshots\",\n  \"agent_instruction_operations\",\n  \"workspace_instruction_policy_revisions\",\n  \"workspace_instruction_policy_heads\",\n  \"workspace_instruction_policy_activation_events\",\n  \"workspaces\",\n  \"sessions\",\n  \"session_turns\",\n  \"session_turn_attempts\",\n  \"files\",\n  \"documents\",\n] as const;\n/** Per-task usage limits: the only runtime entry points. */\nexport const SESSION_USAGE_LIMIT_CAPABILITY_PREDICATE_ROUTINE =\n  \"session_usage_limit_capability_active(uuid, uuid)\";\nexport const SESSION_USAGE_LIMIT_RUNTIME_ROUTINES = [\n  \"maintain_session_usage_limits(integer, integer)\",\n  \"session_usage_limit_command(jsonb)\",\n  SESSION_USAGE_LIMIT_CAPABILITY_PREDICATE_ROUTINE,\n] as const;\nexport const SESSION_USAGE_LIMIT_STATE_ROUTINE = \"session_usage_limit_state(jsonb, boolean)\";\n/** Pure amount rules shared by the event trigger and the legacy import. */\nexport const SESSION_USAGE_LIMIT_AMOUNT_ROUTINES = [\n  \"session_usage_limit_meter_amount(numeric, text, numeric, numeric)\",\n  \"session_usage_limit_event_amount(jsonb)\",\n] as const;\n/** Owner-internal helpers; never runtime-callable. */\nexport const SESSION_USAGE_LIMIT_INTERNAL_ROUTINES = [\n  SESSION_USAGE_LIMIT_STATE_ROUTINE,\n  \"session_usage_limit_apply_receipt(uuid, uuid, uuid, text, uuid, uuid, bigint, text, text, text)\",\n  \"session_usage_limit_import_page(uuid, uuid, uuid, integer)\",\n  \"session_usage_limit_import_step(uuid, uuid, uuid, integer)\",\n  ...SESSION_USAGE_LIMIT_AMOUNT_ROUTINES,\n  \"seed_session_usage_limit_root()\",\n  \"meter_session_usage_limit_event()\",\n] as const;\nexport const SUBSCRIPTION_PLAN_RUNTIME_ROUTINES = [\n  \"free_plan_credit_eligible(uuid)\",\n  \"organization_plan_seats_used(uuid)\",\n  \"upsert_organization_plan(uuid, text, text, text, timestamp with time zone, timestamp with time zone, boolean)\",\n  \"expire_plan_credit_period(uuid, uuid, boolean)\",\n  \"grant_plan_credit_period(uuid, text, timestamp with time zone, timestamp with time zone, text)\",\n  \"replace_plan_credit_period(uuid, text, timestamp with time zone, timestamp with time zone, text)\",\n  \"read_organization_plan_balance(uuid, timestamp with time zone)\",\n  \"expire_ended_plan_credit_periods(uuid)\",\n  \"begin_plan_credit_settlement(uuid)\",\n] as const;\n\nexport const BILLING_SUBSCRIPTION_OPERATION_ROUTINES = [\n  \"begin_billing_subscription_operation(uuid, uuid, text, jsonb, jsonb)\",\n  \"complete_billing_subscription_operation(uuid, uuid, jsonb)\",\n] as const;\n\nexport const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [\n  \"create_agent_child_session(uuid, uuid, uuid, uuid, uuid, integer, jsonb)\",\n  ...BILLING_SUBSCRIPTION_OPERATION_ROUTINES,\n  ...SUBSCRIPTION_PLAN_RUNTIME_ROUTINES,\n  \"scheduled_task_is_exhausted(uuid)\",\n  \"lock_live_native_original_origin_v2(jsonb)\",\n  \"modal_native_origin_member_read_active(uuid, text)\",\n  ...SUBSCRIPTION_SNAPSHOT_VALIDATOR_ROUTINES,\n  \"maintain_usage_allowances(integer, integer)\",\n  \"usage_allowance_command(jsonb)\",\n  \"usage_allowance_capability_active(uuid, uuid)\",\n  ...SESSION_USAGE_LIMIT_RUNTIME_ROUTINES,\n  ...UNIFIED_KNOWLEDGE_ROUTINES,\n  MCP_OPERATION_CAPABILITY_ROUTINE,\n  \"skill_apply_lifecycle(uuid, uuid, jsonb, jsonb)\",\n  COMPANY_BRAIN_CONTEXT_INSPECTION_ROUTINE,\n  COMPANY_BRAIN_CONTEXT_SELECTION_ROUTINE,\n  ...COMPANY_PROFILE_AGENT_ADMIN_ROUTINES,\n  ...GOVERNED_LEARNING_ACTIVATION_ROUTINES,\n  ...GOVERNED_LEARNING_INSPECTION_ROUTINES,\n  FORK_SESSION_CONTENT_ROUTINE,\n  MESSAGE_FORK_SESSION_CONTENT_ROUTINE,\n  LEGACY_FORK_SESSION_CONTENT_ROUTINE,\n  REPLAY_APPLIED_SESSION_FORK_ROUTINE,\n  SESSION_TENANCY_ACTIVATED_ROUTINE,\n  SESSION_TENANCY_ANY_ACTIVATION_ROUTINE,\n  GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE,\n  GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE,\n  KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE,\n  MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE,\n  ...ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES,\n  ...ORGANIZATION_PRIVATE_SESSION_ROUTINES,\n  ...PRIVATE_SESSION_CREATE_CAPABILITY_ROUTINES,\n  PERSONAL_RESOURCE_ATTEMPT_RESOLVER_ROUTINE,\n  ...USER_RESOURCE_LIFECYCLE_ROUTINES,\n  PREFERENCE_KNOWLEDGE_PROPOSAL_ROUTINE,\n  ...VARIABLE_SET_AUTHORITY_ROUTINES,\n  ...VAULT_RUNTIME_ROUTINES,\n  ...CONNECTION_AUTHORITY_ROUTINES,\n  ...PERSONAL_GITHUB_REPOSITORY_AUTHORITY_ROUTINES,\n  ...PERSONAL_DOCUMENT_AUTHORITY_ROUTINES,\n  ...DOCUMENT_MIGRATION_AUTHORITY_ROUTINES,\n  ...SCOPED_COMPUTE_AUTHORITY_ROUTINES,\n  ...SCHEDULED_PERSONAL_RESOURCE_ROUTINES,\n  ...CANONICAL_HUMAN_IDENTITY_ROUTINES,\n  ...MANAGED_AUTH_SESSION_SET_ROUTINES,\n  ...ORGANIZATION_RECOVERY_ROUTINES,\n  ...TASK_NOTE_CAPABILITY_ROUTINES,\n  ...WORK_CLAIM_CAPABILITY_ROUTINES,\n  SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,\n  SESSION_PRIVATE_ACTOR_VISIBLE_KEYS_ROUTINE,\n  SESSION_REFERENCE_VISIBLE_ROUTINE,\n  SESSION_VISIBILITY_LIFECYCLE_CAPABILITY_ROUTINE,\n  TRANSITION_SESSION_VISIBILITY_ROUTINE,\n  SESSION_VISIBILITY_CHANGE_BLOCKER_ROUTINE,\n  SESSION_VISIBILITY_FOREIGN_AUTHORITY_ITEMS_ROUTINE,\n] as const;\n\n/**\n * Boolean-only predicates that shared-table RLS policies must be able to\n * evaluate under table owners and SECURITY DEFINER roles unknown at migration\n * time. The capability ledger and the routine that mints its opaque token stay\n * private; only these exact policy predicates may be PUBLIC-executable.\n */\nexport const RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES = [\n  CONNECTION_CONVERGENCE_AUDIT_CAPABILITY_ROUTINE,\n  \"usage_allowance_capability_active(uuid, uuid)\",\n  SESSION_USAGE_LIMIT_CAPABILITY_PREDICATE_ROUTINE,\n] as const;\nconst RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET = new Set<string>(\n  RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES,\n);\n\n/** Owner-internal helpers that must exist but must never be callable by the runtime role. */\nexport const RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [\n  \"guard_session_agent_creation_provenance()\",\n  \"personal_machine_grant_covers_descendant(uuid, uuid, uuid, uuid)\",\n  \"personal_machine_turn_consent_covers_descendant(uuid, uuid, uuid)\",\n  \"live_session_turn_machine_consent(uuid)\",\n  \"bind_session_attempt_machine_consent(uuid, uuid, uuid)\",\n  \"assert_session_attempt_machine_consent(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean, boolean)\",\n  \"enable_organization_private_sessions_from_activation(uuid, text[])\",\n  \"usage_allowance_members(uuid, uuid)\",\n  \"usage_allowance_effective_period(uuid, jsonb, timestamp with time zone)\",\n  \"count_workspace_allowance_debit()\",\n  \"count_unbilled_model_allowance_debit()\",\n  \"capture_usage_allowance_attribution()\",\n  \"reverse_video_allowance_refund()\",\n  \"capture_usage_allowance_period(uuid, uuid, jsonb, timestamp with time zone)\",\n  \"emit_usage_allowance_notifications(uuid, uuid, jsonb, text, timestamp with time zone, text)\",\n  \"usage_allowance_period(jsonb, timestamp with time zone)\",\n  \"validate_usage_allowance_config(jsonb)\",\n  \"validate_usage_allowance_rule(jsonb)\",\n  \"guard_slack_file_upload_operation()\",\n  ...SESSION_USAGE_LIMIT_INTERNAL_ROUTINES,\n  ADDITIONAL_ORGANIZATION_SESSION_TENANCY_ACTIVATION_ROUTINE,\n  AUTOMATIC_SESSION_TITLE_QUARANTINE_FENCE_ROUTINE,\n  ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE,\n  GREENFIELD_SESSION_TENANCY_ACTIVATION_ROUTINE,\n  SESSION_TENANCY_QUIESCENCE_ROUTINE,\n  TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE,\n  VERIFIED_SIGNUP_TRIAL_SWITCH_SETTER_ROUTINE,\n  \"set_credit_promotion_policy(jsonb, text, text)\",\n  \"set_subscription_plan_catalog(jsonb, text, text)\",\n  MANAGED_AUTH_NEW_SIGNUPS_SWITCH_SETTER_ROUTINE,\n  ...DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES,\n] as const;\n\nexport const RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [\n  \"guard_session_agent_creation_provenance()\",\n  \"set_subscription_plan_catalog(jsonb, text, text)\",\n  \"scheduled_task_is_exhausted(uuid)\",\n  \"set_credit_promotion_policy(jsonb, text, text)\",\n  CLAUDE_SNAPSHOT_VALIDATOR_ROUTINE,\n  \"usage_allowance_period(jsonb, timestamp with time zone)\",\n  \"validate_usage_allowance_config(jsonb)\",\n  \"validate_usage_allowance_rule(jsonb)\",\n  \"guard_slack_file_upload_operation()\",\n  SESSION_USAGE_LIMIT_STATE_ROUTINE,\n  ...SESSION_USAGE_LIMIT_AMOUNT_ROUTINES,\n  \"resolve_workspace_codex_subscription_source(uuid, uuid)\",\n  SESSION_REFERENCE_VISIBLE_ROUTINE,\n  XAI_SNAPSHOT_VALIDATOR_ROUTINE,\n] as const;\nconst RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET = new Set<string>(\n  RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES,\n);\n\n/**\n * The complete standalone tenant-table contract. Adding or removing a\n * FORCE-RLS table is an architectural change: update this list in the same\n * commit as the migration so startup cannot silently accept an unreviewed gap.\n */\nexport const FORCE_RLS_TABLES = [\n  \"additional_organization_creation_receipts\",\n  \"agent_instruction_operations\",\n  \"agent_learning_revisions\",\n  \"agent_learning_snapshots\",\n  \"agent_run_states\",\n  \"api_keys\",\n  \"attached_browser_devices\",\n  \"attached_browser_inventories\",\n  \"audit_events\",\n  \"auth_runs\",\n  \"automation_run_event_links\",\n  \"automation_runs\",\n  \"automation_sources\",\n  \"automation_trigger_events\",\n  \"automation_trigger_revisions\",\n  \"automation_triggers\",\n  \"billing_customers\",\n  \"billing_subscription_operations\",\n  \"browser_identities\",\n  \"browser_revision_components\",\n  \"browser_revisions\",\n  \"browser_session_associations\",\n  \"browser_session_retained_downloads\",\n  \"browser_sessions\",\n  \"browser_state_artifacts\",\n  \"browser_state_uploads\",\n  \"canonical_human_identities\",\n  \"canonical_human_identity_operations\",\n  \"canonical_human_identity_subjects\",\n  \"canonical_human_login_bindings\",\n  \"capability_api_facets\",\n  \"capability_catalog_items\",\n  \"capability_component_owners\",\n  \"capability_facet_installations\",\n  \"capability_facets\",\n  \"capability_installations\",\n  \"capability_integration_facets\",\n  \"capability_mcp_facets\",\n  \"capability_operations\",\n  \"capability_plugin_installations\",\n  \"capability_plugin_versions\",\n  \"capability_plugins\",\n  \"capability_skill_facets\",\n  \"capability_skill_files\",\n  \"channels\",\n  \"claude_capacity_waiters\",\n  \"claude_credential_leases\",\n  \"claude_rotation_settings\",\n  \"claude_session_account_pins\",\n  \"claude_subscription_account_usage\",\n  \"claude_subscription_credentials\",\n  \"codex_apps_settings\",\n  \"codex_capacity_waiters\",\n  \"codex_credential_leases\",\n  \"codex_reset_redemption_attempts\",\n  \"codex_rotation_settings\",\n  \"codex_subscription_credentials\",\n  \"codex_turn_source_bindings\",\n  \"company_brain_context_selection_receipts\",\n  \"company_brain_preference_proposal_receipts\",\n  \"company_brain_turn_context_snapshots\",\n  \"company_profile_activation_events\",\n  \"company_profile_agent_automatic_activation_receipts\",\n  \"company_profile_agent_confirmation_receipts\",\n  \"company_profile_agent_proposal_receipts\",\n  \"company_profile_heads\",\n  \"company_profile_revisions\",\n  \"company_profile_snapshots\",\n  \"composer_drafts\",\n  \"computer_session_associations\",\n  \"computer_sessions\",\n  \"connect_attempts\",\n  \"connection_disconnect_operations\",\n  \"connection_use_audit_facts\",\n  \"connection_use_once_consumption_receipts\",\n  \"connections\",\n  \"connector_action_policies\",\n  \"connector_action_requests\",\n  \"credit_debit_allocations\",\n  \"credit_ledger_entries\",\n  \"device_enrollment_requests\",\n  \"document_authority_reclassifications\",\n  \"document_bases\",\n  \"document_chunks\",\n  \"document_default_collection_backfill_operations\",\n  \"document_default_collection_backfill_receipts\",\n  \"document_default_collection_backfill_runs\",\n  \"documents\",\n  \"editable_artifact_blob_refs\",\n  \"editable_artifact_idempotency_receipts\",\n  \"editable_artifact_live_outbox\",\n  \"editable_artifact_live_tickets\",\n  \"editable_artifact_materialization_jobs\",\n  \"editable_artifact_materialization_results\",\n  \"editable_artifact_operations\",\n  \"editable_artifact_replica_leases\",\n  \"editable_artifact_scope_authorization_heads\",\n  \"editable_artifact_sequence_checkpoints\",\n  \"editable_artifact_session_links\",\n  \"editable_artifact_snapshots\",\n  \"editable_artifact_transactions\",\n  \"editable_artifact_undo_claims\",\n  \"editable_artifact_versions\",\n  \"editable_artifacts\",\n  \"enrollment_token_redemptions\",\n  \"enrollments\",\n  \"external_identities\",\n  \"external_identity_links\",\n  \"external_link_task_authorities\",\n  \"external_link_turn_authorities\",\n  \"feedback_submissions\",\n  \"file_uploads\",\n  \"files\",\n  \"generated_image_artifacts\",\n  \"generated_video_artifacts\",\n  \"github_installation_repositories\",\n  \"github_installations\",\n  \"google_drive_object_acl_evidence\",\n  \"google_drive_object_acl_principals\",\n  \"governed_learning_activation_receipts\",\n  \"governed_learning_activation_undo_receipts\",\n  \"governed_learning_decision_receipts\",\n  \"host_export_config\",\n  \"host_export_consumers\",\n  \"host_export_cursor_state\",\n  \"host_export_dead_letters\",\n  \"host_export_outbox\",\n  \"host_mcp_bindings\",\n  \"host_mcp_delegations\",\n  \"host_mcp_resolver_operations\",\n  \"host_mcp_resolvers\",\n  \"host_mcp_task_authorities\",\n  \"host_mcp_turn_authorities\",\n  \"image_generation_operations\",\n  \"import_batches\",\n  \"integration_facet_binding_owners\",\n  \"integration_facet_bindings\",\n  \"integration_facet_definitions\",\n  \"integration_oauth_pending_states\",\n  \"integration_oauth_state_nonces\",\n  \"integration_spec_revisions\",\n  \"integration_tools\",\n  \"interaction_interventions\",\n  \"interaction_operations\",\n  \"interaction_resource_operations\",\n  \"knowledge_change_proposals\",\n  \"knowledge_claim_evidence\",\n  \"knowledge_claim_relations\",\n  \"knowledge_claim_reviews\",\n  \"knowledge_claims\",\n  \"knowledge_document_versions\",\n  \"knowledge_entities\",\n  \"knowledge_entity_aliases\",\n  \"knowledge_entries\",\n  \"knowledge_entry_decisions\",\n  \"knowledge_entry_links\",\n  \"knowledge_entry_operations\",\n  \"knowledge_entry_revisions\",\n  \"knowledge_entry_search\",\n  \"knowledge_entry_vectors\",\n  \"knowledge_facts\",\n  \"knowledge_index_jobs\",\n  \"knowledge_lifecycle_events\",\n  \"knowledge_memories\",\n  \"knowledge_memory_lifecycle_events\",\n  \"knowledge_memory_relationships\",\n  \"knowledge_operation_receipts\",\n  \"knowledge_providers\",\n  \"knowledge_review_batches\",\n  \"knowledge_source_acl_versions\",\n  \"knowledge_source_objects\",\n  \"knowledge_source_sync_index_obligations\",\n  \"knowledge_source_sync_item_outcomes\",\n  \"knowledge_source_sync_object_observations\",\n  \"knowledge_source_sync_states\",\n  \"knowledge_source_sync_wakes\",\n  \"knowledge_sources\",\n  \"knowledge_sync_runs\",\n  \"machine_metrics_latest\",\n  \"machine_metrics_series\",\n  \"machine_removal_operations\",\n  \"managed_auth_actor_mutation_leases\",\n  \"managed_auth_browser_installations\",\n  \"managed_auth_login_return_intents\",\n  \"managed_auth_login_slots\",\n  \"managed_auth_login_transaction_rate_limits\",\n  \"managed_auth_login_transactions\",\n  \"managed_auth_session_set_operations\",\n  \"managed_auth_session_sets\",\n  \"managed_sign_in_method_operations\",\n  \"mcp_operations\",\n  \"memory_slack_publication_configurations\",\n  \"memory_slack_publication_receipts\",\n  \"memory_slack_publications\",\n  \"model_call_fact_reconciliation_candidates\",\n  \"model_call_fact_reconciliation_progress\",\n  \"model_call_facts\",\n  \"network_routes\",\n  \"new_session_drafts\",\n  \"organization_agent_admin_access\",\n  \"organization_api_key_workspaces\",\n  \"organization_codex_rotation_settings\",\n  \"organization_company_profile_agent_policies\",\n  \"organization_company_profile_agent_policy_events\",\n  \"organization_credential_providers\",\n  \"organization_integration_policies\",\n  \"organization_integration_policy_operations\",\n  \"organization_invitation_binding_events\",\n  \"organization_membership_invitations\",\n  \"organization_membership_lifecycle_events\",\n  \"organization_membership_operation_receipts\",\n  \"organization_memberships\",\n  \"organization_model_defaults\",\n  \"organization_model_provider_connection_operations\",\n  \"organization_model_provider_connections\",\n  \"organization_model_provider_custom_models\",\n  \"organization_plans\",\n  \"organization_privacy_preferences\",\n  \"organization_private_session_setting_events\",\n  \"organization_private_session_settings\",\n  \"organization_profile_events\",\n  \"organization_recovery_approvals\",\n  \"organization_recovery_command_receipts\",\n  \"organization_recovery_custodian_acceptances\",\n  \"organization_recovery_custodians\",\n  \"organization_recovery_events\",\n  \"organization_recovery_notification_attempts\",\n  \"organization_recovery_notification_outbox\",\n  \"organization_recovery_operations\",\n  \"organization_recovery_policies\",\n  \"organization_recovery_policy_heads\",\n  \"organization_service_accounts\",\n  \"organization_shared_workspace_administration_capabilities\",\n  \"organization_user_resource_authorities\",\n  \"organization_user_resource_grants\",\n  \"organization_user_retention_deletion_events\",\n  \"organization_user_retention_deletions\",\n  \"organization_user_retention_object_deletion_receipts\",\n  \"organization_user_retention_object_obligations\",\n  \"organization_user_retention_policies\",\n  \"organization_user_setup_deliveries\",\n  \"organization_user_setup_delivery_attempts\",\n  \"organization_user_setup_intents\",\n  \"organization_webhook_deliveries\",\n  \"organization_webhooks\",\n  \"organization_workspace_lifecycle_events\",\n  \"organization_workspace_operation_receipts\",\n  \"personal_document_once_consumption_receipts\",\n  \"personal_github_repository_selection_heads\",\n  \"personal_github_repository_selection_operations\",\n  \"personal_github_repository_selections\",\n  \"personal_resource_once_consumption_receipts\",\n  \"plan_credit_periods\",\n  \"pr_review_app_registrations\",\n  \"pr_review_managed_github_authority_nonces\",\n  \"pr_review_repository_bindings\",\n  \"preference_registry_events\",\n  \"preference_registry_preferences\",\n  \"preference_registry_revisions\",\n  \"preference_registry_snapshots\",\n  \"private_session_create_capabilities\",\n  \"remember_knowledge_confirmation_receipts\",\n  \"remember_knowledge_memory_materializations\",\n  \"retained_screenshot_artifacts\",\n  \"rig_changes\",\n  \"rig_versions\",\n  \"rigs\",\n  \"sandbox_checkpoint_artifacts\",\n  \"sandbox_lease_holders\",\n  \"sandbox_leases\",\n  \"sandbox_pty_sessions\",\n  \"sandbox_retained_processes\",\n  \"sandbox_session_envelopes\",\n  \"sandbox_workspace_mutation_admissions\",\n  \"sandboxes\",\n  \"scheduled_task_blocker_reviews\",\n  \"scheduled_task_connection_authority_snapshots\",\n  \"scheduled_task_personal_resource_authorities\",\n  \"scheduled_task_personal_resource_snapshots\",\n  \"scheduled_task_reusable_connection_materializations\",\n  \"scheduled_task_revision_authorities\",\n  \"scheduled_task_run_connection_authority_snapshots\",\n  \"scheduled_task_run_personal_resource_admissions\",\n  \"scheduled_task_run_personal_resource_once_receipts\",\n  \"scheduled_task_run_personal_resource_snapshots\",\n  \"scheduled_task_runs\",\n  \"scheduled_task_schedule_outbox\",\n  \"scheduled_tasks\",\n  \"self_service_organization_setup_receipts\",\n  \"session_admin_access\",\n  \"session_attempt_codemode_calls\",\n  \"session_attempt_connected_machine_authorizations\",\n  \"session_attempt_interruptions\",\n  \"session_attempt_machine_consents\",\n  \"session_attempt_model_context_snapshots\",\n  \"session_attempt_personal_document_admissions\",\n  \"session_attempt_personal_document_snapshots\",\n  \"session_attempt_personal_resource_admissions\",\n  \"session_attempt_personal_resource_snapshots\",\n  \"session_attempt_tool_catalogs\",\n  \"session_background_commands\",\n  \"session_command_receipts\",\n  \"session_content_blobs\",\n  \"session_event_cursors\",\n  \"session_events\",\n  \"session_goal_revisions\",\n  \"session_goals\",\n  \"session_history_items\",\n  \"session_human_input_requests\",\n  \"session_list_snapshots\",\n  \"session_mcp_servers\",\n  \"session_pending_tool_calls\",\n  \"session_pins\",\n  \"session_realtime_connections\",\n  \"session_realtime_context_projections\",\n  \"session_realtime_entries\",\n  \"session_realtime_modes\",\n  \"session_recordings\",\n  \"session_spawn_denials\",\n  \"session_stream_acknowledgments\",\n  \"session_system_update_outbox\",\n  \"session_system_updates\",\n  \"session_tenancy_activations\",\n  \"session_tenancy_additional_organization_activation_evidence\",\n  \"session_tenancy_greenfield_activation_evidence\",\n  \"session_title_operations\",\n  \"session_turn_attempts\",\n  \"session_turn_machine_consents\",\n  \"session_turn_startup_milestones\",\n  \"session_turns\",\n  \"session_variable_set_attachments\",\n  \"session_visibility_write_capabilities\",\n  \"session_work_claim_revisions\",\n  \"session_work_claim_write_capabilities\",\n  \"session_work_claims\",\n  \"session_workflow_wake_outbox\",\n  \"sessions\",\n  \"site_abuse_reports\",\n  \"site_auth_codes\",\n  \"site_auth_connections\",\n  \"site_data_collections\",\n  \"site_data_files\",\n  \"site_data_rate_windows\",\n  \"site_data_record_values\",\n  \"site_data_records\",\n  \"site_data_usage\",\n  \"site_data_validation_windows\",\n  \"site_data_workspace_validation_windows\",\n  \"site_hostname_holds\",\n  \"site_hostnames\",\n  \"site_limit_profiles\",\n  \"site_platform_brake\",\n  \"site_platform_storage\",\n  \"site_platform_totals\",\n  \"site_platform_usage\",\n  \"site_publications\",\n  \"site_runtime_conversations\",\n  \"site_runtime_rate_windows\",\n  \"site_runtime_usage\",\n  \"site_session_access\",\n  \"site_sql_databases\",\n  \"site_sql_migrations\",\n  \"site_sql_queries\",\n  \"site_sql_rate_windows\",\n  \"site_sql_usage\",\n  \"site_viewer_sessions\",\n  \"skill_config_conversion_receipts\",\n  \"skill_source_bindings\",\n  \"skill_write_receipts\",\n  \"slack_app_home_refreshes\",\n  \"slack_bot_delete_operations\",\n  \"slack_bot_post_operations\",\n  \"slack_bot_update_operations\",\n  \"slack_bot_user_links\",\n  \"slack_channel_routes\",\n  \"slack_installation_bindings\",\n  \"slack_interaction_action_handles\",\n  \"slack_interaction_inbox\",\n  \"slack_interaction_progress_deliveries\",\n  \"slack_interactions\",\n  \"slack_route_prompt_options\",\n  \"slack_route_prompts\",\n  \"slack_shared_task_origins\",\n  \"slack_task_policy_activation_events\",\n  \"slack_task_policy_heads\",\n  \"slack_task_policy_revisions\",\n  \"slack_user_dm_routes\",\n  \"slack_user_link_access_request_operations\",\n  \"slack_user_link_access_requests\",\n  \"social_connections\",\n  \"social_posts\",\n  \"subscription_apps_designations\",\n  \"subscription_capacity_waiters\",\n  \"subscription_capacity_wake_outbox\",\n  \"subscription_connection_aliases\",\n  \"subscription_connection_assignment_policies\",\n  \"subscription_connection_people\",\n  \"subscription_connection_quota\",\n  \"subscription_connection_workspaces\",\n  \"subscription_connections\",\n  \"subscription_leases\",\n  \"subscription_operation_leases\",\n  \"subscription_person_preferences\",\n  \"subscription_provider_cutovers\",\n  \"subscription_session_bindings\",\n  \"subscription_settings\",\n  \"subscription_turn_failures\",\n  \"task_note_events\",\n  \"task_note_knowledge_promotion_capabilities\",\n  \"task_note_replacement_receipts\",\n  \"task_note_write_capabilities\",\n  \"task_notes\",\n  \"temporal_schedule_cleanup_outbox\",\n  \"tenancy_backfill_receipts\",\n  \"tenancy_backfill_unresolved_rows\",\n  \"tool_gateway_approval_capabilities\",\n  \"transcription_recording_chunks\",\n  \"transcription_recording_objects\",\n  \"transcription_recording_segments\",\n  \"transcription_recordings\",\n  \"turn_connection_authority_snapshots\",\n  \"turn_personal_resource_attachment_receipts\",\n  \"turn_personal_resource_once_receipts\",\n  \"turn_personal_resource_snapshots\",\n  \"usage_events\",\n  \"vault_field_versions\",\n  \"vault_item_fields\",\n  \"vault_item_name_aliases\",\n  \"vault_items\",\n  \"vault_name_aliases\",\n  \"vault_passkey_leases\",\n  \"vaults\",\n  \"video_generation_operations\",\n  \"video_generation_references\",\n  \"workspace_artifact_events\",\n  \"workspace_artifact_uploads\",\n  \"workspace_artifact_versions\",\n  \"workspace_artifacts\",\n  \"workspace_captures\",\n  \"workspace_codex_subscription_preferences\",\n  \"workspace_control_events\",\n  \"workspace_credential_providers\",\n  \"workspace_gateway_custom_models\",\n  \"workspace_inference_controls\",\n  \"workspace_instruction_policy_activation_events\",\n  \"workspace_instruction_policy_deactivation_events\",\n  \"workspace_instruction_policy_heads\",\n  \"workspace_instruction_policy_onboarding_proposals\",\n  \"workspace_instruction_policy_revisions\",\n  \"workspace_instruction_policy_snapshots\",\n  \"workspace_interaction_revisions\",\n  \"workspace_learning_policy_activation_events\",\n  \"workspace_learning_policy_heads\",\n  \"workspace_learning_policy_revisions\",\n  \"workspace_learning_policy_snapshots\",\n  \"workspace_model_policies\",\n  \"workspace_screenshot_quotas\",\n  \"workspace_session_activity_revisions\",\n  \"workspace_variable_set_variables\",\n  \"workspace_variable_sets\",\n  \"workspace_video_generation_policies\",\n  \"workspace_video_generation_quotas\",\n  \"workspace_webhook_deliveries\",\n  \"workspace_webhooks\",\n  \"xai_capacity_waiters\",\n  \"xai_credential_leases\",\n  \"xai_rotation_settings\",\n  \"xai_session_account_pins\",\n  \"xai_subscription_credentials\",\n] as const;\n\n/**\n * Deployment-global and authentication tables used by ordinary API/worker\n * traffic. They intentionally do not carry workspace RLS: their access model\n * is implemented by the authentication/access layer or by exact global keys.\n */\nexport const NON_RLS_RUNTIME_TABLES = [\n  \"auth_identities\",\n  \"auth_rate_limits\",\n  \"auth_sessions\",\n  \"auth_users\",\n  \"auth_verifications\",\n  \"automation_webhook_endpoints\",\n  \"deployment_model_catalog\",\n  \"integration_oauth_clients\",\n  \"managed_accounts\",\n  \"mcp_oauth_access_tokens\",\n  \"mcp_oauth_authorization_codes\",\n  \"mcp_oauth_authorization_requests\",\n  \"mcp_oauth_clients\",\n  \"mcp_oauth_refresh_tokens\",\n  \"nested_agent_depth_configuration\",\n  \"pr_review_managed_github_routes\",\n  \"slack_api_rate_limits\",\n  \"stripe_webhook_events\",\n  \"workspace_memberships\",\n  \"workspaces\",\n] as const;\n\n/**\n * Exact full-CRUD class for the standalone runtime role. This is deliberately\n * explicit instead of being derived from FORCE_RLS_TABLES: adding a protected\n * table must not silently grant it broader DML than its migration intended.\n */\nexport const RUNTIME_FULL_DML_TABLES = [\n  \"agent_run_states\",\n  \"api_keys\",\n  \"audit_events\",\n  \"auth_identities\",\n  \"auth_rate_limits\",\n  \"auth_sessions\",\n  \"auth_users\",\n  \"auth_verifications\",\n  \"automation_run_event_links\",\n  \"automation_runs\",\n  \"automation_sources\",\n  \"automation_trigger_events\",\n  \"automation_trigger_revisions\",\n  \"automation_triggers\",\n  \"automation_webhook_endpoints\",\n  \"billing_customers\",\n  \"browser_session_associations\",\n  \"capability_catalog_items\",\n  \"capability_component_owners\",\n  \"capability_facet_installations\",\n  \"capability_installations\",\n  \"capability_operations\",\n  \"capability_plugin_installations\",\n  \"channels\",\n  \"codex_apps_settings\",\n  \"codex_capacity_waiters\",\n  \"codex_credential_leases\",\n  \"codex_reset_redemption_attempts\",\n  \"codex_rotation_settings\",\n  \"codex_subscription_credentials\",\n  \"composer_drafts\",\n  \"computer_session_associations\",\n  \"connect_attempts\",\n  \"connection_disconnect_operations\",\n  \"connections\",\n  \"connector_action_policies\",\n  \"connector_action_requests\",\n  \"credit_ledger_entries\",\n  \"device_enrollment_requests\",\n  \"document_bases\",\n  \"document_chunks\",\n  \"documents\",\n  \"editable_artifact_replica_leases\",\n  \"enrollment_token_redemptions\",\n  \"enrollments\",\n  \"file_uploads\",\n  \"files\",\n  \"generated_image_artifacts\",\n  \"generated_video_artifacts\",\n  \"github_installation_repositories\",\n  \"github_installations\",\n  \"host_mcp_bindings\",\n  \"host_mcp_delegations\",\n  \"image_generation_operations\",\n  \"import_batches\",\n  \"integration_facet_binding_owners\",\n  \"integration_facet_bindings\",\n  \"integration_oauth_clients\",\n  \"integration_oauth_pending_states\",\n  \"integration_oauth_state_nonces\",\n  \"knowledge_source_sync_index_obligations\",\n  \"knowledge_source_sync_item_outcomes\",\n  \"knowledge_source_sync_object_observations\",\n  \"knowledge_source_sync_states\",\n  \"knowledge_source_sync_wakes\",\n  \"machine_metrics_latest\",\n  \"machine_metrics_series\",\n  \"machine_removal_operations\",\n  \"managed_accounts\",\n  \"mcp_oauth_access_tokens\",\n  \"mcp_oauth_authorization_codes\",\n  \"mcp_oauth_authorization_requests\",\n  \"mcp_oauth_clients\",\n  \"mcp_oauth_refresh_tokens\",\n  \"memory_slack_publication_configurations\",\n  \"memory_slack_publication_receipts\",\n  \"memory_slack_publications\",\n  \"model_call_fact_reconciliation_candidates\",\n  \"model_call_fact_reconciliation_progress\",\n  \"model_call_facts\",\n  \"new_session_drafts\",\n  \"organization_agent_admin_access\",\n  \"organization_api_key_workspaces\",\n  \"organization_codex_rotation_settings\",\n  \"organization_credential_providers\",\n  \"organization_model_defaults\",\n  \"organization_model_provider_connection_operations\",\n  \"organization_model_provider_connections\",\n  \"organization_model_provider_custom_models\",\n  \"organization_privacy_preferences\",\n  \"organization_service_accounts\",\n  \"organization_webhook_deliveries\",\n  \"organization_webhooks\",\n  \"pr_review_app_registrations\",\n  \"pr_review_managed_github_routes\",\n  \"pr_review_repository_bindings\",\n  \"retained_screenshot_artifacts\",\n  \"rig_changes\",\n  \"rig_versions\",\n  \"rigs\",\n  \"sandbox_checkpoint_artifacts\",\n  \"sandbox_lease_holders\",\n  \"sandbox_leases\",\n  \"sandbox_pty_sessions\",\n  \"sandbox_retained_processes\",\n  \"sandbox_session_envelopes\",\n  \"sandbox_workspace_mutation_admissions\",\n  \"sandboxes\",\n  \"scheduled_task_blocker_reviews\",\n  \"scheduled_task_schedule_outbox\",\n  \"session_admin_access\",\n  \"session_attempt_interruptions\",\n  \"session_background_commands\",\n  \"session_command_receipts\",\n  \"session_event_cursors\",\n  \"session_events\",\n  \"session_goals\",\n  \"session_history_items\",\n  \"session_human_input_requests\",\n  \"session_list_snapshots\",\n  \"session_mcp_servers\",\n  \"session_pending_tool_calls\",\n  \"session_pins\",\n  \"session_realtime_connections\",\n  \"session_realtime_context_projections\",\n  \"session_realtime_entries\",\n  \"session_realtime_modes\",\n  \"session_recordings\",\n  \"session_stream_acknowledgments\",\n  \"session_system_update_outbox\",\n  \"session_system_updates\",\n  \"session_title_operations\",\n  \"session_turn_attempts\",\n  \"session_turns\",\n  \"session_workflow_wake_outbox\",\n  \"sessions\",\n  \"site_abuse_reports\",\n  \"site_auth_codes\",\n  \"site_data_collections\",\n  \"site_data_files\",\n  \"site_data_rate_windows\",\n  \"site_data_record_values\",\n  \"site_data_records\",\n  \"site_data_usage\",\n  \"site_data_validation_windows\",\n  \"site_data_workspace_validation_windows\",\n  \"site_hostnames\",\n  \"site_limit_profiles\",\n  \"site_platform_brake\",\n  \"site_platform_storage\",\n  \"site_platform_totals\",\n  \"site_platform_usage\",\n  \"site_publications\",\n  \"site_runtime_conversations\",\n  \"site_runtime_rate_windows\",\n  \"site_runtime_usage\",\n  \"site_session_access\",\n  \"site_sql_databases\",\n  \"site_sql_migrations\",\n  \"site_sql_queries\",\n  \"site_sql_rate_windows\",\n  \"site_sql_usage\",\n  \"site_viewer_sessions\",\n  \"slack_api_rate_limits\",\n  \"slack_app_home_refreshes\",\n  \"slack_bot_delete_operations\",\n  \"slack_bot_post_operations\",\n  \"slack_bot_update_operations\",\n  \"slack_bot_user_links\",\n  \"slack_channel_routes\",\n  \"slack_interaction_action_handles\",\n  \"slack_interaction_inbox\",\n  \"slack_interaction_progress_deliveries\",\n  \"slack_interactions\",\n  \"slack_route_prompt_options\",\n  \"slack_route_prompts\",\n  \"slack_user_dm_routes\",\n  \"social_connections\",\n  \"social_posts\",\n  \"stripe_webhook_events\",\n  \"subscription_apps_designations\",\n  \"subscription_capacity_waiters\",\n  \"subscription_capacity_wake_outbox\",\n  \"subscription_connection_aliases\",\n  \"subscription_connection_assignment_policies\",\n  \"subscription_connection_people\",\n  \"subscription_connection_quota\",\n  \"subscription_connection_workspaces\",\n  \"subscription_connections\",\n  \"subscription_leases\",\n  \"subscription_operation_leases\",\n  \"subscription_person_preferences\",\n  \"subscription_provider_cutovers\",\n  \"subscription_session_bindings\",\n  \"subscription_settings\",\n  \"subscription_turn_failures\",\n  \"tool_gateway_approval_capabilities\",\n  \"transcription_recording_chunks\",\n  \"transcription_recording_objects\",\n  \"transcription_recording_segments\",\n  \"transcription_recordings\",\n  \"usage_events\",\n  \"video_generation_operations\",\n  \"video_generation_references\",\n  \"workspace_artifact_uploads\",\n  \"workspace_artifacts\",\n  \"workspace_captures\",\n  \"workspace_codex_subscription_preferences\",\n  \"workspace_control_events\",\n  \"workspace_credential_providers\",\n  \"workspace_gateway_custom_models\",\n  \"workspace_inference_controls\",\n  \"workspace_instruction_policy_heads\",\n  \"workspace_memberships\",\n  \"workspace_model_policies\",\n  \"workspace_screenshot_quotas\",\n  \"workspace_video_generation_policies\",\n  \"workspace_video_generation_quotas\",\n  \"workspace_webhook_deliveries\",\n  \"workspace_webhooks\",\n  \"workspaces\",\n] as const;\n\n/**\n * A provider's legacy subscription tables once its drained cutover receipt\n * exists: kept for forensics, read-only for the runtime role. Role\n * provisioning grants them full DML only to a database without the receipt\n * (an older binary's world); this binary requires the receipt, so its\n * contract is SELECT only.\n */\nexport const SUBSCRIPTION_CUTOVER_READ_ONLY_TABLES: Readonly<Record<string, readonly string[]>> =\n  Object.freeze({\n    xai: Object.freeze([\n      \"xai_capacity_waiters\",\n      \"xai_credential_leases\",\n      \"xai_rotation_settings\",\n      \"xai_session_account_pins\",\n      \"xai_subscription_credentials\",\n    ]),\n    claude: Object.freeze([\n      \"claude_capacity_waiters\",\n      \"claude_credential_leases\",\n      \"claude_rotation_settings\",\n      \"claude_session_account_pins\",\n      \"claude_subscription_account_usage\",\n      \"claude_subscription_credentials\",\n    ]),\n  });\n\n/** Configuration and lifecycle-owned audit rows are read-only at runtime. */\nexport const RUNTIME_READ_ONLY_TABLES = [\n  \"billing_subscription_operations\",\n  \"codex_turn_source_bindings\",\n  \"company_profile_activation_events\",\n  \"company_profile_heads\",\n  \"company_profile_snapshots\",\n  \"deployment_model_catalog\",\n  \"document_authority_reclassifications\",\n  \"knowledge_lifecycle_events\",\n  \"knowledge_memories\",\n  \"knowledge_memory_lifecycle_events\",\n  \"knowledge_memory_relationships\",\n  \"nested_agent_depth_configuration\",\n  \"organization_integration_policies\",\n  \"organization_integration_policy_operations\",\n  \"organization_plans\",\n  \"plan_credit_periods\",\n  \"preference_registry_events\",\n  \"preference_registry_snapshots\",\n  \"session_tenancy_activations\",\n  \"session_work_claims\",\n  \"site_hostname_holds\",\n  \"skill_source_bindings\",\n  \"skill_write_receipts\",\n  \"slack_installation_bindings\",\n  \"slack_task_policy_activation_events\",\n  \"slack_task_policy_heads\",\n  \"slack_task_policy_revisions\",\n  \"workspace_instruction_policy_deactivation_events\",\n  \"workspace_instruction_policy_snapshots\",\n  \"workspace_learning_policy_activation_events\",\n  \"workspace_learning_policy_heads\",\n  \"workspace_learning_policy_revisions\",\n  \"workspace_learning_policy_snapshots\",\n] as const;\n\n/** Existing runtime authorities that may be observed and advanced, never created or deleted. */\n// Rolling compatibility only: old replicas and legacy SQL lifecycle routines\n// still finalize this counter. New writers use sessions.activity_xid. Keep its\n// exact FORCE-RLS/grant posture until a later contract release retires it.\nexport const RUNTIME_READ_UPDATE_TABLES = [\"workspace_session_activity_revisions\"] as const;\n\n/** Append-only evidence/revision tables are insertable and queryable, never mutable. */\nexport const RUNTIME_READ_INSERT_TABLES = [\n  \"browser_revision_components\",\n  \"browser_revisions\",\n  \"company_profile_revisions\",\n  \"credit_debit_allocations\",\n  \"editable_artifact_blob_refs\",\n  \"editable_artifact_idempotency_receipts\",\n  \"editable_artifact_live_outbox\",\n  \"editable_artifact_materialization_jobs\",\n  \"editable_artifact_materialization_results\",\n  \"editable_artifact_operations\",\n  \"editable_artifact_sequence_checkpoints\",\n  \"editable_artifact_snapshots\",\n  \"editable_artifact_transactions\",\n  \"editable_artifact_undo_claims\",\n  \"editable_artifact_versions\",\n  \"external_link_task_authorities\",\n  \"external_link_turn_authorities\",\n  \"feedback_submissions\",\n  \"google_drive_object_acl_evidence\",\n  \"google_drive_object_acl_principals\",\n  \"host_mcp_resolver_operations\",\n  \"host_mcp_task_authorities\",\n  \"host_mcp_turn_authorities\",\n  \"knowledge_change_proposals\",\n  \"knowledge_claim_evidence\",\n  \"knowledge_claim_relations\",\n  \"knowledge_claim_reviews\",\n  \"knowledge_claims\",\n  \"knowledge_document_versions\",\n  \"knowledge_entities\",\n  \"knowledge_entity_aliases\",\n  \"knowledge_facts\",\n  \"knowledge_operation_receipts\",\n  \"knowledge_providers\",\n  \"knowledge_source_acl_versions\",\n  \"knowledge_source_objects\",\n  \"knowledge_sources\",\n  \"knowledge_sync_runs\",\n  \"pr_review_managed_github_authority_nonces\",\n  \"preference_registry_preferences\",\n  \"preference_registry_revisions\",\n  \"session_attempt_tool_catalogs\",\n  \"session_content_blobs\",\n  \"session_goal_revisions\",\n  \"session_spawn_denials\",\n  \"slack_shared_task_origins\",\n  \"slack_user_link_access_request_operations\",\n  \"temporal_schedule_cleanup_outbox\",\n  \"workspace_artifact_events\",\n  \"workspace_artifact_versions\",\n  \"workspace_instruction_policy_activation_events\",\n  \"workspace_instruction_policy_onboarding_proposals\",\n  \"workspace_instruction_policy_revisions\",\n] as const;\n\n/** Durable operation journals are append/read plus claim/settle updates, never deletes. */\nexport const RUNTIME_READ_INSERT_UPDATE_TABLES = [\n  \"attached_browser_devices\",\n  \"attached_browser_inventories\",\n  \"auth_runs\",\n  \"browser_identities\",\n  \"browser_session_retained_downloads\",\n  \"browser_sessions\",\n  \"browser_state_artifacts\",\n  \"browser_state_uploads\",\n  \"capability_api_facets\",\n  \"capability_facets\",\n  \"capability_integration_facets\",\n  \"capability_mcp_facets\",\n  \"capability_plugin_versions\",\n  \"capability_plugins\",\n  \"capability_skill_facets\",\n  \"capability_skill_files\",\n  \"computer_sessions\",\n  \"editable_artifact_session_links\",\n  \"editable_artifacts\",\n  \"external_identity_links\",\n  \"host_mcp_resolvers\",\n  \"integration_facet_definitions\",\n  \"integration_spec_revisions\",\n  \"integration_tools\",\n  \"interaction_interventions\",\n  \"interaction_operations\",\n  \"interaction_resource_operations\",\n  \"network_routes\",\n  \"scheduled_task_runs\",\n  \"scheduled_tasks\",\n  \"session_attempt_codemode_calls\",\n  \"session_attempt_model_context_snapshots\",\n  \"session_turn_startup_milestones\",\n  \"site_auth_connections\",\n  \"slack_user_link_access_requests\",\n  \"workspace_interaction_revisions\",\n] as const;\n\n/**\n * These FORCE-RLS tables are owned by security-definer host-export routines.\n * The ordinary application role must have no direct table privileges on them.\n */\nexport const PROTECTED_NO_DIRECT_DML_TABLES = [\n  \"additional_organization_creation_receipts\",\n  \"agent_instruction_operations\",\n  \"agent_learning_revisions\",\n  \"agent_learning_snapshots\",\n  \"canonical_human_identities\",\n  \"canonical_human_identity_operations\",\n  \"canonical_human_identity_subjects\",\n  \"canonical_human_login_bindings\",\n  \"company_brain_context_selection_receipts\",\n  \"company_brain_preference_proposal_receipts\",\n  \"company_brain_turn_context_snapshots\",\n  \"company_profile_agent_automatic_activation_receipts\",\n  \"company_profile_agent_confirmation_receipts\",\n  \"company_profile_agent_proposal_receipts\",\n  \"connection_use_audit_facts\",\n  \"connection_use_once_consumption_receipts\",\n  \"document_default_collection_backfill_operations\",\n  \"document_default_collection_backfill_receipts\",\n  \"document_default_collection_backfill_runs\",\n  \"editable_artifact_live_tickets\",\n  \"editable_artifact_scope_authorization_heads\",\n  \"external_identities\",\n  \"governed_learning_activation_receipts\",\n  \"governed_learning_activation_undo_receipts\",\n  \"governed_learning_decision_receipts\",\n  \"host_export_config\",\n  \"host_export_consumers\",\n  \"host_export_cursor_state\",\n  \"host_export_dead_letters\",\n  \"host_export_outbox\",\n  \"knowledge_entries\",\n  \"knowledge_entry_decisions\",\n  \"knowledge_entry_links\",\n  \"knowledge_entry_operations\",\n  \"knowledge_entry_revisions\",\n  \"knowledge_entry_search\",\n  \"knowledge_entry_vectors\",\n  \"knowledge_index_jobs\",\n  \"knowledge_review_batches\",\n  \"managed_auth_actor_mutation_leases\",\n  \"managed_auth_browser_installations\",\n  \"managed_auth_login_return_intents\",\n  \"managed_auth_login_slots\",\n  \"managed_auth_login_transaction_rate_limits\",\n  \"managed_auth_login_transactions\",\n  \"managed_auth_session_set_operations\",\n  \"managed_auth_session_sets\",\n  \"managed_sign_in_method_operations\",\n  \"mcp_operations\",\n  \"organization_company_profile_agent_policies\",\n  \"organization_company_profile_agent_policy_events\",\n  \"organization_invitation_binding_events\",\n  \"organization_membership_invitations\",\n  \"organization_membership_lifecycle_events\",\n  \"organization_membership_operation_receipts\",\n  \"organization_memberships\",\n  \"organization_private_session_setting_events\",\n  \"organization_private_session_settings\",\n  \"organization_profile_events\",\n  \"organization_recovery_approvals\",\n  \"organization_recovery_command_receipts\",\n  \"organization_recovery_custodian_acceptances\",\n  \"organization_recovery_custodians\",\n  \"organization_recovery_events\",\n  \"organization_recovery_notification_attempts\",\n  \"organization_recovery_notification_outbox\",\n  \"organization_recovery_operations\",\n  \"organization_recovery_policies\",\n  \"organization_recovery_policy_heads\",\n  \"organization_shared_workspace_administration_capabilities\",\n  \"organization_user_resource_authorities\",\n  \"organization_user_resource_grants\",\n  \"organization_user_retention_deletion_events\",\n  \"organization_user_retention_deletions\",\n  \"organization_user_retention_object_deletion_receipts\",\n  \"organization_user_retention_object_obligations\",\n  \"organization_user_retention_policies\",\n  \"organization_user_setup_deliveries\",\n  \"organization_user_setup_delivery_attempts\",\n  \"organization_user_setup_intents\",\n  \"organization_workspace_lifecycle_events\",\n  \"organization_workspace_operation_receipts\",\n  \"personal_document_once_consumption_receipts\",\n  \"personal_github_repository_selection_heads\",\n  \"personal_github_repository_selection_operations\",\n  \"personal_github_repository_selections\",\n  \"personal_resource_once_consumption_receipts\",\n  \"private_session_create_capabilities\",\n  \"remember_knowledge_confirmation_receipts\",\n  \"remember_knowledge_memory_materializations\",\n  \"scheduled_task_connection_authority_snapshots\",\n  \"scheduled_task_personal_resource_authorities\",\n  \"scheduled_task_personal_resource_snapshots\",\n  \"scheduled_task_reusable_connection_materializations\",\n  \"scheduled_task_revision_authorities\",\n  \"scheduled_task_run_connection_authority_snapshots\",\n  \"scheduled_task_run_personal_resource_admissions\",\n  \"scheduled_task_run_personal_resource_once_receipts\",\n  \"scheduled_task_run_personal_resource_snapshots\",\n  \"self_service_organization_setup_receipts\",\n  \"session_attempt_connected_machine_authorizations\",\n  \"session_attempt_machine_consents\",\n  \"session_attempt_personal_document_admissions\",\n  \"session_attempt_personal_document_snapshots\",\n  \"session_attempt_personal_resource_admissions\",\n  \"session_attempt_personal_resource_snapshots\",\n  \"session_tenancy_additional_organization_activation_evidence\",\n  \"session_tenancy_greenfield_activation_evidence\",\n  \"session_turn_machine_consents\",\n  \"session_variable_set_attachments\",\n  \"session_visibility_write_capabilities\",\n  \"session_work_claim_revisions\",\n  \"session_work_claim_write_capabilities\",\n  \"skill_config_conversion_receipts\",\n  \"task_note_events\",\n  \"task_note_knowledge_promotion_capabilities\",\n  \"task_note_replacement_receipts\",\n  \"task_note_write_capabilities\",\n  \"task_notes\",\n  \"tenancy_backfill_receipts\",\n  \"tenancy_backfill_unresolved_rows\",\n  \"turn_connection_authority_snapshots\",\n  \"turn_personal_resource_attachment_receipts\",\n  \"turn_personal_resource_once_receipts\",\n  \"turn_personal_resource_snapshots\",\n  \"vault_field_versions\",\n  \"vault_item_fields\",\n  \"vault_item_name_aliases\",\n  \"vault_items\",\n  \"vault_name_aliases\",\n  \"vault_passkey_leases\",\n  \"vaults\",\n  \"workspace_variable_set_variables\",\n  \"workspace_variable_sets\",\n] as const;\n\nexport type RuntimeTableDmlPrivilege = \"SELECT\" | \"INSERT\" | \"UPDATE\" | \"DELETE\";\nexport type RuntimeTablePrivilegeContract = Readonly<\n  Record<string, readonly RuntimeTableDmlPrivilege[]>\n>;\n\nconst FULL_DML_PRIVILEGES = [\"SELECT\", \"INSERT\", \"UPDATE\", \"DELETE\"] as const;\n\n/** Exact per-table DML contract. Absence means no direct table privileges. */\nexport const RUNTIME_TABLE_PRIVILEGES: RuntimeTablePrivilegeContract = Object.freeze({\n  ...Object.fromEntries(RUNTIME_FULL_DML_TABLES.map((table) => [table, FULL_DML_PRIVILEGES])),\n  ...Object.fromEntries(RUNTIME_READ_ONLY_TABLES.map((table) => [table, [\"SELECT\"] as const])),\n  ...Object.fromEntries(\n    Object.values(SUBSCRIPTION_CUTOVER_READ_ONLY_TABLES)\n      .flat()\n      .map((table) => [table, [\"SELECT\"] as const]),\n  ),\n  ...Object.fromEntries(\n    RUNTIME_READ_UPDATE_TABLES.map((table) => [table, [\"SELECT\", \"UPDATE\"] as const]),\n  ),\n  ...Object.fromEntries(\n    RUNTIME_READ_INSERT_TABLES.map((table) => [table, [\"SELECT\", \"INSERT\"] as const]),\n  ),\n  ...Object.fromEntries(\n    RUNTIME_READ_INSERT_UPDATE_TABLES.map((table) => [\n      table,\n      [\"SELECT\", \"INSERT\", \"UPDATE\"] as const,\n    ]),\n  ),\n});\n\n/** All tables with any direct runtime DML; retained as the aggregate public contract. */\nexport const RUNTIME_DML_TABLES = Object.freeze(\n  Object.keys(RUNTIME_TABLE_PRIVILEGES).sort((a, b) => a.localeCompare(b)),\n);\n\n// Membership in ANY binary-owned contract means known, even if a caller uses\n// a narrower protectedTables/tablePrivileges override. In particular, adding\n// FORCE RLS to a known non-RLS or no-direct-DML table must not grant it an escape\n// from its exact ACL contract.\nconst DECLARED_TARGET_TABLES = new Set<string>([\n  ...FORCE_RLS_TABLES,\n  ...NON_RLS_RUNTIME_TABLES,\n  ...RUNTIME_DML_TABLES,\n  ...PROTECTED_NO_DIRECT_DML_TABLES,\n  ...Object.values(SUBSCRIPTION_CUTOVER_READ_ONLY_TABLES).flat(),\n  \"schema_migrations\",\n  \"connection_authority_convergence_audit_capabilities\",\n  \"document_migration_audit_capabilities\",\n  \"session_create_idempotency_guard\",\n  \"session_history_items_repair_audit\",\n]);\n\n// Before the runtime-posture admission change, private routines had an implicit catalog-wide EXECUTE\n// requirement, while unnamed target routines were not inspected at all. Freeze\n// that existing inventory instead of reclassifying old capabilities as unknown\n// (or silently dropping their missing-EXECUTE violations). This is a signature\n// inventory, NOT a new grant list; all named checks below remain authoritative.\n// New private capabilities must be explicitly registered here as known and get\n// their own authority checks. Do not refresh this inventory from a live catalog.\nconst DECLARED_PRIVATE_ROUTINES = new Set<string>([\n  ...legacyRoutines.private,\n  ...OWNER_INTERNAL_PRIVATE_ROUTINES,\n  ...RETIRED_PRIVATE_ROUTINES,\n]);\nconst DECLARED_TARGET_ROUTINES = new Set<string>([\n  ...legacyRoutines.target,\n  ...RETIRED_ROUTINE_ENTRIES.filter(({ schema }) => schema === \"target\").map(\n    ({ signature }) => signature,\n  ),\n  ...RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,\n  ...RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES,\n  ...RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES,\n  ...RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES,\n  SITE_CANCELLATION_PREDICATE,\n]);\n\nfunction securelyShapedUnknownTable(\n  table: Pick<\n    RuntimePrivateTablePosture,\n    \"owner\" | \"rlsEnabled\" | \"rlsForced\" | \"rlsActive\" | \"policyCount\" | \"hasInheritance\"\n  >,\n  runtimeRole: string,\n): boolean {\n  return (\n    table.owner !== runtimeRole &&\n    table.rlsEnabled === true &&\n    table.rlsForced === true &&\n    table.rlsActive === true &&\n    (table.policyCount ?? 0) >= 1 &&\n    // Queries through a parent use the parent's ACL/RLS, not the child's.\n    // Conservatively require a standalone relation, including across schemas.\n    table.hasInheritance === false\n  );\n}\n\nfunction unknownRoutineViolations(\n  routine: RuntimeRoutinePosture,\n  schema: string,\n  runtimeRole: string,\n): string[] {\n  const violations: string[] = [];\n  if (routine.owner === runtimeRole) {\n    violations.push(`runtime role owns unknown routine ${schema}.${routine.name}`);\n  }\n  // SECURITY INVOKER cannot elevate the runtime's identity. Revoked EXECUTE\n  // alone does not make a definer inert: triggers do not check EXECUTE when\n  // firing. Reject trigger/event-trigger return types and pg_trigger bindings,\n  // including absent metadata, even if both runtime and PUBLIC ACLs are revoked.\n  // Aggregates and other catalog dependents can invoke their support functions\n  // without checking those functions' EXECUTE grants. An unknown definer is\n  // eligible only when no catalog object depends on it. Do not enumerate each\n  // indirect invocation mechanism or infer its caller ACL.\n  // A callable unknown definer is NOT proven\n  // safe by FORCE RLS, a trusted owner or a fixed search_path: its body could\n  // disable owner RLS or expose a capability. Require a prior explicit binary\n  // contract for it. Treat missing PUBLIC metadata as unknown, not revoked.\n  if (\n    routine.securityDefiner &&\n    (routine.execute ||\n      routine.publicExecute !== false ||\n      routine.triggerCallable !== false ||\n      routine.hasDependents !== false)\n  ) {\n    violations.push(`unknown routine ${schema}.${routine.name} exposes SECURITY DEFINER execution`);\n  }\n  return violations;\n}\n\nexport type RuntimeDatabasePostureOptions = {\n  rlsStrategy: RlsStrategy;\n  expectedRole?: string;\n  targetSchema?: string;\n  protectedTables?: readonly string[];\n  tablePrivileges?: RuntimeTablePrivilegeContract;\n  protectedNoDirectDmlTables?: readonly string[];\n  targetSchemaCapabilityRoutines?: readonly string[];\n  targetSchemaForbiddenRoutines?: readonly string[];\n  /** Frozen binary contract; current callers require both additive Insights capabilities. */\n  modelFactCapabilityRoutines?: readonly string[];\n};\n\nexport type RuntimeDatabaseIdentity = {\n  currentUser: string;\n  sessionUser: string;\n  databaseOwner: string;\n  canConnectDatabase: boolean;\n  canCreateInDatabase: boolean;\n  rowSecurity: string;\n  canLogin: boolean;\n  superuser: boolean;\n  inherit: boolean;\n  createRole: boolean;\n  createDatabase: boolean;\n  replication: boolean;\n  bypassRls: boolean;\n};\n\nexport type RuntimeSchemaPosture = {\n  name: string;\n  owner: string;\n  usage: boolean;\n  create: boolean;\n};\n\nexport type RuntimeTablePosture = {\n  name: string;\n  owner: string;\n  rlsEnabled: boolean;\n  rlsForced: boolean;\n  rlsActive: boolean;\n  policyCount: number;\n  artifactOutboxDispatcherPolicy: boolean;\n  artifactMaterializerPolicy: boolean;\n  select: boolean;\n  insert: boolean;\n  update: boolean;\n  delete: boolean;\n  truncate: boolean;\n  references: boolean;\n  trigger: boolean;\n  /** Effective column ACLs, kept separate so they cannot satisfy table grants. */\n  columnPrivileges?: string[];\n  extraPrivileges?: string[];\n  hasInheritance?: boolean | undefined;\n};\n\nexport type RuntimeRoutinePosture = {\n  name: string;\n  owner: string;\n  execute: boolean;\n  publicExecute?: boolean;\n  securityDefiner: boolean;\n  triggerCallable?: boolean | undefined;\n  hasDependents?: boolean | undefined;\n  configuration?: string[] | null;\n};\n\nexport type RuntimeTargetRoutinePosture = RuntimeRoutinePosture & {\n  publicExecute: boolean;\n};\n\nexport type RuntimePrivateTablePosture = {\n  name: string;\n  owner: string;\n  rlsEnabled?: boolean;\n  rlsForced?: boolean;\n  rlsActive?: boolean;\n  policyCount?: number;\n  select: boolean;\n  insert: boolean;\n  update: boolean;\n  delete: boolean;\n  truncate?: boolean;\n  references?: boolean;\n  trigger?: boolean;\n  /** Effective relation ACL privileges not represented by the named flags. */\n  extraPrivileges?: string[];\n  columnPrivileges?: string[];\n  hasInheritance?: boolean | undefined;\n};\n\nexport type RuntimeDatabasePosture = {\n  identity: RuntimeDatabaseIdentity;\n  /** Privilege-bearing role relationships; exact PG16+ management-only grants are excluded. */\n  memberships: string[];\n  schemas: RuntimeSchemaPosture[];\n  ownedSchemas: string[];\n  ownedRelations: string[];\n  tables: RuntimeTablePosture[];\n  privateTables: RuntimePrivateTablePosture[];\n  targetRoutines: RuntimeTargetRoutinePosture[];\n  privateRoutines: RuntimeRoutinePosture[];\n  /** Separate owner-only schema: not part of the previous binary's runtime API inventory. */\n  subscriptionOwnerRoutines?: RuntimeRoutinePosture[];\n  sessionVariableSetAttachmentsCutoverPresent: boolean;\n  /**\n   * Retired subscription objects (SUBSCRIPTION_RETIRED_ROUTINES, _POLICIES and\n   * _TRIGGERS, and the Codex names of SUBSCRIPTION_RENAMED_*) the database\n   * still holds; empty once migration 0751 applied.\n   */\n  retiredSubscriptionObjects: string[];\n  /** Migration 0689: Codex runs on the shared subscription core. */\n  subscriptionCodexCutoverActivationPresent: boolean;\n  /**\n   * Providers of SUBSCRIPTION_PROVIDER_CUTOVER_MIGRATIONS whose cutover\n   * receipt the database holds (migration 0712's readiness function).\n   */\n  subscriptionProviderCutoverReceipts: string[];\n};\n\nexport class RuntimeDatabasePostureError extends Error {\n  readonly violations: readonly string[];\n\n  constructor(violations: readonly string[]) {\n    super(`Runtime database posture check failed: ${violations.join(\"; \")}`);\n    this.name = \"RuntimeDatabasePostureError\";\n    this.violations = violations;\n  }\n}\n\n/** Posture/configuration mismatches cannot heal through connection backoff. */\nexport function isRetryableRuntimeDatabaseStartupError(error: unknown): boolean {\n  const seen = new Set<unknown>();\n  let current = error;\n  while (current instanceof Error && !seen.has(current)) {\n    seen.add(current);\n    if (current instanceof RuntimeDatabasePostureError) return false;\n    const code = (current as Error & { code?: unknown }).code;\n    // PostgreSQL authentication, missing database, permission, and schema errors.\n    // Network failures and server-starting states retain the existing retry path.\n    if (\n      typeof code === \"string\" &&\n      [\"28P01\", \"28000\", \"3D000\", \"42501\", \"42P01\", \"42703\"].includes(code)\n    ) {\n      return false;\n    }\n    current = current.cause;\n  }\n  return true;\n}\n\ntype IdentityRow = {\n  current_user: string;\n  session_user: string;\n  database_owner: string;\n  can_connect_database: boolean;\n  can_create_in_database: boolean;\n  row_security: string;\n  rolcanlogin: boolean;\n  rolsuper: boolean;\n  rolinherit: boolean;\n  rolcreaterole: boolean;\n  rolcreatedb: boolean;\n  rolreplication: boolean;\n  rolbypassrls: boolean;\n};\n\nfunction resultRows<T>(result: unknown): T[] {\n  if (Array.isArray(result)) {\n    return result as T[];\n  }\n  const rows = (result as { rows?: unknown } | null)?.rows;\n  if (Array.isArray(rows)) {\n    return rows as T[];\n  }\n  throw new Error(\"Runtime database posture query returned an unsupported result shape\");\n}\n\nfunction sorted(values: Iterable<string>): string[] {\n  return [...values].sort((a, b) => a.localeCompare(b));\n}\n\nfunction difference(left: ReadonlySet<string>, right: ReadonlySet<string>): string[] {\n  return sorted([...left].filter((value) => !right.has(value)));\n}\n\n/** Inspect PostgreSQL catalogs plus one value-free global activation predicate; no tenant content. */\nexport async function inspectRuntimeDatabasePosture(\n  db: Database,\n  options: RuntimeDatabasePostureOptions,\n): Promise<RuntimeDatabasePosture> {\n  const targetSchema = options.targetSchema?.trim() || \"public\";\n\n  return await db.transaction(\n    async (tx) => {\n      const identityRows = resultRows<\n        IdentityRow & {\n          variable_set_cutover_present: boolean;\n          codex_cutover_activation_present: boolean;\n          receipt_reader_present: boolean;\n        }\n      >(\n        await tx.execute(sql`\n          select\n            current_user::text as current_user,\n            session_user::text as session_user,\n            pg_get_userbyid(d.datdba)::text as database_owner,\n            has_database_privilege(current_user, d.oid, 'CONNECT') as can_connect_database,\n            has_database_privilege(current_user, d.oid, 'CREATE') as can_create_in_database,\n            current_setting('row_security')::text as row_security,\n            r.rolcanlogin,\n            r.rolsuper,\n            r.rolinherit,\n            r.rolcreaterole,\n            r.rolcreatedb,\n            r.rolreplication,\n            r.rolbypassrls,\n            to_regprocedure('opengeni_private.session_variable_set_attachments_protocol_v1_active()')\n              is not null as variable_set_cutover_present,\n            to_regprocedure('opengeni_private.subscription_codex_cutover_v1_active()')\n              is not null as codex_cutover_activation_present,\n            to_regprocedure('opengeni_private.subscription_provider_cutover_committed(text)')\n              is not null as receipt_reader_present\n          from pg_roles r\n          join pg_database d on d.datname = current_database()\n          where r.rolname = current_user\n        `),\n      );\n      const identity = identityRows[0];\n      if (!identity) {\n        throw new Error(\"Runtime database posture could not resolve the current PostgreSQL role\");\n      }\n\n      const mappedIdentity: RuntimeDatabaseIdentity = {\n        currentUser: identity.current_user,\n        sessionUser: identity.session_user,\n        databaseOwner: identity.database_owner,\n        canConnectDatabase: identity.can_connect_database,\n        canCreateInDatabase: identity.can_create_in_database,\n        rowSecurity: identity.row_security,\n        canLogin: identity.rolcanlogin,\n        superuser: identity.rolsuper,\n        inherit: identity.rolinherit,\n        createRole: identity.rolcreaterole,\n        createDatabase: identity.rolcreatedb,\n        replication: identity.rolreplication,\n        bypassRls: identity.rolbypassrls,\n      };\n\n      const sessionVariableSetAttachmentsCutoverPresent =\n        identity.variable_set_cutover_present === true;\n      // Migration 0751: any retired subscription object still present (a\n      // dropped one, or the Codex name of a renamed one) means the drained\n      // retirement migration has not run. Read from the catalogs by name (no\n      // schema privilege needed); a routine counts by name, so an unexpected\n      // overload is reported too. Byte order, as\n      // retiredSubscriptionObjectDescriptions lists them.\n      const retiredSubscriptionObjects = resultRows<{ object: string }>(\n        await tx.execute(sql`\n          select object from (\n          select 'routine ' || n.nspname || '.' || p.proname || '('\n            || pg_catalog.oidvectortypes(p.proargtypes) || ')' as object\n          from pg_catalog.pg_proc p\n          join pg_catalog.pg_namespace n on n.oid = p.pronamespace\n          join jsonb_to_recordset(${JSON.stringify(\n            RETIRED_ROUTINE_ENTRIES.map(({ schema, signature }) => ({\n              schema_name: schema === \"target\" ? targetSchema : schema,\n              routine_name: signature.slice(0, signature.indexOf(\"(\")),\n            })),\n          )}::jsonb) as retired(schema_name text, routine_name text)\n            on retired.schema_name = n.nspname and retired.routine_name = p.proname\n          union all\n          select 'policy ' || c.relname || '.' || pol.polname\n          from pg_catalog.pg_policy pol\n          join pg_catalog.pg_class c on c.oid = pol.polrelid\n          join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n          join jsonb_to_recordset(${JSON.stringify(\n            RETIRED_POLICY_ENTRIES,\n          )}::jsonb) as retired(\"table\" text, policy text)\n            on retired.\"table\" = c.relname and retired.policy = pol.polname\n          where n.nspname = ${targetSchema}\n          union all\n          select 'trigger ' || c.relname || '.' || t.tgname\n          from pg_catalog.pg_trigger t\n          join pg_catalog.pg_class c on c.oid = t.tgrelid\n          join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n          join jsonb_to_recordset(${JSON.stringify(\n            RETIRED_TRIGGER_ENTRIES,\n          )}::jsonb) as retired(\"table\" text, \"trigger\" text)\n            on retired.\"table\" = c.relname and retired.\"trigger\" = t.tgname\n          where n.nspname = ${targetSchema} and not t.tgisinternal\n          union all\n          select 'relation ' || n.nspname || '.' || c.relname\n          from pg_catalog.pg_class c\n          join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n          join jsonb_to_recordset(${JSON.stringify(\n            SUBSCRIPTION_RENAMED_RELATIONS.map(({ schema, from }) => ({\n              schema_name: schema,\n              relation_name: from,\n            })),\n          )}::jsonb) as retired(schema_name text, relation_name text)\n            on retired.schema_name = n.nspname and retired.relation_name = c.relname\n          where c.relkind in ('r', 'p', 'v', 'm', 'f')\n          ) retired_objects\n          order by object collate \"C\"\n        `),\n      ).map((row) => row.object);\n      const subscriptionCodexCutoverActivationPresent =\n        identity.codex_cutover_activation_present === true;\n      // The receipt is read through its boolean readiness function only:\n      // committed_at is never read as a date ('-infinity' for Codex).\n      const subscriptionProviderCutoverReceipts =\n        identity.receipt_reader_present === true\n          ? resultRows<{ provider: string }>(\n              await tx.execute(sql`select provider from jsonb_array_elements_text(${JSON.stringify(\n                Object.keys(SUBSCRIPTION_PROVIDER_CUTOVER_MIGRATIONS),\n              )}::jsonb) provider\n                where opengeni_private.subscription_provider_cutover_committed(provider)\n                order by provider`),\n            ).map((row) => row.provider)\n          : [];\n\n      // Scoped/embedded topology deliberately leaves ownership and isolation to\n      // the host. Prove the connection identity is coherent, but do not impose\n      // the standalone opengeni_app object/grant contract on the host's role.\n      if (options.rlsStrategy === \"scoped\") {\n        return {\n          identity: mappedIdentity,\n          memberships: [],\n          schemas: [],\n          ownedSchemas: [],\n          ownedRelations: [],\n          tables: [],\n          privateTables: [],\n          targetRoutines: [],\n          privateRoutines: [],\n          sessionVariableSetAttachmentsCutoverPresent,\n          retiredSubscriptionObjects,\n          subscriptionCodexCutoverActivationPresent,\n          subscriptionProviderCutoverReceipts,\n        };\n      }\n\n      const relationshipRows = resultRows<RoleRelationshipCatalogRow>(\n        await tx.execute(sql.raw(roleRelationshipsCatalogQuery(\"current_user\"))),\n      );\n      const memberships = classifyRoleRelationships(relationshipRows).unsafeRelationships;\n\n      const schemas = resultRows<{\n        name: string;\n        owner: string;\n        usage: boolean;\n        create: boolean;\n      }>(\n        await tx.execute(sql`\n          select\n            n.nspname::text as name,\n            pg_get_userbyid(n.nspowner)::text as owner,\n            has_schema_privilege(current_user, n.oid, 'USAGE') as usage,\n            has_schema_privilege(current_user, n.oid, 'CREATE') as create\n          from pg_namespace n\n          where n.nspname in (${targetSchema}, 'opengeni_private')\n          order by n.nspname\n        `),\n      );\n\n      const ownedSchemas = resultRows<{ name: string }>(\n        await tx.execute(sql`\n          select n.nspname::text as name\n          from pg_namespace n\n          join pg_roles r on r.oid = n.nspowner\n          where r.rolname = current_user\n            and n.nspname <> 'information_schema'\n            and n.nspname !~ '^pg_'\n          order by n.nspname\n        `),\n      ).map((row) => row.name);\n\n      const ownedRelations = resultRows<{ name: string }>(\n        await tx.execute(sql`\n          select (n.nspname || '.' || c.relname)::text as name\n          from pg_class c\n          join pg_namespace n on n.oid = c.relnamespace\n          join pg_roles r on r.oid = c.relowner\n          where r.rolname = current_user\n            and c.relkind in ('r', 'p', 'S', 'v', 'm', 'f')\n            and n.nspname <> 'information_schema'\n            and n.nspname !~ '^pg_'\n          order by n.nspname, c.relname\n        `),\n      ).map((row) => row.name);\n\n      // Inspect both namespaces together: their catalog and privilege probes\n      // are identical. Keep evaluation live on every readiness check.\n      const tableRows = resultRows<{\n        private_schema: boolean;\n        name: string;\n        owner: string;\n        rls_enabled: boolean;\n        rls_forced: boolean;\n        rls_active: boolean;\n        policy_count: number;\n        artifact_outbox_dispatcher_policy: boolean;\n        artifact_materializer_policy: boolean;\n        can_select: boolean;\n        can_insert: boolean;\n        can_update: boolean;\n        can_delete: boolean;\n        can_truncate: boolean;\n        can_references: boolean;\n        can_trigger: boolean;\n        column_privileges: string[];\n        extra_privileges: string[];\n        has_inheritance: boolean;\n      }>(\n        await tx.execute(sql`\n          select\n            (n.nspname = 'opengeni_private') as private_schema,\n            c.relname::text as name,\n            pg_get_userbyid(c.relowner)::text as owner,\n            c.relrowsecurity as rls_enabled,\n            c.relforcerowsecurity as rls_forced,\n            row_security_active(c.oid) as rls_active,\n            coalesce(policies.policy_count, 0) as policy_count,\n            coalesce(policies.artifact_outbox_dispatcher_policy, false) as artifact_outbox_dispatcher_policy,\n            coalesce(policies.artifact_materializer_policy, false) as artifact_materializer_policy,\n            has_table_privilege(current_user, c.oid, 'SELECT') as can_select,\n            has_table_privilege(current_user, c.oid, 'INSERT') as can_insert,\n            has_table_privilege(current_user, c.oid, 'UPDATE') as can_update,\n            has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,\n            has_table_privilege(current_user, c.oid, 'TRUNCATE') as can_truncate,\n            has_table_privilege(current_user, c.oid, 'REFERENCES') as can_references,\n            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger,\n            exists(select 1 from pg_inherits i where i.inhrelid = c.oid or i.inhparent = c.oid) as has_inheritance,\n            ARRAY(\n              SELECT DISTINCT acl.privilege_type FROM aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) acl\n              WHERE acl.privilege_type NOT IN ('SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER')\n                AND CASE WHEN acl.grantee = 0 THEN true ELSE pg_has_role(current_user, acl.grantee, 'USAGE') END\n              ORDER BY acl.privilege_type\n            ) AS extra_privileges,\n            ARRAY(SELECT privilege FROM unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) privilege\n              WHERE has_any_column_privilege(current_user, c.oid, privilege)) as column_privileges\n          from pg_class c\n          join pg_namespace n on n.oid = c.relnamespace\n          left join (\n            select polrelid, count(*)::int as policy_count,\n              bool_or(polname = 'editable_artifact_outbox_dispatcher') as artifact_outbox_dispatcher_policy,\n              bool_or(polname = 'editable_artifact_materializer_owner') as artifact_materializer_policy\n            from pg_policy group by polrelid\n          ) policies on policies.polrelid = c.oid\n          where n.nspname in (${targetSchema}, 'opengeni_private')\n            and c.relkind in ('r', 'p')\n          order by c.relname\n        `),\n      );\n      const tables = tableRows\n        .filter((row) => !row.private_schema || targetSchema === \"opengeni_private\")\n        .map((row) => ({\n          name: row.name,\n          owner: row.owner,\n          rlsEnabled: row.rls_enabled,\n          rlsForced: row.rls_forced,\n          rlsActive: row.rls_active,\n          policyCount: row.policy_count,\n          artifactOutboxDispatcherPolicy: row.artifact_outbox_dispatcher_policy,\n          artifactMaterializerPolicy: row.artifact_materializer_policy,\n          select: row.can_select,\n          insert: row.can_insert,\n          update: row.can_update,\n          delete: row.can_delete,\n          truncate: row.can_truncate,\n          references: row.can_references,\n          trigger: row.can_trigger,\n          columnPrivileges: row.column_privileges,\n          extraPrivileges: row.extra_privileges,\n          hasInheritance: row.has_inheritance,\n        }));\n\n      const privateTables = tableRows\n        .filter((row) => row.private_schema)\n        .map((row) => ({\n          name: row.name,\n          owner: row.owner,\n          rlsEnabled: row.rls_enabled,\n          rlsForced: row.rls_forced,\n          rlsActive: row.rls_active,\n          policyCount: row.policy_count,\n          select: row.can_select,\n          insert: row.can_insert,\n          update: row.can_update,\n          delete: row.can_delete,\n          truncate: row.can_truncate,\n          references: row.can_references,\n          trigger: row.can_trigger,\n          ...(row.extra_privileges?.length ? { extraPrivileges: row.extra_privileges } : {}),\n          columnPrivileges: row.column_privileges,\n          hasInheritance: row.has_inheritance,\n        }));\n\n      const routineRows = resultRows<{\n        private_schema: boolean;\n        name: string;\n        owner: string;\n        can_execute: boolean;\n        public_execute: boolean;\n        security_definer: boolean;\n        trigger_callable: boolean;\n        has_dependents: boolean;\n        configuration: string[] | null;\n      }>(\n        await tx.execute(sql`\n          select\n            (n.nspname = 'opengeni_private') as private_schema,\n            (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,\n            pg_get_userbyid(p.proowner)::text as owner,\n            has_function_privilege(current_user, p.oid, 'EXECUTE') as can_execute,\n            exists (\n              select 1\n              from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl\n              where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'\n            ) as public_execute,\n            p.prosecdef as security_definer,\n            (p.prorettype in ('pg_catalog.trigger'::regtype, 'pg_catalog.event_trigger'::regtype)\n              or exists(select 1 from pg_trigger t where t.tgfoid = p.oid)) as trigger_callable,\n            exists(select 1 from pg_depend d where d.refclassid = 'pg_catalog.pg_proc'::regclass and d.refobjid = p.oid) as has_dependents,\n            p.proconfig as configuration\n          from pg_proc p\n          join pg_namespace n on n.oid = p.pronamespace\n          where n.nspname in (${targetSchema}, 'opengeni_private')\n            and p.prokind in ('f', 'p')\n          order by p.proname, pg_catalog.oidvectortypes(p.proargtypes)\n        `),\n      );\n      const targetRoutines = routineRows\n        .filter((row) => !row.private_schema || targetSchema === \"opengeni_private\")\n        .map((row) => ({\n          name: row.name,\n          owner: row.owner,\n          execute: row.can_execute,\n          publicExecute: row.public_execute,\n          securityDefiner: row.security_definer,\n          triggerCallable: row.trigger_callable,\n          hasDependents: row.has_dependents,\n          configuration: row.configuration,\n        }))\n        .sort((left, right) => left.name.localeCompare(right.name));\n\n      const privateRoutines = routineRows\n        .filter((row) => row.private_schema)\n        .map((row) => ({\n          name: row.name,\n          owner: row.owner,\n          execute: row.can_execute,\n          publicExecute: row.public_execute,\n          securityDefiner: row.security_definer,\n          triggerCallable: row.trigger_callable,\n          hasDependents: row.has_dependents,\n          configuration: row.configuration,\n        }));\n\n      const subscriptionOwnerRoutines = resultRows<RuntimeRoutinePosture>(\n        await tx.execute(sql`\n          select (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')')::text as name,\n            pg_get_userbyid(p.proowner)::text as owner,\n            (has_function_privilege(current_user, p.oid, 'EXECUTE')\n              or has_schema_privilege(current_user, n.oid, 'USAGE')\n              or has_schema_privilege(current_user, n.oid, 'CREATE')) as execute,\n            exists (select 1 from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl\n              where acl.grantee = 0 and acl.privilege_type = 'EXECUTE') as \"publicExecute\",\n            p.prosecdef as \"securityDefiner\", p.proconfig as configuration\n          from pg_proc p join pg_namespace n on n.oid = p.pronamespace\n          where n.nspname = 'opengeni_subscription_internal' and p.prokind = 'f'\n        `),\n      );\n      return {\n        identity: mappedIdentity,\n        memberships,\n        schemas,\n        ownedSchemas,\n        ownedRelations,\n        tables,\n        privateTables,\n        targetRoutines,\n        privateRoutines,\n        subscriptionOwnerRoutines,\n        sessionVariableSetAttachmentsCutoverPresent,\n        retiredSubscriptionObjects,\n        subscriptionCodexCutoverActivationPresent,\n        subscriptionProviderCutoverReceipts,\n      };\n    },\n    { isolationLevel: \"repeatable read\", accessMode: \"read only\" },\n  );\n}\n\n/** Private per-task usage accounting; FORCE-RLS, owner-only. */\nexport const RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES = [\n  \"session_usage_limit_roots\",\n  \"session_usage_limit_receipts\",\n  \"session_usage_limit_config_receipts\",\n] as const;\n\n/** Additive private inventory; absent from older binaries' exact data tables. */\nexport const RUNTIME_ALLOWANCE_PRIVATE_TABLES = [\n  \"workspace_usage_allowances\",\n  \"workspace_member_allowances\",\n  \"workspace_allowance_grants\",\n  \"workspace_allowance_counters\",\n  \"workspace_allowance_periods\",\n  \"workspace_allowance_notifications\",\n  \"usage_allowance_attribution_receipts\",\n  \"workspace_video_allowance_allocations\",\n  \"workspace_allowance_clear_receipts\",\n] as const;\n\n// This was the private-table inspection filter before forward compatibility.\n// Keep the exact named checks below for every member; only other private tables\n// are eligible for the generic additive rule.\nconst DECLARED_PRIVATE_TABLES = new Set<string>([\n  // Provisioning explicitly grants this historical non-RLS rollout receipt\n  // SELECT; it is a known contract even though readiness did not inventory it.\n  \"sandbox_recovery_rollout\",\n  PERSONAL_RESOURCE_CAPABILITY_TABLE,\n  SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE,\n  VARIABLE_SET_CAPABILITY_TABLE,\n  SITE_CANCELLATION_CAPABILITY_TABLE,\n  VAULT_CAPABILITY_TABLE,\n  PERSONAL_DOCUMENT_CAPABILITY_TABLE,\n  DOCUMENT_MIGRATION_CAPABILITY_TABLE,\n  SCOPED_COMPUTE_CAPABILITY_TABLE,\n  CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE,\n  SANDBOX_FILE_PUBLICATIONS_TABLE,\n  ARTIFACT_PINS_TABLE,\n  SCHEDULED_SLACK_BOT_MESSAGES_TABLE,\n  ORGANIZATION_SLACK_BOT_ACCESS_TABLE,\n  ORGANIZATION_SIGNUP_USE_CASES_TABLE,\n  SLACK_FILE_UPLOAD_OPERATIONS_TABLE,\n  AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE,\n  VERIFIED_SIGNUP_TRIAL_SWITCH_TABLE,\n  MANAGED_AUTH_NEW_SIGNUPS_SWITCH_TABLE,\n  \"organization_usage_read_capabilities\",\n  \"usage_allowance_capabilities\",\n  \"usage_maintenance_due\",\n  \"usage_allowance_membership_changes\",\n  \"session_usage_limit_capabilities\",\n  \"session_file_attachments\",\n  \"session_file_read_capabilities\",\n  \"session_import_batches\",\n  \"modal_inventory_read_capabilities\",\n  \"modal_native_origin_read_capabilities\",\n  \"credit_promotion_policy_revisions\",\n  \"subscription_plan_catalog_revisions\",\n  ...MAINTENANCE_PRIVATE_TABLES,\n  ...RUNTIME_ALLOWANCE_PRIVATE_TABLES,\n  ...RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES,\n]);\n\n// These exact existing contracts forbid every SELECT/INSERT/UPDATE column\n// grant. Historically the inspector folded those ACLs into their deny flags.\n// Preserve their named violations while keeping required table grants (catalog,\n// credit policy, Slack ledger) separate from column grants in the inspector.\nconst COLUMN_DENIED_PRIVATE_TABLES = new Set<string>([\n  \"modal_native_origin_read_capabilities\",\n  \"modal_inventory_read_capabilities\",\n  \"usage_allowance_capabilities\",\n  \"usage_maintenance_due\",\n  \"usage_allowance_membership_changes\",\n  \"session_import_batches\",\n  ARTIFACT_PINS_TABLE,\n  SITE_CANCELLATION_CAPABILITY_TABLE,\n  ...MAINTENANCE_PRIVATE_TABLES,\n  ...RUNTIME_ALLOWANCE_PRIVATE_TABLES,\n  ...RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES,\n  \"session_usage_limit_capabilities\",\n]);\n\n/** Pure deterministic evaluator used by startup/readiness and unit tests. */\nexport function evaluateRuntimeDatabasePosture(\n  catalogPosture: RuntimeDatabasePosture,\n  options: RuntimeDatabasePostureOptions,\n): string[] {\n  // Local deny-only projection; never mutate the catalog snapshot or substitute\n  // column grants for a table-level requirement. Unknown objects are untouched.\n  const posture = {\n    ...catalogPosture,\n    privateTables: catalogPosture.privateTables.map((table) => {\n      if (!DECLARED_PRIVATE_TABLES.has(table.name)) return table;\n      const denyColumns = COLUMN_DENIED_PRIVATE_TABLES.has(table.name);\n      return {\n        ...table,\n        select:\n          table.select || (denyColumns && table.columnPrivileges?.includes(\"SELECT\")) || false,\n        insert:\n          table.insert || (denyColumns && table.columnPrivileges?.includes(\"INSERT\")) || false,\n        update:\n          table.update || (denyColumns && table.columnPrivileges?.includes(\"UPDATE\")) || false,\n        references: table.references || table.columnPrivileges?.includes(\"REFERENCES\") || false,\n      };\n    }),\n  };\n  const violations: string[] = [];\n  const identity = posture.identity;\n\n  // Exact posture of the M4 retirement: this release names none of the\n  // retired subscription objects, and the drained retirement migration\n  // (SUBSCRIPTION_RETIREMENT_MIGRATION) drops them.\n  for (const object of posture.retiredSubscriptionObjects) {\n    violations.push(retiredSubscriptionObjectViolation(object));\n  }\n\n  if (!posture.subscriptionCodexCutoverActivationPresent)\n    violations.push(\n      \"database is missing the 0689 Codex subscription-core cutover receipt; run the drained migration first\",\n    );\n  for (const [provider, migration] of Object.entries(SUBSCRIPTION_PROVIDER_CUTOVER_MIGRATIONS)) {\n    if (!posture.subscriptionProviderCutoverReceipts.includes(provider)) {\n      violations.push(\n        `database is missing the ${provider} subscription-core cutover receipt (${migration}); apply the pending migrations first`,\n      );\n    }\n  }\n\n  if (!posture.sessionVariableSetAttachmentsCutoverPresent) {\n    violations.push(\"database is missing the 0352 session Variable Set attachment runtime receipt\");\n  }\n\n  if (!identity.currentUser || !identity.sessionUser) {\n    violations.push(\"database identity is empty\");\n  }\n  if (identity.currentUser !== identity.sessionUser) {\n    violations.push(\n      `current_user ${identity.currentUser} does not match session_user ${identity.sessionUser}`,\n    );\n  }\n  if (!identity.canConnectDatabase) {\n    violations.push(\"runtime role lacks CONNECT on the current database\");\n  }\n\n  if (options.rlsStrategy === \"scoped\") {\n    return violations;\n  }\n\n  const expectedRole = options.expectedRole?.trim() || \"opengeni_app\";\n  const targetSchema = options.targetSchema?.trim() || \"public\";\n  const protectedTables = new Set(options.protectedTables ?? FORCE_RLS_TABLES);\n  const tablePrivileges = options.tablePrivileges ?? RUNTIME_TABLE_PRIVILEGES;\n  const legacyTablesBeforeReceipt = new Set(\n    Object.entries(SUBSCRIPTION_CUTOVER_READ_ONLY_TABLES)\n      .filter(([provider]) => !posture.subscriptionProviderCutoverReceipts.includes(provider))\n      .flatMap(([, tables]) => tables),\n  );\n  const directRuntimeTables = new Set(Object.keys(tablePrivileges));\n  const protectedNoDirectDmlTables = new Set(\n    options.protectedNoDirectDmlTables ??\n      (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES),\n  );\n  const targetSchemaCapabilityRoutines =\n    options.targetSchemaCapabilityRoutines ?? RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES;\n  const targetSchemaForbiddenRoutines =\n    options.targetSchemaForbiddenRoutines ?? RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES;\n  const knownTables = new Set([\n    ...DECLARED_TARGET_TABLES,\n    ...protectedTables,\n    ...directRuntimeTables,\n    ...protectedNoDirectDmlTables,\n  ]);\n  const knownTargetRoutines = new Set([\n    ...DECLARED_TARGET_ROUTINES,\n    ...targetSchemaCapabilityRoutines,\n    ...targetSchemaForbiddenRoutines,\n  ]);\n  const toleratedUnknownTables = new Set(\n    posture.tables\n      .filter(\n        (table) => !knownTables.has(table.name) && securelyShapedUnknownTable(table, expectedRole),\n      )\n      .map((table) => table.name),\n  );\n\n  if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {\n    violations.push(\n      `runtime identity must be ${expectedRole} (current_user=${identity.currentUser}, session_user=${identity.sessionUser})`,\n    );\n  }\n  if (!identity.canLogin) violations.push(\"runtime role is not LOGIN\");\n  if (identity.superuser) violations.push(\"runtime role is SUPERUSER\");\n  if (identity.bypassRls) violations.push(\"runtime role has BYPASSRLS\");\n  if (identity.createRole) violations.push(\"runtime role has CREATEROLE\");\n  if (identity.createDatabase) violations.push(\"runtime role has CREATEDB\");\n  if (identity.replication) violations.push(\"runtime role has REPLICATION\");\n  if (identity.inherit) violations.push(\"runtime role must be NOINHERIT\");\n  if (identity.databaseOwner === expectedRole) violations.push(\"runtime role owns the database\");\n  if (identity.canCreateInDatabase) {\n    violations.push(\"runtime role has CREATE on the current database\");\n  }\n  if (identity.rowSecurity.toLowerCase() !== \"on\") {\n    violations.push(`row_security is ${identity.rowSecurity}, expected on`);\n  }\n  if (posture.memberships.length > 0) {\n    violations.push(`runtime role has memberships: ${sorted(posture.memberships).join(\", \")}`);\n  }\n  if (posture.ownedSchemas.length > 0) {\n    violations.push(`runtime role owns schemas: ${sorted(posture.ownedSchemas).join(\", \")}`);\n  }\n  if (posture.ownedRelations.length > 0) {\n    violations.push(`runtime role owns relations: ${sorted(posture.ownedRelations).join(\", \")}`);\n  }\n\n  for (const schemaName of new Set([targetSchema, \"opengeni_private\"])) {\n    const schema = posture.schemas.find((candidate) => candidate.name === schemaName);\n    if (!schema) {\n      violations.push(`required schema ${schemaName} is missing`);\n      continue;\n    }\n    if (schema.owner === expectedRole) {\n      violations.push(`runtime role owns schema ${schemaName}`);\n    }\n    if (!schema.usage) violations.push(`runtime role lacks USAGE on schema ${schemaName}`);\n    if (schema.create) violations.push(`runtime role has CREATE on schema ${schemaName}`);\n  }\n\n  const tableByName = new Map(posture.tables.map((table) => [table.name, table]));\n  for (const table of posture.privateTables) {\n    if (DECLARED_PRIVATE_TABLES.has(table.name)) {\n      // Keep table-level flags exact for required-grant checks below. Column\n      // grants may add forbidden access but cannot satisfy a table contract.\n      const tableGrants = new Set([\n        ...(table.select ? [\"SELECT\"] : []),\n        ...(table.insert ? [\"INSERT\"] : []),\n        ...(table.update ? [\"UPDATE\"] : []),\n        ...(table.references ? [\"REFERENCES\"] : []),\n      ]);\n      if (table.columnPrivileges?.some((privilege) => !tableGrants.has(privilege))) {\n        violations.push(`private table ${table.name} has excess column privileges`);\n      }\n      continue;\n    }\n    if (table.hasInheritance) {\n      violations.push(\n        `unknown private table ${table.name} has an inheritance or partition relationship`,\n      );\n    }\n    if (table.owner === expectedRole) {\n      violations.push(`runtime role owns private table ${table.name}`);\n    }\n    if (\n      (table.select ||\n        table.insert ||\n        table.update ||\n        table.delete ||\n        table.truncate ||\n        table.references ||\n        table.trigger ||\n        table.extraPrivileges?.length ||\n        table.columnPrivileges?.length) &&\n      (!securelyShapedUnknownTable(table, expectedRole) ||\n        table.truncate ||\n        table.references ||\n        table.trigger ||\n        table.extraPrivileges?.length ||\n        table.columnPrivileges?.includes(\"REFERENCES\"))\n    ) {\n      violations.push(`unknown private table ${table.name} has unsafe runtime privileges`);\n    }\n  }\n  if (\n    !options.protectedTables &&\n    !posture.privateRoutines.some(\n      (routine) => routine.name === SUBSCRIPTION_PLAN_MAINTENANCE_INVENTORY_ROUTINE,\n    )\n  ) {\n    violations.push(\"subscription plan maintenance inventory is missing\");\n  }\n  if (\n    !options.protectedTables &&\n    !posture.privateRoutines.some(\n      (routine) => routine.name === SUBSCRIPTION_PLAN_FREE_ANNIVERSARY_ROUTINE,\n    )\n  ) {\n    violations.push(\"subscription plan Free anniversary helper is missing\");\n  }\n  const privateSchemaOwner = posture.schemas.find(\n    (schema) => schema.name === \"opengeni_private\",\n  )?.owner;\n  const quotedTargetSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n  const precursorSearchPaths = new Set([\n    `search_path=pg_catalog, ${quotedTargetSchema}, opengeni_private, pg_temp`,\n    `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedTargetSchema}, opengeni_private, pg_temp`,\n  ]);\n  const safeSearchPath = (routine: RuntimeRoutinePosture) =>\n    routine.name === \"subscription_codex_refresh_write_allowed(uuid, uuid, uuid)\" ||\n    routine.name === \"subscription_core_refresh_write_allowed(text, uuid, uuid, uuid)\"\n      ? routine.configuration?.includes(\"search_path=pg_catalog, opengeni_private, pg_temp\")\n      : routine.configuration?.some((configuration) => precursorSearchPaths.has(configuration));\n  const hardenedPrivateRoutine = (matches: RuntimeRoutinePosture[]) =>\n    matches.length === 1 &&\n    matches[0]!.execute &&\n    !matches[0]!.publicExecute &&\n    matches[0]!.securityDefiner &&\n    !(privateSchemaOwner && matches[0]!.owner !== privateSchemaOwner) &&\n    safeSearchPath(matches[0]!) === true;\n  for (const expectedRoutine of SUBSCRIPTION_M3_PRECURSOR_PRIVATE_ROUTINES) {\n    const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n    if (!hardenedPrivateRoutine(matches)) {\n      violations.push(\n        `subscription M3 precursor private routine ${expectedRoutine} is missing or unsafe`,\n      );\n    }\n  }\n  for (const ownerOnly of SUBSCRIPTION_M3_OWNER_ONLY_PRIVATE_ROUTINES) {\n    const routine = [...posture.privateRoutines, ...(posture.subscriptionOwnerRoutines ?? [])].find(\n      (candidate) => candidate.name === ownerOnly,\n    );\n    if (routine && (routine.execute || routine.publicExecute)) {\n      violations.push(`subscription M3 owner-only private routine ${ownerOnly} is executable`);\n    }\n  }\n  const privateRoutinePresent = (prefix: string) =>\n    posture.privateRoutines.some((routine) => routine.name.startsWith(prefix));\n  // Keyed on the neutral personal writer (the Codex twins are retired), so\n  // the owner checks below run on every database this release accepts.\n  if (\n    posture.subscriptionOwnerRoutines !== undefined &&\n    privateRoutinePresent(\"connect_subscription_core_personal(\")\n  ) {\n    const required = [\n      // The reset-credit fence, which stays, calls these two.\n      \"grant_subscription_codex_owner_capability(text, uuid, uuid, text, uuid)\",\n      \"drop_subscription_codex_owner_capabilities(uuid)\",\n      \"derive_scheduled_revision_subscription_authority()\",\n      ...SUBSCRIPTION_CORE_NEUTRAL_OWNER_ROUTINES,\n      ...(posture.privateRoutines.some((routine) =>\n        routine.name.startsWith(\"subscription_provider_cutover_committed(\"),\n      )\n        ? SUBSCRIPTION_CORE_PRECURSOR_OWNER_ROUTINES\n        : []),\n      ...(posture.privateRoutines.some((routine) =>\n        routine.name.startsWith(\"copy_subscription_authority_compat(\"),\n      )\n        ? SUBSCRIPTION_AUTHORITY_COMPAT_OWNER_ROUTINES\n        : []),\n      // 0717 adds no runtime routine: once any of its helpers exists, all of\n      // them must, owner-only and with a safe search path.\n      ...(posture.subscriptionOwnerRoutines.some((routine) =>\n        (SUBSCRIPTION_AUTHORITY_FENCE_OWNER_ROUTINES as readonly string[]).includes(routine.name),\n      )\n        ? SUBSCRIPTION_AUTHORITY_FENCE_OWNER_ROUTINES\n        : []),\n    ];\n    for (const signature of required) {\n      const matches = posture.subscriptionOwnerRoutines.filter(\n        (routine) => routine.name === signature,\n      );\n      if (\n        matches.length !== 1 ||\n        matches[0]!.owner !== privateSchemaOwner ||\n        matches[0]!.execute ||\n        matches[0]!.publicExecute ||\n        !matches[0]!.configuration?.some(\n          (value) =>\n            precursorSearchPaths.has(value) ||\n            value === `search_path=pg_catalog, ${targetSchema}, pg_temp` ||\n            value === `search_path=pg_catalog, ${quotedTargetSchema}, pg_temp`,\n        )\n      ) {\n        violations.push(`subscription owner implementation ${signature} is missing or unsafe`);\n      }\n    }\n  }\n  if (tableByName.has(\"organization_integration_policies\")) {\n    for (const name of [\n      \"update_organization_integration_policy(uuid, text, jsonb)\",\n      \"assert_organization_integration_policy_administrator(uuid, text)\",\n    ]) {\n      const routines = posture.privateRoutines.filter((routine) => routine.name === name);\n      const quotedSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n      const searchPaths = new Set([\n        `search_path=pg_catalog, ${quotedSchema}, pg_temp`,\n        `search_path=pg_catalog, ${targetSchema}, pg_temp`,\n      ]);\n      const routine = routines[0];\n      if (\n        routines.length !== 1 ||\n        !routine?.execute ||\n        routine.publicExecute ||\n        !routine.securityDefiner ||\n        !routine.configuration?.some((configuration) => searchPaths.has(configuration)) ||\n        [\n          \"organization_integration_policies\",\n          \"organization_integration_policy_operations\",\n          \"organization_memberships\",\n          \"api_keys\",\n        ].some((table) => tableByName.get(table)?.owner !== routine.owner)\n      ) {\n        violations.push(\"organization integration policy mutation capability is missing or unsafe\");\n      }\n    }\n  }\n  const actualRlsTables = new Set(\n    posture.tables.filter((table) => table.rlsEnabled).map((table) => table.name),\n  );\n  const classifiedProtectedTables = new Set([\n    ...directRuntimeTables,\n    ...protectedNoDirectDmlTables,\n  ]);\n  const unclassifiedProtectedTables = difference(protectedTables, classifiedProtectedTables);\n  if (unclassifiedProtectedTables.length > 0) {\n    violations.push(\n      `protected tables lack an explicit privilege class: ${unclassifiedProtectedTables.join(\", \")}`,\n    );\n  }\n  const protectedNoDirectDmlOverlap = difference(\n    protectedNoDirectDmlTables,\n    new Set([...protectedNoDirectDmlTables].filter((table) => !directRuntimeTables.has(table))),\n  );\n  if (protectedNoDirectDmlOverlap.length > 0) {\n    violations.push(\n      `protected no-direct-DML tables also declare runtime privileges: ${protectedNoDirectDmlOverlap.join(\", \")}`,\n    );\n  }\n  const nonProtectedNoDirectDmlTables = difference(protectedNoDirectDmlTables, protectedTables);\n  if (nonProtectedNoDirectDmlTables.length > 0) {\n    violations.push(\n      `no-direct-DML tables are absent from the protected contract: ${nonProtectedNoDirectDmlTables.join(\", \")}`,\n    );\n  }\n  const catalogTables = new Set(tableByName.keys());\n  const missingRuntimeTables = difference(directRuntimeTables, catalogTables);\n  if (missingRuntimeTables.length > 0) {\n    violations.push(`runtime privilege tables are missing: ${missingRuntimeTables.join(\", \")}`);\n  }\n  const missingTables = difference(protectedTables, catalogTables);\n  if (missingTables.length > 0) {\n    violations.push(`protected tables are missing: ${missingTables.join(\", \")}`);\n  }\n  const undeclaredRlsTables = difference(\n    actualRlsTables,\n    new Set([...protectedTables, ...toleratedUnknownTables]),\n  );\n  if (undeclaredRlsTables.length > 0) {\n    violations.push(\n      `RLS tables are absent from the declared contract: ${undeclaredRlsTables.join(\", \")}`,\n    );\n  }\n\n  for (const table of posture.tables) {\n    // Even an ungranted child can be read/written through a known parent.\n    // Relation-local ACL flags do not describe that indirect access path.\n    if (!knownTables.has(table.name) && table.hasInheritance) {\n      violations.push(`unknown table ${table.name} has an inheritance or partition relationship`);\n    }\n    const privileges = [\n      [\"SELECT\", table.select],\n      [\"INSERT\", table.insert],\n      [\"UPDATE\", table.update],\n      [\"DELETE\", table.delete],\n      [\"TRUNCATE\", table.truncate],\n      [\"REFERENCES\", table.references],\n      [\"TRIGGER\", table.trigger],\n    ] as const;\n    const expectedPrivileges = new Set<string>(tablePrivileges[table.name] ?? []);\n    // Before a provider's receipt, provisioning still grants its legacy\n    // tables full DML (an older binary's world): tolerated, since the missing\n    // receipt is reported and refuses readiness on its own.\n    const toleratedPrivileges = new Set<string>(expectedPrivileges);\n    if (legacyTablesBeforeReceipt.has(table.name)) {\n      for (const privilege of FULL_DML_PRIVILEGES) toleratedPrivileges.add(privilege);\n    }\n    if (toleratedUnknownTables.has(table.name)) {\n      // RLS governs row DML, not TRUNCATE, REFERENCES, TRIGGER or MAINTAIN.\n      for (const privilege of FULL_DML_PRIVILEGES) toleratedPrivileges.add(privilege);\n    }\n    if (table.owner === expectedRole) {\n      violations.push(`runtime role owns table ${table.name}`);\n    }\n    const missingPrivileges = privileges\n      .filter(([privilege, granted]) => expectedPrivileges.has(privilege) && !granted)\n      .map(([privilege]) => privilege);\n    if (missingPrivileges.length > 0) {\n      violations.push(\n        `table ${table.name} lacks required runtime privileges: ${missingPrivileges.join(\", \")}`,\n      );\n    }\n    const excessPrivileges: string[] = privileges\n      .filter(\n        ([privilege, granted]) =>\n          !toleratedPrivileges.has(privilege) &&\n          (granted || table.columnPrivileges?.includes(privilege)),\n      )\n      .map(([privilege]) => privilege);\n    excessPrivileges.push(...(table.extraPrivileges ?? []));\n    if (excessPrivileges.length > 0) {\n      violations.push(\n        `table ${table.name} grants excess runtime privileges: ${excessPrivileges.join(\", \")}`,\n      );\n    }\n  }\n\n  for (const tableName of protectedTables) {\n    const table = tableByName.get(tableName);\n    if (!table) continue;\n    if (!table.rlsEnabled) violations.push(`table ${tableName} does not ENABLE RLS`);\n    if (!table.rlsForced) violations.push(`table ${tableName} does not FORCE RLS`);\n    if (!table.rlsActive) violations.push(`table ${tableName} has inactive RLS for runtime role`);\n    if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);\n  }\n\n  const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;\n  for (const routine of posture.targetRoutines) {\n    if (!knownTargetRoutines.has(routine.name)) {\n      violations.push(...unknownRoutineViolations(routine, targetSchema, expectedRole));\n    }\n  }\n  for (const forbiddenRoutine of targetSchemaForbiddenRoutines) {\n    const matches = posture.targetRoutines.filter((routine) => routine.name === forbiddenRoutine);\n    if (matches.length !== 1) {\n      violations.push(\n        `owner-internal target-schema helper ${forbiddenRoutine} is missing or ambiguous`,\n      );\n      continue;\n    }\n    const routine = matches[0]!;\n    const invoker = RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET.has(routine.name);\n    if (routine.securityDefiner === invoker) {\n      violations.push(\n        `owner-internal target-schema helper ${routine.name} is not SECURITY ${invoker ? \"INVOKER\" : \"DEFINER\"}`,\n      );\n    }\n    const authorityOwner = tableByName.get(\"sessions\")?.owner ?? targetSchemaOwner;\n    if (authorityOwner && routine.owner !== authorityOwner) {\n      violations.push(\n        `owner-internal target-schema helper ${routine.name} owner ${routine.owner} does not match session authority owner ${authorityOwner}`,\n      );\n    }\n    if (routine.execute) {\n      violations.push(`runtime role has forbidden owner-internal helper ${routine.name}`);\n    }\n    if (routine.publicExecute) {\n      violations.push(`PUBLIC has forbidden owner-internal helper ${routine.name}`);\n    }\n  }\n  for (const expectedRoutine of targetSchemaCapabilityRoutines) {\n    const matches = posture.targetRoutines.filter((routine) => routine.name === expectedRoutine);\n    if (matches.length !== 1) {\n      violations.push(\n        `target-schema runtime capability ${expectedRoutine} is missing or ambiguous`,\n      );\n      continue;\n    }\n    const routine = matches[0]!;\n    if (RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINE_SET.has(routine.name)) {\n      if (routine.securityDefiner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} must be SECURITY INVOKER`,\n        );\n      }\n    } else if (!routine.securityDefiner) {\n      violations.push(`target-schema runtime capability ${routine.name} is not SECURITY DEFINER`);\n    }\n    if (\n      routine.name.startsWith(\"usage_allowance_\") ||\n      routine.name === \"maintain_usage_allowances(integer, integer)\"\n    ) {\n      const owners = new Set(\n        RUNTIME_ALLOWANCE_PRIVATE_TABLES.map(\n          (name) => posture.privateTables.find((table) => table.name === name)?.owner,\n        ),\n      );\n      if (\n        (!options.protectedTables ||\n          posture.privateTables.some((table) => table.name === \"usage_allowance_capabilities\")) &&\n        (owners.size !== 1 || owners.has(undefined) || !owners.has(routine.owner))\n      ) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} allowance authority owners do not match`,\n        );\n      }\n    } else if ((SESSION_USAGE_LIMIT_RUNTIME_ROUTINES as readonly string[]).includes(routine.name)) {\n      const owners = new Set(\n        RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES.map(\n          (name) => posture.privateTables.find((table) => table.name === name)?.owner,\n        ),\n      );\n      if (\n        (!options.protectedTables ||\n          posture.privateTables.some(\n            (table) => table.name === \"session_usage_limit_capabilities\",\n          )) &&\n        (owners.size !== 1 || owners.has(undefined) || !owners.has(routine.owner))\n      ) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} session usage limit authority owners do not match`,\n        );\n      }\n    } else if (\n      routine.name === GOOGLE_DRIVE_FILE_AUTHORIZATION_ROUTINE ||\n      routine.name === GOOGLE_DRIVE_DOCUMENT_CITATION_ROUTINE\n    ) {\n      const missingAuthorityTables = GOOGLE_DRIVE_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = GOOGLE_DRIVE_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (\n      (BILLING_SUBSCRIPTION_OPERATION_ROUTINES as readonly string[]).includes(routine.name)\n    ) {\n      const table = tableByName.get(\"billing_subscription_operations\");\n      if ((!options.protectedTables || table) && (!table || table.owner !== routine.owner)) {\n        violations.push(\n          `subscription operation capability ${routine.name} authority table owner does not match`,\n        );\n      }\n    } else if ((SUBSCRIPTION_PLAN_RUNTIME_ROUTINES as readonly string[]).includes(routine.name)) {\n      const authorityTables = [\n        \"organization_plans\",\n        \"plan_credit_periods\",\n        \"credit_ledger_entries\",\n      ];\n      if (\n        (!options.protectedTables || authorityTables.some((name) => tableByName.has(name))) &&\n        authorityTables.some(\n          (name) => !tableByName.has(name) || tableByName.get(name)!.owner !== routine.owner,\n        )\n      ) {\n        violations.push(\n          `subscription plan capability ${routine.name} authority table owners do not match`,\n        );\n      }\n    } else if (routine.name === MCP_OPERATION_CAPABILITY_ROUTINE) {\n      const missing = MCP_OPERATION_AUTHORITY_TABLES.filter((name) => !tableByName.has(name));\n      if (missing.length > 0) {\n        violations.push(`MCP operation authority tables are missing: ${missing.join(\", \")}`);\n      } else if (\n        MCP_OPERATION_AUTHORITY_TABLES.some(\n          (name) => tableByName.get(name)!.owner !== routine.owner,\n        )\n      ) {\n        violations.push(\n          `MCP operation capability ${routine.name} authority table owners do not match`,\n        );\n      }\n    } else if (routine.name === KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_ROUTINE) {\n      const missingAuthorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = KNOWLEDGE_SOURCE_SYNC_LOCK_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (\n      [\n        \"lookup_external_identity(uuid, text, text, text)\",\n        \"prepare_external_workspace_membership_operation(jsonb)\",\n        \"record_external_workspace_membership_operation(jsonb, jsonb)\",\n      ].includes(routine.name)\n    ) {\n      const names = [\n        \"external_identities\",\n        \"organization_memberships\",\n        \"organization_workspace_operation_receipts\",\n        \"api_keys\",\n      ];\n      if (\n        names.some(\n          (name) => !tableByName.has(name) || tableByName.get(name)!.owner !== routine.owner,\n        )\n      ) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority table owners do not match`,\n        );\n      }\n    } else if (\n      [\n        \"ensure_external_identity(uuid, text, text)\",\n        \"get_external_identity_link_reference(uuid, uuid, text)\",\n        \"get_external_identity_link_inventory_references(uuid, uuid[])\",\n      ].includes(routine.name)\n    ) {\n      const names =\n        routine.name !== \"ensure_external_identity(uuid, text, text)\"\n          ? [\"external_identity_links\", \"external_identities\", \"organization_memberships\"]\n          : [\n              \"external_identities\",\n              \"organization_memberships\",\n              \"workspaces\",\n              \"workspace_inference_controls\",\n            ];\n      const missing = names.filter((name) => !tableByName.has(name));\n      if (missing.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missing.join(\", \")}`,\n        );\n      } else if (names.some((name) => tableByName.get(name)!.owner !== routine.owner)) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority table owners do not match`,\n        );\n      }\n    } else if (routine.name === MANAGED_HUMAN_PERSONAL_WORKSPACE_ROUTINE) {\n      const authorityTables = MANAGED_HUMAN_PERSONAL_WORKSPACE_AUTHORITY_TABLES.filter(\n        (tableName) => tableByName.has(tableName),\n      ).map((tableName) => tableByName.get(tableName)!);\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityOwners.size > 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n        );\n      } else if (authorityTables[0] && routine.owner !== authorityTables[0].owner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`,\n        );\n      }\n    } else if (routine.name === GOVERNED_LEARNING_EVALUATION_ROUTINE) {\n      if (!tableByName.has(\"governed_learning_decision_receipts\")) {\n        continue;\n      }\n      const missingAuthorityTables = GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = GOVERNED_LEARNING_EVALUATION_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (\n      GOVERNED_LEARNING_INSPECTION_ROUTINES.includes(\n        routine.name as (typeof GOVERNED_LEARNING_INSPECTION_ROUTINES)[number],\n      )\n    ) {\n      if (!tableByName.has(\"governed_learning_decision_receipts\")) continue;\n      const missingAuthorityTables = GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES.filter(\n        (name) => !tableByName.has(name),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = GOVERNED_LEARNING_INSPECTION_AUTHORITY_TABLES.map(\n          (name) => tableByName.get(name)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1 || routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner does not match governed-learning inspection authority`,\n          );\n        }\n      }\n    } else if (\n      GOVERNED_LEARNING_ACTIVATION_ROUTINES.includes(\n        routine.name as (typeof GOVERNED_LEARNING_ACTIVATION_ROUTINES)[number],\n      )\n    ) {\n      if (!tableByName.has(\"governed_learning_activation_receipts\")) {\n        continue;\n      }\n      const missingAuthorityTables = GOVERNED_LEARNING_ACTIVATION_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = GOVERNED_LEARNING_ACTIVATION_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (\n      COMPANY_PROFILE_AGENT_ADMIN_ROUTINES.includes(\n        routine.name as (typeof COMPANY_PROFILE_AGENT_ADMIN_ROUTINES)[number],\n      )\n    ) {\n      const missingAuthorityTables = COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = COMPANY_PROFILE_AGENT_ADMIN_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (routine.name === ADDITIONAL_ORGANIZATION_CREATION_ROUTINE) {\n      const missingAuthorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = ADDITIONAL_ORGANIZATION_CREATION_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (\n      (ORGANIZATION_MEMBERSHIP_LIFECYCLE_ROUTINES as readonly string[]).includes(routine.name)\n    ) {\n      const missingAuthorityTables = ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = ORGANIZATION_MEMBERSHIP_LIFECYCLE_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (\n      (ORGANIZATION_PRIVATE_SESSION_ROUTINES as readonly string[]).includes(routine.name)\n    ) {\n      if (!tableByName.has(\"organization_private_session_settings\")) {\n        continue;\n      }\n      const authorityTableNames =\n        ORGANIZATION_PRIVATE_SESSION_ROUTINE_AUTHORITY_TABLES[\n          routine.name as keyof typeof ORGANIZATION_PRIVATE_SESSION_ROUTINE_AUTHORITY_TABLES\n        ];\n      const missingAuthorityTables = authorityTableNames.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = authorityTableNames.map((tableName) => tableByName.get(tableName)!);\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if (UNIFIED_KNOWLEDGE_ROUTINE_SET.has(routine.name)) {\n      // PostgreSQL 15+ public is owned by pg_database_owner while migrated\n      // tables/functions share the concrete migrator. Check the authority graph,\n      // as for the native Skill lifecycle, rather than the schema label.\n      for (const name of UNIFIED_KNOWLEDGE_AUTHORITY_TABLES) {\n        const table = tableByName.get(name);\n        if (!table) violations.push(`Knowledge authority table ${name} is missing`);\n        else if (routine.owner !== table.owner)\n          violations.push(\n            `Knowledge capability ${routine.name} owner ${routine.owner} does not match ${name} owner ${table.owner}`,\n          );\n      }\n    } else if (routine.name === \"skill_apply_lifecycle(uuid, uuid, jsonb, jsonb)\") {\n      const authorityTables = [\n        \"preference_registry_preferences\",\n        \"preference_registry_revisions\",\n        \"preference_registry_events\",\n      ];\n      for (const name of authorityTables) {\n        const table = tableByName.get(name);\n        if (!table) violations.push(`Skill lifecycle authority table ${name} is missing`);\n        else if (routine.owner !== table.owner)\n          violations.push(\n            `Skill lifecycle owner ${routine.owner} does not match ${name} owner ${table.owner}`,\n          );\n      }\n    } else if (routine.name === PREFERENCE_KNOWLEDGE_PROPOSAL_ROUTINE) {\n      if (!tableByName.has(\"company_brain_preference_proposal_receipts\")) {\n        continue;\n      }\n      const missingAuthorityTables = PREFERENCE_KNOWLEDGE_PROPOSAL_AUTHORITY_TABLES.filter(\n        (tableName) => !tableByName.has(tableName),\n      );\n      if (missingAuthorityTables.length > 0) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority tables are missing: ${missingAuthorityTables.join(\", \")}`,\n        );\n      } else {\n        const authorityTables = PREFERENCE_KNOWLEDGE_PROPOSAL_AUTHORITY_TABLES.map(\n          (tableName) => tableByName.get(tableName)!,\n        );\n        const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n        if (authorityOwners.size !== 1) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n          );\n        } else if (routine.owner !== authorityTables[0]!.owner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n          );\n        }\n      }\n    } else if ((ORGANIZATION_RECOVERY_ROUTINES as readonly string[]).includes(routine.name)) {\n      const authorityTables = ORGANIZATION_RECOVERY_AUTHORITY_TABLES.filter((tableName) =>\n        tableByName.has(tableName),\n      ).map((tableName) => tableByName.get(tableName)!);\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityTables.length !== ORGANIZATION_RECOVERY_AUTHORITY_TABLES.length) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} organization recovery authority tables are missing`,\n        );\n      } else if (authorityOwners.size !== 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n        );\n      } else if (routine.owner !== authorityTables[0]!.owner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n        );\n      }\n    } else if ((MANAGED_AUTH_SESSION_SET_ROUTINES as readonly string[]).includes(routine.name)) {\n      const authorityTables = MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.filter((tableName) =>\n        tableByName.has(tableName),\n      ).map((tableName) => tableByName.get(tableName)!);\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityTables.length !== MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.length) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} managed auth session-set authority tables are missing`,\n        );\n      } else if (authorityOwners.size !== 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n        );\n      } else if (routine.owner !== authorityTables[0]!.owner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n        );\n      }\n    } else if ((CANONICAL_HUMAN_IDENTITY_ROUTINES as readonly string[]).includes(routine.name)) {\n      const authorityTables = CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.filter((tableName) =>\n        tableByName.has(tableName),\n      ).map((tableName) => tableByName.get(tableName)!);\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityTables.length !== CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.length) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} canonical identity authority tables are missing`,\n        );\n      } else if (authorityOwners.size !== 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(\", \")}`,\n        );\n      } else if (routine.owner !== authorityTables[0]!.owner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,\n        );\n      }\n    } else if (\n      (PERSONAL_GITHUB_REPOSITORY_AUTHORITY_ROUTINES as readonly string[]).includes(routine.name)\n    ) {\n      const authorityTables = PERSONAL_GITHUB_REPOSITORY_AUTHORITY_TABLES.map((tableName) =>\n        tableByName.get(tableName),\n      ).filter((table): table is RuntimeTablePosture => table !== undefined);\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityOwners.size > 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} personal GitHub repository authority table owners do not match`,\n        );\n      } else {\n        const authorityOwner = authorityTables[0]?.owner ?? targetSchemaOwner;\n        if (authorityOwner && routine.owner !== authorityOwner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match personal GitHub repository authority owner ${authorityOwner}`,\n          );\n        }\n      }\n    } else if (\n      (PERSONAL_DOCUMENT_AUTHORITY_ROUTINES as readonly string[]).includes(routine.name) ||\n      (DOCUMENT_MIGRATION_AUTHORITY_ROUTINES as readonly string[]).includes(routine.name)\n    ) {\n      const authorityOwner = tableByName.get(\"documents\")?.owner ?? targetSchemaOwner;\n      if (authorityOwner && routine.owner !== authorityOwner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match document authority owner ${authorityOwner}`,\n        );\n      }\n    } else if ((VARIABLE_SET_AUTHORITY_ROUTINES as readonly string[]).includes(routine.name)) {\n      const authorityTables = [\"workspace_variable_sets\", \"workspace_variable_set_variables\"]\n        .map((tableName) => tableByName.get(tableName))\n        .filter((table): table is RuntimeTablePosture => table !== undefined);\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityOwners.size > 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} variable-set table owners do not match`,\n        );\n      } else {\n        const authorityOwner = authorityTables[0]?.owner ?? targetSchemaOwner;\n        if (authorityOwner && routine.owner !== authorityOwner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match variable-set authority owner ${authorityOwner}`,\n          );\n        }\n      }\n    } else if ((VAULT_RUNTIME_ROUTINES as readonly string[]).includes(routine.name)) {\n      const authorityTables = VAULT_TABLES.map((tableName) => tableByName.get(tableName)).filter(\n        (table): table is RuntimeTablePosture => table !== undefined,\n      );\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityOwners.size > 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} vault table owners do not match`,\n        );\n      } else {\n        const authorityOwner = authorityTables[0]?.owner ?? targetSchemaOwner;\n        if (authorityOwner && routine.owner !== authorityOwner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match vault authority owner ${authorityOwner}`,\n          );\n        }\n      }\n    } else if ((SCOPED_COMPUTE_AUTHORITY_ROUTINES as readonly string[]).includes(routine.name)) {\n      const authorityTables = [\"rigs\", \"rig_versions\", \"enrollments\", \"sandboxes\"]\n        .map((tableName) => tableByName.get(tableName))\n        .filter((table): table is RuntimeTablePosture => table !== undefined);\n      const authorityOwners = new Set(authorityTables.map((table) => table.owner));\n      if (authorityOwners.size > 1) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} scoped-compute table owners do not match`,\n        );\n      } else {\n        const authorityOwner = authorityTables[0]?.owner ?? targetSchemaOwner;\n        if (authorityOwner && routine.owner !== authorityOwner) {\n          violations.push(\n            `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match scoped-compute authority owner ${authorityOwner}`,\n          );\n        }\n      }\n    } else if (SESSION_AUTHORITY_ROUTINES.has(routine.name)) {\n      const authorityOwner = tableByName.get(\"sessions\")?.owner ?? targetSchemaOwner;\n      if (authorityOwner && routine.owner !== authorityOwner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match session authority owner ${authorityOwner}`,\n        );\n      }\n    } else if (routine.name === \"scheduled_task_is_exhausted(uuid)\") {\n      // This scoped invoker predicate cannot mint authority or bypass RLS.\n      // Public-schema installations may have a different schema owner.\n      const taskOwner = tableByName.get(\"scheduled_tasks\")?.owner;\n      if (taskOwner && routine.owner !== taskOwner) {\n        violations.push(\n          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match scheduled task owner ${taskOwner}`,\n        );\n      }\n    } else if (\n      routine.name === XAI_SNAPSHOT_VALIDATOR_ROUTINE ||\n      routine.name === CLAUDE_SNAPSHOT_VALIDATOR_ROUTINE\n    ) {\n      // The immutable SQL validator is invoker-rights and reads no table. Its\n      // exact ACL is posture-checked above; it does not participate in the\n      // SECURITY DEFINER same-owner authority graph.\n    } else if (targetSchemaOwner && routine.owner !== targetSchemaOwner) {\n      violations.push(\n        `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match schema owner ${targetSchemaOwner}`,\n      );\n    }\n    if (!routine.execute) {\n      violations.push(`runtime role lacks target-schema capability ${routine.name}`);\n    }\n    const publicPolicyPredicate = RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET.has(\n      routine.name,\n    );\n    if (publicPolicyPredicate && !routine.publicExecute) {\n      violations.push(`PUBLIC lacks required shared-policy predicate ${routine.name}`);\n    } else if (!publicPolicyPredicate && routine.publicExecute) {\n      violations.push(`PUBLIC has forbidden target-schema capability ${routine.name}`);\n    }\n  }\n\n  const artifactOutbox = tableByName.get(\"editable_artifact_live_outbox\");\n  if (artifactOutbox) {\n    if (!artifactOutbox.artifactOutboxDispatcherPolicy) {\n      violations.push(\"table editable_artifact_live_outbox lacks its owner dispatcher RLS policy\");\n    }\n    for (const expectedRoutine of ARTIFACT_OUTBOX_CAPABILITY_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n      if (matches.length !== 1) {\n        violations.push(`artifact outbox capability ${expectedRoutine} is missing or ambiguous`);\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(`artifact outbox capability ${routine.name} is not SECURITY DEFINER`);\n      }\n      if (routine.owner !== artifactOutbox.owner) {\n        violations.push(\n          `artifact outbox capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactOutbox.owner}`,\n        );\n      }\n      if (routine.execute) {\n        violations.push(\n          `generic runtime role has forbidden global artifact outbox capability ${routine.name}`,\n        );\n      }\n    }\n  }\n\n  const automaticTitleFanoutOutboxes = posture.privateTables.filter(\n    (table) => table.name === AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE,\n  );\n  const automaticTitleFanoutRoutineNames = new Set<string>([\n    ...AUTOMATIC_SESSION_TITLE_FANOUT_RUNTIME_ROUTINES,\n    AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE,\n    AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE,\n  ]);\n  const automaticTitleFanoutCatalogPresent = posture.privateRoutines.some((routine) =>\n    automaticTitleFanoutRoutineNames.has(routine.name),\n  );\n  if (automaticTitleFanoutCatalogPresent && automaticTitleFanoutOutboxes.length !== 1) {\n    violations.push(\n      `automatic session title fanout private outbox ${AUTOMATIC_SESSION_TITLE_FANOUT_OUTBOX_TABLE} is missing or ambiguous`,\n    );\n  }\n  const automaticTitleFanoutOutbox = automaticTitleFanoutOutboxes[0];\n  if (automaticTitleFanoutOutbox) {\n    if (automaticTitleFanoutOutbox.owner === expectedRole) {\n      violations.push(\n        `runtime role owns private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name}`,\n      );\n    }\n    if (!automaticTitleFanoutOutbox.rlsEnabled) {\n      violations.push(\n        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} does not ENABLE RLS`,\n      );\n    }\n    if (!automaticTitleFanoutOutbox.rlsForced) {\n      violations.push(\n        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} does not FORCE RLS`,\n      );\n    }\n    if (!automaticTitleFanoutOutbox.rlsActive) {\n      violations.push(\n        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} has inactive RLS for runtime role`,\n      );\n    }\n    if ((automaticTitleFanoutOutbox.policyCount ?? 0) < 1) {\n      violations.push(\n        `private automatic session title fanout outbox ${automaticTitleFanoutOutbox.name} has no RLS policy`,\n      );\n    }\n    const directPrivileges = [\n      [\"SELECT\", automaticTitleFanoutOutbox.select],\n      [\"INSERT\", automaticTitleFanoutOutbox.insert],\n      [\"UPDATE\", automaticTitleFanoutOutbox.update],\n      [\"DELETE\", automaticTitleFanoutOutbox.delete],\n    ].filter(([, granted]) => granted);\n    if (directPrivileges.length > 0) {\n      violations.push(\n        `runtime role has forbidden direct privileges on private table ${automaticTitleFanoutOutbox.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n      );\n    }\n    for (const expectedRoutine of AUTOMATIC_SESSION_TITLE_FANOUT_RUNTIME_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n      if (matches.length !== 1) {\n        violations.push(\n          `automatic session title fanout capability ${expectedRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(\n          `automatic session title fanout capability ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (routine.owner !== automaticTitleFanoutOutbox.owner) {\n        violations.push(\n          `automatic session title fanout capability ${routine.name} owner ${routine.owner} does not match table owner ${automaticTitleFanoutOutbox.owner}`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(\n          `runtime role lacks automatic session title fanout capability ${routine.name}`,\n        );\n      }\n      if (routine.publicExecute) {\n        violations.push(\n          `PUBLIC has forbidden automatic session title fanout capability ${routine.name}`,\n        );\n      }\n    }\n    const enqueueMatches = posture.privateRoutines.filter(\n      (routine) => routine.name === AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE,\n    );\n    if (enqueueMatches.length !== 1) {\n      violations.push(\n        `automatic session title fanout migration helper ${AUTOMATIC_SESSION_TITLE_FANOUT_MIGRATION_ROUTINE} is missing or ambiguous`,\n      );\n    } else {\n      const routine = enqueueMatches[0]!;\n      if (routine.securityDefiner) {\n        violations.push(\n          `automatic session title fanout migration helper ${routine.name} must be SECURITY INVOKER`,\n        );\n      }\n      if (routine.owner !== automaticTitleFanoutOutbox.owner) {\n        violations.push(\n          `automatic session title fanout migration helper ${routine.name} owner ${routine.owner} does not match table owner ${automaticTitleFanoutOutbox.owner}`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(\n          `runtime role lacks rolling-compatible automatic session title fanout migration helper ${routine.name}`,\n        );\n      }\n      if (routine.publicExecute) {\n        violations.push(\n          `PUBLIC has forbidden automatic session title fanout migration helper ${routine.name}`,\n        );\n      }\n    }\n    const policyTriggerMatches = posture.privateRoutines.filter(\n      (routine) => routine.name === AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE,\n    );\n    if (policyTriggerMatches.length !== 1) {\n      violations.push(\n        `automatic session title policy trigger ${AUTOMATIC_SESSION_TITLE_POLICY_TRIGGER_ROUTINE} is missing or ambiguous`,\n      );\n    } else {\n      const routine = policyTriggerMatches[0]!;\n      if (routine.securityDefiner) {\n        violations.push(\n          `automatic session title policy trigger ${routine.name} must be SECURITY INVOKER`,\n        );\n      }\n      if (routine.owner !== automaticTitleFanoutOutbox.owner) {\n        violations.push(\n          `automatic session title policy trigger ${routine.name} owner ${routine.owner} does not match table owner ${automaticTitleFanoutOutbox.owner}`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(\n          `runtime role lacks rolling-compatible automatic session title policy trigger ${routine.name}`,\n        );\n      }\n      if (routine.publicExecute) {\n        violations.push(\n          `PUBLIC has forbidden automatic session title policy trigger ${routine.name}`,\n        );\n      }\n    }\n  }\n\n  const artifactMaterializationJobs = tableByName.get(\"editable_artifact_materialization_jobs\");\n  if (artifactMaterializationJobs) {\n    for (const tableName of [\n      \"editable_artifact_materialization_jobs\",\n      \"editable_artifact_materialization_results\",\n      \"editable_artifact_blob_refs\",\n      \"editable_artifact_sequence_checkpoints\",\n      \"editable_artifact_versions\",\n      \"editable_artifact_idempotency_receipts\",\n    ]) {\n      const table = tableByName.get(tableName);\n      if (table && !table.artifactMaterializerPolicy) {\n        violations.push(`table ${tableName} lacks its owner materializer RLS policy`);\n      }\n    }\n    for (const expectedRoutine of ARTIFACT_MATERIALIZER_CAPABILITY_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n      if (matches.length !== 1) {\n        violations.push(\n          `artifact materializer capability ${expectedRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(`artifact materializer capability ${routine.name} is not SECURITY DEFINER`);\n      }\n      if (routine.owner !== artifactMaterializationJobs.owner) {\n        violations.push(\n          `artifact materializer capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactMaterializationJobs.owner}`,\n        );\n      }\n      if (routine.execute) {\n        violations.push(\n          `generic runtime role has forbidden global artifact materializer capability ${routine.name}`,\n        );\n      }\n    }\n  }\n  const artifactAuthority = tableByName.get(\"editable_artifacts\");\n  if (artifactAuthority) {\n    const matches = posture.privateRoutines.filter((routine) =>\n      routine.name.startsWith(\"advance_editable_artifact_authorization_revision(\"),\n    );\n    if (matches.length !== 1) {\n      violations.push(\n        \"editable artifact authorization revision capability is missing or ambiguous\",\n      );\n    } else {\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(\n          `editable artifact authorization revision capability ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (routine.owner !== artifactAuthority.owner) {\n        violations.push(\n          `editable artifact authorization revision capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`,\n        );\n      }\n    }\n    for (const expectedRoutine of ARTIFACT_AUTHORIZATION_CAPABILITY_ROUTINES) {\n      const capabilityMatches = posture.privateRoutines.filter(\n        (routine) => routine.name === expectedRoutine,\n      );\n      if (capabilityMatches.length !== 1) {\n        violations.push(\n          `editable artifact authorization capability ${expectedRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = capabilityMatches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(\n          `editable artifact authorization capability ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (routine.owner !== artifactAuthority.owner) {\n        violations.push(\n          `editable artifact authorization capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactAuthority.owner}`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(\n          `runtime role lacks editable artifact authorization capability ${routine.name}`,\n        );\n      }\n    }\n  }\n\n  const artifactLiveTickets = tableByName.get(\"editable_artifact_live_tickets\");\n  if (artifactLiveTickets) {\n    for (const expectedRoutine of ARTIFACT_LIVE_TICKET_CAPABILITY_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === expectedRoutine);\n      if (matches.length !== 1) {\n        violations.push(\n          `artifact live ticket capability ${expectedRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(`artifact live ticket capability ${routine.name} is not SECURITY DEFINER`);\n      }\n      if (routine.owner !== artifactLiveTickets.owner) {\n        violations.push(\n          `artifact live ticket capability ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(`runtime role lacks artifact live ticket capability ${routine.name}`);\n      }\n    }\n    for (const internalRoutine of ARTIFACT_LIVE_TICKET_INTERNAL_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === internalRoutine);\n      if (matches.length !== 1) {\n        violations.push(\n          `artifact live ticket internal routine ${internalRoutine} is missing or ambiguous`,\n        );\n        continue;\n      }\n      const routine = matches[0]!;\n      if (!routine.securityDefiner) {\n        violations.push(\n          `artifact live ticket internal routine ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (routine.owner !== artifactLiveTickets.owner) {\n        violations.push(\n          `artifact live ticket internal routine ${routine.name} owner ${routine.owner} does not match table owner ${artifactLiveTickets.owner}`,\n        );\n      }\n      if (routine.execute) {\n        violations.push(`runtime role has forbidden ticket schema resolver ${routine.name}`);\n      }\n    }\n  }\n\n  const personalResourceCapabilityTables = posture.privateTables.filter(\n    (table) => table.name === PERSONAL_RESOURCE_CAPABILITY_TABLE,\n  );\n  const personalResourceCapabilityRoutines = posture.privateRoutines.filter(\n    (routine) => routine.name === PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE,\n  );\n  if (personalResourceCapabilityTables.length !== 1) {\n    violations.push(\n      `personal-resource capability table ${PERSONAL_RESOURCE_CAPABILITY_TABLE} is missing or ambiguous`,\n    );\n  }\n  if (personalResourceCapabilityRoutines.length !== 1) {\n    violations.push(\n      `personal-resource capability predicate ${PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n    );\n  }\n  if (\n    personalResourceCapabilityTables.length === 1 &&\n    personalResourceCapabilityRoutines.length === 1\n  ) {\n    const table = personalResourceCapabilityTables[0]!;\n    const routine = personalResourceCapabilityRoutines[0]!;\n    if (routine.owner !== table.owner) {\n      violations.push(\n        `personal-resource capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n      );\n    }\n    if (!routine.securityDefiner) {\n      violations.push(\n        `personal-resource capability predicate ${routine.name} is not SECURITY DEFINER`,\n      );\n    }\n    if (!routine.execute) {\n      violations.push(`runtime role lacks personal-resource capability predicate ${routine.name}`);\n    }\n    if (routine.publicExecute) {\n      violations.push(\n        `PUBLIC has forbidden personal-resource capability predicate ${routine.name}`,\n      );\n    }\n    const directPrivileges = [\n      [\"SELECT\", table.select],\n      [\"INSERT\", table.insert],\n      [\"UPDATE\", table.update],\n      [\"DELETE\", table.delete],\n    ].filter(([, granted]) => granted);\n    if (directPrivileges.length > 0) {\n      violations.push(\n        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n      );\n    }\n  }\n\n  const personalDocumentCapabilityTables = posture.privateTables.filter(\n    (table) => table.name === PERSONAL_DOCUMENT_CAPABILITY_TABLE,\n  );\n  const personalDocumentCapabilityRoutines = posture.privateRoutines.filter(\n    (routine) => routine.name === PERSONAL_DOCUMENT_CAPABILITY_PREDICATE_ROUTINE,\n  );\n  if (personalDocumentCapabilityTables.length !== 1) {\n    violations.push(\n      `personal-document capability table ${PERSONAL_DOCUMENT_CAPABILITY_TABLE} is missing or ambiguous`,\n    );\n  }\n  if (personalDocumentCapabilityRoutines.length !== 1) {\n    violations.push(\n      `personal-document capability predicate ${PERSONAL_DOCUMENT_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n    );\n  }\n  if (\n    personalDocumentCapabilityTables.length === 1 &&\n    personalDocumentCapabilityRoutines.length === 1\n  ) {\n    const table = personalDocumentCapabilityTables[0]!;\n    const routine = personalDocumentCapabilityRoutines[0]!;\n    if (routine.owner !== table.owner) {\n      violations.push(\n        `personal-document capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n      );\n    }\n    if (!routine.securityDefiner) {\n      violations.push(\n        `personal-document capability predicate ${routine.name} is not SECURITY DEFINER`,\n      );\n    }\n    if (!routine.execute) {\n      violations.push(`runtime role lacks personal-document capability predicate ${routine.name}`);\n    }\n    if (routine.publicExecute) {\n      violations.push(\n        `PUBLIC has forbidden personal-document capability predicate ${routine.name}`,\n      );\n    }\n    const directPrivileges = [\n      [\"SELECT\", table.select],\n      [\"INSERT\", table.insert],\n      [\"UPDATE\", table.update],\n      [\"DELETE\", table.delete],\n    ].filter(([, granted]) => granted);\n    if (directPrivileges.length > 0) {\n      violations.push(\n        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n      );\n    }\n  }\n\n  const documentMigrationCapabilityTables = posture.privateTables.filter(\n    (table) => table.name === DOCUMENT_MIGRATION_CAPABILITY_TABLE,\n  );\n  const documentMigrationCapabilityRoutines = posture.privateRoutines.filter(\n    (routine) => routine.name === DOCUMENT_MIGRATION_CAPABILITY_PREDICATE_ROUTINE,\n  );\n  if (documentMigrationCapabilityTables.length !== 1) {\n    violations.push(\n      `document-migration capability table ${DOCUMENT_MIGRATION_CAPABILITY_TABLE} is missing or ambiguous`,\n    );\n  }\n  if (documentMigrationCapabilityRoutines.length !== 1) {\n    violations.push(\n      `document-migration capability predicate ${DOCUMENT_MIGRATION_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n    );\n  }\n  if (\n    documentMigrationCapabilityTables.length === 1 &&\n    documentMigrationCapabilityRoutines.length === 1\n  ) {\n    const table = documentMigrationCapabilityTables[0]!;\n    const routine = documentMigrationCapabilityRoutines[0]!;\n    if (routine.owner !== table.owner) {\n      violations.push(\n        `document-migration capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n      );\n    }\n    if (!routine.securityDefiner) {\n      violations.push(\n        `document-migration capability predicate ${routine.name} is not SECURITY DEFINER`,\n      );\n    }\n    if (!routine.execute) {\n      violations.push(`runtime role lacks document-migration capability predicate ${routine.name}`);\n    }\n    if (routine.publicExecute) {\n      violations.push(\n        `PUBLIC has forbidden document-migration capability predicate ${routine.name}`,\n      );\n    }\n    const directPrivileges = [\n      [\"SELECT\", table.select],\n      [\"INSERT\", table.insert],\n      [\"UPDATE\", table.update],\n      [\"DELETE\", table.delete],\n    ].filter(([, granted]) => granted);\n    if (directPrivileges.length > 0) {\n      violations.push(\n        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n      );\n    }\n  }\n\n  const scheduledCapabilityTables = posture.privateTables.filter(\n    (table) => table.name === SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE,\n  );\n  const scheduledCapabilityRoutines = posture.privateRoutines.filter(\n    (routine) => routine.name === SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE,\n  );\n  if (scheduledCapabilityTables.length !== 1) {\n    violations.push(\n      `scheduled personal-resource capability table ${SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE} is missing or ambiguous`,\n    );\n  }\n  if (scheduledCapabilityRoutines.length !== 1) {\n    violations.push(\n      `scheduled personal-resource capability predicate ${SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n    );\n  }\n  if (scheduledCapabilityTables.length === 1 && scheduledCapabilityRoutines.length === 1) {\n    const table = scheduledCapabilityTables[0]!;\n    const routine = scheduledCapabilityRoutines[0]!;\n    if (routine.owner !== table.owner) {\n      violations.push(\n        `scheduled personal-resource capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n      );\n    }\n    if (!routine.securityDefiner) {\n      violations.push(\n        `scheduled personal-resource capability predicate ${routine.name} is not SECURITY DEFINER`,\n      );\n    }\n    if (!routine.execute) {\n      violations.push(\n        `runtime role lacks scheduled personal-resource capability predicate ${routine.name}`,\n      );\n    }\n    if (routine.publicExecute) {\n      violations.push(\n        `PUBLIC has forbidden scheduled personal-resource capability predicate ${routine.name}`,\n      );\n    }\n    const directPrivileges = [\n      [\"SELECT\", table.select],\n      [\"INSERT\", table.insert],\n      [\"UPDATE\", table.update],\n      [\"DELETE\", table.delete],\n    ].filter(([, granted]) => granted);\n    if (directPrivileges.length > 0) {\n      violations.push(\n        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n      );\n    }\n  }\n\n  if (options.protectedTables === undefined) {\n    const variableSetCapabilityTables = posture.privateTables.filter(\n      (table) => table.name === VARIABLE_SET_CAPABILITY_TABLE,\n    );\n    const variableSetCapabilityRoutines = posture.privateRoutines.filter(\n      (routine) => routine.name === VARIABLE_SET_CAPABILITY_PREDICATE_ROUTINE,\n    );\n    if (variableSetCapabilityTables.length !== 1) {\n      violations.push(\n        `variable-set capability table ${VARIABLE_SET_CAPABILITY_TABLE} is missing or ambiguous`,\n      );\n    }\n    if (variableSetCapabilityRoutines.length !== 1) {\n      violations.push(\n        `variable-set capability predicate ${VARIABLE_SET_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n      );\n    }\n    if (variableSetCapabilityTables.length === 1 && variableSetCapabilityRoutines.length === 1) {\n      const table = variableSetCapabilityTables[0]!;\n      const routine = variableSetCapabilityRoutines[0]!;\n      if (routine.owner !== table.owner) {\n        violations.push(\n          `variable-set capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n        );\n      }\n      if (!routine.securityDefiner) {\n        violations.push(\n          `variable-set capability predicate ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(`runtime role lacks variable-set capability predicate ${routine.name}`);\n      }\n      if (routine.publicExecute) {\n        violations.push(`PUBLIC has forbidden variable-set capability predicate ${routine.name}`);\n      }\n      const directPrivileges = [\n        [\"SELECT\", table.select],\n        [\"INSERT\", table.insert],\n        [\"UPDATE\", table.update],\n        [\"DELETE\", table.delete],\n      ].filter(([, granted]) => granted);\n      if (directPrivileges.length > 0) {\n        violations.push(\n          `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n        );\n      }\n    }\n    const vaultCapabilityTables = posture.privateTables.filter(\n      (table) => table.name === VAULT_CAPABILITY_TABLE,\n    );\n    const vaultCapabilityRoutines = posture.privateRoutines.filter(\n      (routine) => routine.name === VAULT_CAPABILITY_PREDICATE_ROUTINE,\n    );\n    if (vaultCapabilityTables.length !== 1) {\n      violations.push(`vault capability table ${VAULT_CAPABILITY_TABLE} is missing or ambiguous`);\n    }\n    if (vaultCapabilityRoutines.length !== 1) {\n      violations.push(\n        `vault capability predicate ${VAULT_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n      );\n    }\n    if (vaultCapabilityTables.length === 1 && vaultCapabilityRoutines.length === 1) {\n      const table = vaultCapabilityTables[0]!;\n      const routine = vaultCapabilityRoutines[0]!;\n      if (routine.owner !== table.owner) {\n        violations.push(\n          `vault capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n        );\n      }\n      if (!routine.securityDefiner) {\n        violations.push(`vault capability predicate ${routine.name} is not SECURITY DEFINER`);\n      }\n      if (!routine.execute) {\n        violations.push(`runtime role lacks vault capability predicate ${routine.name}`);\n      }\n      if (routine.publicExecute) {\n        violations.push(`PUBLIC has forbidden vault capability predicate ${routine.name}`);\n      }\n      const directPrivileges = [\n        [\"SELECT\", table.select],\n        [\"INSERT\", table.insert],\n        [\"UPDATE\", table.update],\n        [\"DELETE\", table.delete],\n      ].filter(([, granted]) => granted);\n      if (directPrivileges.length > 0) {\n        violations.push(\n          `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n        );\n      }\n    }\n    const scopedComputeCapabilityTables = posture.privateTables.filter(\n      (table) => table.name === SCOPED_COMPUTE_CAPABILITY_TABLE,\n    );\n    const scopedComputeCapabilityRoutines = posture.privateRoutines.filter(\n      (routine) => routine.name === SCOPED_COMPUTE_CAPABILITY_PREDICATE_ROUTINE,\n    );\n    if (scopedComputeCapabilityTables.length !== 1) {\n      violations.push(\n        `scoped-compute capability table ${SCOPED_COMPUTE_CAPABILITY_TABLE} is missing or ambiguous`,\n      );\n    }\n    if (scopedComputeCapabilityRoutines.length !== 1) {\n      violations.push(\n        `scoped-compute capability predicate ${SCOPED_COMPUTE_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n      );\n    }\n    if (\n      scopedComputeCapabilityTables.length === 1 &&\n      scopedComputeCapabilityRoutines.length === 1\n    ) {\n      const table = scopedComputeCapabilityTables[0]!;\n      const routine = scopedComputeCapabilityRoutines[0]!;\n      if (routine.owner !== table.owner) {\n        violations.push(\n          `scoped-compute capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n        );\n      }\n      if (!routine.securityDefiner) {\n        violations.push(\n          `scoped-compute capability predicate ${routine.name} is not SECURITY DEFINER`,\n        );\n      }\n      if (!routine.execute) {\n        violations.push(`runtime role lacks scoped-compute capability predicate ${routine.name}`);\n      }\n      if (routine.publicExecute) {\n        violations.push(`PUBLIC has forbidden scoped-compute capability predicate ${routine.name}`);\n      }\n      const directPrivileges = [\n        [\"SELECT\", table.select],\n        [\"INSERT\", table.insert],\n        [\"UPDATE\", table.update],\n        [\"DELETE\", table.delete],\n      ].filter(([, granted]) => granted);\n      if (directPrivileges.length > 0) {\n        violations.push(\n          `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n        );\n      }\n    }\n  }\n\n  if (posture.privateRoutines.length === 0) {\n    violations.push(\"opengeni_private has no helper routines\");\n  }\n\n  // The trial-credit kill switch is operator state. Runtime roles may read it\n  // for the gauge (SELECT is optional) but must never append or rewrite it.\n  const creditPolicyTable = posture.privateTables.find(\n    (table) => table.name === \"credit_promotion_policy_revisions\",\n  );\n  const planCatalogTable = posture.privateTables.find(\n    (table) => table.name === \"subscription_plan_catalog_revisions\",\n  );\n  if (!planCatalogTable?.select)\n    violations.push(\"runtime role cannot read the subscription plan catalog\");\n  if (\n    planCatalogTable &&\n    (planCatalogTable.owner === expectedRole ||\n      planCatalogTable.insert ||\n      planCatalogTable.update ||\n      planCatalogTable.delete)\n  ) {\n    violations.push(\"runtime role has forbidden write authority on the subscription plan catalog\");\n  }\n  if (!creditPolicyTable) {\n    violations.push(\"credit promotion policy table is missing\");\n  } else if (!creditPolicyTable.select) {\n    violations.push(\"runtime role cannot read the credit promotion policy\");\n  }\n  if (\n    creditPolicyTable &&\n    (creditPolicyTable.owner === expectedRole ||\n      creditPolicyTable.insert ||\n      creditPolicyTable.update ||\n      creditPolicyTable.delete)\n  ) {\n    violations.push(\"runtime role has forbidden write authority on the credit promotion policy\");\n  }\n  const trialSwitchTable = posture.privateTables.find(\n    (table) => table.name === VERIFIED_SIGNUP_TRIAL_SWITCH_TABLE,\n  );\n  if (\n    trialSwitchTable &&\n    (trialSwitchTable.owner === expectedRole ||\n      trialSwitchTable.insert ||\n      trialSwitchTable.update ||\n      trialSwitchTable.delete)\n  ) {\n    violations.push(\n      \"runtime role has forbidden write authority on the verified signup trial switch\",\n    );\n  }\n\n  // The new-account sign-up switch is operator state too. The API reads it on\n  // each sign-up decision but must never append or rewrite it.\n  const newSignupsSwitchTable = posture.privateTables.find(\n    (table) => table.name === MANAGED_AUTH_NEW_SIGNUPS_SWITCH_TABLE,\n  );\n  if (\n    newSignupsSwitchTable &&\n    (newSignupsSwitchTable.owner === expectedRole ||\n      newSignupsSwitchTable.insert ||\n      newSignupsSwitchTable.update ||\n      newSignupsSwitchTable.delete)\n  ) {\n    violations.push(\n      \"runtime role has forbidden write authority on the managed auth new signups switch\",\n    );\n  }\n\n  const connectionBackfillCapabilityTables = posture.privateTables.filter(\n    (table) => table.name === CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE,\n  );\n  const connectionBackfillCapabilityRoutines = posture.privateRoutines.filter(\n    (routine) => routine.name === CONNECTION_TENANCY_BACKFILL_CAPABILITY_PREDICATE_ROUTINE,\n  );\n  if (connectionBackfillCapabilityTables.length !== 1) {\n    violations.push(\n      `connection-tenancy backfill capability table ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE} is missing or ambiguous`,\n    );\n  }\n  if (connectionBackfillCapabilityRoutines.length !== 1) {\n    violations.push(\n      `connection-tenancy backfill capability predicate ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_PREDICATE_ROUTINE} is missing or ambiguous`,\n    );\n  }\n  if (\n    connectionBackfillCapabilityTables.length === 1 &&\n    connectionBackfillCapabilityRoutines.length === 1\n  ) {\n    const table = connectionBackfillCapabilityTables[0]!;\n    const routine = connectionBackfillCapabilityRoutines[0]!;\n    if (routine.owner !== table.owner) {\n      violations.push(\n        `connection-tenancy backfill capability predicate ${routine.name} owner ${routine.owner} does not match table owner ${table.owner}`,\n      );\n    }\n    if (!routine.securityDefiner) {\n      violations.push(\n        `connection-tenancy backfill capability predicate ${routine.name} is not SECURITY DEFINER`,\n      );\n    }\n    if (!routine.execute) {\n      violations.push(\n        `runtime role lacks connection-tenancy backfill capability predicate ${routine.name}`,\n      );\n    }\n    if (routine.publicExecute) {\n      violations.push(\n        `PUBLIC has forbidden connection-tenancy backfill capability predicate ${routine.name}`,\n      );\n    }\n    const directPrivileges = [\n      [\"SELECT\", table.select],\n      [\"INSERT\", table.insert],\n      [\"UPDATE\", table.update],\n      [\"DELETE\", table.delete],\n    ].filter(([, granted]) => granted);\n    if (directPrivileges.length > 0) {\n      violations.push(\n        `runtime role has forbidden direct privileges on private table ${table.name}: ${directPrivileges.map(([privilege]) => privilege).join(\", \")}`,\n      );\n    }\n  }\n\n  const publicationTables = posture.privateTables.filter(\n    (table) => table.name === SANDBOX_FILE_PUBLICATIONS_TABLE,\n  );\n  if (publicationTables.length !== 1) {\n    if (!options.protectedTables)\n      violations.push(\"sandbox file publication private relation is missing or ambiguous\");\n  } else {\n    const table = publicationTables[0]!;\n    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 2) {\n      violations.push(\"sandbox file publication relation lacks active FORCE-RLS file isolation\");\n    }\n    if (\n      table.select ||\n      table.insert ||\n      table.update ||\n      table.delete ||\n      table.owner === expectedRole\n    ) {\n      violations.push(\"runtime role has forbidden direct sandbox file publication authority\");\n    }\n    const filesOwner = tableByName.get(\"files\")?.owner;\n    if (filesOwner && table.owner !== filesOwner)\n      violations.push(\"sandbox file publication owner does not match file authority\");\n    for (const name of SANDBOX_FILE_PUBLICATION_RUNTIME_ROUTINES) {\n      const routines = posture.privateRoutines.filter((routine) => routine.name === name);\n      const quotedSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n      const searchPaths = new Set([\n        `search_path=pg_catalog, ${quotedSchema}, pg_temp`,\n        `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedSchema}, pg_temp`,\n      ]);\n      if (\n        routines.length !== 1 ||\n        !routines[0]!.execute ||\n        routines[0]!.publicExecute ||\n        !routines[0]!.securityDefiner ||\n        routines[0]!.owner !== table.owner ||\n        !routines[0]!.configuration?.some((configuration) => searchPaths.has(configuration))\n      ) {\n        violations.push(`sandbox file publication capability ${name} is missing or unsafe`);\n      }\n    }\n  }\n\n  const pinTables = posture.privateTables.filter((table) => table.name === ARTIFACT_PINS_TABLE);\n  if (pinTables.length !== 1) {\n    if (!options.protectedTables)\n      violations.push(\"artifact pin private relation is missing or ambiguous\");\n  } else {\n    const table = pinTables[0]!;\n    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1)\n      violations.push(\"artifact pin relation lacks active FORCE-RLS workspace isolation\");\n    if (\n      table.select ||\n      table.insert ||\n      table.update ||\n      table.delete ||\n      table.truncate ||\n      table.references ||\n      table.trigger ||\n      table.extraPrivileges?.length ||\n      table.owner === expectedRole\n    )\n      violations.push(\"runtime role has forbidden direct artifact pin authority\");\n    if (tableByName.get(\"files\")?.owner && table.owner !== tableByName.get(\"files\")!.owner)\n      violations.push(\"artifact pin owner does not match workspace authority\");\n    const quotedSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n    const searchPaths = new Set([\n      `search_path=pg_catalog, ${quotedSchema}, pg_temp`,\n      `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedSchema}, pg_temp`,\n    ]);\n    for (const name of ARTIFACT_PIN_RUNTIME_ROUTINES) {\n      const routines = posture.privateRoutines.filter((routine) => routine.name === name);\n      if (\n        routines.length !== 1 ||\n        !routines[0]!.execute ||\n        routines[0]!.publicExecute ||\n        !routines[0]!.securityDefiner ||\n        routines[0]!.owner !== table.owner ||\n        !routines[0]!.configuration?.some((configuration) => searchPaths.has(configuration))\n      )\n        violations.push(`artifact pin capability ${name} is missing or unsafe`);\n    }\n  }\n\n  const slackFileUploadTables = posture.privateTables.filter(\n    (table) => table.name === SLACK_FILE_UPLOAD_OPERATIONS_TABLE,\n  );\n  if (slackFileUploadTables.length !== 1) {\n    if (!options.protectedTables)\n      violations.push(\"Slack file upload private relation is missing or ambiguous\");\n  } else {\n    const table = slackFileUploadTables[0]!;\n    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1) {\n      violations.push(\"Slack file upload relation lacks active FORCE-RLS session isolation\");\n    }\n    if (\n      !table.select ||\n      !table.insert ||\n      !table.update ||\n      table.delete ||\n      table.owner === expectedRole\n    ) {\n      violations.push(\"runtime role has unsafe Slack file upload ledger privileges\");\n    }\n    const sessionOwner = tableByName.get(\"sessions\")?.owner;\n    if (sessionOwner && table.owner !== sessionOwner)\n      violations.push(\"Slack file upload owner does not match session authority\");\n  }\n\n  const scheduledSlackMessageTables = posture.privateTables.filter(\n    (table) => table.name === SCHEDULED_SLACK_BOT_MESSAGES_TABLE,\n  );\n  if (scheduledSlackMessageTables.length !== 1) {\n    if (!options.protectedTables)\n      violations.push(\"scheduled Slack bot message private relation is missing or ambiguous\");\n  } else {\n    const table = scheduledSlackMessageTables[0]!;\n    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1) {\n      violations.push(\"scheduled Slack bot message relation lacks active FORCE-RLS isolation\");\n    }\n    if (\n      table.select ||\n      table.insert ||\n      table.update ||\n      table.delete ||\n      table.owner === expectedRole\n    ) {\n      violations.push(\"runtime role has forbidden direct scheduled Slack bot message authority\");\n    }\n    const postLedgerOwner = tableByName.get(\"slack_bot_post_operations\")?.owner;\n    if (postLedgerOwner && table.owner !== postLedgerOwner)\n      violations.push(\"scheduled Slack bot message owner does not match Slack post authority\");\n    for (const name of SCHEDULED_SLACK_BOT_MESSAGE_RUNTIME_ROUTINES) {\n      const routines = posture.privateRoutines.filter((routine) => routine.name === name);\n      const quotedSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n      const searchPaths = new Set([\n        `search_path=pg_catalog, ${quotedSchema}, pg_temp`,\n        `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedSchema}, pg_temp`,\n      ]);\n      if (\n        routines.length !== 1 ||\n        !routines[0]!.execute ||\n        routines[0]!.publicExecute ||\n        !routines[0]!.securityDefiner ||\n        routines[0]!.owner !== table.owner ||\n        !routines[0]!.configuration?.some((configuration) => searchPaths.has(configuration))\n      ) {\n        violations.push(`scheduled Slack bot message capability ${name} is missing or unsafe`);\n      }\n    }\n  }\n\n  const botAccessTables = posture.privateTables.filter(\n    (table) => table.name === ORGANIZATION_SLACK_BOT_ACCESS_TABLE,\n  );\n  if (botAccessTables.length !== 1) {\n    if (!options.protectedTables)\n      violations.push(\"organization Slack bot access relation is missing or ambiguous\");\n  } else {\n    const table = botAccessTables[0]!;\n    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1)\n      violations.push(\"organization Slack bot access lacks active FORCE-RLS isolation\");\n    if (\n      table.select ||\n      table.insert ||\n      table.update ||\n      table.delete ||\n      table.truncate ||\n      table.references ||\n      table.trigger ||\n      table.owner === expectedRole\n    )\n      violations.push(\"runtime role has forbidden direct organization Slack bot access authority\");\n    if (table.owner !== scheduledSlackMessageTables[0]?.owner)\n      violations.push(\"organization Slack bot access owner does not match Slack post authority\");\n  }\n\n  const signupUseCaseTables = posture.privateTables.filter(\n    (table) => table.name === ORGANIZATION_SIGNUP_USE_CASES_TABLE,\n  );\n  if (signupUseCaseTables.length !== 1) {\n    if (!options.protectedTables)\n      violations.push(\"organization signup use case private relation is missing or ambiguous\");\n  } else {\n    const table = signupUseCaseTables[0]!;\n    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1) {\n      violations.push(\"organization signup use case relation lacks active FORCE-RLS isolation\");\n    }\n    if (\n      table.select ||\n      table.insert ||\n      table.update ||\n      table.delete ||\n      table.owner === expectedRole\n    ) {\n      violations.push(\"runtime role has forbidden direct organization signup use case authority\");\n    }\n    const sessionOwner = tableByName.get(\"sessions\")?.owner;\n    if (sessionOwner && table.owner !== sessionOwner)\n      violations.push(\"organization signup use case owner does not match session authority\");\n    const quotedSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n    const searchPaths = new Set([\n      `search_path=pg_catalog, ${quotedSchema}, pg_temp`,\n      `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedSchema}, pg_temp`,\n    ]);\n    for (const name of ORGANIZATION_SIGNUP_USE_CASE_RUNTIME_ROUTINES) {\n      const routines = posture.privateRoutines.filter((routine) => routine.name === name);\n      if (\n        routines.length !== 1 ||\n        !routines[0]!.execute ||\n        routines[0]!.publicExecute ||\n        !routines[0]!.securityDefiner ||\n        routines[0]!.owner !== table.owner ||\n        !routines[0]!.configuration?.some((configuration) => searchPaths.has(configuration))\n      ) {\n        violations.push(`organization signup use case capability ${name} is missing or unsafe`);\n      }\n    }\n  }\n\n  for (const name of [\"session_file_attachments\", \"session_file_read_capabilities\"]) {\n    const table = posture.privateTables.find((candidate) => candidate.name === name);\n    if (!table) {\n      if (!options.protectedTables)\n        violations.push(`session attachment relation ${name} is missing`);\n      continue;\n    }\n    if (\n      table.owner === expectedRole ||\n      table.owner !== tableByName.get(\"files\")?.owner ||\n      table.select ||\n      table.insert ||\n      table.update ||\n      table.delete\n    )\n      violations.push(`session attachment relation ${name} has unsafe authority`);\n    if (\n      name === \"session_file_attachments\" &&\n      (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1)\n    )\n      violations.push(\"session attachment grants lack FORCE-RLS isolation\");\n    const routines =\n      name === \"session_file_attachments\"\n        ? [\n            \"accept_session_file_attachments(uuid, uuid, uuid, uuid, text, uuid[])\",\n            \"read_session_file_attachments(uuid, uuid, uuid, integer, uuid[], jsonb)\",\n          ]\n        : [\"session_file_read_allowed(uuid, uuid, uuid)\"];\n    for (const signature of routines) {\n      const routine = posture.privateRoutines.find((candidate) => candidate.name === signature);\n      const quotedSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n      const paths =\n        name === \"session_file_read_capabilities\"\n          ? [\"search_path=pg_catalog, pg_temp\"]\n          : [\n              `search_path=pg_catalog, ${quotedSchema}, pg_temp`,\n              `search_path=pg_catalog, ${targetSchema}, pg_temp`,\n            ];\n      if (\n        !routine ||\n        !routine.execute ||\n        routine.publicExecute ||\n        !routine.securityDefiner ||\n        routine.owner !== table.owner ||\n        !routine.configuration?.some((value) => paths.includes(value))\n      )\n        violations.push(`session attachment capability ${signature} is missing or unsafe`);\n    }\n  }\n\n  const archiveImportLedger = posture.privateTables.find(\n    (table) => table.name === \"session_import_batches\",\n  );\n  if (archiveImportLedger) {\n    if (\n      archiveImportLedger.owner === expectedRole ||\n      archiveImportLedger.owner !== tableByName.get(\"sessions\")?.owner ||\n      !archiveImportLedger.rlsEnabled ||\n      !archiveImportLedger.rlsForced ||\n      !archiveImportLedger.rlsActive ||\n      (archiveImportLedger.policyCount ?? 0) < 3 ||\n      archiveImportLedger.select ||\n      archiveImportLedger.insert ||\n      archiveImportLedger.update ||\n      archiveImportLedger.delete ||\n      archiveImportLedger.truncate ||\n      archiveImportLedger.references ||\n      archiveImportLedger.trigger\n    )\n      violations.push(\"archived import ledger lacks private same-owner FORCE-RLS isolation\");\n    const quotedSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n    const paths = [\n      `search_path=pg_catalog, ${quotedSchema}, pg_temp`,\n      `search_path=pg_catalog, ${targetSchema}, pg_temp`,\n    ];\n    for (const signature of [\n      \"read_archived_session_import_batch(uuid, uuid, uuid, text, text, text)\",\n      \"record_archived_session_import_batch(uuid, uuid, uuid, text, text, text, text, integer, integer)\",\n    ]) {\n      const routine = posture.privateRoutines.find((candidate) => candidate.name === signature);\n      if (\n        !routine ||\n        !routine.execute ||\n        routine.publicExecute ||\n        !routine.securityDefiner ||\n        routine.owner !== archiveImportLedger.owner ||\n        !routine.configuration?.some((value) => paths.includes(value))\n      )\n        violations.push(`archived import capability ${signature} is missing or unsafe`);\n    }\n  }\n\n  const organizationUsageCapability = posture.privateTables.find(\n    (table) => table.name === \"organization_usage_read_capabilities\",\n  );\n  const usageAllowanceCapability = posture.privateTables.find(\n    (table) => table.name === \"usage_allowance_capabilities\",\n  );\n  for (const indexName of [\"usage_maintenance_due\", \"usage_allowance_membership_changes\"]) {\n    const usageMaintenanceIndex = posture.privateTables.find((table) => table.name === indexName);\n    if (\n      usageMaintenanceIndex &&\n      (usageMaintenanceIndex.owner === expectedRole ||\n        usageMaintenanceIndex.owner !== tableByName.get(\"workspaces\")?.owner ||\n        usageMaintenanceIndex.select ||\n        usageMaintenanceIndex.insert ||\n        usageMaintenanceIndex.update ||\n        usageMaintenanceIndex.delete ||\n        usageMaintenanceIndex.truncate ||\n        usageMaintenanceIndex.references ||\n        usageMaintenanceIndex.trigger)\n    )\n      violations.push(\n        `usage maintenance index ${indexName} has unsafe owner or direct runtime privileges`,\n      );\n  }\n  if (!options.protectedTables || usageAllowanceCapability) {\n    const authorityOwner = tableByName.get(\"workspaces\")?.owner;\n    for (const name of RUNTIME_ALLOWANCE_PRIVATE_TABLES) {\n      const table = posture.privateTables.find((candidate) => candidate.name === name);\n      if (\n        !table ||\n        table.owner === expectedRole ||\n        table.owner !== authorityOwner ||\n        !table.rlsEnabled ||\n        !table.rlsForced ||\n        !table.rlsActive ||\n        (table.policyCount ?? 0) < 1 ||\n        table.select ||\n        table.insert ||\n        table.update ||\n        table.delete ||\n        table.truncate ||\n        table.references ||\n        table.trigger\n      ) {\n        violations.push(`usage allowance private table ${name} is missing or unsafe`);\n      }\n    }\n  }\n  if (\n    usageAllowanceCapability &&\n    (usageAllowanceCapability.owner === expectedRole ||\n      usageAllowanceCapability.owner !==\n        posture.privateTables.find((table) => table.name === \"workspace_usage_allowances\")?.owner ||\n      usageAllowanceCapability.select ||\n      usageAllowanceCapability.insert ||\n      usageAllowanceCapability.update ||\n      usageAllowanceCapability.delete)\n  ) {\n    violations.push(\"usage allowance capability has unsafe owner or direct runtime privileges\");\n  }\n  const allowanceAttribution = posture.privateTables.find(\n    (table) => table.name === \"usage_allowance_attribution_receipts\",\n  );\n  if (\n    allowanceAttribution &&\n    (allowanceAttribution.owner !==\n      posture.privateTables.find((table) => table.name === \"workspace_usage_allowances\")?.owner ||\n      !allowanceAttribution.rlsEnabled ||\n      !allowanceAttribution.rlsForced ||\n      !allowanceAttribution.rlsActive)\n  ) {\n    violations.push(\"usage allowance attribution receipts lack same-owner FORCE-RLS isolation\");\n  }\n  const sessionUsageLimitCapability = posture.privateTables.find(\n    (table) => table.name === \"session_usage_limit_capabilities\",\n  );\n  if (!options.protectedTables || sessionUsageLimitCapability) {\n    const authorityOwner = tableByName.get(\"workspaces\")?.owner;\n    for (const name of RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES) {\n      const table = posture.privateTables.find((candidate) => candidate.name === name);\n      if (\n        !table ||\n        table.owner === expectedRole ||\n        table.owner !== authorityOwner ||\n        !table.rlsEnabled ||\n        !table.rlsForced ||\n        !table.rlsActive ||\n        (table.policyCount ?? 0) < 1 ||\n        table.select ||\n        table.insert ||\n        table.update ||\n        table.delete ||\n        table.truncate ||\n        table.references ||\n        table.trigger\n      ) {\n        violations.push(`session usage limit private table ${name} is missing or unsafe`);\n      }\n    }\n    if (\n      !sessionUsageLimitCapability ||\n      sessionUsageLimitCapability.owner === expectedRole ||\n      sessionUsageLimitCapability.owner !== authorityOwner ||\n      sessionUsageLimitCapability.select ||\n      sessionUsageLimitCapability.insert ||\n      sessionUsageLimitCapability.update ||\n      sessionUsageLimitCapability.delete ||\n      sessionUsageLimitCapability.truncate\n    ) {\n      violations.push(\n        \"session usage limit capability has unsafe owner or direct runtime privileges\",\n      );\n    }\n  }\n  const nativeOriginCapability = posture.privateTables.find(\n    (table) => table.name === \"modal_native_origin_read_capabilities\",\n  );\n  const nativeOriginRoutineInstalled = posture.targetRoutines.some(\n    (routine) => routine.name === \"lock_live_native_original_origin_v2(jsonb)\",\n  );\n  if (\n    (nativeOriginRoutineInstalled || nativeOriginCapability) &&\n    (!nativeOriginCapability ||\n      nativeOriginCapability.owner === expectedRole ||\n      nativeOriginCapability.owner !== tableByName.get(\"sessions\")?.owner ||\n      nativeOriginCapability.owner !== tableByName.get(\"organization_memberships\")?.owner ||\n      !nativeOriginCapability.rlsEnabled ||\n      !nativeOriginCapability.rlsForced ||\n      !nativeOriginCapability.rlsActive ||\n      nativeOriginCapability.select ||\n      nativeOriginCapability.insert ||\n      nativeOriginCapability.update ||\n      nativeOriginCapability.delete ||\n      nativeOriginCapability.truncate ||\n      nativeOriginCapability.references ||\n      nativeOriginCapability.trigger)\n  )\n    violations.push(\"Native LIVE-origin read capability has unsafe owner, RLS or privileges\");\n  const modalInventoryCapability = posture.privateTables.find(\n    (table) => table.name === \"modal_inventory_read_capabilities\",\n  );\n  if (modalInventoryCapability) {\n    const capability = modalInventoryCapability;\n    const inventory = posture.privateRoutines.find(\n      (routine) => routine.name === \"list_live_modal_sandbox_leases()\",\n    );\n    if (\n      capability.owner === expectedRole ||\n      capability.owner !== tableByName.get(\"sandbox_leases\")?.owner ||\n      capability.select ||\n      capability.insert ||\n      capability.update ||\n      capability.delete ||\n      !inventory?.execute ||\n      !inventory.securityDefiner ||\n      inventory.publicExecute ||\n      inventory.owner !== capability.owner ||\n      !inventory.configuration?.includes(\"search_path=pg_catalog\")\n    ) {\n      violations.push(\"Modal inventory capability has unsafe owner, ACL or runtime privileges\");\n    }\n    const createInventory = posture.privateRoutines.find(\n      (routine) => routine.name === \"list_pending_modal_provider_creates()\",\n    );\n    if (\n      createInventory &&\n      (!createInventory.execute ||\n        createInventory.publicExecute ||\n        !createInventory.securityDefiner ||\n        createInventory.owner !== capability.owner ||\n        !createInventory.configuration?.includes(\"search_path=pg_catalog\"))\n    ) {\n      violations.push(\"Modal create inventory has unsafe owner, ACL or runtime privileges\");\n    }\n    const enrollmentInventory = posture.privateRoutines.find(\n      (routine) => routine.name === \"list_stale_compute_sandbox_enrollments(uuid)\",\n    );\n    if (\n      enrollmentInventory &&\n      (!enrollmentInventory.execute ||\n        enrollmentInventory.publicExecute ||\n        !enrollmentInventory.securityDefiner ||\n        enrollmentInventory.owner !== capability.owner ||\n        !enrollmentInventory.configuration?.includes(\"search_path=pg_catalog\"))\n    ) {\n      violations.push(\"Compute enrollment inventory has unsafe owner, ACL or runtime privileges\");\n    }\n  }\n  if (organizationUsageCapability) {\n    const capability = organizationUsageCapability;\n    if (\n      capability.owner === expectedRole ||\n      capability.owner !== tableByName.get(\"usage_events\")?.owner ||\n      capability.select ||\n      capability.insert ||\n      capability.update ||\n      capability.delete\n    ) {\n      violations.push(\n        \"organization usage capability has unsafe owner or direct runtime privileges\",\n      );\n    }\n    const aggregateRoutine = posture.privateRoutines.find(\n      (routine) =>\n        routine.name ===\n        \"organization_usage_summary(uuid, timestamp with time zone, timestamp with time zone, text, uuid, boolean)\",\n    );\n    if (\n      !aggregateRoutine ||\n      !aggregateRoutine.securityDefiner ||\n      !aggregateRoutine.execute ||\n      aggregateRoutine.publicExecute ||\n      aggregateRoutine.owner !== capability.owner\n    ) {\n      violations.push(\"organization usage aggregate capability is missing or unsafe\");\n    }\n  }\n  const siteCancellation = posture.privateTables.find(\n    (table) => table.name === SITE_CANCELLATION_CAPABILITY_TABLE,\n  );\n  const siteCancellationPredicate = posture.targetRoutines.filter(\n    (routine) => routine.name === SITE_CANCELLATION_PREDICATE,\n  );\n  const siteCancellationRoutines = posture.privateRoutines.filter((routine) =>\n    (SITE_CANCELLATION_PRIVATE_ROUTINES as readonly string[]).includes(routine.name),\n  );\n  // Require the current production contract; reduced fixture/embedding inventories\n  // may omit Sites, but any installed half must satisfy the complete capability.\n  if (\n    !options.protectedTables ||\n    siteCancellation ||\n    siteCancellationPredicate.length ||\n    siteCancellationRoutines.length\n  ) {\n    if (\n      !siteCancellation ||\n      siteCancellation.owner === expectedRole ||\n      siteCancellation.owner !== tableByName.get(\"sessions\")?.owner ||\n      siteCancellation.select ||\n      siteCancellation.insert ||\n      siteCancellation.update ||\n      siteCancellation.delete ||\n      siteCancellation.truncate ||\n      siteCancellation.references ||\n      siteCancellation.trigger\n    )\n      violations.push(\"Site cancellation capability ledger is missing or unsafe\");\n    const predicate = siteCancellationPredicate[0];\n    if (\n      siteCancellationPredicate.length !== 1 ||\n      !predicate?.securityDefiner ||\n      !predicate.execute ||\n      !predicate.publicExecute ||\n      predicate.owner !== siteCancellation?.owner ||\n      !predicate.configuration?.includes(\"search_path=pg_catalog\")\n    )\n      violations.push(\"Site cancellation policy predicate is missing or unsafe\");\n    for (const name of SITE_CANCELLATION_PRIVATE_ROUTINES) {\n      const matches = siteCancellationRoutines.filter((routine) => routine.name === name);\n      const routine = matches[0];\n      if (\n        matches.length !== 1 ||\n        !routine?.securityDefiner ||\n        !routine.execute ||\n        routine.publicExecute ||\n        routine.owner !== siteCancellation?.owner ||\n        !(name.startsWith(\"end_\")\n          ? routine.configuration?.includes(\"search_path=pg_catalog\")\n          : safeSearchPath(routine))\n      )\n        violations.push(`Site cancellation routine ${name} is missing or unsafe`);\n    }\n  }\n  const modelCallFactsOwner = tableByName.get(\"model_call_facts\")?.owner;\n  const modelFactCapabilityRoutines = new Set(\n    options.modelFactCapabilityRoutines ?? MODEL_FACT_CAPABILITY_ROUTINES.map(([name]) => name),\n  );\n  if (modelCallFactsOwner !== undefined) {\n    for (const [name, violation] of MODEL_FACT_CAPABILITY_ROUTINES) {\n      const matches = posture.privateRoutines.filter((routine) => routine.name === name);\n      // An older binary does not require a later additive capability, but any\n      // installed capability must retain the same owner and ACL safety contract.\n      if (matches.length === 0 && !modelFactCapabilityRoutines.has(name)) continue;\n      const routine = matches[0];\n      if (\n        matches.length !== 1 ||\n        !routine?.securityDefiner ||\n        !routine.execute ||\n        routine.publicExecute ||\n        routine.owner !== modelCallFactsOwner\n      ) {\n        violations.push(violation);\n      }\n    }\n  }\n\n  const integrationRoutine = [\n    [\n      \"resolve_organization_credential_provider_v1(uuid, uuid)\",\n      \"organization_credential_providers\",\n      true,\n    ],\n    [\n      \"resolve_integration_initiating_human_v1(uuid, uuid, text, uuid)\",\n      \"external_identities\",\n      true,\n    ],\n    [\n      \"integration_webhook_payload_v1(uuid, uuid, uuid, text, uuid, uuid, bigint, timestamp with time zone, jsonb, text)\",\n      \"session_turns\",\n      false,\n    ],\n    [\"enqueue_organization_webhook_deliveries_v1()\", \"organization_webhook_deliveries\", true],\n    [\n      \"claim_organization_webhook_deliveries_v1(uuid, integer, integer)\",\n      \"organization_webhook_deliveries\",\n      true,\n    ],\n    [\n      \"settle_organization_webhook_delivery_v1(uuid, uuid, integer, text, integer)\",\n      \"organization_webhook_deliveries\",\n      true,\n    ],\n    [\n      \"prune_organization_webhook_deliveries_v1(integer, integer)\",\n      \"organization_webhook_deliveries\",\n      true,\n    ],\n  ] as const;\n  const quotedIntegrationSchema = `\"${targetSchema.replaceAll('\"', '\"\"')}\"`;\n  const integrationSearchPaths = [\n    `search_path=pg_catalog, ${quotedIntegrationSchema}, pg_temp`,\n    `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedIntegrationSchema}, pg_temp`,\n  ];\n  // Read-only maintenance work checks hold exactly the authority of the claim\n  // each previews. Once that claim exists, its check must too, so a cadence\n  // never silently loses the ability to see work.\n  for (const [name, claimName, claimSchema] of MAINTENANCE_WORK_PROBE_ROUTINES) {\n    const claim = (\n      claimSchema === \"target\" ? posture.targetRoutines : posture.privateRoutines\n    ).find((entry) => entry.name === claimName);\n    if (!claim) continue;\n    const matches = posture.privateRoutines.filter((routine) => routine.name === name);\n    const routine = matches[0];\n    if (\n      matches.length !== 1 ||\n      !routine ||\n      routine.owner !== claim.owner ||\n      !routine.securityDefiner ||\n      routine.publicExecute ||\n      !routine.execute ||\n      !routine.configuration?.includes(\"search_path=pg_catalog\")\n    ) {\n      violations.push(`maintenance work check ${name} is missing or has unsafe posture`);\n    }\n  }\n  if (\n    !options.protectedTables ||\n    posture.privateTables.some((table) => MAINTENANCE_PROBE_TABLES.includes(table.name))\n  ) {\n    const owner = tableByName.get(\"workspaces\")?.owner;\n    for (const name of MAINTENANCE_PRIVATE_TABLES) {\n      const table = posture.privateTables.find((candidate) => candidate.name === name);\n      if (\n        !table ||\n        table.owner !== owner ||\n        table.owner === expectedRole ||\n        table.select ||\n        table.insert ||\n        table.update ||\n        table.delete ||\n        table.truncate ||\n        table.references ||\n        table.trigger\n      ) {\n        violations.push(`maintenance probe index ${name} is missing or accessible to runtime`);\n      }\n    }\n    for (const name of MAINTENANCE_PROBE_OWNER_ROUTINES) {\n      const routine = posture.privateRoutines.find((candidate) => candidate.name === name);\n      if (\n        !routine ||\n        routine.owner !== owner ||\n        routine.execute ||\n        routine.publicExecute ||\n        !routine.configuration?.some(\n          (value) => value === \"search_path=pg_catalog\" || integrationSearchPaths.includes(value),\n        )\n      ) {\n        violations.push(`maintenance probe helper ${name} is missing or unsafe`);\n      }\n    }\n    for (const name of [\n      \"maintenance_claim_active(text, text)\",\n      \"maintenance_title_event_visible(text, uuid)\",\n    ]) {\n      const capability = posture.privateRoutines.find((routine) => routine.name === name);\n      if (\n        !capability ||\n        capability.owner !== owner ||\n        !capability.securityDefiner ||\n        !capability.execute ||\n        capability.publicExecute ||\n        !capability.configuration?.includes(\"search_path=pg_catalog\")\n      ) {\n        violations.push(`maintenance claim predicate ${name} is missing or unsafe`);\n      }\n    }\n  }\n  if (tableByName.has(\"organization_credential_providers\")) {\n    for (const [name] of integrationRoutine) {\n      if (posture.privateRoutines.filter((routine) => routine.name === name).length !== 1) {\n        violations.push(`integration routine ${name} is missing or ambiguous`);\n      }\n    }\n  }\n  for (const routine of posture.privateRoutines) {\n    if (routine.owner === expectedRole) {\n      violations.push(`runtime role owns private routine ${routine.name}`);\n    }\n    if (!DECLARED_PRIVATE_ROUTINES.has(routine.name)) {\n      violations.push(...unknownRoutineViolations(routine, \"opengeni_private\", expectedRole));\n    }\n    if (routine.name === SUBSCRIPTION_PLAN_MAINTENANCE_INVENTORY_ROUTINE) {\n      if (\n        !routine.execute ||\n        routine.publicExecute ||\n        !routine.securityDefiner ||\n        !routine.configuration?.includes(\"search_path=pg_catalog\") ||\n        [\n          \"managed_accounts\",\n          \"organization_plans\",\n          \"plan_credit_periods\",\n          \"credit_ledger_entries\",\n        ].some((name) => routine.owner !== tableByName.get(name)?.owner)\n      ) {\n        violations.push(\"subscription plan maintenance inventory has unsafe capability posture\");\n      }\n    }\n    if (\n      routine.name === SUBSCRIPTION_PLAN_FREE_ANNIVERSARY_ROUTINE &&\n      (!routine.execute ||\n        routine.publicExecute ||\n        routine.securityDefiner ||\n        !routine.configuration?.includes(\"search_path=pg_catalog\") ||\n        routine.owner !== tableByName.get(\"managed_accounts\")?.owner)\n    ) {\n      violations.push(\"subscription plan Free anniversary helper has unsafe capability posture\");\n    }\n    if (\n      routine.name === \"list_pending_child_terminal_wake_repairs_v1(integer, uuid, uuid)\" ||\n      routine.name === \"list_exhausted_scheduled_tasks(integer)\" ||\n      routine.name === \"list_scheduled_task_schedule_reconciliations(integer)\" ||\n      routine.name === \"list_quiescence_receipt_wake_repairs_v1(integer, uuid, uuid)\"\n    ) {\n      const dispatcher = posture.privateRoutines.find(\n        (entry) => entry.name === \"claim_session_workflow_wakes(integer)\",\n      );\n      if (\n        !dispatcher ||\n        routine.owner !== dispatcher.owner ||\n        !routine.securityDefiner ||\n        routine.publicExecute ||\n        !routine.execute ||\n        !routine.configuration?.includes(\"search_path=pg_catalog\")\n      ) {\n        violations.push(\n          `wake repair inventory ${routine.name} has unsafe dispatcher capability posture`,\n        );\n      }\n    }\n    const integrationContract = integrationRoutine.find(([name]) => name === routine.name);\n    if (integrationContract) {\n      const [, tableName, definer] = integrationContract;\n      if (\n        routine.publicExecute ||\n        !routine.execute ||\n        routine.securityDefiner !== definer ||\n        routine.owner !== tableByName.get(tableName)?.owner ||\n        !routine.configuration?.some((value) => integrationSearchPaths.includes(value))\n      ) {\n        violations.push(\n          `integration routine ${routine.name} has unsafe execution, ownership or search path`,\n        );\n      }\n    }\n    const ownerInternalRoutine = OWNER_INTERNAL_PRIVATE_ROUTINES.has(routine.name);\n    if (\n      [\"sync_usage_maintenance_due()\", \"arm_usage_allowances_for_membership()\"].includes(\n        routine.name,\n      ) &&\n      (routine.execute ||\n        routine.publicExecute ||\n        !routine.securityDefiner ||\n        routine.owner !== tableByName.get(\"workspaces\")?.owner ||\n        !routine.configuration?.some((value) =>\n          [\n            \"search_path=pg_catalog, pg_temp\",\n            `search_path=pg_catalog, ${targetSchema}, pg_temp`,\n            `search_path=pg_catalog, ${quotedIntegrationSchema}, pg_temp`,\n          ].includes(value),\n        ))\n    )\n      violations.push(`usage maintenance helper ${routine.name} has unsafe posture`);\n    if (\n      [\"validate_mcp_account_bindings(jsonb, jsonb)\", \"fence_mcp_account_bindings()\"].includes(\n        routine.name,\n      )\n    ) {\n      if (routine.execute || routine.publicExecute) {\n        violations.push(\n          `runtime or PUBLIC has forbidden EXECUTE on MCP account binding internal routine ${routine.name}`,\n        );\n      }\n      if (routine.owner !== tableByName.get(\"session_turns\")?.owner) {\n        violations.push(\n          `MCP account binding internal routine ${routine.name} owner does not match turn owner`,\n        );\n      }\n      if (routine.securityDefiner !== (routine.name === \"fence_mcp_account_bindings()\")) {\n        violations.push(\n          `MCP account binding internal routine ${routine.name} has unsafe execution mode`,\n        );\n      }\n    }\n    if (\n      routine.name === \"read_sender_connection(uuid, uuid, uuid, text)\" &&\n      (routine.execute || routine.publicExecute)\n    ) {\n      violations.push(\"runtime or PUBLIC can call the internal sender connection reader\");\n    }\n    if (\n      [\n        \"guard_mcp_operation_immutable()\",\n        \"mcp_operation_command_scoped(jsonb, text, jsonb)\",\n      ].includes(routine.name)\n    ) {\n      if (routine.execute || routine.publicExecute) {\n        violations.push(\n          `runtime or PUBLIC has forbidden EXECUTE on MCP operation internal routine ${routine.name}`,\n        );\n      }\n      if (routine.owner !== tableByName.get(\"mcp_operations\")?.owner) {\n        violations.push(\n          `MCP operation internal routine ${routine.name} owner does not match ledger owner`,\n        );\n      }\n    }\n    if (\n      [\n        \"guard_workspace_owned_skill_head_delete()\",\n        \"guard_workspace_owned_skill_history_delete()\",\n      ].includes(routine.name) &&\n      (routine.execute || routine.publicExecute)\n    ) {\n      violations.push(\n        `runtime or PUBLIC has forbidden EXECUTE on Skill cascade guard ${routine.name}`,\n      );\n    }\n    // A retired routine still present is reported once, as retired (it is\n    // never granted again, so its missing EXECUTE is not a second finding).\n    if (\n      DECLARED_PRIVATE_ROUTINES.has(routine.name) &&\n      !routine.execute &&\n      !ownerInternalRoutine &&\n      !RETIRED_PRIVATE_ROUTINES.has(routine.name)\n    ) {\n      violations.push(`runtime role lacks EXECUTE on private routine ${routine.name}`);\n    }\n  }\n\n  return violations;\n}\n\nexport async function assertRuntimeDatabasePosture(\n  db: Database,\n  options: RuntimeDatabasePostureOptions,\n): Promise<RuntimeDatabasePosture> {\n  const posture = await inspectRuntimeDatabasePosture(db, options);\n  const violations = evaluateRuntimeDatabasePosture(posture, options);\n  if (violations.length > 0) {\n    throw new RuntimeDatabasePostureError(violations);\n  }\n  return posture;\n}\n\nexport function runtimeDatabaseReadyCheck(\n  db: Database,\n  options: RuntimeDatabasePostureOptions,\n): () => Promise<void> {\n  return async () => {\n    await assertRuntimeDatabasePosture(db, options);\n  };\n}\n","{\n  \"sourceCommit\": \"58f1b148fe025c763f739bd7fc86fbc1b96980e5\",\n  \"target\": [\n    \"accept_organization_invitation_v2(jsonb)\",\n    \"accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)\",\n    \"acquire_automatic_session_title_quarantine_fences_v1(integer)\",\n    \"acquire_due_retained_process_session_tenancy_fences()\",\n    \"acquire_due_sandbox_rotation_session_tenancy_fences(bigint)\",\n    \"acquire_organization_session_tenancy_fences(uuid)\",\n    \"acquire_sandbox_reaper_session_tenancy_fences()\",\n    \"acquire_sandbox_reaper_session_tenancy_fences(bigint)\",\n    \"acquire_scoped_machine_session_tenancy_fences(uuid, uuid)\",\n    \"acquire_session_tenancy_fence(uuid)\",\n    \"activate_governed_learning_decision(uuid, uuid, uuid, uuid)\",\n    \"activate_greenfield_session_tenancy_from_setup(text)\",\n    \"activate_human_confirmed_learning_decision(uuid, uuid, uuid, uuid, uuid)\",\n    \"activate_session_tenancy_from_additional_organization(uuid)\",\n    \"activate_session_tenancy_product(uuid, text, text, text, text[])\",\n    \"admit_scheduled_agent_run_execution()\",\n    \"admit_scheduled_task_run_connection_authorities()\",\n    \"admit_scheduled_task_run_personal_resources()\",\n    \"admit_session_attempt_personal_documents()\",\n    \"admit_session_attempt_personal_machine()\",\n    \"admit_session_attempt_personal_machine_v1()\",\n    \"admit_session_attempt_personal_resources()\",\n    \"admit_session_attempt_personal_resources_v1()\",\n    \"advance_session_event_cursors_for_inserted_events()\",\n    \"agent_instruction_activation_preserves_baseline()\",\n    \"agent_instruction_apply(uuid, uuid, jsonb, jsonb)\",\n    \"agent_instruction_apply_0462_unsafe(uuid, uuid, jsonb, jsonb)\",\n    \"agent_learning_manage(uuid, uuid, jsonb, jsonb)\",\n    \"apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)\",\n    \"apply_secret_answers(uuid, uuid, jsonb, jsonb)\",\n    \"archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)\",\n    \"archive_vault_item(uuid, jsonb)\",\n    \"assert_active_managed_human_organization_membership(uuid, text)\",\n    \"assert_document_migration_audit_authority(jsonb)\",\n    \"assert_managed_sign_in_recovery(text, text, uuid, jsonb)\",\n    \"assert_organization_shared_workspace_administrator(uuid, uuid, text)\",\n    \"assert_scoped_variable_set_attempt(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"assert_scoped_variable_set_materialization_attempt(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"assert_session_attempt_machine_consent(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean, boolean)\",\n    \"assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean)\",\n    \"assert_session_event_projection_not_ahead()\",\n    \"assert_session_tenancy_quiescent(uuid, uuid, uuid, boolean)\",\n    \"assert_workspace_member_management_candidate(uuid, uuid, text, text)\",\n    \"authorize_organization_shared_workspace_administration(uuid, uuid, text)\",\n    \"authorize_scoped_sandbox_attach(uuid, uuid, uuid)\",\n    \"authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid)\",\n    \"authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)\",\n    \"backfill_organization_connection_authority(uuid, integer, boolean)\",\n    \"backfill_organization_session_ownership(uuid, integer, boolean, text)\",\n    \"begin_billing_subscription_operation(uuid, uuid, text, jsonb, jsonb)\",\n    \"begin_plan_credit_settlement(uuid)\",\n    \"bind_managed_social_account()\",\n    \"bind_pending_organization_invitations_for_verified_email(text, text)\",\n    \"bind_scheduled_task_run_connection_authorities(uuid, uuid, uuid, uuid)\",\n    \"bind_scheduled_task_run_session(uuid, uuid, uuid, uuid)\",\n    \"bind_session_attempt_machine_consent(uuid, uuid, uuid)\",\n    \"bind_session_site_audience()\",\n    \"bump_social_connection_version()\",\n    \"capability_plugin_versions_restrict_update()\",\n    \"capability_v2_reject_immutable_update()\",\n    \"capability_v2_validate_component_owner()\",\n    \"capability_v2_validate_facet_binding()\",\n    \"capability_v2_validate_facet_binding_owner()\",\n    \"capability_v2_validate_facet_installation()\",\n    \"capability_v2_validate_plugin_installation()\",\n    \"capture_company_brain_turn_context_snapshot()\",\n    \"capture_legacy_codex_turn_sources(uuid, uuid)\",\n    \"capture_usage_allowance_attribution()\",\n    \"capture_usage_allowance_period(uuid, uuid, jsonb, timestamp with time zone)\",\n    \"change_connected_machine_audience(uuid, uuid, uuid, bigint, text, text, boolean)\",\n    \"check_organization_tenancy_parity(uuid, integer, integer)\",\n    \"check_tenancy_backfill_activation_evidence(uuid)\",\n    \"claim_managed_sign_in_notification(uuid, text, text, integer)\",\n    \"claim_organization_retention_deletion(uuid, uuid, uuid[])\",\n    \"claim_organization_user_setup_delivery(jsonb)\",\n    \"claim_organization_user_setup_delivery_v2(jsonb)\",\n    \"classify_organization_connection_authority(uuid, text)\",\n    \"classify_organization_session_ownership(uuid, text)\",\n    \"claude_provider_account_authority_snapshot_v1_valid(jsonb)\",\n    \"clear_subscription_connection_health_retry()\",\n    \"clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint)\",\n    \"clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint)\",\n    \"close_organization_shared_workspace_administration_capability(uuid)\",\n    \"close_private_session_create_capability(uuid)\",\n    \"codex_provider_account_authority_snapshot_v1_valid(jsonb)\",\n    \"company_brain_context_get_or_create_selection(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"company_brain_inspect_context_receipts(uuid, uuid, text, uuid, timestamp with time zone, uuid, integer)\",\n    \"company_profile_agent_confirmation_prompt(uuid, bigint, text, text)\",\n    \"company_profile_agent_confirmation_summary(text)\",\n    \"company_profile_agent_policy_events_immutable()\",\n    \"company_profile_agent_receipts_immutable()\",\n    \"company_profile_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text, text)\",\n    \"company_profile_canonical_snapshot_at(uuid, timestamp with time zone)\",\n    \"company_profile_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"company_profile_guard_head_mutation()\",\n    \"company_profile_reject_history_mutation()\",\n    \"company_profile_reject_snapshot_mutation()\",\n    \"company_profile_validate_event()\",\n    \"company_profile_validate_head()\",\n    \"company_profile_validate_revision()\",\n    \"company_profile_validate_snapshot()\",\n    \"complete_billing_subscription_operation(uuid, uuid, jsonb)\",\n    \"complete_organization_retention_deletion(uuid, uuid, uuid, text)\",\n    \"complete_organization_user_setup(jsonb)\",\n    \"complete_self_service_organization_setup(jsonb)\",\n    \"complete_tenancy_backfill_receipt(uuid, bigint, bigint, text)\",\n    \"confirm_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)\",\n    \"confirm_remember_knowledge_claim(uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid)\",\n    \"connected_machine_audience_inventory(uuid, uuid, uuid, text, text, boolean)\",\n    \"connected_machine_audience_workspaces(uuid, uuid, uuid)\",\n    \"connection_authority_convergence_audit_capability_active(uuid)\",\n    \"consent_session_turn_personal_machine(uuid, uuid, uuid, uuid)\",\n    \"count_scoped_rigs(uuid, uuid, text)\",\n    \"count_scoped_variable_sets(uuid, uuid, text)\",\n    \"count_unbilled_model_allowance_debit()\",\n    \"count_workspace_allowance_debit()\",\n    \"create_additional_managed_organization(text, text, text, text, uuid)\",\n    \"create_agent_child_session(uuid, uuid, uuid, uuid, uuid, integer, jsonb)\",\n    \"create_managed_organization(text, text, text, uuid)\",\n    \"create_organization_invitation_v2(jsonb)\",\n    \"create_organization_shared_workspace(uuid, text, text, text, text, uuid)\",\n    \"create_personal_document_authority(uuid, uuid, uuid)\",\n    \"create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb)\",\n    \"create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean)\",\n    \"create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)\",\n    \"create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)\",\n    \"create_vault(jsonb, jsonb)\",\n    \"delete_vault(uuid, text, boolean, jsonb)\",\n    \"delete_vault_item_permanently(uuid, jsonb)\",\n    \"derive_session_execution_authority_epoch()\",\n    \"detach_scoped_machine_dependent_sessions(uuid, uuid, uuid)\",\n    \"digest_turn_personal_resource_snapshot(turn_personal_resource_snapshots)\",\n    \"document_migration_audit_capability_active(text)\",\n    \"emit_usage_allowance_notifications(uuid, uuid, jsonb, text, timestamp with time zone, text)\",\n    \"enable_organization_private_sessions_from_activation(uuid, text[])\",\n    \"enforce_subscription_refresh_generation()\",\n    \"ensure_canonical_human_identity(text, text)\",\n    \"ensure_default_vault(uuid, text, jsonb)\",\n    \"ensure_external_identity(uuid, text, text)\",\n    \"ensure_managed_human_personal_workspace(uuid, text, uuid)\",\n    \"ensure_organization_user_setup_intent(jsonb)\",\n    \"ensure_task_vault(uuid, uuid, jsonb)\",\n    \"evaluate_governed_learning_proposal(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, uuid)\",\n    \"expire_ended_plan_credit_periods(uuid)\",\n    \"expire_plan_credit_period(uuid, uuid, boolean)\",\n    \"fail_organization_retention_deletion(uuid, uuid, uuid, text)\",\n    \"fence_attempt_personal_resource_protocol_update()\",\n    \"fence_background_command_launch_identity()\",\n    \"fence_child_session_authority()\",\n    \"fence_scheduled_agent_run_delete()\",\n    \"fence_scheduled_occurrence_evidence_delete()\",\n    \"fence_scheduled_occurrence_update()\",\n    \"fence_scheduled_task_personal_resource_execution_update()\",\n    \"fence_scheduled_task_run_connection_session_identity()\",\n    \"fence_scheduled_task_tombstone()\",\n    \"fence_scheduled_task_turn_run_identity()\",\n    \"fence_scheduled_turn_execution_update()\",\n    \"fence_session_create_requested_visibility_update()\",\n    \"fence_session_initial_personal_resource_intent_update()\",\n    \"fence_terminal_scheduled_occurrence_delivery()\",\n    \"fence_turn_personal_resource_protocol_update()\",\n    \"finalize_organization_retention_deletion(uuid, uuid, uuid, text)\",\n    \"finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean)\",\n    \"fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)\",\n    \"fork_session_content(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, uuid)\",\n    \"fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text, integer)\",\n    \"fork_session_content_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, jsonb, uuid, uuid, text)\",\n    \"free_plan_credit_eligible(uuid)\",\n    \"freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint)\",\n    \"get_canonical_human_exact_login_binding(text, text)\",\n    \"get_canonical_human_identity_projection(text)\",\n    \"get_company_profile_agent_policy(uuid, uuid, text)\",\n    \"get_document_default_collection_backfill_audit(jsonb)\",\n    \"get_external_identity_link_inventory_references(uuid, uuid[])\",\n    \"get_external_identity_link_reference(uuid, uuid, text)\",\n    \"get_organization_administration_overview(uuid, text)\",\n    \"get_organization_invitation_for_administration(uuid, text, uuid)\",\n    \"get_organization_private_session_settings(uuid, text)\",\n    \"get_organization_recovery_overview(uuid, text, jsonb, text, text)\",\n    \"get_organization_retention_policy(uuid, text)\",\n    \"get_private_session_create_policy(uuid, uuid, text)\",\n    \"get_scoped_sandbox(uuid, uuid, uuid)\",\n    \"get_self_organization_invitation(text, uuid)\",\n    \"get_self_personal_github_repository_selection(uuid, uuid, text, uuid)\",\n    \"get_session_attempt_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, boolean, boolean)\",\n    \"get_session_machine_access(uuid, uuid, uuid)\",\n    \"get_vault_for_subject(uuid, jsonb)\",\n    \"get_vault_item(uuid, jsonb)\",\n    \"get_workspace_kind(uuid, uuid)\",\n    \"google_drive_document_citation(uuid, uuid, text, uuid, uuid)\",\n    \"google_drive_file_authorized(uuid, uuid, text, uuid)\",\n    \"governed_learning_apply_instruction_policy(text, uuid, uuid, uuid, uuid, uuid, bigint, uuid, text)\",\n    \"governed_learning_apply_knowledge_review(uuid, uuid, uuid, uuid, uuid, bigint, text, text, text)\",\n    \"governed_learning_apply_knowledge_review(uuid, uuid, uuid, uuid, uuid, bigint, text, text, text, text)\",\n    \"governed_learning_apply_preference(text, uuid, uuid, uuid, uuid, uuid, uuid, uuid, integer, text)\",\n    \"governed_learning_deactivate_instruction_policy(uuid, uuid, uuid, uuid, uuid, bigint, text)\",\n    \"governed_learning_guard_service_review()\",\n    \"governed_learning_reject_activation_receipt_mutation()\",\n    \"grant_plan_credit_period(uuid, text, timestamp with time zone, timestamp with time zone, text)\",\n    \"guard_company_brain_context_selection_receipt()\",\n    \"guard_company_brain_turn_context_snapshot()\",\n    \"guard_explicit_workspace_recovery_publication()\",\n    \"guard_explicit_workspace_recovery_warning()\",\n    \"guard_imported_archive_identity()\",\n    \"guard_managed_social_account()\",\n    \"guard_private_child_session_create()\",\n    \"guard_private_session_visibility_transition()\",\n    \"guard_public_sandbox_recovery_lease()\",\n    \"guard_public_sandbox_recovery_session()\",\n    \"guard_sandbox_automatic_warning_receipt()\",\n    \"guard_sandbox_recovery_consent_receipt()\",\n    \"guard_sandbox_recovery_warning_claim()\",\n    \"guard_session_admission_block()\",\n    \"guard_session_agent_creation_provenance()\",\n    \"guard_session_authority_write()\",\n    \"guard_session_work_claim_mutation()\",\n    \"guard_session_work_claim_revision_mutation()\",\n    \"guard_slack_file_upload_operation()\",\n    \"guard_task_note_event_mutation()\",\n    \"guard_task_note_mutation()\",\n    \"guard_tenancy_backfill_unresolved_row()\",\n    \"guard_variable_set_session_attachments()\",\n    \"has_pending_organization_invitation_for_subject(text)\",\n    \"initialize_company_profile_agent_policy()\",\n    \"initialize_session_event_cursors_for_inserted_sessions()\",\n    \"insights_fact_read_policy_capability_active(text, text, text)\",\n    \"inspect_governed_learning_activation_undos(uuid, uuid, text, integer)\",\n    \"inspect_governed_learning_activations(uuid, uuid, text, integer)\",\n    \"inspect_governed_learning_decisions(uuid, uuid, text, integer)\",\n    \"inspect_organization_connection_authority_convergence(uuid, integer, uuid)\",\n    \"invalidate_unclaimed_scheduled_agent_runs_on_task_inactive()\",\n    \"inventory_organization_tenancy(uuid)\",\n    \"issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, boolean)\",\n    \"issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)\",\n    \"knowledge_document_prepare(uuid, uuid, uuid, jsonb)\",\n    \"knowledge_document_visible(uuid)\",\n    \"knowledge_enqueue_index()\",\n    \"knowledge_entry_apply(uuid, uuid, jsonb, jsonb)\",\n    \"knowledge_entry_confirm_legacy(uuid, uuid, jsonb, jsonb)\",\n    \"knowledge_entry_prepare_file(uuid, uuid, jsonb, jsonb)\",\n    \"knowledge_entry_read(uuid, uuid, jsonb, jsonb)\",\n    \"knowledge_entry_visible_body(uuid, jsonb, boolean)\",\n    \"knowledge_file_owner_immutable()\",\n    \"knowledge_index_attribution_immutable()\",\n    \"knowledge_index_billing_policy(uuid, uuid, uuid, text, timestamp with time zone, bigint)\",\n    \"knowledge_index_claim(text, integer, integer)\",\n    \"knowledge_index_paid_publication_guard(uuid, uuid, uuid)\",\n    \"knowledge_index_retention_active(uuid, uuid, uuid, uuid)\",\n    \"knowledge_index_revision(uuid, uuid, uuid, text)\",\n    \"knowledge_index_wait_for_funding(uuid, uuid, uuid)\",\n    \"knowledge_index_work(uuid, uuid, uuid, jsonb)\",\n    \"knowledge_instruction_confirm_legacy(uuid, uuid, jsonb, jsonb)\",\n    \"knowledge_instruction_context(workspace_instruction_policy_revisions)\",\n    \"knowledge_learning_context_visible(uuid, uuid, text, text, text)\",\n    \"knowledge_learning_for_turn(uuid, uuid, uuid)\",\n    \"knowledge_learning_resolve(uuid, uuid, text, text, timestamp with time zone)\",\n    \"knowledge_learning_settings_valid(jsonb, boolean)\",\n    \"knowledge_legacy_memory_setting_retired()\",\n    \"knowledge_legacy_version_visible(uuid, uuid)\",\n    \"knowledge_media_file_owner_immutable()\",\n    \"knowledge_memory_apply_operation(jsonb, text, text, text, uuid, uuid, uuid, integer)\",\n    \"knowledge_memory_plan_hash(jsonb)\",\n    \"knowledge_memory_revert_operation(uuid, uuid, text, text, text, uuid, uuid, uuid, integer)\",\n    \"knowledge_memory_stable_jsonb(jsonb)\",\n    \"knowledge_query_billing_receipt_immutable()\",\n    \"knowledge_reject_history_mutation()\",\n    \"knowledge_resolve_actor(uuid, uuid, jsonb)\",\n    \"knowledge_retired_learning_read_only()\",\n    \"knowledge_retired_memory_read_only()\",\n    \"knowledge_review_batch_for_actor(uuid, uuid, jsonb)\",\n    \"knowledge_revision_visible(uuid, uuid, uuid, boolean)\",\n    \"knowledge_scope_visible(knowledge_entries)\",\n    \"knowledge_source_index_wake()\",\n    \"knowledge_source_sync_lock_authority(uuid, uuid, uuid)\",\n    \"knowledge_source_visible(uuid, jsonb)\",\n    \"knowledge_task_note_source(uuid, uuid, jsonb, uuid, integer)\",\n    \"knowledge_validate_links(uuid, uuid, jsonb, uuid)\",\n    \"knowledge_validate_source(uuid, uuid, jsonb)\",\n    \"knowledge_visible_index_status(uuid, uuid, jsonb, jsonb, text)\",\n    \"lease_vault_passkeys(jsonb, text, integer)\",\n    \"link_provider_vault(jsonb, jsonb)\",\n    \"list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)\",\n    \"list_document_default_collection_backfill_runs(jsonb)\",\n    \"list_organization_administration_members(uuid, text)\",\n    \"list_organization_codex_workspace_ids(uuid)\",\n    \"list_organization_document_authority_reclassifications(jsonb)\",\n    \"list_organization_invitations(uuid, text, uuid, integer)\",\n    \"list_organization_members(uuid, text)\",\n    \"list_organization_membership_backfill_anchors(uuid, text[])\",\n    \"list_organization_memberships_without_personal_workspace(uuid, integer, text)\",\n    \"list_organization_retention_deletion_objects(uuid, uuid, uuid, text, integer)\",\n    \"list_organization_subscription_workspace_ids(uuid)\",\n    \"list_organization_workspace_ids(uuid)\",\n    \"list_owned_connection_accounts(uuid, uuid)\",\n    \"list_scoped_enrollments(uuid, uuid, uuid, text)\",\n    \"list_scoped_machine_dependent_sessions(uuid, uuid, uuid)\",\n    \"list_scoped_rigs(uuid, uuid, uuid, text, text)\",\n    \"list_scoped_variable_sets(uuid, uuid, uuid, text, text)\",\n    \"list_self_organization_invitations(text)\",\n    \"list_self_organization_invitations(text, uuid, integer)\",\n    \"list_self_organization_memberships(text)\",\n    \"list_self_user_resource_authorities(uuid)\",\n    \"list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)\",\n    \"list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)\",\n    \"list_vault_field_versions(uuid, jsonb)\",\n    \"list_vault_items(uuid, text, text, boolean, text, integer, jsonb)\",\n    \"list_vaults_for_subject(uuid, jsonb)\",\n    \"list_workspace_member_management_candidates(uuid, uuid, text)\",\n    \"live_session_turn_machine_consent(uuid)\",\n    \"lock_live_native_original_origin_v2(jsonb)\",\n    \"lock_nested_agent_depth_configuration()\",\n    \"lock_session_tenancy_activation_boundary()\",\n    \"lookup_external_identity(uuid, text, text, text)\",\n    \"maintain_session_usage_limits(integer, integer)\",\n    \"maintain_usage_allowances(integer, integer)\",\n    \"managed_auth_actor_mutation_fence(text, bigint, uuid)\",\n    \"managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)\",\n    \"managed_auth_actor_mutation_lease_release(text, uuid)\",\n    \"managed_auth_actor_mutation_lease_validate(text, bigint, uuid)\",\n    \"managed_auth_adopted_session_snapshot(text)\",\n    \"managed_auth_expired_session_set_reap(integer)\",\n    \"managed_auth_isolated_session_reap(integer)\",\n    \"managed_auth_login_transaction_rate_limit_take(text, text)\",\n    \"managed_auth_session_exact_binding_stamp()\",\n    \"managed_auth_session_set_authority_state(text)\",\n    \"managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)\",\n    \"managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)\",\n    \"managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)\",\n    \"managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)\",\n    \"managed_auth_session_set_operation_receipt(text, uuid, text, text)\",\n    \"managed_auth_session_set_operations_append_only()\",\n    \"managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)\",\n    \"managed_auth_session_slot_invalidation()\",\n    \"managed_sign_in_method_authority(text, text, jsonb)\",\n    \"materialize_remember_knowledge_memory(uuid, uuid, uuid)\",\n    \"materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text)\",\n    \"materialize_scheduled_task_reusable_session_from_run_0252(uuid, uuid, uuid, uuid, uuid, bigint, text)\",\n    \"materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)\",\n    \"materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid)\",\n    \"mcp_operation_command(jsonb, text, jsonb)\",\n    \"meter_session_usage_limit_event()\",\n    \"modal_inventory_read_capability_active()\",\n    \"modal_native_origin_member_read_active(uuid, text)\",\n    \"move_vault_item(uuid, uuid, text, text, jsonb)\",\n    \"mutate_managed_sign_in_method(text, text, jsonb)\",\n    \"mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean)\",\n    \"mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean)\",\n    \"mutate_self_personal_github_repository_selection(uuid, uuid, text, uuid, bigint, bigint, text, jsonb, boolean)\",\n    \"normalize_legacy_session_event_sequence_from_cursor()\",\n    \"normalize_session_variable_set_selection()\",\n    \"open_organization_shared_workspace_administration_capability(uuid, uuid, text)\",\n    \"open_private_child_session_create_capability(uuid, uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"open_private_session_create_capability(uuid, uuid, uuid, text)\",\n    \"open_tenancy_backfill_receipt(uuid, text, text)\",\n    \"organization_membership_command(jsonb)\",\n    \"organization_membership_command_0263(jsonb)\",\n    \"organization_plan_seats_used(uuid)\",\n    \"organization_private_sessions_enabled(uuid)\",\n    \"organization_recovery_append_only()\",\n    \"organization_recovery_assert_recent_reauth(jsonb, text, text, text)\",\n    \"organization_recovery_command(jsonb)\",\n    \"organization_recovery_exactly_three_custodians()\",\n    \"organization_recovery_lock_policy_evidence(uuid, uuid)\",\n    \"organization_recovery_overview_json(uuid, text, timestamp with time zone)\",\n    \"organization_recovery_resolve_recent_reauth(jsonb, text, text, text)\",\n    \"organization_recovery_valid_acceptance_id(uuid, uuid)\",\n    \"organization_recovery_valid_approval_count(uuid)\",\n    \"organization_recovery_valid_approvals_json(uuid)\",\n    \"organization_usage_policy_capability_active(text)\",\n    \"organization_workspace_command(jsonb)\",\n    \"organization_workspace_command_without_creator_access(jsonb)\",\n    \"personal_machine_grant_covers_descendant(uuid, uuid, uuid, uuid)\",\n    \"personal_machine_turn_consent_covers_descendant(uuid, uuid, uuid)\",\n    \"preference_registry_accepted_snapshot_for_recovery(uuid, uuid, uuid, uuid, integer, text, timestamp with time zone)\",\n    \"preference_registry_activation_authority(uuid, uuid[])\",\n    \"preference_registry_apply_lifecycle(text, uuid, integer, uuid, uuid, text, uuid, text, text)\",\n    \"preference_registry_canonical_snapshot_at(uuid, uuid, text, timestamp with time zone)\",\n    \"preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamp with time zone, text)\",\n    \"preference_registry_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"preference_registry_guard_head_mutation()\",\n    \"preference_registry_lock_heads(uuid[])\",\n    \"preference_registry_reject_history_mutation()\",\n    \"preference_registry_require_proposal_event()\",\n    \"preference_registry_validate_head()\",\n    \"preference_registry_validate_snapshot()\",\n    \"preflight_organization_user_setup(text)\",\n    \"prepare_external_workspace_membership_operation(jsonb)\",\n    \"prepare_organization_membership_protocol_settlements(jsonb)\",\n    \"prepare_organization_recovery_notifications(text, text, integer, integer)\",\n    \"prepare_organization_user_setup_delivery(jsonb)\",\n    \"prepare_organization_user_setup_delivery_v2(jsonb)\",\n    \"prepare_organization_workspace_member_removal(jsonb)\",\n    \"prepare_scheduled_task_attempt_once_grants()\",\n    \"prepare_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)\",\n    \"prepare_workspace_membership_removal_settlements(jsonb)\",\n    \"prevent_claude_snapshot_mutation()\",\n    \"prevent_codex_provider_account_authority_snapshot_mutation()\",\n    \"prevent_session_event_projection_regression()\",\n    \"prevent_subscription_authority_v2_mutation()\",\n    \"prevent_xai_snapshot_mutation()\",\n    \"preview_connected_machine_audience_change(uuid, uuid, uuid, text, text, boolean)\",\n    \"preview_organization_retention_deletions(uuid, integer)\",\n    \"preview_organization_user_setup(text)\",\n    \"private_session_cancels_foreign_update()\",\n    \"propose_company_profile_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, text)\",\n    \"propose_company_profile_for_attempt_v2(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, text, text, text)\",\n    \"provider_connection_home_workspace(uuid)\",\n    \"provider_vault_item_ref(uuid, uuid, text, jsonb)\",\n    \"provider_vault_sync_target(uuid, jsonb)\",\n    \"read_organization_plan_balance(uuid, timestamp with time zone)\",\n    \"read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer)\",\n    \"read_vault_field_ciphertext(uuid, integer, text, jsonb, jsonb)\",\n    \"reclassify_document_authority(jsonb)\",\n    \"reconcile_organization_recovery_notification(uuid, uuid, text, text, text)\",\n    \"record_external_workspace_membership_operation(jsonb, jsonb)\",\n    \"record_organization_retention_object_deleted(uuid, uuid, uuid, text, text, text, text)\",\n    \"record_organization_workspace_member_removal(jsonb, uuid, uuid)\",\n    \"record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint)\",\n    \"record_tenancy_backfill_unresolved(uuid, uuid, text)\",\n    \"record_vault_secret_use(jsonb, jsonb, jsonb)\",\n    \"refuse_imported_archive_execution()\",\n    \"reject_governed_learning_decision_receipt_mutation()\",\n    \"reject_legacy_claude_subscription_credentials()\",\n    \"reject_managed_auth_new_signups_switch_revision_mutation()\",\n    \"reject_remember_knowledge_confirmation_receipt_mutation()\",\n    \"reject_remember_knowledge_memory_materialization_mutation()\",\n    \"reject_task_note_replacement_receipt_mutation()\",\n    \"reject_turn_personal_resource_snapshot_update()\",\n    \"reject_verified_signup_trial_switch_revision_mutation()\",\n    \"reject_workspace_account_id_change()\",\n    \"release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)\",\n    \"release_vault_passkey_leases(text, jsonb)\",\n    \"replace_plan_credit_period(uuid, text, timestamp with time zone, timestamp with time zone, text)\",\n    \"replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)\",\n    \"replay_applied_session_fork(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer)\",\n    \"replay_applied_session_fork_with_runtime(uuid, uuid, uuid, text, uuid, text, boolean, text, text, integer, text)\",\n    \"replay_managed_sign_in_method(text, text, jsonb)\",\n    \"resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)\",\n    \"resolve_connection_use_authority_legacy_0256(uuid, uuid, uuid, jsonb)\",\n    \"resolve_document_original_file(uuid, uuid, text, uuid)\",\n    \"resolve_organization_workspace_removal_subject(uuid, text, uuid)\",\n    \"resolve_secret_reference_candidates(jsonb, jsonb)\",\n    \"resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)\",\n    \"resolve_session_attempt_personal_resources(uuid, uuid, uuid)\",\n    \"resolve_session_attempt_personal_resources_legacy_0305(uuid, uuid, uuid)\",\n    \"resolve_session_work_claim_attempt_authority(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"resolve_task_note_attempt_authority(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)\",\n    \"resolve_workspace_codex_subscription_source(uuid, uuid)\",\n    \"resolve_workspace_writer_grant_identity(uuid, text)\",\n    \"restore_vault_item(uuid, jsonb)\",\n    \"retire_terminal_turn_run_state()\",\n    \"reverse_video_allowance_refund()\",\n    \"revoke_personal_document_authority_after_delete()\",\n    \"revoke_self_user_resource_grant(uuid, uuid)\",\n    \"revoke_self_user_resource_grant(uuid, uuid, uuid)\",\n    \"run_document_default_collection_backfill(jsonb)\",\n    \"sandbox_warm_attribution_immutable()\",\n    \"scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid)\",\n    \"scheduled_task_execution_digest(scheduled_tasks)\",\n    \"scheduled_task_execution_state(scheduled_tasks)\",\n    \"scheduled_task_is_exhausted(uuid)\",\n    \"scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint)\",\n    \"scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint)\",\n    \"scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint)\",\n    \"scheduled_task_run_connection_authority_subject(uuid, uuid, uuid)\",\n    \"scheduled_task_run_personal_resource_authority(uuid, uuid, uuid)\",\n    \"scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)\",\n    \"scoped_compute_actor_membership(uuid, uuid)\",\n    \"scoped_compute_policy_capability_active(text, text, text)\",\n    \"scoped_knowledge_advance_object_version(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text)\",\n    \"scoped_knowledge_advance_source_acl(uuid, uuid, bigint, bigint, uuid, text, text, text, text, text, text)\",\n    \"scoped_knowledge_apply_lifecycle(uuid, text, uuid, text, bigint, text, text, text, text, text, text)\",\n    \"scoped_knowledge_complete_sync(uuid, uuid, text, text, timestamp with time zone, jsonb, text, text, text)\",\n    \"scoped_knowledge_guard_acl_insert()\",\n    \"scoped_knowledge_guard_head_insert()\",\n    \"scoped_knowledge_guard_object_mutation()\",\n    \"scoped_knowledge_guard_provider_mutation()\",\n    \"scoped_knowledge_guard_source_mutation()\",\n    \"scoped_knowledge_guard_sync_insert()\",\n    \"scoped_knowledge_guard_sync_mutation()\",\n    \"scoped_knowledge_guard_version_insert()\",\n    \"scoped_knowledge_reject_immutable_mutation()\",\n    \"scoped_knowledge_validate_bridge()\",\n    \"scoped_knowledge_validate_claim_relation()\",\n    \"scoped_rig_json(uuid)\",\n    \"scoped_variable_set_actor_membership(uuid, uuid)\",\n    \"scoped_variable_set_json(uuid)\",\n    \"seed_session_usage_limit_root()\",\n    \"session_attempt_interruption_fill_quiescence_hint()\",\n    \"session_document_inspection_receipt_immutable()\",\n    \"session_document_inspection_receipt_retained()\",\n    \"session_events_fill_usage_source_key()\",\n    \"session_foreign_subscription_binding_count(uuid, uuid, uuid, text)\",\n    \"session_goal_freeze_report_requirements()\",\n    \"session_goal_freeze_turn_snapshot()\",\n    \"session_goal_normalize_root_constraints(jsonb)\",\n    \"session_goal_normalize_root_constraints_before_write()\",\n    \"session_goal_prompt_projection(text, integer)\",\n    \"session_goal_reject_turn_snapshot_mutation()\",\n    \"session_goal_report_requirements_before_delete()\",\n    \"session_goal_report_requirements_before_write()\",\n    \"session_goal_revision_after_write()\",\n    \"session_goal_revision_before_write()\",\n    \"session_goal_revision_bound_insert()\",\n    \"session_goal_revision_reject_mutation()\",\n    \"session_private_actor_visible(uuid, uuid, uuid, text)\",\n    \"session_private_actor_visible_keys()\",\n    \"session_private_transition_blocker(uuid, uuid, uuid)\",\n    \"session_reference_visible(uuid, uuid, uuid)\",\n    \"session_secrets_view(uuid, jsonb)\",\n    \"session_site_actor_visible(uuid, uuid, uuid, text, text)\",\n    \"session_system_update_carries_foreign_authority(session_system_updates, text, uuid)\",\n    \"session_tenancy_any_product_activation()\",\n    \"session_tenancy_fence_owner_policy_active(text, text, oid, uuid, boolean)\",\n    \"session_tenancy_fence_target_schema()\",\n    \"session_tenancy_product_activated(uuid, integer)\",\n    \"session_tenancy_standing_blocker(uuid, uuid, uuid)\",\n    \"session_turn_attempt_propagate_quiescence_hint()\",\n    \"session_turn_attempts_fill_authority_snapshot()\",\n    \"session_turn_attempts_guard_authority_snapshot_immutable()\",\n    \"session_usage_limit_apply_receipt(uuid, uuid, uuid, text, uuid, uuid, bigint, text, text, text)\",\n    \"session_usage_limit_capability_active(uuid, uuid)\",\n    \"session_usage_limit_command(jsonb)\",\n    \"session_usage_limit_event_amount(jsonb)\",\n    \"session_usage_limit_import_page(uuid, uuid, uuid, integer)\",\n    \"session_usage_limit_import_step(uuid, uuid, uuid, integer)\",\n    \"session_usage_limit_meter_amount(numeric, text, numeric, numeric)\",\n    \"session_usage_limit_state(jsonb, boolean)\",\n    \"session_visibility_change_blocker(uuid, uuid, uuid)\",\n    \"session_visibility_foreign_authority_items(uuid, uuid, uuid)\",\n    \"session_visibility_lifecycle_capability_held()\",\n    \"session_work_claim_subject_digest(text, text, text)\",\n    \"set_credit_promotion_policy(jsonb, text, text)\",\n    \"set_managed_auth_new_signups_enabled(boolean, text, text)\",\n    \"set_scheduled_task_execution_digest()\",\n    \"set_session_vault_policy(uuid, jsonb, jsonb)\",\n    \"set_subscription_plan_catalog(jsonb, text, text)\",\n    \"set_vault_sync_status(uuid, jsonb, jsonb)\",\n    \"set_verified_signup_trial_credits_enabled(boolean, text, text)\",\n    \"settle_active_session_work_claims(uuid, uuid, uuid, text, text)\",\n    \"settle_managed_sign_in_notification(uuid, uuid, text)\",\n    \"settle_organization_recovery_notification(uuid, uuid, text, text, text, text)\",\n    \"settle_organization_user_setup_delivery(jsonb)\",\n    \"settle_scheduled_run_from_terminal_turn()\",\n    \"settle_scheduled_run_from_terminal_update()\",\n    \"settle_session_work_claims_on_goal_completion()\",\n    \"settle_session_work_claims_on_session_terminal()\",\n    \"site_session_cancellation_capability_active(uuid, uuid, uuid, uuid)\",\n    \"skill_apply_lifecycle(uuid, uuid, jsonb, jsonb)\",\n    \"skill_files_valid(jsonb)\",\n    \"skill_guard_legacy_activation()\",\n    \"skill_guard_legacy_revision()\",\n    \"skill_publish_finalized_owner()\",\n    \"skill_revision_activation_authority(uuid, timestamp with time zone)\",\n    \"skill_source_has_effective_owner(uuid, uuid, uuid)\",\n    \"slack_shared_task_origin_forbid_mutation()\",\n    \"slack_task_policy_forbid_mutation()\",\n    \"slack_task_policy_guard_head_mutation()\",\n    \"slack_task_policy_hash(jsonb)\",\n    \"slack_task_policy_update(uuid, text, uuid, uuid, jsonb, uuid, bigint, text, text)\",\n    \"slack_task_policy_valid(jsonb)\",\n    \"stamp_model_call_site()\",\n    \"stamp_model_debit_site()\",\n    \"stamp_session_activity_xid()\",\n    \"stamp_turn_personal_resource_snapshot_digest()\",\n    \"strip_private_session_list_snapshots()\",\n    \"subscription_effective_settings(uuid, uuid)\",\n    \"subscription_personal_authority_v2_valid(jsonb)\",\n    \"sync_organization_user_setup_delivery_revocation()\",\n    \"sync_personal_enrollment_authority()\",\n    \"sync_session_history_items_ordered()\",\n    \"sync_session_pending_tool_calls_ordered()\",\n    \"sync_session_variable_set_attachment_status()\",\n    \"sync_session_variable_set_attachments()\",\n    \"transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text)\",\n    \"transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer)\",\n    \"undo_governed_learning_activation(uuid, uuid, uuid, uuid)\",\n    \"update_company_profile_agent_policy(uuid, uuid, text, text, bigint, uuid)\",\n    \"update_organization_name(uuid, text, text, timestamp with time zone, uuid)\",\n    \"update_organization_private_session_settings(uuid, text, boolean, bigint, uuid)\",\n    \"update_passkey_sign_count(uuid, bigint, jsonb)\",\n    \"update_vault(uuid, bigint, jsonb, jsonb)\",\n    \"upsert_organization_plan(uuid, text, text, text, timestamp with time zone, timestamp with time zone, boolean)\",\n    \"upsert_organization_shared_workspace_member(uuid, uuid, text, uuid, text, text, jsonb, boolean)\",\n    \"upsert_provider_vault_items(uuid, text, jsonb, jsonb)\",\n    \"upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)\",\n    \"upsert_vault_item(jsonb, jsonb)\",\n    \"usage_allowance_capability_active(uuid, uuid)\",\n    \"usage_allowance_command(jsonb)\",\n    \"usage_allowance_effective_period(uuid, jsonb, timestamp with time zone)\",\n    \"usage_allowance_members(uuid, uuid)\",\n    \"usage_allowance_period(jsonb, timestamp with time zone)\",\n    \"validate_canonical_human_session(text, text, boolean)\",\n    \"validate_personal_codex_credential_authority()\",\n    \"validate_scheduled_agent_run_live_authority(uuid, uuid, uuid)\",\n    \"validate_scheduled_occurrence_accepted_execution()\",\n    \"validate_scheduled_task_attempt_personal_resources()\",\n    \"validate_task_note_knowledge_evidence()\",\n    \"validate_usage_allowance_config(jsonb)\",\n    \"validate_usage_allowance_rule(jsonb)\",\n    \"vault_actor_membership(uuid, text)\",\n    \"vault_name_key(text)\",\n    \"verify_organization_resource_classification(uuid, text)\",\n    \"workspace_artifact_reject_history_mutation()\",\n    \"workspace_artifact_validate_current()\",\n    \"workspace_artifact_validate_event_links()\",\n    \"workspace_governance_reject_turn_human_mutation()\",\n    \"workspace_governance_snapshot_reject_mutation()\",\n    \"workspace_instruction_policy_canonical_snapshot_entries(uuid, uuid, text, timestamp with time zone)\",\n    \"workspace_instruction_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"workspace_instruction_policy_guard_head_delete()\",\n    \"workspace_instruction_policy_guard_lifecycle_operation()\",\n    \"workspace_instruction_policy_normalize_role_key(text)\",\n    \"workspace_instruction_policy_reject_mutation()\",\n    \"workspace_instruction_policy_reject_session_role_mutation()\",\n    \"workspace_instruction_policy_validate_deactivation_event()\",\n    \"workspace_instruction_policy_validate_event()\",\n    \"workspace_instruction_policy_validate_head()\",\n    \"workspace_instruction_policy_validate_onboarding_proposal()\",\n    \"workspace_instruction_policy_validate_revision_link()\",\n    \"workspace_instruction_policy_validate_snapshot()\",\n    \"workspace_learning_policy_apply_activation(uuid, text, uuid, uuid, uuid, uuid, bigint, text, text, text)\",\n    \"workspace_learning_policy_canonical_at(uuid, uuid, timestamp with time zone)\",\n    \"workspace_learning_policy_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer)\",\n    \"workspace_learning_policy_guard_head_mutation()\",\n    \"workspace_learning_policy_hash(text, jsonb)\",\n    \"workspace_learning_policy_reject_history_mutation()\",\n    \"workspace_learning_policy_reject_snapshot_mutation()\",\n    \"workspace_learning_policy_snapshot_hash(uuid, bigint, text, bigint, timestamp with time zone, text, jsonb)\",\n    \"workspace_learning_policy_source_overrides_valid(jsonb)\",\n    \"workspace_learning_policy_validate_event()\",\n    \"workspace_learning_policy_validate_head()\",\n    \"workspace_learning_policy_validate_revision_link()\",\n    \"workspace_learning_policy_validate_snapshot()\",\n    \"workspace_membership_removal_command(jsonb)\",\n    \"xai_provider_account_authority_snapshot_v1_valid(jsonb)\"\n  ],\n  \"private\": [\n    \"abandon_session_content_archive(uuid, uuid)\",\n    \"accept_session_file_attachments(uuid, uuid, uuid, uuid, text, uuid[])\",\n    \"account_rls_visible(uuid)\",\n    \"active_external_owning_subject(uuid, text)\",\n    \"advance_editable_artifact_authorization_revision(uuid, uuid, text, bigint, bigint, name)\",\n    \"advance_editable_artifact_scope_authorization_revision(uuid, uuid, bigint, bigint, name)\",\n    \"advance_session_execution_context()\",\n    \"analytics_model_provider(text)\",\n    \"append_subscription_usage_reading(uuid, uuid, text, jsonb)\",\n    \"apply_document_authority()\",\n    \"apply_document_chunk_authority()\",\n    \"archived_session_event_types()\",\n    \"arm_usage_allowances_for_membership()\",\n    \"assert_organization_administrator(uuid, text)\",\n    \"assert_organization_integration_policy_administrator(uuid, text)\",\n    \"assert_organization_retention_account(uuid)\",\n    \"assert_organization_shared_workspace_administrator(uuid, uuid, text)\",\n    \"assert_session_ownership_scope(uuid, text)\",\n    \"assert_workspace_membership_removal_actor(uuid, uuid, text, text)\",\n    \"assign_managed_self_organization_owner()\",\n    \"attached_browser_devices_update_guard()\",\n    \"authorize_editable_artifact_actor(uuid, uuid, text, text, text, text, text, text, integer, text, text, name)\",\n    \"authorize_subscription_ownerless_session_access(uuid, uuid, uuid, uuid)\",\n    \"authorize_subscription_personal_access(uuid, uuid, uuid, uuid, uuid, text, text, text)\",\n    \"authorize_subscription_personal_placement_access(uuid, uuid, uuid, uuid, text, uuid, bigint, text, text)\",\n    \"authorize_subscription_service_session_access(uuid, uuid, uuid, uuid, text)\",\n    \"authorize_subscription_session_access(uuid, uuid, uuid, uuid, text, text)\",\n    \"auto_assign_subscription_core_personal_workspace()\",\n    \"auto_assign_subscription_core_workspace()\",\n    \"automatic_session_title_fanout_due_v1()\",\n    \"backfill_product_lifecycle_facts(text, integer)\",\n    \"begin_site_session_cancellation(uuid, uuid, uuid, uuid)\",\n    \"begin_subscription_codex_apps_refresh(uuid, uuid, uuid)\",\n    \"begin_subscription_core_connection_refresh(text, uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n    \"begin_subscription_core_owned_connection_refresh(text, uuid, uuid, text, uuid)\",\n    \"begin_subscription_core_refresh(text, uuid, uuid, uuid, uuid, text, text, uuid, text, bigint)\",\n    \"bind_connection_authority()\",\n    \"bind_connection_owner_authority(uuid, text, uuid, uuid)\",\n    \"bound_workspace_control_event()\",\n    \"browser_deadline_checkpoint(jsonb, boolean, boolean)\",\n    \"browser_deadline_checkpoint_due_v1()\",\n    \"browser_identities_update_guard()\",\n    \"browser_state_artifacts_update_guard()\",\n    \"browser_state_uploads_update_guard()\",\n    \"browser_system_checkpoint_digest(text, uuid, uuid, uuid, bigint, text, text, text)\",\n    \"browser_system_checkpoint_operation_id(text)\",\n    \"capture_accepted_turn_connection_authorities()\",\n    \"capture_host_export_root_session()\",\n    \"capture_product_lifecycle_fact()\",\n    \"capture_scheduled_turn_connection_authorities()\",\n    \"check_organization_tenancy_parity_pre_0340(uuid, integer, integer)\",\n    \"claim_automatic_session_title_fanout_v1(integer)\",\n    \"claim_browser_state_artifact_cleanup(bigint, integer)\",\n    \"claim_browser_state_upload_cleanup(bigint, integer)\",\n    \"claim_connected_command_output_releases(uuid, integer, bigint, timestamp with time zone)\",\n    \"claim_connected_machine_background_commands(uuid, integer, bigint)\",\n    \"claim_connected_machine_background_commands(uuid, integer, bigint, timestamp with time zone)\",\n    \"claim_due_transcription_recording_object_cleanup(bigint, bigint, integer)\",\n    \"claim_editable_artifact_live_outbox(text, integer, integer, name)\",\n    \"claim_editable_artifact_materializations(text, integer, integer, name)\",\n    \"claim_expired_file_upload_cleanup(bigint, bigint, integer)\",\n    \"claim_memory_slack_publication(uuid, integer)\",\n    \"claim_native_push_deliveries_v1(uuid, integer, integer)\",\n    \"claim_organization_user_setup_delivery_unfenced_0401(jsonb)\",\n    \"claim_organization_webhook_deliveries_v1(uuid, integer, integer)\",\n    \"claim_retained_screenshot_maintenance(bigint, bigint, integer)\",\n    \"claim_sandbox_checkpoint_artifacts(uuid, integer, bigint)\",\n    \"claim_session_archive_object_deletions(integer, integer)\",\n    \"claim_session_system_update_outbox(integer)\",\n    \"claim_session_system_update_outbox_v2(integer)\",\n    \"claim_session_title_workflows(integer)\",\n    \"claim_session_workflow_wakes(integer)\",\n    \"claim_site_auth_maintenance(bigint, integer)\",\n    \"claim_slack_app_home_refresh(uuid, integer)\",\n    \"claim_slack_interaction_delivery(uuid, integer)\",\n    \"claim_slack_interaction_inbox(uuid, integer)\",\n    \"claim_temporal_schedule_cleanups(uuid, integer, integer)\",\n    \"claim_terminal_retained_processes(uuid, integer, bigint)\",\n    \"claim_terminal_retained_processes(uuid, integer, bigint, integer)\",\n    \"claim_video_generation_operations(text, integer, integer)\",\n    \"claim_workspace_webhook_deliveries_v1(uuid, integer, integer)\",\n    \"classify_connected_command_ops(uuid, uuid, text, text[])\",\n    \"claude_subscription_pool_protocol_v1_active()\",\n    \"cleanup_expired_editable_artifact_live_tickets(integer, name)\",\n    \"clear_command_containment_reason()\",\n    \"clear_context_compaction_pending_attempt()\",\n    \"clear_context_compaction_pending_turn()\",\n    \"clear_deadline_forced_admissions()\",\n    \"clear_subscription_settings_locked_overrides()\",\n    \"clear_unobservable_command_drain()\",\n    \"clear_untracked_writer_since()\",\n    \"clear_workspace_codex_session_affinity()\",\n    \"close_inbox_items_v1(uuid, text[], text, text)\",\n    \"close_session_tenancy_fence_inventory(uuid)\",\n    \"close_session_tenancy_fenced_access(uuid)\",\n    \"codex_cooldown_revision_guard()\",\n    \"codex_credential_serves_turn(uuid, uuid, uuid, uuid)\",\n    \"codex_credential_serves_workspace(uuid, uuid, uuid)\",\n    \"codex_organization_admin_visible(uuid)\",\n    \"codex_organization_live_lease_count(uuid, uuid, uuid)\",\n    \"codex_organization_scope_visible(uuid)\",\n    \"compact_session_content_row(text, uuid, uuid, jsonb, jsonb)\",\n    \"company_brain_legacy_instruction_projection(text)\",\n    \"company_brain_memory_selections_valid(jsonb)\",\n    \"complete_session_archive_object_deletion(text)\",\n    \"complete_temporal_schedule_connector_cleanup(uuid, uuid)\",\n    \"complete_workspace_insights_usage_projection(uuid, timestamp with time zone, timestamp with time zone, text[])\",\n    \"complete_workspace_temporal_connector_cleanups(uuid, uuid)\",\n    \"configure_fork_session_runtime(uuid, uuid, uuid, uuid, text, jsonb, uuid, uuid, text)\",\n    \"connect_subscription_core_personal(text, uuid, uuid, text, text, text, text, text, jsonb, timestamp with time zone, timestamp with time zone, text, text, text)\",\n    \"connect_subscription_core_personal(text, uuid, uuid, text, text, text, text, text, jsonb, timestamp with time zone, timestamp with time zone, text, text, text, text)\",\n    \"connected_command_output_release_due_v1()\",\n    \"connected_command_reconciliation_due_v1()\",\n    \"connected_output_runner_eligible_v1(uuid, uuid, text)\",\n    \"connection_account_intent_is_valid(jsonb)\",\n    \"connection_tenancy_backfill_capability_active(uuid)\",\n    \"consume_editable_artifact_live_ticket(text, name)\",\n    \"context_compaction_pending_summary()\",\n    \"copy_subscription_authority_compat(text, text, uuid, uuid, bigint)\",\n    \"count_active_retained_processes_by_owner_state()\",\n    \"count_active_users()\",\n    \"count_expired_draining_sandbox_leases()\",\n    \"count_queued_turns()\",\n    \"count_sandbox_leases_by_liveness()\",\n    \"count_session_recovery_backlog()\",\n    \"credit_balance_by_account()\",\n    \"credit_grant_class(text, text)\",\n    \"credit_grant_totals()\",\n    \"current_account_id()\",\n    \"current_api_key_hash()\",\n    \"current_memory_actor_id()\",\n    \"current_memory_actor_kind()\",\n    \"current_memory_role_key()\",\n    \"current_memory_session_id()\",\n    \"current_subject_id()\",\n    \"current_workspace_id()\",\n    \"dead_letter_editable_artifact_live_outbox(text, text, integer, text, name)\",\n    \"detach_retention_variable_set_session_selections(uuid, uuid, uuid)\",\n    \"disconnect_subscription_core_connection(text, uuid, uuid, text, uuid)\",\n    \"dismiss_inbox_notification_v1(uuid, uuid, text)\",\n    \"document_migration_capability_active(text)\",\n    \"editable_artifact_actor_key_matches(text, text, text, text, text, text, integer, text)\",\n    \"editable_artifact_frontier_dominates(jsonb, jsonb)\",\n    \"editable_artifact_frontier_merge_dot_equals(jsonb, jsonb, jsonb, text, bigint)\",\n    \"editable_artifact_frontier_valid(jsonb)\",\n    \"editable_artifact_id_array_valid(jsonb)\",\n    \"editable_artifact_identity_valid(text)\",\n    \"editable_artifact_object_has_exact_keys(jsonb, text[])\",\n    \"editable_artifact_operation_id_list_valid(jsonb)\",\n    \"editable_artifact_scope_matches_context(uuid, uuid)\",\n    \"editable_artifact_text_sha256(text)\",\n    \"end_site_session_cancellation(uuid)\",\n    \"enforce_automatic_session_title_policy_v1()\",\n    \"enforce_codex_credential_workspace()\",\n    \"enforce_codex_lease_source()\",\n    \"enforce_model_connection_access_update()\",\n    \"enforce_organization_codex_runtime_update()\",\n    \"enforce_organization_plan_seats()\",\n    \"enforce_rig_platform_base_only_v1()\",\n    \"enforce_sandbox_checkpoint_artifact_immutability()\",\n    \"enforce_sandbox_recovery_protocol_v2()\",\n    \"enforce_session_inference_claim()\",\n    \"enqueue_automatic_session_title_fanout_v1(uuid, uuid, uuid, uuid)\",\n    \"enqueue_host_session_event_export()\",\n    \"enqueue_host_usage_event_export()\",\n    \"enqueue_native_push_for_session_event_v1()\",\n    \"enqueue_native_push_v1(uuid, text, text, text, text, text)\",\n    \"enqueue_native_push_v2(uuid, text, text, text, text, text, jsonb)\",\n    \"enqueue_native_push_v3(uuid, text, text, text, text, text, jsonb, text, boolean)\",\n    \"enqueue_organization_webhook_deliveries_v1()\",\n    \"enqueue_session_archive_object_deletion()\",\n    \"enqueue_workspace_webhook_deliveries_v1()\",\n    \"ensure_editable_artifact_scope_authorization_head(uuid, uuid, name)\",\n    \"ensure_workspace_session_activity_revision(text, uuid, uuid)\",\n    \"expire_refunded_plan_credit()\",\n    \"external_membership_service_authority(jsonb)\",\n    \"external_workspace_service_permissions(uuid, text)\",\n    \"fail_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, name)\",\n    \"fail_subscription_codex_apps_refresh(uuid, uuid, uuid, bigint, text)\",\n    \"fail_subscription_core_connection_refresh(text, uuid, uuid, uuid, bigint, text)\",\n    \"fail_subscription_core_refresh(text, uuid, uuid, uuid, uuid, uuid, bigint, text)\",\n    \"fence_inbox_execution_context()\",\n    \"fence_legacy_lossless_content_update()\",\n    \"fence_mcp_account_bindings()\",\n    \"fence_new_session_draft_project_provenance_v1()\",\n    \"fence_session_execution_context()\",\n    \"fence_slack_bot_post_claim_mode()\",\n    \"file_private_to_another(uuid, uuid, uuid)\",\n    \"fold_session_event_delta_run(uuid, uuid, uuid, integer, integer, uuid[], jsonb, integer)\",\n    \"google_drive_object_acl_capability_active()\",\n    \"governed_learning_derived_uuid(uuid, text)\",\n    \"governed_learning_reason_codes_valid(text[])\",\n    \"grant_verified_signup_trial_credit()\",\n    \"guard_activated_tenancy_writer()\",\n    \"guard_connect_attempt_origin()\",\n    \"guard_editable_artifact_mutable_state()\",\n    \"guard_editable_artifact_transaction_child_insert()\",\n    \"guard_editable_artifact_update()\",\n    \"guard_external_identity_link_lifecycle()\",\n    \"guard_external_link_work_snapshot()\",\n    \"guard_host_mcp_binding_update()\",\n    \"guard_host_mcp_child_turn_authority()\",\n    \"guard_host_mcp_delegation()\",\n    \"guard_host_mcp_inherited_turn_authority()\",\n    \"guard_host_mcp_resolver_write()\",\n    \"guard_host_mcp_scheduled_turn_authority()\",\n    \"guard_host_mcp_task_authority()\",\n    \"guard_host_mcp_turn_authority()\",\n    \"guard_mcp_operation_immutable()\",\n    \"guard_memory_slack_publication_identity()\",\n    \"guard_pending_tool_event_output_delete()\",\n    \"guard_scheduled_admission_diagnostic()\",\n    \"guard_scheduled_admission_refusal()\",\n    \"guard_scheduled_run_owner()\",\n    \"guard_scheduled_task_owner()\",\n    \"guard_session_title_operation()\",\n    \"guard_subscription_binding_provider()\",\n    \"guard_subscription_connection_reference()\",\n    \"guard_subscription_connection_scope()\",\n    \"guard_subscription_designation_disconnect()\",\n    \"guard_subscription_disconnect_admission()\",\n    \"guard_subscription_disconnect_history()\",\n    \"guard_subscription_operation_lease_reference()\",\n    \"guard_subscription_provider_connection_kind()\",\n    \"guard_subscription_provider_registry()\",\n    \"guard_subscription_request_history()\",\n    \"guard_subscription_settings_identity()\",\n    \"guard_subscription_settings_locked_overrides()\",\n    \"guard_subscription_turn_session_reference()\",\n    \"guard_unresolved_provider_create()\",\n    \"guard_workspace_owned_skill_head_delete()\",\n    \"guard_workspace_owned_skill_history_delete()\",\n    \"guard_workspace_session_activity_revision()\",\n    \"hold_deleted_site_hostname()\",\n    \"host_export_session_root(uuid, uuid)\",\n    \"immutable_memory_lifecycle_event()\",\n    \"inbox_item_v1(uuid, uuid, text)\",\n    \"inbox_settings_v1(uuid, text)\",\n    \"inbox_settings_v2(uuid, text)\",\n    \"inbox_settings_v3(uuid, text)\",\n    \"inbox_settings_v4(uuid, text)\",\n    \"initialize_workspace_session_activity_revision()\",\n    \"insights_raw_amount_inputs(uuid, uuid, timestamp with time zone, timestamp with time zone)\",\n    \"insights_scoped_calls_rows(uuid, uuid, timestamp with time zone, timestamp with time zone, jsonb, timestamp with time zone, uuid, integer, uuid[], boolean)\",\n    \"insights_scoped_usage_rows(uuid, uuid, timestamp with time zone, timestamp with time zone, text, uuid[], boolean)\",\n    \"insights_site_usage(uuid, uuid, timestamp with time zone, timestamp with time zone, text)\",\n    \"insights_usage_filter(jsonb, jsonb)\",\n    \"insights_usage_payer(text, text)\",\n    \"inspect_slack_installation_binding(text, text, text)\",\n    \"integration_webhook_payload_v1(uuid, uuid, uuid, text, uuid, uuid, bigint, timestamp with time zone, jsonb, text)\",\n    \"invalidate_stale_verified_install()\",\n    \"keep_subscription_codex_cutover_identity()\",\n    \"knowledge_index_due_v1(text, integer)\",\n    \"knowledge_memory_relationship_guard()\",\n    \"knowledge_memory_row_guard()\",\n    \"lifecycle_backfill_read_active()\",\n    \"list_artifact_pins(uuid, uuid)\",\n    \"list_browser_deadline_checkpoints(integer)\",\n    \"list_command_containment_candidates(integer, bigint)\",\n    \"list_continuable_sessions(uuid, uuid)\",\n    \"list_due_workspace_pause_timers(integer)\",\n    \"list_exhausted_scheduled_tasks(integer)\",\n    \"list_idle_checkpoint_candidates(integer, bigint)\",\n    \"list_idle_interaction_leases(integer, bigint)\",\n    \"list_inbox_items_v1(uuid, text)\",\n    \"list_inbox_items_v2(uuid, text)\",\n    \"list_inbox_items_v3(uuid, text)\",\n    \"list_legacy_modal_checkpoint_slots(integer)\",\n    \"list_live_modal_sandbox_leases()\",\n    \"list_meterable_warm_leases()\",\n    \"list_organization_slack_bots(uuid, uuid)\",\n    \"list_orphaned_idle_browser_checkpoints(integer)\",\n    \"list_pending_child_terminal_wake_repairs_v1(integer, uuid, uuid)\",\n    \"list_pending_modal_provider_creates()\",\n    \"list_quiescence_receipt_wake_repairs_v1(integer, uuid, uuid)\",\n    \"list_sandbox_ended_epoch_blockers(integer)\",\n    \"list_sandbox_ended_epoch_setup_uncertainties(integer)\",\n    \"list_sandbox_file_publications(uuid, uuid, jsonb)\",\n    \"list_sandbox_file_publications_pinned(uuid, uuid, jsonb)\",\n    \"list_sandbox_viewer_force_drain_workspaces()\",\n    \"list_scheduled_task_blocker_reviews(integer)\",\n    \"list_scheduled_task_schedule_reconciliations(integer)\",\n    \"list_stale_compute_sandbox_enrollments(uuid)\",\n    \"list_subscription_plan_maintenance_accounts(integer)\",\n    \"list_unobservable_command_drain_candidates(integer)\",\n    \"locate_connected_command_completion(uuid, uuid, text, text)\",\n    \"lock_nested_agent_workspace_policy_update()\",\n    \"maintenance_claim_active(text, text)\",\n    \"maintenance_claim_checkpoint_gc_inner(uuid, integer, bigint)\",\n    \"maintenance_claim_checkpoint_prune_inner(bigint, integer)\",\n    \"maintenance_claim_checkpoint_settle_inner(uuid, uuid, boolean, text, bigint)\",\n    \"maintenance_claim_ended_blockers_inner(integer)\",\n    \"maintenance_claim_ended_setup_inner(integer)\",\n    \"maintenance_claim_output_release_inner(uuid, integer, bigint, timestamp with time zone)\",\n    \"maintenance_claim_site_auth_inner(bigint, integer)\",\n    \"maintenance_claim_snapshots_inner(integer)\",\n    \"maintenance_claim_titles_inner(integer)\",\n    \"maintenance_claim_updates_inner(integer)\",\n    \"maintenance_claim_wakes_inner(integer)\",\n    \"maintenance_inventory_draining_inner()\",\n    \"maintenance_inventory_retained_inner()\",\n    \"maintenance_probe_browser_sessions_sync()\",\n    \"maintenance_probe_enrollments_sync()\",\n    \"maintenance_probe_output_runner_eligible_v1(uuid, uuid, text)\",\n    \"maintenance_probe_rig_changes_sync()\",\n    \"maintenance_probe_rig_versions_sync()\",\n    \"maintenance_probe_sandbox_checkpoint_artifacts_sync()\",\n    \"maintenance_probe_sandbox_lease_holders_sync()\",\n    \"maintenance_probe_sandbox_leases_sync()\",\n    \"maintenance_probe_sandbox_retained_processes_sync()\",\n    \"maintenance_probe_sandbox_workspace_mutation_admissions_sync()\",\n    \"maintenance_probe_session_background_commands_sync()\",\n    \"maintenance_probe_session_list_snapshots_sync()\",\n    \"maintenance_probe_session_system_update_outbox_sync()\",\n    \"maintenance_probe_session_turns_sync()\",\n    \"maintenance_probe_session_workflow_wake_outbox_sync()\",\n    \"maintenance_probe_sessions_sync()\",\n    \"maintenance_probe_site_auth_connections_sync()\",\n    \"maintenance_schedule_cleanup_claim_inner(uuid, integer, integer)\",\n    \"maintenance_schedule_cleanup_connector_inner(uuid, uuid)\",\n    \"maintenance_schedule_cleanup_settle_inner(uuid, uuid, text)\",\n    \"maintenance_title_event_visible(text, uuid)\",\n    \"maintenance_workspace_commands_prepare_inner(uuid, uuid)\",\n    \"maintenance_workspace_commands_prune_inner(uuid, uuid)\",\n    \"make_room_for_retained_screenshot(uuid, uuid, bigint)\",\n    \"manage_subscription_core_personal(text, uuid, uuid, text, uuid, text, text, boolean, integer)\",\n    \"mark_automatic_session_title_fanout_delivered_v1(uuid, uuid)\",\n    \"mark_automatic_session_title_fanout_failed_v1(uuid, uuid, text)\",\n    \"mark_editable_artifact_live_outbox_published(text, text, integer, name)\",\n    \"mark_inbox_item_event_v1(uuid, text, text, integer)\",\n    \"mark_session_activity_pending()\",\n    \"mark_session_turn_deltas_folded(uuid, uuid, integer, integer)\",\n    \"mcp_operation_command_scoped(jsonb, text, jsonb)\",\n    \"member_notifications_allowed_v1(uuid, text)\",\n    \"memory_labels_valid(text[])\",\n    \"memory_scope_authorized(text, text, text, uuid)\",\n    \"memory_scope_visible(text, text, text, uuid, timestamp with time zone, timestamp with time zone)\",\n    \"model_context_contributions_valid(jsonb)\",\n    \"model_context_value_valid(text)\",\n    \"native_push_device_v1(text)\",\n    \"normalize_api_key_credential_kind()\",\n    \"normalize_legacy_member_connection_read_0516()\",\n    \"observe_credit_grant()\",\n    \"open_inbox_item_v1(uuid, uuid, uuid, text, text, text, text, text, text, jsonb)\",\n    \"open_session_tenancy_fence_inventory(oid)\",\n    \"open_session_tenancy_fenced_access(oid)\",\n    \"optional_workspace_rls_visible(uuid, uuid)\",\n    \"organization_invitation_row_json(organization_membership_invitations)\",\n    \"organization_membership_history_immutable()\",\n    \"organization_membership_row_json(organization_memberships)\",\n    \"organization_model_provider_scope_visible(uuid)\",\n    \"organization_model_usage_summary(uuid, timestamp with time zone, timestamp with time zone, uuid)\",\n    \"organization_retention_file_candidates(uuid, uuid)\",\n    \"organization_retention_object_candidates(uuid, uuid)\",\n    \"organization_subscription_model_scope_visible(uuid)\",\n    \"organization_tenancy_inventory_capability_active()\",\n    \"organization_tenancy_parity_capability_active()\",\n    \"organization_usage_summary(uuid, timestamp with time zone, timestamp with time zone, text, uuid, boolean)\",\n    \"organization_user_setup_delivery_json(organization_user_setup_deliveries)\",\n    \"pause_private_scheduled_task(uuid, uuid, text, uuid)\",\n    \"persist_subscription_codex_apps_refresh(uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n    \"persist_subscription_core_connection_refresh(text, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n    \"persist_subscription_core_refresh(text, uuid, uuid, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone)\",\n    \"persist_subscription_core_refresh_with_plan(text, uuid, uuid, uuid, uuid, uuid, bigint, text, timestamp with time zone, timestamp with time zone, text)\",\n    \"personal_document_authority_capability_active(text)\",\n    \"personal_resource_delegation_capability_active(text)\",\n    \"plan_general_balance(uuid)\",\n    \"plan_period_usage(plan_credit_periods, timestamp with time zone)\",\n    \"preference_registry_scope_visible(uuid, text, uuid, text)\",\n    \"prepare_organization_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, uuid, bigint, text, text, text)\",\n    \"prepare_scheduled_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, text, text, text)\",\n    \"prepare_workspace_background_command_deletion(uuid, uuid)\",\n    \"preserve_credit_grant_scope()\",\n    \"prevent_connection_account_intent_mutation()\",\n    \"prevent_connector_action_request_identity_mutation()\",\n    \"prevent_organization_codex_disconnect_with_live_leases()\",\n    \"prevent_personal_connection_authority_mutation()\",\n    \"prevent_scheduled_task_creator_mutation()\",\n    \"prevent_session_creator_mutation()\",\n    \"prevent_session_turn_initiator_mutation()\",\n    \"prevent_workspace_control_revision_rollback()\",\n    \"private_scheduled_task_summaries(uuid, uuid, text, uuid, timestamp with time zone, integer)\",\n    \"product_lifecycle_auth_method(text)\",\n    \"product_lifecycle_connection_class(text)\",\n    \"product_lifecycle_fact_valid(text, text)\",\n    \"project_context_compaction_event()\",\n    \"project_inbox_for_session_event_v1()\",\n    \"project_session_event_payload(jsonb)\",\n    \"prune_deleted_sandbox_checkpoint_artifacts(bigint, integer)\",\n    \"prune_native_push_deliveries_v1(integer, integer)\",\n    \"prune_organization_webhook_deliveries_v1(integer, integer)\",\n    \"prune_settled_cross_workspace_background_commands(uuid, uuid)\",\n    \"prune_subscription_usage_history()\",\n    \"prune_workspace_webhook_deliveries_v1(integer, integer)\",\n    \"purge_archived_session_content(uuid, uuid, text, integer)\",\n    \"purge_expired_transcription_recordings(bigint, integer)\",\n    \"put_editable_artifact_live_ticket(text, uuid, uuid, text, text, text, text, text, text, text, text, integer, text, boolean, integer, timestamp with time zone, timestamp with time zone, name)\",\n    \"quarantine_subscription_core_connection(text, uuid, uuid, uuid, uuid, uuid, text, bigint, bigint, text, text, timestamp with time zone)\",\n    \"queue_detached_retained_screenshot()\",\n    \"read_archived_session_import_batch(uuid, uuid, uuid, text, text, text)\",\n    \"read_fork_session_runtime(uuid, uuid, uuid, uuid, text, text)\",\n    \"read_organization_slack_bot_access(uuid, uuid, uuid)\",\n    \"read_organization_slack_bot_message(uuid, uuid, uuid, uuid)\",\n    \"read_scheduled_slack_bot_message(uuid, uuid, uuid, uuid)\",\n    \"read_sender_connection(uuid, uuid, uuid, text)\",\n    \"read_session_file_attachments(uuid, uuid, uuid, integer, uuid[], jsonb)\",\n    \"read_slack_bot_workspace_access(uuid, uuid, uuid)\",\n    \"read_subscription_authority_compat(text, text, uuid, uuid, bigint)\",\n    \"read_subscription_codex_apps_credential(uuid, uuid, uuid)\",\n    \"read_subscription_core_connection_credential(text, uuid, uuid, uuid, uuid, uuid, text, bigint)\",\n    \"read_subscription_core_owned_connection_credential(text, uuid, uuid, text, uuid)\",\n    \"read_subscription_usage_history(uuid, uuid, text, text, uuid[])\",\n    \"reap_expired_session_list_snapshots(integer)\",\n    \"reap_mcp_oauth_state(integer)\",\n    \"reap_sandbox_leases(bigint, bigint)\",\n    \"reap_sandbox_leases(bigint, bigint, bigint, bigint)\",\n    \"reap_stale_interaction_transitions(bigint)\",\n    \"reclaim_finished_subscription_runtime_capabilities()\",\n    \"record_archived_session_import_batch(uuid, uuid, uuid, text, text, text, text, integer, integer)\",\n    \"record_organization_signup_use_case(uuid, text, text)\",\n    \"record_sandbox_file_publication(uuid, uuid, uuid, uuid)\",\n    \"record_sandbox_recovery_operator_event(uuid, text)\",\n    \"record_subscription_core_owned_connection_quota(text, uuid, uuid, text, uuid, bigint, bigint, jsonb, timestamp with time zone)\",\n    \"record_subscription_core_plan_change()\",\n    \"record_user_activity_presence(text[])\",\n    \"recover_subscription_core_connection_health(text, uuid, uuid, uuid, uuid)\",\n    \"refresh_concurrent_capture_takeover()\",\n    \"register_mcp_oauth_client(text, jsonb, text, jsonb, jsonb, text)\",\n    \"register_native_push_device_v1(text, text, text, text, text, text[])\",\n    \"reject_document_migration_receipt_mutation()\",\n    \"reject_editable_artifact_history_mutation()\",\n    \"reject_memory_slack_immutable_mutation()\",\n    \"reject_session_turn_prompt_routing_mutation()\",\n    \"reject_session_turn_surface_mutation()\",\n    \"reject_skill_config_receipt_mutation()\",\n    \"reject_unfinalized_session_activity()\",\n    \"release_editable_artifact_live_outbox(text, text, integer, name)\",\n    \"renew_editable_artifact_live_outbox(text, text, integer, integer, name)\",\n    \"renew_editable_artifact_materialization(uuid, uuid, text, text, text, integer, integer, name)\",\n    \"request_due_sandbox_rotations(bigint, integer)\",\n    \"require_session_tenancy_fence()\",\n    \"reset_subscription_binding_cache_clock()\",\n    \"resolve_device_enrollment_request(text)\",\n    \"resolve_document_index_authority(uuid, uuid, uuid)\",\n    \"resolve_editable_artifact_data_schema(name)\",\n    \"resolve_editable_artifact_ticket_data_schema(name)\",\n    \"resolve_integration_initiating_human_v1(uuid, uuid, text, uuid)\",\n    \"resolve_organization_credential_provider_v1(uuid, uuid)\",\n    \"resolve_pending_device_enrollment_by_user_code(text)\",\n    \"resolve_slack_action_handle_tenancy(uuid, uuid)\",\n    \"resolve_slack_action_handle_tenancy(uuid, uuid, uuid)\",\n    \"resolve_slack_installation(text)\",\n    \"resolve_slack_interaction_tenancy(uuid, text)\",\n    \"resolve_slack_interaction_tenancy(uuid, uuid, text)\",\n    \"resolve_subscription_codex_apps_designation(uuid, uuid)\",\n    \"resource_classification_capability_active()\",\n    \"retry_editable_artifact_live_outbox(text, text, integer, integer, text, name)\",\n    \"sandbox_checkpoint_artifact_gc_due_v1(bigint)\",\n    \"sandbox_checkpoint_artifact_inventory()\",\n    \"sandbox_checkpoint_staleness()\",\n    \"sandbox_checkpoint_staleness_at(text)\",\n    \"sandbox_ended_epoch_blockers_due_v1()\",\n    \"sandbox_idle_checkpoint_due_v1(bigint)\",\n    \"sandbox_lease_reaper_due_v1()\",\n    \"sandbox_recovery_observations()\",\n    \"sandbox_rotation_backlog()\",\n    \"sandbox_rotation_interaction_blocked()\",\n    \"scheduled_personal_resource_capability_active(text)\",\n    \"scoped_compute_capability_active(text)\",\n    \"scoped_knowledge_actor_authorized(text, text, text)\",\n    \"scoped_knowledge_actor_valid(text, text, text)\",\n    \"scoped_knowledge_scope_key(text, uuid, text)\",\n    \"scoped_knowledge_scope_valid(text, uuid, text)\",\n    \"scoped_knowledge_scope_visible(uuid, text, uuid, text)\",\n    \"seed_subscription_codex_cutover()\",\n    \"session_archive_candidates(bigint, integer, uuid)\",\n    \"session_archive_preference_snapshot_rows(uuid, uuid, uuid, integer)\",\n    \"session_archive_unfinished(bigint, integer)\",\n    \"session_content_compaction_candidates(text, uuid, integer)\",\n    \"session_create_idempotency_guard_insert()\",\n    \"session_delta_fold_candidates(bigint, integer)\",\n    \"session_depth_policy_defaults()\",\n    \"session_depth_snapshot_immutable()\",\n    \"session_file_read_allowed(uuid, uuid, uuid)\",\n    \"session_hands_back_v1(uuid, uuid)\",\n    \"session_list_snapshots_expired_v1()\",\n    \"session_ownership_capability_active()\",\n    \"session_person_v1(uuid, uuid, text, text)\",\n    \"session_recipient_v1(text, text)\",\n    \"session_replies_muted_for_v1(uuid, text)\",\n    \"session_replies_muted_v1(uuid)\",\n    \"session_spawn_denials_append_only()\",\n    \"session_system_update_outbox_due_v1()\",\n    \"session_tenancy_account_activated(uuid)\",\n    \"session_tenancy_fence_inventory_capability_active(oid)\",\n    \"session_tenancy_fenced_access_capability_active(oid)\",\n    \"session_variable_set_attachments_protocol_v1_active()\",\n    \"session_work_claim_capability_active()\",\n    \"session_workflow_wakes_due_v1()\",\n    \"set_inbox_settings_v1(uuid, text, text)\",\n    \"set_inbox_settings_v2(uuid, text, text, boolean)\",\n    \"set_inbox_settings_v3(uuid, text, text, boolean, boolean)\",\n    \"set_inbox_settings_v4(uuid, text, text, boolean, boolean, boolean)\",\n    \"set_member_notifications_allowed_v1(uuid, uuid, text, boolean)\",\n    \"set_organization_slack_bot_access(uuid, uuid, uuid, text, boolean)\",\n    \"set_session_replies_muted_v1(uuid, uuid, uuid, text, boolean)\",\n    \"set_slack_bot_workspace_access(uuid, uuid, uuid, text, boolean, uuid[])\",\n    \"set_subscription_core_reach(text, uuid, uuid, boolean, boolean)\",\n    \"set_subscription_core_reach_allocator(text, uuid, uuid, boolean)\",\n    \"settle_background_command_from_retained_process()\",\n    \"settle_native_push_delivery_v1(uuid, uuid, text, text, integer)\",\n    \"settle_organization_webhook_delivery_v1(uuid, uuid, integer, text, integer)\",\n    \"settle_sandbox_checkpoint_artifact(uuid, uuid, boolean, text, bigint)\",\n    \"settle_temporal_schedule_cleanup(uuid, uuid, text)\",\n    \"settle_workspace_webhook_delivery_v1(uuid, uuid, integer, text, integer)\",\n    \"site_auth_maintenance_due_v1(bigint)\",\n    \"slack_routing_capability_active()\",\n    \"stamp_document_index_completion()\",\n    \"stamp_sandbox_drain_teardown_fence()\",\n    \"stamp_sandbox_lease_holders_changed()\",\n    \"stamp_session_workflow_control_revision()\",\n    \"subscription_apps_designation_allowed(uuid, uuid, uuid)\",\n    \"subscription_apps_designation_manage_allowed(uuid, uuid, uuid)\",\n    \"subscription_authority_carrier_inserted_now(text, uuid, uuid, bigint)\",\n    \"subscription_authority_compat_providers()\",\n    \"subscription_codex_apps_designation_target(uuid, uuid)\",\n    \"subscription_codex_cutover_v1_active()\",\n    \"subscription_codex_owner_capability_held(uuid, text[], text, uuid, boolean)\",\n    \"subscription_codex_owner_membership_held(uuid, uuid)\",\n    \"subscription_codex_refresh_write_allowed(uuid, uuid, uuid)\",\n    \"subscription_codex_reset_authority(uuid, uuid, uuid, text)\",\n    \"subscription_codex_reset_credit_fence(uuid, uuid, uuid, text, text, uuid)\",\n    \"subscription_connection_visible(uuid, uuid, uuid, text, text, uuid, text, text)\",\n    \"subscription_core_acceptance_authority_v2(text, uuid, uuid, uuid, text)\",\n    \"subscription_core_connection_kind(text)\",\n    \"subscription_core_failover_readiness(text)\",\n    \"subscription_core_owner_capability_held(text, uuid, text[], text, uuid, boolean)\",\n    \"subscription_core_owner_membership_held(uuid, uuid)\",\n    \"subscription_core_personal_connection_versions(text, uuid, uuid, text)\",\n    \"subscription_core_personal_connections(text, uuid, uuid, text)\",\n    \"subscription_core_personal_sharing(text, uuid, text, uuid, integer)\",\n    \"subscription_core_reach(text, uuid, uuid)\",\n    \"subscription_core_refresh_write_allowed(text, uuid, uuid, uuid)\",\n    \"subscription_core_revision_authority_v2(uuid, uuid, uuid, bigint)\",\n    \"subscription_core_task_authority_v2(text, uuid, uuid, uuid, text)\",\n    \"subscription_organization_admin(uuid)\",\n    \"subscription_own_person_membership_id(uuid)\",\n    \"subscription_people_assignment_visible(uuid, uuid, uuid, text, text)\",\n    \"subscription_people_designation_visible(uuid, uuid, uuid)\",\n    \"subscription_person_preference_owned(uuid, uuid)\",\n    \"subscription_person_preference_visible(uuid, uuid, text, text)\",\n    \"subscription_personal_connection_visible(uuid, uuid, uuid, text, text, text)\",\n    \"subscription_plan_definition(text)\",\n    \"subscription_plan_free_anniversary(timestamp with time zone, timestamp with time zone)\",\n    \"subscription_provider_cutover_committed(text)\",\n    \"subscription_setting_override_widened(jsonb, jsonb, boolean)\",\n    \"subscription_usage_history_prune_due()\",\n    \"succeed_editable_artifact_materialization(uuid, uuid, text, text, text, integer, text, text, text, bigint, text, text, timestamp with time zone, name)\",\n    \"summarize_session_recovery_backlog()\",\n    \"supervised_command_blocker_guard()\",\n    \"supervised_command_capture_guard()\",\n    \"supervised_command_guard()\",\n    \"supervised_provider_loss_commit_guard()\",\n    \"sync_external_membership_lifecycle()\",\n    \"sync_slack_action_handle_tenancy()\",\n    \"sync_slack_installation_binding()\",\n    \"sync_usage_maintenance_due()\",\n    \"tenancy_activation_canonical_json(jsonb)\",\n    \"tenancy_backfill_ledger_available()\",\n    \"terminal_retained_processes_due_v1()\",\n    \"truncate_workspace_control_text(text, integer)\",\n    \"unregister_native_push_device_v1(text)\",\n    \"update_artifact_pin(uuid, uuid, text, text, boolean)\",\n    \"update_inbox_item_attention_v1(uuid, uuid, text, boolean, boolean, timestamp with time zone, boolean)\",\n    \"update_organization_integration_policy(uuid, text, jsonb)\",\n    \"upgrade_temporal_schedule_connector_cleanup(uuid, uuid, text, uuid, text, jsonb, uuid)\",\n    \"validate_editable_artifact_projection()\",\n    \"validate_editable_artifact_transaction_commit()\",\n    \"validate_editable_artifact_version_projection()\",\n    \"validate_mcp_account_bindings(jsonb, jsonb)\",\n    \"validate_sandbox_checkpoint_artifact_refs()\",\n    \"validate_sandbox_checkpoint_refs()\",\n    \"validate_sandbox_pty_process_v2()\",\n    \"validate_sandbox_retained_process_v2()\",\n    \"validate_session_parent_turn()\",\n    \"validate_usage_event_execution_context()\",\n    \"validate_user_resource_grant_action()\",\n    \"variable_set_authority_capability_active(text)\",\n    \"vault_assert_name(text, text)\",\n    \"vault_assert_writable(jsonb, vaults)\",\n    \"vault_audit(uuid, uuid, text, text, text, text, jsonb)\",\n    \"vault_authority_capability_active(text)\",\n    \"vault_capability_close()\",\n    \"vault_capability_open(text)\",\n    \"vault_context(jsonb, uuid)\",\n    \"vault_ensure_default(jsonb, text)\",\n    \"vault_ensure_task(jsonb, uuid)\",\n    \"vault_insert(jsonb, text, text, text, uuid[], boolean, boolean, uuid)\",\n    \"vault_item_json(vault_items, boolean)\",\n    \"vault_items_by_key(uuid[], text)\",\n    \"vault_limit(text, integer)\",\n    \"vault_name_is_valid(text)\",\n    \"vault_owner_scope_key(vaults)\",\n    \"vault_policy_ids(jsonb)\",\n    \"vault_policy_intersect(jsonb, jsonb)\",\n    \"vault_policy_is_valid(jsonb)\",\n    \"vault_principal_context(jsonb)\",\n    \"vault_raise(text, text, jsonb)\",\n    \"vault_reach(jsonb)\",\n    \"vault_reachable_item(jsonb, uuid)\",\n    \"vault_reachable_row(jsonb, uuid)\",\n    \"vault_sanitize_legacy_name(text)\",\n    \"vault_session_policy_chain(uuid, uuid, uuid, boolean)\",\n    \"vault_session_view_json(jsonb, uuid)\",\n    \"vault_subject_has_secrets_use(uuid, uuid, text)\",\n    \"vault_subject_in_workspace(uuid, uuid, text)\",\n    \"vault_summary_json(vaults, jsonb)\",\n    \"vault_vaults_by_key(uuid[], text)\",\n    \"vault_workspace_is_personal(uuid, uuid)\",\n    \"vault_workspace_set(uuid[])\",\n    \"vault_write_item(jsonb, vaults, vault_items, jsonb)\",\n    \"visible_workspace_insights_model_call_facts(uuid, timestamp with time zone, timestamp with time zone)\",\n    \"visible_workspace_insights_model_call_facts(uuid, timestamp with time zone, timestamp with time zone, text, text)\",\n    \"visible_workspace_insights_model_fact_rows(uuid, timestamp with time zone, timestamp with time zone, text, text, uuid, uuid)\",\n    \"visible_workspace_insights_usage_events(uuid, timestamp with time zone, timestamp with time zone)\",\n    \"visible_workspace_insights_usage_events(uuid, timestamp with time zone, timestamp with time zone, text[])\",\n    \"visible_workspace_insights_usage_projection(uuid, timestamp with time zone, timestamp with time zone, text[])\",\n    \"warming_reset_resume_state_v2(text, text, jsonb, integer, integer, timestamp with time zone)\",\n    \"workspace_insights_amount_fact_rows(uuid, timestamp with time zone, timestamp with time zone, text, text, uuid, uuid)\",\n    \"workspace_member_custom_permissions_valid(jsonb)\",\n    \"workspace_member_legacy_permissions_0516()\",\n    \"workspace_member_legacy_permissions_0555()\",\n    \"workspace_member_legacy_permissions_0865()\",\n    \"workspace_member_role(text, jsonb)\",\n    \"workspace_member_role_permissions(text)\",\n    \"workspace_rls_visible(uuid, uuid)\"\n  ]\n}\n","export type RoleRelationshipDirection = \"inherits\" | \"member\";\n\nexport type RoleRelationshipCatalogRow = {\n  relationship: string;\n  direction: RoleRelationshipDirection;\n  server_version_num: number;\n  admin_option: boolean | null;\n  inherit_option: boolean | null;\n  set_option: boolean | null;\n  member_is_superuser: boolean | null;\n  member_can_create_role: boolean | null;\n  grantor_role: string | null;\n  grantor_is_superuser: boolean | null;\n};\n\nexport type ClassifiedRoleRelationships = {\n  relationships: string[];\n  managementOnlyRelationships: string[];\n  unsafeRelationships: string[];\n};\n\ntype RoleTargetExpression = \"current_user\" | \"$1\";\n\n/**\n * One PostgreSQL 15-compatible catalog query for both provisioning and runtime\n * posture. PostgreSQL 16 added per-membership INHERIT and SET columns; reading\n * the catalog row through to_jsonb keeps this statement parseable on 15 while\n * leaving the missing options null and therefore fail-closed.\n */\nexport function roleRelationshipsCatalogQuery(targetRole: RoleTargetExpression): string {\n  return `\nwith recursive target_role(oid, rolname) as (\n  select oid, rolname\n  from pg_roles\n  where rolname = ${targetRole}\n), inherited_roles(oid, rolname) as (\n  select parent.oid, parent.rolname\n  from pg_auth_members membership\n  join target_role target on target.oid = membership.member\n  join pg_roles parent on parent.oid = membership.roleid\n  union\n  select parent.oid, parent.rolname\n  from inherited_roles inherited\n  join pg_auth_members membership on membership.member = inherited.oid\n  join pg_roles parent on parent.oid = membership.roleid\n), relationships as (\n  select\n    ('inherits:' || inherited.rolname)::text as relationship,\n    'inherits'::text as direction,\n    null::boolean as admin_option,\n    null::boolean as inherit_option,\n    null::boolean as set_option,\n    null::boolean as member_is_superuser,\n    null::boolean as member_can_create_role,\n    null::text as grantor_role,\n    null::boolean as grantor_is_superuser\n  from inherited_roles inherited\n  union all\n  select\n    ('member:' || member.rolname)::text as relationship,\n    'member'::text as direction,\n    membership.admin_option,\n    case\n      when current_setting('server_version_num')::integer >= 160000\n        then (to_jsonb(membership) ->> 'inherit_option')::boolean\n      else null::boolean\n    end as inherit_option,\n    case\n      when current_setting('server_version_num')::integer >= 160000\n        then (to_jsonb(membership) ->> 'set_option')::boolean\n      else null::boolean\n    end as set_option,\n    member.rolsuper as member_is_superuser,\n    member.rolcreaterole as member_can_create_role,\n    grantor.rolname::text as grantor_role,\n    grantor.rolsuper as grantor_is_superuser\n  from pg_auth_members membership\n  join target_role target on target.oid = membership.roleid\n  join pg_roles member on member.oid = membership.member\n  left join pg_roles grantor on grantor.oid = membership.grantor\n)\nselect\n  relationship,\n  direction,\n  current_setting('server_version_num')::integer as server_version_num,\n  admin_option,\n  inherit_option,\n  set_option,\n  member_is_superuser,\n  member_can_create_role,\n  grantor_role,\n  grantor_is_superuser\nfrom relationships\norder by relationship, direction, grantor_role nulls first\n`;\n}\n\n/**\n * PostgreSQL 16+ automatically gives a non-superuser CREATEROLE principal an\n * ADMIN-only grant on a role it creates. The exact edge below permits role\n * management but cannot inherit the app role's privileges or SET ROLE into it.\n */\nexport function isManagementOnlyRoleRelationship(row: RoleRelationshipCatalogRow): boolean {\n  return (\n    row.direction === \"member\" &&\n    row.server_version_num >= 160000 &&\n    row.admin_option === true &&\n    row.inherit_option === false &&\n    row.set_option === false &&\n    row.member_is_superuser === false &&\n    row.member_can_create_role === true &&\n    row.grantor_is_superuser === true\n  );\n}\n\nfunction sortedUnique(values: Iterable<string>): string[] {\n  return [...new Set(values)].sort((a, b) => a.localeCompare(b));\n}\n\n/** Classify exact management-only reverse grants while rejecting every other edge. */\nexport function classifyRoleRelationships(\n  rows: readonly RoleRelationshipCatalogRow[],\n): ClassifiedRoleRelationships {\n  const managementOnlyRows = rows.filter(isManagementOnlyRoleRelationship);\n  const unsafeRows = rows.filter((row) => !isManagementOnlyRoleRelationship(row));\n\n  return {\n    relationships: sortedUnique(rows.map((row) => row.relationship)),\n    managementOnlyRelationships: sortedUnique(managementOnlyRows.map((row) => row.relationship)),\n    unsafeRelationships: sortedUnique(unsafeRows.map((row) => row.relationship)),\n  };\n}\n"],"mappings":";;;;;AAAA,OAAO,cAAc;;;ACArB,SAAS,WAAW;;;ACApB;AAAA,EACE,cAAgB;AAAA,EAChB,QAAU;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ACnuCO,SAAS,8BAA8B,YAA0C;AACtF,SAAO;AAAA;AAAA;AAAA;AAAA,oBAIW,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6D9B;AAOO,SAAS,iCAAiC,KAA0C;AACzF,SACE,IAAI,cAAc,YAClB,IAAI,sBAAsB,QAC1B,IAAI,iBAAiB,QACrB,IAAI,mBAAmB,SACvB,IAAI,eAAe,SACnB,IAAI,wBAAwB,SAC5B,IAAI,2BAA2B,QAC/B,IAAI,yBAAyB;AAEjC;AAEA,SAAS,aAAa,QAAoC;AACxD,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAC/D;AAGO,SAAS,0BACd,MAC6B;AAC7B,QAAM,qBAAqB,KAAK,OAAO,gCAAgC;AACvE,QAAM,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC,iCAAiC,GAAG,CAAC;AAE9E,SAAO;AAAA,IACL,eAAe,aAAa,KAAK,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;AAAA,IAC/D,6BAA6B,aAAa,mBAAmB,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;AAAA,IAC3F,qBAAqB,aAAa,WAAW,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;AAAA,EAC7E;AACF;;;AF1HA,IAAM,sCAAsC;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,4CAA4C;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,2CAA2C;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,yCAAyC;AAAA,EAC7C;AACF;AAEA,IAAM,6CAA6C;AAAA,EACjD;AACF;AAEA,IAAM,kDAAkD;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,kDACX;AACK,IAAM,6CACX;AAIK,IAAM,kCAAkC;AAAA,EAC7C,CAAC,mCAAmC,yCAAyC,SAAS;AAAA,EACtF;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,CAAC,wCAAwC,8CAA8C,SAAS;AAAA,EAChG;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGO,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACO,IAAM,2BAA2B,0BAA0B;AAAA,EAChE,CAAC,SAAS,qBAAqB,IAAI;AACrC;AACO,IAAM,6BAA6B;AAAA,EACxC,GAAG;AAAA,EACH;AACF;AACO,IAAM,mCAAmC;AAAA,EAC9C,GAAG,yBAAyB,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,iCAAiC;AAAA,EACrC;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,EACF;AACF;AAEA,IAAM,mDACJ;AAEF,IAAM,iDACJ;AACF,IAAM,8CAA8C;AAC7C,IAAM,4CAA4C;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,kCAAkC;AACjC,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,sBAAsB;AACrB,IAAM,+CAA+C;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,qCAAqC;AAC3C,IAAM,sCAAsC;AACrC,IAAM,gDAAgD;AAAA,EAC3D;AACF;AACA,IAAM,sCAAsC;AACrC,IAAM,qCAAqC;AAClD,IAAM,mDACJ;AAEF,IAAM,mCAAmC;AACzC,IAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,kCAAkC,oBAAI,IAAY;AAAA,EACtD;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAED,IAAM,+CACJ;AACF,IAAM,0CACJ;AACF,IAAM,yCACJ;AACF,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,8CAA8C;AAAA,EAClD;AAAA,EACA;AACF;AACA,IAAM,2CACJ;AACF,IAAM,2CACJ;AACF,IAAM,6CAA6C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,qDAAqD;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,oDAAoD;AAAA,EACxD,GAAG;AAAA,EACH;AACF;AACA,IAAM,wCAAwC;AAC9C,IAAM,qDACJ;AACF,IAAM,uDACJ;AACF,IAAM,wDAAwD;AAAA,EAC5D,CAAC,qCAAqC,GAAG;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,CAAC,kDAAkD,GAAG;AAAA,IACpD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,CAAC,oDAAoD,GAAG;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AACA,IAAM,wCAAwC,OAAO;AAAA,EACnD;AACF;AACA,IAAM,gDAAgD;AAEtD,IAAM,8CACJ;AACF,IAAM,qCAAqC;AAE3C,IAAM,iDACJ;AACF,IAAM,wCAAwC;AAC9C,IAAM,wCACJ;AACF,IAAM,iDAAiD;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,oDAAoD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,6CACJ;AACF,IAAM,mCAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,kDACJ;AACF,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,gDAAgD;AAAA,EACpD;AAAA,EACA;AACF;AACA,IAAM,8CAA8C;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,uCAAuC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,iDACJ;AACF,IAAM,qCAAqC;AAC3C,IAAM,2DACJ;AACF,IAAM,+CAA+C;AACrD,IAAM,4CAA4C;AAClD,IAAM,gCAAgC;AACtC,IAAM,qCAAqC;AAC3C,IAAM,8BACJ;AACF,IAAM,qCAAqC;AAAA,EACzC;AAAA,EACA;AACF;AACA,IAAM,iDACJ;AACF,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,kDACJ;AACF,IAAM,sCAAsC;AAC5C,IAAM,wCAAwC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,6CAA6C;AAAA,EACjD;AAAA,EACA;AACF;AACA,IAAM,kCAAkC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,qCAAqC;AAC3C,IAAM,yBAAyB;AAExB,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,8CAA8C;AACpD,IAAM,kCAAkC;AACxC,IAAM,+CAA+C;AACrD,IAAM,2DACJ;AACF,IAAM,oCAAoC;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,oCAAoC;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4CAA4C;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,oCAAoC;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4CAA4C;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AACF;AACA,IAAM,yCAAyC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,wCACJ;AACF,IAAM,6CAA6C;AACnD,IAAM,oCAAoC;AAC1C,IAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACO,IAAM,iCAAiC;AAAA,EAC5C;AAAA,EACA;AACF;AACA,IAAM,0CACJ;AACF,IAAM,2CACJ;AACF,IAAM,uCACJ;AACF,IAAM,wCAAwC;AAAA,EAC5C;AACF;AACA,IAAM,wCAAwC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,gDAAgD;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,uCAAuC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,+CAA+C;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,gDAAgD;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,gDAAgD;AAAA,EACpD,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,wCACJ;AAEF,IAAM,4CACJ;AAEF,IAAM,qDACJ;AACF,IAAM,sCACJ;AACF,IAAM,+BACJ;AACF,IAAM,uCACJ;AACF,IAAM,sCACJ;AACF,IAAM,oCAAoC;AAC1C,IAAM,yCAAyC;AAC/C,IAAM,qCACJ;AACF,IAAM,+CACJ;AACF,IAAM,gDACJ;AACF,IAAM,6DACJ;AACF,IAAM,kDACJ;AACF,IAAM,6CAA6C;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,6BAA6B,oBAAI,IAAY;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AACF,CAAC;AACD,IAAM,iCAAiC;AACvC,IAAM,oCACJ;AAMK,IAAM,2CAA2C;AAAA,EACtD;AAAA,EACA;AACF;AAMO,IAAM,6CAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,2CAA2C;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF;AASO,IAAM,2CAA2C;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAkBO,IAAM,gCAGP;AAAA,EACJ,GAAI,CAAC,OAAO,QAAQ,EAAY,QAAQ,CAAC,aAAa;AAAA,IACpD,GAAG;AAAA,MACD,UAAU,QAAQ;AAAA,MAClB,cAAc,QAAQ;AAAA,MACtB,WAAW,QAAQ;AAAA,MACnB,cAAc,QAAQ;AAAA,MACtB,GAAG,QAAQ;AAAA,MACX,GAAG,QAAQ;AAAA,MACX,WAAW,QAAQ;AAAA,IACrB,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,UAAmB,UAAU,EAAE;AAAA,IAC/D,GAAG;AAAA,MACD,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,MACnB,wBAAwB,QAAQ;AAAA,IAClC,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,oBAA6B,UAAU,EAAE;AAAA,EAC3E,CAAC;AAAA,EACD,GAAG;AAAA,IACD,GAAG;AAAA,IACH;AAAA,IACA;AAAA,EACF,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,oBAA6B,UAAU,EAAE;AAAA,EACzE;AAAA,IACE,QAAQ;AAAA,IACR,WAAW;AAAA,EACb;AACF;AAQO,IAAM,gCAA8E;AAAA,EACzF,GAAI,CAAC,OAAO,QAAQ,EAAY,QAAQ,CAAC,aAAa;AAAA,IACpD,EAAE,OAAO,GAAG,QAAQ,6BAA6B,QAAQ,GAAG,QAAQ,sBAAsB;AAAA,IAC1F,GAAG,CAAC,qBAAqB,qBAAqB,wBAAwB,kBAAkB,EAAE;AAAA,MACxF,CAAC,WAAW;AAAA,QACV,OAAO,GAAG,QAAQ,IAAI,KAAK;AAAA,QAC3B,QAAQ,GAAG,QAAQ;AAAA,MACrB;AAAA,IACF;AAAA,IACA,GAAG,CAAC,mBAAmB,iBAAiB,EAAE,IAAI,CAAC,YAAY;AAAA,MACzD,OAAO;AAAA,MACP,QAAQ,GAAG,QAAQ,iBAAiB,MAAM;AAAA,IAC5C,EAAE;AAAA,IACF,GAAG,CAAC,qBAAqB,mBAAmB,mBAAmB,EAAE,IAAI,CAAC,YAAY;AAAA,MAChF,OAAO;AAAA,MACP,QAAQ,GAAG,QAAQ,iBAAiB,MAAM;AAAA,IAC5C,EAAE;AAAA;AAAA,IAEF,GAAI,aAAa,WACb;AAAA,MACE;AAAA,QACE,OAAO,GAAG,QAAQ;AAAA,QAClB,QAAQ,GAAG,QAAQ;AAAA,MACrB;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAGO,IAAM,gCACX,CAAC,OAAO,QAAQ,EAChB,QAAQ,CAAC,aAAa;AAAA,EACtB;AAAA,IACE,OAAO,GAAG,QAAQ;AAAA,IAClB,SAAS,GAAG,QAAQ;AAAA,EACtB;AAAA,EACA;AAAA,IACE,OAAO,GAAG,QAAQ;AAAA,IAClB,SAAS,GAAG,QAAQ;AAAA,EACtB;AAAA,EACA;AAAA,IACE,OAAO,GAAG,QAAQ;AAAA,IAClB,SAAS,GAAG,QAAQ;AAAA,EACtB;AAAA,EACA;AAAA,IACE,OAAO,GAAG,QAAQ;AAAA,IAClB,SAAS,GAAG,QAAQ;AAAA,EACtB;AAAA,EACA,EAAE,OAAO,GAAG,QAAQ,sBAAsB,SAAS,GAAG,QAAQ,kCAAkC;AAAA,EAChG,EAAE,OAAO,GAAG,QAAQ,sBAAsB,SAAS,GAAG,QAAQ,+BAA+B;AAAA,EAC7F,EAAE,OAAO,GAAG,QAAQ,yBAAyB,SAAS,GAAG,QAAQ,6BAA6B;AAChG,CAAC;AAQM,IAAM,gCAIP;AAAA,EACJ,CAAC,8CAA8C,2CAA2C;AAAA,EAC1F;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAAA,EACA,CAAC,2CAA2C,wCAAwC;AACtF,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,oBAA6B,MAAa,GAAQ,EAAE;AAG9E,IAAM,gCACX;AAAA,EACE;AAAA,IACE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,IAAI;AAAA,EACN;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,IAAI;AAAA,EACN;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,IAAI;AAAA,EACN;AACF;AAOK,IAAM,gCACX;AAAA,EACE;AAAA,IACE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,IAAI;AAAA,EACN;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,IAAI;AAAA,EACN;AACF;AAGK,IAAM,iCAIP;AAAA,EACJ;AAAA,IACE,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,IAAI;AAAA,EACN;AACF;AAQO,IAAM,mCAAmC;AAMhD,IAAM,0BAGA;AAAA,EACJ,GAAG;AAAA,EACH,GAAG,8BAA8B,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,EAAE,QAAQ,WAAW,KAAK,EAAE;AAC1F;AACA,IAAM,yBAAuE;AAAA,EAC3E,GAAG;AAAA,EACH,GAAG,8BAA8B,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,EAAE,OAAO,QAAQ,KAAK,EAAE;AACrF;AACA,IAAM,0BAAyE;AAAA,EAC7E,GAAG;AAAA,EACH,GAAG,8BAA8B,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,EAAE,OAAO,SAAS,KAAK,EAAE;AACtF;AAEA,IAAM,2BAA2B,IAAI;AAAA,EACnC,wBAAwB,OAAO,CAAC,EAAE,OAAO,MAAM,WAAW,kBAAkB,EAAE;AAAA,IAC5E,CAAC,EAAE,UAAU,MAAM;AAAA,EACrB;AACF;AAMO,IAAM,qCAAwD;AAAA,EACnE,GAAG,IAAI;AAAA,IACL,wBAAwB,IAAI,CAAC,EAAE,UAAU,MAAM,UAAU,MAAM,GAAG,UAAU,QAAQ,GAAG,CAAC,CAAC;AAAA,EAC3F;AACF;AASO,SAAS,sCAAsC,eAAe,UAAoB;AACvF,SAAO;AAAA,IACL,GAAG,wBAAwB;AAAA,MACzB,CAAC,EAAE,QAAQ,UAAU,MACnB,WAAW,WAAW,WAAW,eAAe,MAAM,IAAI,SAAS;AAAA,IACvE;AAAA,IACA,GAAG,uBAAuB,IAAI,CAAC,EAAE,OAAO,OAAO,MAAM,UAAU,KAAK,IAAI,MAAM,EAAE;AAAA,IAChF,GAAG,wBAAwB,IAAI,CAAC,EAAE,OAAO,QAAQ,MAAM,WAAW,KAAK,IAAI,OAAO,EAAE;AAAA,IACpF,GAAG,+BAA+B,IAAI,CAAC,EAAE,QAAQ,KAAK,MAAM,YAAY,MAAM,IAAI,IAAI,EAAE;AAAA,EAC1F,EAAE,KAAK,CAAC,MAAM,UAAW,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAE;AACpE;AAGO,SAAS,mCAAmC,QAAwB;AACzE,SAAO,wBAAwB,MAAM,uDAAuD,iCAAiC;AAC/H;AAMO,IAAM,+CAA+C;AAAA,EAC1D;AACF;AAGO,IAAM,6CAA6C;AAAA,EACxD;AAAA,EACA;AACF;AAQO,IAAM,2CAA6E;AAAA,EACxF,OAAO;AAAA,EACP,KAAK;AAAA,EACL,QAAQ;AACV;AASO,IAAM,oCAAoC;AAQ1C,IAAM,iDAAiD;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AACF;AAOO,IAAM,+CAA+C;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,IAAM,8CAA8C;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,6CAA6C;AAAA,EACxD;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAGO,IAAM,8CAA8C;AAAA;AAAA,EAEzD;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL;AAEA,IAAM,6BAA6B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,gCAAgC,IAAI,IAAY,0BAA0B;AAChF,IAAM,qCAAqC;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,mDACX;AACK,IAAM,uCAAuC;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AACF;AACO,IAAM,oCAAoC;AAE1C,IAAM,sCAAsC;AAAA,EACjD;AAAA,EACA;AACF;AAEO,IAAM,wCAAwC;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH;AAAA,EACA;AACF;AACO,IAAM,qCAAqC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,0CAA0C;AAAA,EACrD;AAAA,EACA;AACF;AAEO,IAAM,4CAA4C;AAAA,EACvD;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA,GAAG;AAAA,EACH;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,IAAM,yDAAyD;AAAA,EACpE;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4DAA4D,IAAI;AAAA,EACpE;AACF;AAGO,IAAM,2CAA2C;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEO,IAAM,yCAAyC;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4CAA4C,IAAI;AAAA,EACpD;AACF;AAOO,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,wCACX,OAAO,OAAO;AAAA,EACZ,KAAK,OAAO,OAAO;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,QAAQ,OAAO,OAAO;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH,CAAC;AAGI,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,6BAA6B,CAAC,sCAAsC;AAG1E,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,oCAAoC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,iCAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOA,IAAM,sBAAsB,CAAC,UAAU,UAAU,UAAU,QAAQ;AAG5D,IAAM,2BAA0D,OAAO,OAAO;AAAA,EACnF,GAAG,OAAO,YAAY,wBAAwB,IAAI,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAAA,EAC1F,GAAG,OAAO,YAAY,yBAAyB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAU,CAAC,CAAC;AAAA,EAC3F,GAAG,OAAO;AAAA,IACR,OAAO,OAAO,qCAAqC,EAChD,KAAK,EACL,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAU,CAAC;AAAA,EAChD;AAAA,EACA,GAAG,OAAO;AAAA,IACR,2BAA2B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,QAAQ,CAAU,CAAC;AAAA,EAClF;AAAA,EACA,GAAG,OAAO;AAAA,IACR,2BAA2B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,QAAQ,CAAU,CAAC;AAAA,EAClF;AAAA,EACA,GAAG,OAAO;AAAA,IACR,kCAAkC,IAAI,CAAC,UAAU;AAAA,MAC/C;AAAA,MACA,CAAC,UAAU,UAAU,QAAQ;AAAA,IAC/B,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,qBAAqB,OAAO;AAAA,EACvC,OAAO,KAAK,wBAAwB,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACzE;AAMA,IAAM,yBAAyB,oBAAI,IAAY;AAAA,EAC7C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG,OAAO,OAAO,qCAAqC,EAAE,KAAK;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASD,IAAM,4BAA4B,oBAAI,IAAY;AAAA,EAChD,GAAG,wCAAe;AAAA,EAClB,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AACD,IAAM,2BAA2B,oBAAI,IAAY;AAAA,EAC/C,GAAG,wCAAe;AAAA,EAClB,GAAG,wBAAwB,OAAO,CAAC,EAAE,OAAO,MAAM,WAAW,QAAQ,EAAE;AAAA,IACrE,CAAC,EAAE,UAAU,MAAM;AAAA,EACrB;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AACF,CAAC;AAED,SAAS,2BACP,OAIA,aACS;AACT,SACE,MAAM,UAAU,eAChB,MAAM,eAAe,QACrB,MAAM,cAAc,QACpB,MAAM,cAAc,SACnB,MAAM,eAAe,MAAM;AAAA;AAAA,EAG5B,MAAM,mBAAmB;AAE7B;AAEA,SAAS,yBACP,SACA,QACA,aACU;AACV,QAAM,aAAuB,CAAC;AAC9B,MAAI,QAAQ,UAAU,aAAa;AACjC,eAAW,KAAK,qCAAqC,MAAM,IAAI,QAAQ,IAAI,EAAE;AAAA,EAC/E;AAaA,MACE,QAAQ,oBACP,QAAQ,WACP,QAAQ,kBAAkB,SAC1B,QAAQ,oBAAoB,SAC5B,QAAQ,kBAAkB,QAC5B;AACA,eAAW,KAAK,mBAAmB,MAAM,IAAI,QAAQ,IAAI,qCAAqC;AAAA,EAChG;AACA,SAAO;AACT;AA4HO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAC5C;AAAA,EAET,YAAY,YAA+B;AACzC,UAAM,0CAA0C,WAAW,KAAK,IAAI,CAAC,EAAE;AACvE,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAGO,SAAS,uCAAuC,OAAyB;AAC9E,QAAM,OAAO,oBAAI,IAAa;AAC9B,MAAI,UAAU;AACd,SAAO,mBAAmB,SAAS,CAAC,KAAK,IAAI,OAAO,GAAG;AACrD,SAAK,IAAI,OAAO;AAChB,QAAI,mBAAmB,4BAA6B,QAAO;AAC3D,UAAM,OAAQ,QAAuC;AAGrD,QACE,OAAO,SAAS,YAChB,CAAC,SAAS,SAAS,SAAS,SAAS,SAAS,OAAO,EAAE,SAAS,IAAI,GACpE;AACA,aAAO;AAAA,IACT;AACA,cAAU,QAAQ;AAAA,EACpB;AACA,SAAO;AACT;AAkBA,SAAS,WAAc,QAAsB;AAC3C,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,EACT;AACA,QAAM,OAAQ,QAAsC;AACpD,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,qEAAqE;AACvF;AAEA,SAAS,OAAO,QAAoC;AAClD,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACtD;AAEA,SAAS,WAAW,MAA2B,OAAsC;AACnF,SAAO,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAC9D;AAGA,eAAsB,8BACpB,IACA,SACiC;AACjC,QAAM,eAAe,QAAQ,cAAc,KAAK,KAAK;AAErD,SAAO,MAAM,GAAG;AAAA,IACd,OAAO,OAAO;AACZ,YAAM,eAAe;AAAA,QAOnB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAwBhB;AAAA,MACH;AACA,YAAM,WAAW,aAAa,CAAC;AAC/B,UAAI,CAAC,UAAU;AACb,cAAM,IAAI,MAAM,wEAAwE;AAAA,MAC1F;AAEA,YAAM,iBAA0C;AAAA,QAC9C,aAAa,SAAS;AAAA,QACtB,aAAa,SAAS;AAAA,QACtB,eAAe,SAAS;AAAA,QACxB,oBAAoB,SAAS;AAAA,QAC7B,qBAAqB,SAAS;AAAA,QAC9B,aAAa,SAAS;AAAA,QACtB,UAAU,SAAS;AAAA,QACnB,WAAW,SAAS;AAAA,QACpB,SAAS,SAAS;AAAA,QAClB,YAAY,SAAS;AAAA,QACrB,gBAAgB,SAAS;AAAA,QACzB,aAAa,SAAS;AAAA,QACtB,WAAW,SAAS;AAAA,MACtB;AAEA,YAAM,8CACJ,SAAS,iCAAiC;AAO5C,YAAM,6BAA6B;AAAA,QACjC,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCAMW,KAAK;AAAA,UAC7B,wBAAwB,IAAI,CAAC,EAAE,QAAQ,UAAU,OAAO;AAAA,YACtD,aAAa,WAAW,WAAW,eAAe;AAAA,YAClD,cAAc,UAAU,MAAM,GAAG,UAAU,QAAQ,GAAG,CAAC;AAAA,UACzD,EAAE;AAAA,QACJ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCAOyB,KAAK;AAAA,UAC7B;AAAA,QACF,CAAC;AAAA;AAAA,8BAEmB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCAMN,KAAK;AAAA,UAC7B;AAAA,QACF,CAAC;AAAA;AAAA,8BAEmB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,oCAKN,KAAK;AAAA,UAC7B,+BAA+B,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO;AAAA,YACxD,aAAa;AAAA,YACb,eAAe;AAAA,UACjB,EAAE;AAAA,QACJ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,SAKF;AAAA,MACH,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM;AACzB,YAAM,4CACJ,SAAS,qCAAqC;AAGhD,YAAM,sCACJ,SAAS,2BAA2B,OAChC;AAAA,QACE,MAAM,GAAG,QAAQ,qDAAqD,KAAK;AAAA,UACzE,OAAO,KAAK,wCAAwC;AAAA,QACtD,CAAC;AAAA;AAAA,kCAEmB;AAAA,MACtB,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,IAC3B,CAAC;AAKP,UAAI,QAAQ,gBAAgB,UAAU;AACpC,eAAO;AAAA,UACL,UAAU;AAAA,UACV,aAAa,CAAC;AAAA,UACd,SAAS,CAAC;AAAA,UACV,cAAc,CAAC;AAAA,UACf,gBAAgB,CAAC;AAAA,UACjB,QAAQ,CAAC;AAAA,UACT,eAAe,CAAC;AAAA,UAChB,gBAAgB,CAAC;AAAA,UACjB,iBAAiB,CAAC;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,mBAAmB;AAAA,QACvB,MAAM,GAAG,QAAQ,IAAI,IAAI,8BAA8B,cAAc,CAAC,CAAC;AAAA,MACzE;AACA,YAAM,cAAc,0BAA0B,gBAAgB,EAAE;AAEhE,YAAM,UAAU;AAAA,QAMd,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAOO,YAAY;AAAA;AAAA,SAEnC;AAAA,MACH;AAEA,YAAM,eAAe;AAAA,QACnB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAQhB;AAAA,MACH,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;AAEvB,YAAM,iBAAiB;AAAA,QACrB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAUhB;AAAA,MACH,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;AAIvB,YAAM,YAAY;AAAA,QAqBhB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAmCO,YAAY;AAAA;AAAA;AAAA,SAGnC;AAAA,MACH;AACA,YAAM,SAAS,UACZ,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,iBAAiB,kBAAkB,EAC1E,IAAI,CAAC,SAAS;AAAA,QACb,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,YAAY,IAAI;AAAA,QAChB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,gCAAgC,IAAI;AAAA,QACpC,4BAA4B,IAAI;AAAA,QAChC,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI;AAAA,QACb,kBAAkB,IAAI;AAAA,QACtB,iBAAiB,IAAI;AAAA,QACrB,gBAAgB,IAAI;AAAA,MACtB,EAAE;AAEJ,YAAM,gBAAgB,UACnB,OAAO,CAAC,QAAQ,IAAI,cAAc,EAClC,IAAI,CAAC,SAAS;AAAA,QACb,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,YAAY,IAAI;AAAA,QAChB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI;AAAA,QACb,GAAI,IAAI,kBAAkB,SAAS,EAAE,iBAAiB,IAAI,iBAAiB,IAAI,CAAC;AAAA,QAChF,kBAAkB,IAAI;AAAA,QACtB,gBAAgB,IAAI;AAAA,MACtB,EAAE;AAEJ,YAAM,cAAc;AAAA,QAWlB,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAkBO,YAAY;AAAA;AAAA;AAAA,SAGnC;AAAA,MACH;AACA,YAAM,iBAAiB,YACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,iBAAiB,kBAAkB,EAC1E,IAAI,CAAC,SAAS;AAAA,QACb,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,SAAS,IAAI;AAAA,QACb,eAAe,IAAI;AAAA,QACnB,iBAAiB,IAAI;AAAA,QACrB,iBAAiB,IAAI;AAAA,QACrB,eAAe,IAAI;AAAA,QACnB,eAAe,IAAI;AAAA,MACrB,EAAE,EACD,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAE5D,YAAM,kBAAkB,YACrB,OAAO,CAAC,QAAQ,IAAI,cAAc,EAClC,IAAI,CAAC,SAAS;AAAA,QACb,MAAM,IAAI;AAAA,QACV,OAAO,IAAI;AAAA,QACX,SAAS,IAAI;AAAA,QACb,eAAe,IAAI;AAAA,QACnB,iBAAiB,IAAI;AAAA,QACrB,iBAAiB,IAAI;AAAA,QACrB,eAAe,IAAI;AAAA,QACnB,eAAe,IAAI;AAAA,MACrB,EAAE;AAEJ,YAAM,4BAA4B;AAAA,QAChC,MAAM,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAWhB;AAAA,MACH;AACA,aAAO;AAAA,QACL,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,EAAE,gBAAgB,mBAAmB,YAAY,YAAY;AAAA,EAC/D;AACF;AAGO,IAAM,6CAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,mCAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,0BAA0B,oBAAI,IAAY;AAAA;AAAA;AAAA,EAG9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAMD,IAAM,+BAA+B,oBAAI,IAAY;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AAAA,EACH;AACF,CAAC;AAGM,SAAS,+BACd,gBACA,SACU;AAGV,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,eAAe,eAAe,cAAc,IAAI,CAAC,UAAU;AACzD,UAAI,CAAC,wBAAwB,IAAI,MAAM,IAAI,EAAG,QAAO;AACrD,YAAM,cAAc,6BAA6B,IAAI,MAAM,IAAI;AAC/D,aAAO;AAAA,QACL,GAAG;AAAA,QACH,QACE,MAAM,UAAW,eAAe,MAAM,kBAAkB,SAAS,QAAQ,KAAM;AAAA,QACjF,QACE,MAAM,UAAW,eAAe,MAAM,kBAAkB,SAAS,QAAQ,KAAM;AAAA,QACjF,QACE,MAAM,UAAW,eAAe,MAAM,kBAAkB,SAAS,QAAQ,KAAM;AAAA,QACjF,YAAY,MAAM,cAAc,MAAM,kBAAkB,SAAS,YAAY,KAAK;AAAA,MACpF;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,aAAuB,CAAC;AAC9B,QAAM,WAAW,QAAQ;AAKzB,aAAW,UAAU,QAAQ,4BAA4B;AACvD,eAAW,KAAK,mCAAmC,MAAM,CAAC;AAAA,EAC5D;AAEA,MAAI,CAAC,QAAQ;AACX,eAAW;AAAA,MACT;AAAA,IACF;AACF,aAAW,CAAC,UAAU,SAAS,KAAK,OAAO,QAAQ,wCAAwC,GAAG;AAC5F,QAAI,CAAC,QAAQ,oCAAoC,SAAS,QAAQ,GAAG;AACnE,iBAAW;AAAA,QACT,2BAA2B,QAAQ,uCAAuC,SAAS;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,6CAA6C;AACxD,eAAW,KAAK,8EAA8E;AAAA,EAChG;AAEA,MAAI,CAAC,SAAS,eAAe,CAAC,SAAS,aAAa;AAClD,eAAW,KAAK,4BAA4B;AAAA,EAC9C;AACA,MAAI,SAAS,gBAAgB,SAAS,aAAa;AACjD,eAAW;AAAA,MACT,gBAAgB,SAAS,WAAW,gCAAgC,SAAS,WAAW;AAAA,IAC1F;AAAA,EACF;AACA,MAAI,CAAC,SAAS,oBAAoB;AAChC,eAAW,KAAK,oDAAoD;AAAA,EACtE;AAEA,MAAI,QAAQ,gBAAgB,UAAU;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,QAAQ,cAAc,KAAK,KAAK;AACrD,QAAM,eAAe,QAAQ,cAAc,KAAK,KAAK;AACrD,QAAM,kBAAkB,IAAI,IAAI,QAAQ,mBAAmB,gBAAgB;AAC3E,QAAM,kBAAkB,QAAQ,mBAAmB;AACnD,QAAM,4BAA4B,IAAI;AAAA,IACpC,OAAO,QAAQ,qCAAqC,EACjD,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,oCAAoC,SAAS,QAAQ,CAAC,EACtF,QAAQ,CAAC,CAAC,EAAE,MAAM,MAAM,MAAM;AAAA,EACnC;AACA,QAAM,sBAAsB,IAAI,IAAI,OAAO,KAAK,eAAe,CAAC;AAChE,QAAM,6BAA6B,IAAI;AAAA,IACrC,QAAQ,+BACL,QAAQ,kBAAkB,CAAC,IAAI;AAAA,EACpC;AACA,QAAM,iCACJ,QAAQ,kCAAkC;AAC5C,QAAM,gCACJ,QAAQ,iCAAiC;AAC3C,QAAM,cAAc,oBAAI,IAAI;AAAA,IAC1B,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL,CAAC;AACD,QAAM,sBAAsB,oBAAI,IAAI;AAAA,IAClC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL,CAAC;AACD,QAAM,yBAAyB,IAAI;AAAA,IACjC,QAAQ,OACL;AAAA,MACC,CAAC,UAAU,CAAC,YAAY,IAAI,MAAM,IAAI,KAAK,2BAA2B,OAAO,YAAY;AAAA,IAC3F,EACC,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,EAC9B;AAEA,MAAI,SAAS,gBAAgB,gBAAgB,SAAS,gBAAgB,cAAc;AAClF,eAAW;AAAA,MACT,4BAA4B,YAAY,kBAAkB,SAAS,WAAW,kBAAkB,SAAS,WAAW;AAAA,IACtH;AAAA,EACF;AACA,MAAI,CAAC,SAAS,SAAU,YAAW,KAAK,2BAA2B;AACnE,MAAI,SAAS,UAAW,YAAW,KAAK,2BAA2B;AACnE,MAAI,SAAS,UAAW,YAAW,KAAK,4BAA4B;AACpE,MAAI,SAAS,WAAY,YAAW,KAAK,6BAA6B;AACtE,MAAI,SAAS,eAAgB,YAAW,KAAK,2BAA2B;AACxE,MAAI,SAAS,YAAa,YAAW,KAAK,8BAA8B;AACxE,MAAI,SAAS,QAAS,YAAW,KAAK,gCAAgC;AACtE,MAAI,SAAS,kBAAkB,aAAc,YAAW,KAAK,gCAAgC;AAC7F,MAAI,SAAS,qBAAqB;AAChC,eAAW,KAAK,iDAAiD;AAAA,EACnE;AACA,MAAI,SAAS,YAAY,YAAY,MAAM,MAAM;AAC/C,eAAW,KAAK,mBAAmB,SAAS,WAAW,eAAe;AAAA,EACxE;AACA,MAAI,QAAQ,YAAY,SAAS,GAAG;AAClC,eAAW,KAAK,iCAAiC,OAAO,QAAQ,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EAC3F;AACA,MAAI,QAAQ,aAAa,SAAS,GAAG;AACnC,eAAW,KAAK,8BAA8B,OAAO,QAAQ,YAAY,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EACzF;AACA,MAAI,QAAQ,eAAe,SAAS,GAAG;AACrC,eAAW,KAAK,gCAAgC,OAAO,QAAQ,cAAc,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7F;AAEA,aAAW,cAAc,oBAAI,IAAI,CAAC,cAAc,kBAAkB,CAAC,GAAG;AACpE,UAAM,SAAS,QAAQ,QAAQ,KAAK,CAAC,cAAc,UAAU,SAAS,UAAU;AAChF,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,mBAAmB,UAAU,aAAa;AAC1D;AAAA,IACF;AACA,QAAI,OAAO,UAAU,cAAc;AACjC,iBAAW,KAAK,4BAA4B,UAAU,EAAE;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,MAAO,YAAW,KAAK,sCAAsC,UAAU,EAAE;AACrF,QAAI,OAAO,OAAQ,YAAW,KAAK,qCAAqC,UAAU,EAAE;AAAA,EACtF;AAEA,QAAM,cAAc,IAAI,IAAI,QAAQ,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;AAC9E,aAAW,SAAS,QAAQ,eAAe;AACzC,QAAI,wBAAwB,IAAI,MAAM,IAAI,GAAG;AAG3C,YAAM,cAAc,oBAAI,IAAI;AAAA,QAC1B,GAAI,MAAM,SAAS,CAAC,QAAQ,IAAI,CAAC;AAAA,QACjC,GAAI,MAAM,SAAS,CAAC,QAAQ,IAAI,CAAC;AAAA,QACjC,GAAI,MAAM,SAAS,CAAC,QAAQ,IAAI,CAAC;AAAA,QACjC,GAAI,MAAM,aAAa,CAAC,YAAY,IAAI,CAAC;AAAA,MAC3C,CAAC;AACD,UAAI,MAAM,kBAAkB,KAAK,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS,CAAC,GAAG;AAC5E,mBAAW,KAAK,iBAAiB,MAAM,IAAI,+BAA+B;AAAA,MAC5E;AACA;AAAA,IACF;AACA,QAAI,MAAM,gBAAgB;AACxB,iBAAW;AAAA,QACT,yBAAyB,MAAM,IAAI;AAAA,MACrC;AAAA,IACF;AACA,QAAI,MAAM,UAAU,cAAc;AAChC,iBAAW,KAAK,mCAAmC,MAAM,IAAI,EAAE;AAAA,IACjE;AACA,SACG,MAAM,UACL,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,YACN,MAAM,cACN,MAAM,WACN,MAAM,iBAAiB,UACvB,MAAM,kBAAkB,YACzB,CAAC,2BAA2B,OAAO,YAAY,KAC9C,MAAM,YACN,MAAM,cACN,MAAM,WACN,MAAM,iBAAiB,UACvB,MAAM,kBAAkB,SAAS,YAAY,IAC/C;AACA,iBAAW,KAAK,yBAAyB,MAAM,IAAI,gCAAgC;AAAA,IACrF;AAAA,EACF;AACA,MACE,CAAC,QAAQ,mBACT,CAAC,QAAQ,gBAAgB;AAAA,IACvB,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC,GACA;AACA,eAAW,KAAK,oDAAoD;AAAA,EACtE;AACA,MACE,CAAC,QAAQ,mBACT,CAAC,QAAQ,gBAAgB;AAAA,IACvB,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC,GACA;AACA,eAAW,KAAK,sDAAsD;AAAA,EACxE;AACA,QAAM,qBAAqB,QAAQ,QAAQ;AAAA,IACzC,CAAC,WAAW,OAAO,SAAS;AAAA,EAC9B,GAAG;AACH,QAAM,qBAAqB,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AACjE,QAAM,uBAAuB,oBAAI,IAAI;AAAA,IACnC,2BAA2B,kBAAkB;AAAA,IAC7C,2BAA2B,qBAAqB,KAAK,YAAY,IAAI,eAAe,kBAAkB;AAAA,EACxG,CAAC;AACD,QAAM,iBAAiB,CAAC,YACtB,QAAQ,SAAS,gEACjB,QAAQ,SAAS,oEACb,QAAQ,eAAe,SAAS,mDAAmD,IACnF,QAAQ,eAAe,KAAK,CAAC,kBAAkB,qBAAqB,IAAI,aAAa,CAAC;AAC5F,QAAM,yBAAyB,CAAC,YAC9B,QAAQ,WAAW,KACnB,QAAQ,CAAC,EAAG,WACZ,CAAC,QAAQ,CAAC,EAAG,iBACb,QAAQ,CAAC,EAAG,mBACZ,EAAE,sBAAsB,QAAQ,CAAC,EAAG,UAAU,uBAC9C,eAAe,QAAQ,CAAC,CAAE,MAAM;AAClC,aAAW,mBAAmB,4CAA4C;AACxE,UAAM,UAAU,QAAQ,gBAAgB,OAAO,CAAC,YAAY,QAAQ,SAAS,eAAe;AAC5F,QAAI,CAAC,uBAAuB,OAAO,GAAG;AACpC,iBAAW;AAAA,QACT,6CAA6C,eAAe;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AACA,aAAW,aAAa,6CAA6C;AACnE,UAAM,UAAU,CAAC,GAAG,QAAQ,iBAAiB,GAAI,QAAQ,6BAA6B,CAAC,CAAE,EAAE;AAAA,MACzF,CAAC,cAAc,UAAU,SAAS;AAAA,IACpC;AACA,QAAI,YAAY,QAAQ,WAAW,QAAQ,gBAAgB;AACzD,iBAAW,KAAK,8CAA8C,SAAS,gBAAgB;AAAA,IACzF;AAAA,EACF;AACA,QAAM,wBAAwB,CAAC,WAC7B,QAAQ,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,WAAW,MAAM,CAAC;AAG3E,MACE,QAAQ,8BAA8B,UACtC,sBAAsB,qCAAqC,GAC3D;AACA,UAAM,WAAW;AAAA;AAAA,MAEf;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,MACH,GAAI,QAAQ,gBAAgB;AAAA,QAAK,CAAC,YAChC,QAAQ,KAAK,WAAW,0CAA0C;AAAA,MACpE,IACI,6CACA,CAAC;AAAA,MACL,GAAI,QAAQ,gBAAgB;AAAA,QAAK,CAAC,YAChC,QAAQ,KAAK,WAAW,qCAAqC;AAAA,MAC/D,IACI,+CACA,CAAC;AAAA;AAAA;AAAA,MAGL,GAAI,QAAQ,0BAA0B;AAAA,QAAK,CAAC,YACzC,4CAAkE,SAAS,QAAQ,IAAI;AAAA,MAC1F,IACI,8CACA,CAAC;AAAA,IACP;AACA,eAAW,aAAa,UAAU;AAChC,YAAM,UAAU,QAAQ,0BAA0B;AAAA,QAChD,CAAC,YAAY,QAAQ,SAAS;AAAA,MAChC;AACA,UACE,QAAQ,WAAW,KACnB,QAAQ,CAAC,EAAG,UAAU,sBACtB,QAAQ,CAAC,EAAG,WACZ,QAAQ,CAAC,EAAG,iBACZ,CAAC,QAAQ,CAAC,EAAG,eAAe;AAAA,QAC1B,CAAC,UACC,qBAAqB,IAAI,KAAK,KAC9B,UAAU,2BAA2B,YAAY,eACjD,UAAU,2BAA2B,kBAAkB;AAAA,MAC3D,GACA;AACA,mBAAW,KAAK,qCAAqC,SAAS,uBAAuB;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,IAAI,mCAAmC,GAAG;AACxD,eAAW,QAAQ;AAAA,MACjB;AAAA,MACA;AAAA,IACF,GAAG;AACD,YAAM,WAAW,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,IAAI;AAClF,YAAM,eAAe,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AAC3D,YAAM,cAAc,oBAAI,IAAI;AAAA,QAC1B,2BAA2B,YAAY;AAAA,QACvC,2BAA2B,YAAY;AAAA,MACzC,CAAC;AACD,YAAM,UAAU,SAAS,CAAC;AAC1B,UACE,SAAS,WAAW,KACpB,CAAC,SAAS,WACV,QAAQ,iBACR,CAAC,QAAQ,mBACT,CAAC,QAAQ,eAAe,KAAK,CAAC,kBAAkB,YAAY,IAAI,aAAa,CAAC,KAC9E;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,CAAC,UAAU,YAAY,IAAI,KAAK,GAAG,UAAU,QAAQ,KAAK,GACjE;AACA,mBAAW,KAAK,0EAA0E;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,QAAM,kBAAkB,IAAI;AAAA,IAC1B,QAAQ,OAAO,OAAO,CAAC,UAAU,MAAM,UAAU,EAAE,IAAI,CAAC,UAAU,MAAM,IAAI;AAAA,EAC9E;AACA,QAAM,4BAA4B,oBAAI,IAAI;AAAA,IACxC,GAAG;AAAA,IACH,GAAG;AAAA,EACL,CAAC;AACD,QAAM,8BAA8B,WAAW,iBAAiB,yBAAyB;AACzF,MAAI,4BAA4B,SAAS,GAAG;AAC1C,eAAW;AAAA,MACT,sDAAsD,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC9F;AAAA,EACF;AACA,QAAM,8BAA8B;AAAA,IAClC;AAAA,IACA,IAAI,IAAI,CAAC,GAAG,0BAA0B,EAAE,OAAO,CAAC,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC,CAAC;AAAA,EAC5F;AACA,MAAI,4BAA4B,SAAS,GAAG;AAC1C,eAAW;AAAA,MACT,mEAAmE,4BAA4B,KAAK,IAAI,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,QAAM,gCAAgC,WAAW,4BAA4B,eAAe;AAC5F,MAAI,8BAA8B,SAAS,GAAG;AAC5C,eAAW;AAAA,MACT,gEAAgE,8BAA8B,KAAK,IAAI,CAAC;AAAA,IAC1G;AAAA,EACF;AACA,QAAM,gBAAgB,IAAI,IAAI,YAAY,KAAK,CAAC;AAChD,QAAM,uBAAuB,WAAW,qBAAqB,aAAa;AAC1E,MAAI,qBAAqB,SAAS,GAAG;AACnC,eAAW,KAAK,yCAAyC,qBAAqB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC5F;AACA,QAAM,gBAAgB,WAAW,iBAAiB,aAAa;AAC/D,MAAI,cAAc,SAAS,GAAG;AAC5B,eAAW,KAAK,iCAAiC,cAAc,KAAK,IAAI,CAAC,EAAE;AAAA,EAC7E;AACA,QAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,sBAAsB,CAAC;AAAA,EACzD;AACA,MAAI,oBAAoB,SAAS,GAAG;AAClC,eAAW;AAAA,MACT,qDAAqD,oBAAoB,KAAK,IAAI,CAAC;AAAA,IACrF;AAAA,EACF;AAEA,aAAW,SAAS,QAAQ,QAAQ;AAGlC,QAAI,CAAC,YAAY,IAAI,MAAM,IAAI,KAAK,MAAM,gBAAgB;AACxD,iBAAW,KAAK,iBAAiB,MAAM,IAAI,+CAA+C;AAAA,IAC5F;AACA,UAAM,aAAa;AAAA,MACjB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,YAAY,MAAM,QAAQ;AAAA,MAC3B,CAAC,cAAc,MAAM,UAAU;AAAA,MAC/B,CAAC,WAAW,MAAM,OAAO;AAAA,IAC3B;AACA,UAAM,qBAAqB,IAAI,IAAY,gBAAgB,MAAM,IAAI,KAAK,CAAC,CAAC;AAI5E,UAAM,sBAAsB,IAAI,IAAY,kBAAkB;AAC9D,QAAI,0BAA0B,IAAI,MAAM,IAAI,GAAG;AAC7C,iBAAW,aAAa,oBAAqB,qBAAoB,IAAI,SAAS;AAAA,IAChF;AACA,QAAI,uBAAuB,IAAI,MAAM,IAAI,GAAG;AAE1C,iBAAW,aAAa,oBAAqB,qBAAoB,IAAI,SAAS;AAAA,IAChF;AACA,QAAI,MAAM,UAAU,cAAc;AAChC,iBAAW,KAAK,2BAA2B,MAAM,IAAI,EAAE;AAAA,IACzD;AACA,UAAM,oBAAoB,WACvB,OAAO,CAAC,CAAC,WAAW,OAAO,MAAM,mBAAmB,IAAI,SAAS,KAAK,CAAC,OAAO,EAC9E,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACjC,QAAI,kBAAkB,SAAS,GAAG;AAChC,iBAAW;AAAA,QACT,SAAS,MAAM,IAAI,uCAAuC,kBAAkB,KAAK,IAAI,CAAC;AAAA,MACxF;AAAA,IACF;AACA,UAAM,mBAA6B,WAChC;AAAA,MACC,CAAC,CAAC,WAAW,OAAO,MAClB,CAAC,oBAAoB,IAAI,SAAS,MACjC,WAAW,MAAM,kBAAkB,SAAS,SAAS;AAAA,IAC1D,EACC,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACjC,qBAAiB,KAAK,GAAI,MAAM,mBAAmB,CAAC,CAAE;AACtD,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,SAAS,MAAM,IAAI,sCAAsC,iBAAiB,KAAK,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AAEA,aAAW,aAAa,iBAAiB;AACvC,UAAM,QAAQ,YAAY,IAAI,SAAS;AACvC,QAAI,CAAC,MAAO;AACZ,QAAI,CAAC,MAAM,WAAY,YAAW,KAAK,SAAS,SAAS,sBAAsB;AAC/E,QAAI,CAAC,MAAM,UAAW,YAAW,KAAK,SAAS,SAAS,qBAAqB;AAC7E,QAAI,CAAC,MAAM,UAAW,YAAW,KAAK,SAAS,SAAS,oCAAoC;AAC5F,QAAI,MAAM,cAAc,EAAG,YAAW,KAAK,SAAS,SAAS,oBAAoB;AAAA,EACnF;AAEA,QAAM,oBAAoB,QAAQ,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,YAAY,GAAG;AAC1F,aAAW,WAAW,QAAQ,gBAAgB;AAC5C,QAAI,CAAC,oBAAoB,IAAI,QAAQ,IAAI,GAAG;AAC1C,iBAAW,KAAK,GAAG,yBAAyB,SAAS,cAAc,YAAY,CAAC;AAAA,IAClF;AAAA,EACF;AACA,aAAW,oBAAoB,+BAA+B;AAC5D,UAAM,UAAU,QAAQ,eAAe,OAAO,CAACA,aAAYA,SAAQ,SAAS,gBAAgB;AAC5F,QAAI,QAAQ,WAAW,GAAG;AACxB,iBAAW;AAAA,QACT,uCAAuC,gBAAgB;AAAA,MACzD;AACA;AAAA,IACF;AACA,UAAM,UAAU,QAAQ,CAAC;AACzB,UAAM,UAAU,0CAA0C,IAAI,QAAQ,IAAI;AAC1E,QAAI,QAAQ,oBAAoB,SAAS;AACvC,iBAAW;AAAA,QACT,uCAAuC,QAAQ,IAAI,oBAAoB,UAAU,YAAY,SAAS;AAAA,MACxG;AAAA,IACF;AACA,UAAM,iBAAiB,YAAY,IAAI,UAAU,GAAG,SAAS;AAC7D,QAAI,kBAAkB,QAAQ,UAAU,gBAAgB;AACtD,iBAAW;AAAA,QACT,uCAAuC,QAAQ,IAAI,UAAU,QAAQ,KAAK,2CAA2C,cAAc;AAAA,MACrI;AAAA,IACF;AACA,QAAI,QAAQ,SAAS;AACnB,iBAAW,KAAK,oDAAoD,QAAQ,IAAI,EAAE;AAAA,IACpF;AACA,QAAI,QAAQ,eAAe;AACzB,iBAAW,KAAK,8CAA8C,QAAQ,IAAI,EAAE;AAAA,IAC9E;AAAA,EACF;AACA,aAAW,mBAAmB,gCAAgC;AAC5D,UAAM,UAAU,QAAQ,eAAe,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC3F,QAAI,QAAQ,WAAW,GAAG;AACxB,iBAAW;AAAA,QACT,oCAAoC,eAAe;AAAA,MACrD;AACA;AAAA,IACF;AACA,UAAM,UAAU,QAAQ,CAAC;AACzB,QAAI,0CAA0C,IAAI,QAAQ,IAAI,GAAG;AAC/D,UAAI,QAAQ,iBAAiB;AAC3B,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF;AAAA,IACF,WAAW,CAAC,QAAQ,iBAAiB;AACnC,iBAAW,KAAK,oCAAoC,QAAQ,IAAI,0BAA0B;AAAA,IAC5F;AACA,QACE,QAAQ,KAAK,WAAW,kBAAkB,KAC1C,QAAQ,SAAS,+CACjB;AACA,YAAM,SAAS,IAAI;AAAA,QACjB,iCAAiC;AAAA,UAC/B,CAAC,SAAS,QAAQ,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,IAAI,GAAG;AAAA,QACxE;AAAA,MACF;AACA,WACG,CAAC,QAAQ,mBACR,QAAQ,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,8BAA8B,OACpF,OAAO,SAAS,KAAK,OAAO,IAAI,MAAS,KAAK,CAAC,OAAO,IAAI,QAAQ,KAAK,IACxE;AACA,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF;AAAA,IACF,WAAY,qCAA2D,SAAS,QAAQ,IAAI,GAAG;AAC7F,YAAM,SAAS,IAAI;AAAA,QACjB,2CAA2C;AAAA,UACzC,CAAC,SAAS,QAAQ,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,IAAI,GAAG;AAAA,QACxE;AAAA,MACF;AACA,WACG,CAAC,QAAQ,mBACR,QAAQ,cAAc;AAAA,QACpB,CAAC,UAAU,MAAM,SAAS;AAAA,MAC5B,OACD,OAAO,SAAS,KAAK,OAAO,IAAI,MAAS,KAAK,CAAC,OAAO,IAAI,QAAQ,KAAK,IACxE;AACA,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF;AAAA,IACF,WACE,QAAQ,SAAS,2CACjB,QAAQ,SAAS,wCACjB;AACA,YAAM,yBAAyB,8BAA8B;AAAA,QAC3D,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,8BAA8B;AAAA,UACpD,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACG,wCAA8D,SAAS,QAAQ,IAAI,GACpF;AACA,YAAM,QAAQ,YAAY,IAAI,iCAAiC;AAC/D,WAAK,CAAC,QAAQ,mBAAmB,WAAW,CAAC,SAAS,MAAM,UAAU,QAAQ,QAAQ;AACpF,mBAAW;AAAA,UACT,qCAAqC,QAAQ,IAAI;AAAA,QACnD;AAAA,MACF;AAAA,IACF,WAAY,mCAAyD,SAAS,QAAQ,IAAI,GAAG;AAC3F,YAAM,kBAAkB;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,WACG,CAAC,QAAQ,mBAAmB,gBAAgB,KAAK,CAAC,SAAS,YAAY,IAAI,IAAI,CAAC,MACjF,gBAAgB;AAAA,QACd,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,EAAG,UAAU,QAAQ;AAAA,MAC/E,GACA;AACA,mBAAW;AAAA,UACT,gCAAgC,QAAQ,IAAI;AAAA,QAC9C;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,SAAS,kCAAkC;AAC5D,YAAM,UAAU,+BAA+B,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC;AACtF,UAAI,QAAQ,SAAS,GAAG;AACtB,mBAAW,KAAK,+CAA+C,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,MACrF,WACE,+BAA+B;AAAA,QAC7B,CAAC,SAAS,YAAY,IAAI,IAAI,EAAG,UAAU,QAAQ;AAAA,MACrD,GACA;AACA,mBAAW;AAAA,UACT,4BAA4B,QAAQ,IAAI;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,SAAS,8CAA8C;AACxE,YAAM,yBAAyB,4CAA4C;AAAA,QACzE,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,4CAA4C;AAAA,UAClE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACE;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,QAAQ,IAAI,GACvB;AACA,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,UACE,MAAM;AAAA,QACJ,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,EAAG,UAAU,QAAQ;AAAA,MAC/E,GACA;AACA,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF;AAAA,IACF,WACE;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,QAAQ,IAAI,GACvB;AACA,YAAM,QACJ,QAAQ,SAAS,+CACb,CAAC,2BAA2B,uBAAuB,0BAA0B,IAC7E;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACN,YAAM,UAAU,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI,CAAC;AAC7D,UAAI,QAAQ,SAAS,GAAG;AACtB,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,QAAQ,KAAK,IAAI,CAAC;AAAA,QACtG;AAAA,MACF,WAAW,MAAM,KAAK,CAAC,SAAS,YAAY,IAAI,IAAI,EAAG,UAAU,QAAQ,KAAK,GAAG;AAC/E,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,SAAS,0CAA0C;AACpE,YAAM,kBAAkB,kDAAkD;AAAA,QACxE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,MAC1C,EAAE,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAE;AAChD,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,OAAO,GAAG;AAC5B,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,QACpK;AAAA,MACF,WAAW,gBAAgB,CAAC,KAAK,QAAQ,UAAU,gBAAgB,CAAC,EAAE,OAAO;AAC3E,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAE,KAAK;AAAA,QAC1I;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,SAAS,sCAAsC;AAChE,UAAI,CAAC,YAAY,IAAI,qCAAqC,GAAG;AAC3D;AAAA,MACF;AACA,YAAM,yBAAyB,8CAA8C;AAAA,QAC3E,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,8CAA8C;AAAA,UACpE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACE,sCAAsC;AAAA,MACpC,QAAQ;AAAA,IACV,GACA;AACA,UAAI,CAAC,YAAY,IAAI,qCAAqC,EAAG;AAC7D,YAAM,yBAAyB,8CAA8C;AAAA,QAC3E,CAAC,SAAS,CAAC,YAAY,IAAI,IAAI;AAAA,MACjC;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,8CAA8C;AAAA,UACpE,CAAC,SAAS,YAAY,IAAI,IAAI;AAAA,QAChC;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,KAAK,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AAC7E,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI;AAAA,UAClD;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACE,sCAAsC;AAAA,MACpC,QAAQ;AAAA,IACV,GACA;AACA,UAAI,CAAC,YAAY,IAAI,uCAAuC,GAAG;AAC7D;AAAA,MACF;AACA,YAAM,yBAAyB,8CAA8C;AAAA,QAC3E,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,8CAA8C;AAAA,UACpE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACE,qCAAqC;AAAA,MACnC,QAAQ;AAAA,IACV,GACA;AACA,YAAM,yBAAyB,6CAA6C;AAAA,QAC1E,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,6CAA6C;AAAA,UACnE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,SAAS,0CAA0C;AACpE,YAAM,yBAAyB,kDAAkD;AAAA,QAC/E,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,kDAAkD;AAAA,UACxE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACG,2CAAiE,SAAS,QAAQ,IAAI,GACvF;AACA,YAAM,yBAAyB,mDAAmD;AAAA,QAChF,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,mDAAmD;AAAA,UACzE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACG,sCAA4D,SAAS,QAAQ,IAAI,GAClF;AACA,UAAI,CAAC,YAAY,IAAI,uCAAuC,GAAG;AAC7D;AAAA,MACF;AACA,YAAM,sBACJ,sDACE,QAAQ,IACV;AACF,YAAM,yBAAyB,oBAAoB;AAAA,QACjD,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,oBAAoB,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAE;AAC1F,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,8BAA8B,IAAI,QAAQ,IAAI,GAAG;AAI1D,iBAAW,QAAQ,oCAAoC;AACrD,cAAM,QAAQ,YAAY,IAAI,IAAI;AAClC,YAAI,CAAC,MAAO,YAAW,KAAK,6BAA6B,IAAI,aAAa;AAAA,iBACjE,QAAQ,UAAU,MAAM;AAC/B,qBAAW;AAAA,YACT,wBAAwB,QAAQ,IAAI,UAAU,QAAQ,KAAK,mBAAmB,IAAI,UAAU,MAAM,KAAK;AAAA,UACzG;AAAA,MACJ;AAAA,IACF,WAAW,QAAQ,SAAS,mDAAmD;AAC7E,YAAM,kBAAkB;AAAA,QACtB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,iBAAW,QAAQ,iBAAiB;AAClC,cAAM,QAAQ,YAAY,IAAI,IAAI;AAClC,YAAI,CAAC,MAAO,YAAW,KAAK,mCAAmC,IAAI,aAAa;AAAA,iBACvE,QAAQ,UAAU,MAAM;AAC/B,qBAAW;AAAA,YACT,yBAAyB,QAAQ,KAAK,mBAAmB,IAAI,UAAU,MAAM,KAAK;AAAA,UACpF;AAAA,MACJ;AAAA,IACF,WAAW,QAAQ,SAAS,uCAAuC;AACjE,UAAI,CAAC,YAAY,IAAI,4CAA4C,GAAG;AAClE;AAAA,MACF;AACA,YAAM,yBAAyB,+CAA+C;AAAA,QAC5E,CAAC,cAAc,CAAC,YAAY,IAAI,SAAS;AAAA,MAC3C;AACA,UAAI,uBAAuB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,kCAAkC,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACrH;AAAA,MACF,OAAO;AACL,cAAM,kBAAkB,+CAA+C;AAAA,UACrE,CAAC,cAAc,YAAY,IAAI,SAAS;AAAA,QAC1C;AACA,cAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,YAAI,gBAAgB,SAAS,GAAG;AAC9B,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,UACpK;AAAA,QACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,UAC3I;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAY,+BAAqD,SAAS,QAAQ,IAAI,GAAG;AACvF,YAAM,kBAAkB,uCAAuC;AAAA,QAAO,CAAC,cACrE,YAAY,IAAI,SAAS;AAAA,MAC3B,EAAE,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAE;AAChD,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,WAAW,uCAAuC,QAAQ;AAC5E,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF,WAAW,gBAAgB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,QACpK;AAAA,MACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,QAC3I;AAAA,MACF;AAAA,IACF,WAAY,kCAAwD,SAAS,QAAQ,IAAI,GAAG;AAC1F,YAAM,kBAAkB,0CAA0C;AAAA,QAAO,CAAC,cACxE,YAAY,IAAI,SAAS;AAAA,MAC3B,EAAE,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAE;AAChD,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,WAAW,0CAA0C,QAAQ;AAC/E,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF,WAAW,gBAAgB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,QACpK;AAAA,MACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,QAC3I;AAAA,MACF;AAAA,IACF,WAAY,kCAAwD,SAAS,QAAQ,IAAI,GAAG;AAC1F,YAAM,kBAAkB,0CAA0C;AAAA,QAAO,CAAC,cACxE,YAAY,IAAI,SAAS;AAAA,MAC3B,EAAE,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAE;AAChD,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,WAAW,0CAA0C,QAAQ;AAC/E,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF,WAAW,gBAAgB,SAAS,GAAG;AACrC,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,yCAAyC,gBAAgB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,QACpK;AAAA,MACF,WAAW,QAAQ,UAAU,gBAAgB,CAAC,EAAG,OAAO;AACtD,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,gBAAgB,CAAC,EAAG,KAAK;AAAA,QAC3I;AAAA,MACF;AAAA,IACF,WACG,8CAAoE,SAAS,QAAQ,IAAI,GAC1F;AACA,YAAM,kBAAkB,4CAA4C;AAAA,QAAI,CAAC,cACvE,YAAY,IAAI,SAAS;AAAA,MAC3B,EAAE,OAAO,CAAC,UAAwC,UAAU,MAAS;AACrE,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,OAAO,GAAG;AAC5B,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF,OAAO;AACL,cAAM,iBAAiB,gBAAgB,CAAC,GAAG,SAAS;AACpD,YAAI,kBAAkB,QAAQ,UAAU,gBAAgB;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,8DAA8D,cAAc;AAAA,UACrJ;AAAA,QACF;AAAA,MACF;AAAA,IACF,WACG,qCAA2D,SAAS,QAAQ,IAAI,KAChF,sCAA4D,SAAS,QAAQ,IAAI,GAClF;AACA,YAAM,iBAAiB,YAAY,IAAI,WAAW,GAAG,SAAS;AAC9D,UAAI,kBAAkB,QAAQ,UAAU,gBAAgB;AACtD,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,4CAA4C,cAAc;AAAA,QACnI;AAAA,MACF;AAAA,IACF,WAAY,gCAAsD,SAAS,QAAQ,IAAI,GAAG;AACxF,YAAM,kBAAkB,CAAC,2BAA2B,kCAAkC,EACnF,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAC,EAC7C,OAAO,CAAC,UAAwC,UAAU,MAAS;AACtE,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,OAAO,GAAG;AAC5B,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF,OAAO;AACL,cAAM,iBAAiB,gBAAgB,CAAC,GAAG,SAAS;AACpD,YAAI,kBAAkB,QAAQ,UAAU,gBAAgB;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,gDAAgD,cAAc;AAAA,UACvI;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAY,uBAA6C,SAAS,QAAQ,IAAI,GAAG;AAC/E,YAAM,kBAAkB,aAAa,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAC,EAAE;AAAA,QAClF,CAAC,UAAwC,UAAU;AAAA,MACrD;AACA,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,OAAO,GAAG;AAC5B,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF,OAAO;AACL,cAAM,iBAAiB,gBAAgB,CAAC,GAAG,SAAS;AACpD,YAAI,kBAAkB,QAAQ,UAAU,gBAAgB;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,yCAAyC,cAAc;AAAA,UAChI;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAY,kCAAwD,SAAS,QAAQ,IAAI,GAAG;AAC1F,YAAM,kBAAkB,CAAC,QAAQ,gBAAgB,eAAe,WAAW,EACxE,IAAI,CAAC,cAAc,YAAY,IAAI,SAAS,CAAC,EAC7C,OAAO,CAAC,UAAwC,UAAU,MAAS;AACtE,YAAM,kBAAkB,IAAI,IAAI,gBAAgB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC3E,UAAI,gBAAgB,OAAO,GAAG;AAC5B,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI;AAAA,QAClD;AAAA,MACF,OAAO;AACL,cAAM,iBAAiB,gBAAgB,CAAC,GAAG,SAAS;AACpD,YAAI,kBAAkB,QAAQ,UAAU,gBAAgB;AACtD,qBAAW;AAAA,YACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,kDAAkD,cAAc;AAAA,UACzI;AAAA,QACF;AAAA,MACF;AAAA,IACF,WAAW,2BAA2B,IAAI,QAAQ,IAAI,GAAG;AACvD,YAAM,iBAAiB,YAAY,IAAI,UAAU,GAAG,SAAS;AAC7D,UAAI,kBAAkB,QAAQ,UAAU,gBAAgB;AACtD,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,2CAA2C,cAAc;AAAA,QAClI;AAAA,MACF;AAAA,IACF,WAAW,QAAQ,SAAS,qCAAqC;AAG/D,YAAM,YAAY,YAAY,IAAI,iBAAiB,GAAG;AACtD,UAAI,aAAa,QAAQ,UAAU,WAAW;AAC5C,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,wCAAwC,SAAS;AAAA,QAC1H;AAAA,MACF;AAAA,IACF,WACE,QAAQ,SAAS,kCACjB,QAAQ,SAAS,mCACjB;AAAA,IAIF,WAAW,qBAAqB,QAAQ,UAAU,mBAAmB;AACnE,iBAAW;AAAA,QACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,gCAAgC,iBAAiB;AAAA,MAC1H;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS;AACpB,iBAAW,KAAK,+CAA+C,QAAQ,IAAI,EAAE;AAAA,IAC/E;AACA,UAAM,wBAAwB,0DAA0D;AAAA,MACtF,QAAQ;AAAA,IACV;AACA,QAAI,yBAAyB,CAAC,QAAQ,eAAe;AACnD,iBAAW,KAAK,iDAAiD,QAAQ,IAAI,EAAE;AAAA,IACjF,WAAW,CAAC,yBAAyB,QAAQ,eAAe;AAC1D,iBAAW,KAAK,iDAAiD,QAAQ,IAAI,EAAE;AAAA,IACjF;AAAA,EACF;AAEA,QAAM,iBAAiB,YAAY,IAAI,+BAA+B;AACtE,MAAI,gBAAgB;AAClB,QAAI,CAAC,eAAe,gCAAgC;AAClD,iBAAW,KAAK,2EAA2E;AAAA,IAC7F;AACA,eAAW,mBAAmB,qCAAqC;AACjE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW,KAAK,8BAA8B,eAAe,0BAA0B;AACvF;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW,KAAK,8BAA8B,QAAQ,IAAI,0BAA0B;AAAA,MACtF;AACA,UAAI,QAAQ,UAAU,eAAe,OAAO;AAC1C,mBAAW;AAAA,UACT,8BAA8B,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,eAAe,KAAK;AAAA,QACtH;AAAA,MACF;AACA,UAAI,QAAQ,SAAS;AACnB,mBAAW;AAAA,UACT,wEAAwE,QAAQ,IAAI;AAAA,QACtF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,+BAA+B,QAAQ,cAAc;AAAA,IACzD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,mCAAmC,oBAAI,IAAY;AAAA,IACvD,GAAG;AAAA,IACH;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,qCAAqC,QAAQ,gBAAgB;AAAA,IAAK,CAAC,YACvE,iCAAiC,IAAI,QAAQ,IAAI;AAAA,EACnD;AACA,MAAI,sCAAsC,6BAA6B,WAAW,GAAG;AACnF,eAAW;AAAA,MACT,iDAAiD,2CAA2C;AAAA,IAC9F;AAAA,EACF;AACA,QAAM,6BAA6B,6BAA6B,CAAC;AACjE,MAAI,4BAA4B;AAC9B,QAAI,2BAA2B,UAAU,cAAc;AACrD,iBAAW;AAAA,QACT,mEAAmE,2BAA2B,IAAI;AAAA,MACpG;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,YAAY;AAC1C,iBAAW;AAAA,QACT,iDAAiD,2BAA2B,IAAI;AAAA,MAClF;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,WAAW;AACzC,iBAAW;AAAA,QACT,iDAAiD,2BAA2B,IAAI;AAAA,MAClF;AAAA,IACF;AACA,QAAI,CAAC,2BAA2B,WAAW;AACzC,iBAAW;AAAA,QACT,iDAAiD,2BAA2B,IAAI;AAAA,MAClF;AAAA,IACF;AACA,SAAK,2BAA2B,eAAe,KAAK,GAAG;AACrD,iBAAW;AAAA,QACT,iDAAiD,2BAA2B,IAAI;AAAA,MAClF;AAAA,IACF;AACA,UAAM,mBAAmB;AAAA,MACvB,CAAC,UAAU,2BAA2B,MAAM;AAAA,MAC5C,CAAC,UAAU,2BAA2B,MAAM;AAAA,MAC5C,CAAC,UAAU,2BAA2B,MAAM;AAAA,MAC5C,CAAC,UAAU,2BAA2B,MAAM;AAAA,IAC9C,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,iEAAiE,2BAA2B,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,MAClK;AAAA,IACF;AACA,eAAW,mBAAmB,iDAAiD;AAC7E,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW;AAAA,UACT,6CAA6C,eAAe;AAAA,QAC9D;AACA;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,6CAA6C,QAAQ,IAAI;AAAA,QAC3D;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,2BAA2B,OAAO;AACtD,mBAAW;AAAA,UACT,6CAA6C,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,2BAA2B,KAAK;AAAA,QACjJ;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW;AAAA,UACT,gEAAgE,QAAQ,IAAI;AAAA,QAC9E;AAAA,MACF;AACA,UAAI,QAAQ,eAAe;AACzB,mBAAW;AAAA,UACT,kEAAkE,QAAQ,IAAI;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AACA,UAAM,iBAAiB,QAAQ,gBAAgB;AAAA,MAC7C,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QAAI,eAAe,WAAW,GAAG;AAC/B,iBAAW;AAAA,QACT,mDAAmD,gDAAgD;AAAA,MACrG;AAAA,IACF,OAAO;AACL,YAAM,UAAU,eAAe,CAAC;AAChC,UAAI,QAAQ,iBAAiB;AAC3B,mBAAW;AAAA,UACT,mDAAmD,QAAQ,IAAI;AAAA,QACjE;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,2BAA2B,OAAO;AACtD,mBAAW;AAAA,UACT,mDAAmD,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,2BAA2B,KAAK;AAAA,QACvJ;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW;AAAA,UACT,yFAAyF,QAAQ,IAAI;AAAA,QACvG;AAAA,MACF;AACA,UAAI,QAAQ,eAAe;AACzB,mBAAW;AAAA,UACT,wEAAwE,QAAQ,IAAI;AAAA,QACtF;AAAA,MACF;AAAA,IACF;AACA,UAAM,uBAAuB,QAAQ,gBAAgB;AAAA,MACnD,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QAAI,qBAAqB,WAAW,GAAG;AACrC,iBAAW;AAAA,QACT,0CAA0C,8CAA8C;AAAA,MAC1F;AAAA,IACF,OAAO;AACL,YAAM,UAAU,qBAAqB,CAAC;AACtC,UAAI,QAAQ,iBAAiB;AAC3B,mBAAW;AAAA,UACT,0CAA0C,QAAQ,IAAI;AAAA,QACxD;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,2BAA2B,OAAO;AACtD,mBAAW;AAAA,UACT,0CAA0C,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,2BAA2B,KAAK;AAAA,QAC9I;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW;AAAA,UACT,gFAAgF,QAAQ,IAAI;AAAA,QAC9F;AAAA,MACF;AACA,UAAI,QAAQ,eAAe;AACzB,mBAAW;AAAA,UACT,+DAA+D,QAAQ,IAAI;AAAA,QAC7E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,8BAA8B,YAAY,IAAI,wCAAwC;AAC5F,MAAI,6BAA6B;AAC/B,eAAW,aAAa;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAG;AACD,YAAM,QAAQ,YAAY,IAAI,SAAS;AACvC,UAAI,SAAS,CAAC,MAAM,4BAA4B;AAC9C,mBAAW,KAAK,SAAS,SAAS,0CAA0C;AAAA,MAC9E;AAAA,IACF;AACA,eAAW,mBAAmB,2CAA2C;AACvE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW;AAAA,UACT,oCAAoC,eAAe;AAAA,QACrD;AACA;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW,KAAK,oCAAoC,QAAQ,IAAI,0BAA0B;AAAA,MAC5F;AACA,UAAI,QAAQ,UAAU,4BAA4B,OAAO;AACvD,mBAAW;AAAA,UACT,oCAAoC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,4BAA4B,KAAK;AAAA,QACzI;AAAA,MACF;AACA,UAAI,QAAQ,SAAS;AACnB,mBAAW;AAAA,UACT,8EAA8E,QAAQ,IAAI;AAAA,QAC5F;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,YAAY,IAAI,oBAAoB;AAC9D,MAAI,mBAAmB;AACrB,UAAM,UAAU,QAAQ,gBAAgB;AAAA,MAAO,CAAC,YAC9C,QAAQ,KAAK,WAAW,mDAAmD;AAAA,IAC7E;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,iBAAW;AAAA,QACT;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,uDAAuD,QAAQ,IAAI;AAAA,QACrE;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,kBAAkB,OAAO;AAC7C,mBAAW;AAAA,UACT,uDAAuD,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,kBAAkB,KAAK;AAAA,QAClJ;AAAA,MACF;AAAA,IACF;AACA,eAAW,mBAAmB,4CAA4C;AACxE,YAAM,oBAAoB,QAAQ,gBAAgB;AAAA,QAChD,CAACA,aAAYA,SAAQ,SAAS;AAAA,MAChC;AACA,UAAI,kBAAkB,WAAW,GAAG;AAClC,mBAAW;AAAA,UACT,8CAA8C,eAAe;AAAA,QAC/D;AACA;AAAA,MACF;AACA,YAAM,UAAU,kBAAkB,CAAC;AACnC,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,8CAA8C,QAAQ,IAAI;AAAA,QAC5D;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,kBAAkB,OAAO;AAC7C,mBAAW;AAAA,UACT,8CAA8C,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,kBAAkB,KAAK;AAAA,QACzI;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW;AAAA,UACT,iEAAiE,QAAQ,IAAI;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,sBAAsB,YAAY,IAAI,gCAAgC;AAC5E,MAAI,qBAAqB;AACvB,eAAW,mBAAmB,0CAA0C;AACtE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW;AAAA,UACT,mCAAmC,eAAe;AAAA,QACpD;AACA;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW,KAAK,mCAAmC,QAAQ,IAAI,0BAA0B;AAAA,MAC3F;AACA,UAAI,QAAQ,UAAU,oBAAoB,OAAO;AAC/C,mBAAW;AAAA,UACT,mCAAmC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,oBAAoB,KAAK;AAAA,QAChI;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW,KAAK,sDAAsD,QAAQ,IAAI,EAAE;AAAA,MACtF;AAAA,IACF;AACA,eAAW,mBAAmB,wCAAwC;AACpE,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,eAAe;AAC5F,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW;AAAA,UACT,yCAAyC,eAAe;AAAA,QAC1D;AACA;AAAA,MACF;AACA,YAAM,UAAU,QAAQ,CAAC;AACzB,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,yCAAyC,QAAQ,IAAI;AAAA,QACvD;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,oBAAoB,OAAO;AAC/C,mBAAW;AAAA,UACT,yCAAyC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,oBAAoB,KAAK;AAAA,QACtI;AAAA,MACF;AACA,UAAI,QAAQ,SAAS;AACnB,mBAAW,KAAK,qDAAqD,QAAQ,IAAI,EAAE;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mCAAmC,QAAQ,cAAc;AAAA,IAC7D,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,qCAAqC,QAAQ,gBAAgB;AAAA,IACjE,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC;AACA,MAAI,iCAAiC,WAAW,GAAG;AACjD,eAAW;AAAA,MACT,sCAAsC,kCAAkC;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,mCAAmC,WAAW,GAAG;AACnD,eAAW;AAAA,MACT,0CAA0C,8CAA8C;AAAA,IAC1F;AAAA,EACF;AACA,MACE,iCAAiC,WAAW,KAC5C,mCAAmC,WAAW,GAC9C;AACA,UAAM,QAAQ,iCAAiC,CAAC;AAChD,UAAM,UAAU,mCAAmC,CAAC;AACpD,QAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,iBAAW;AAAA,QACT,0CAA0C,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,MACzH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,iBAAiB;AAC5B,iBAAW;AAAA,QACT,0CAA0C,QAAQ,IAAI;AAAA,MACxD;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS;AACpB,iBAAW,KAAK,6DAA6D,QAAQ,IAAI,EAAE;AAAA,IAC7F;AACA,QAAI,QAAQ,eAAe;AACzB,iBAAW;AAAA,QACT,+DAA+D,QAAQ,IAAI;AAAA,MAC7E;AAAA,IACF;AACA,UAAM,mBAAmB;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,IACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,MAC7I;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mCAAmC,QAAQ,cAAc;AAAA,IAC7D,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,qCAAqC,QAAQ,gBAAgB;AAAA,IACjE,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC;AACA,MAAI,iCAAiC,WAAW,GAAG;AACjD,eAAW;AAAA,MACT,sCAAsC,kCAAkC;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,mCAAmC,WAAW,GAAG;AACnD,eAAW;AAAA,MACT,0CAA0C,8CAA8C;AAAA,IAC1F;AAAA,EACF;AACA,MACE,iCAAiC,WAAW,KAC5C,mCAAmC,WAAW,GAC9C;AACA,UAAM,QAAQ,iCAAiC,CAAC;AAChD,UAAM,UAAU,mCAAmC,CAAC;AACpD,QAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,iBAAW;AAAA,QACT,0CAA0C,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,MACzH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,iBAAiB;AAC5B,iBAAW;AAAA,QACT,0CAA0C,QAAQ,IAAI;AAAA,MACxD;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS;AACpB,iBAAW,KAAK,6DAA6D,QAAQ,IAAI,EAAE;AAAA,IAC7F;AACA,QAAI,QAAQ,eAAe;AACzB,iBAAW;AAAA,QACT,+DAA+D,QAAQ,IAAI;AAAA,MAC7E;AAAA,IACF;AACA,UAAM,mBAAmB;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,IACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,MAC7I;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oCAAoC,QAAQ,cAAc;AAAA,IAC9D,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,sCAAsC,QAAQ,gBAAgB;AAAA,IAClE,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC;AACA,MAAI,kCAAkC,WAAW,GAAG;AAClD,eAAW;AAAA,MACT,uCAAuC,mCAAmC;AAAA,IAC5E;AAAA,EACF;AACA,MAAI,oCAAoC,WAAW,GAAG;AACpD,eAAW;AAAA,MACT,2CAA2C,+CAA+C;AAAA,IAC5F;AAAA,EACF;AACA,MACE,kCAAkC,WAAW,KAC7C,oCAAoC,WAAW,GAC/C;AACA,UAAM,QAAQ,kCAAkC,CAAC;AACjD,UAAM,UAAU,oCAAoC,CAAC;AACrD,QAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,iBAAW;AAAA,QACT,2CAA2C,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,MAC1H;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,iBAAiB;AAC5B,iBAAW;AAAA,QACT,2CAA2C,QAAQ,IAAI;AAAA,MACzD;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS;AACpB,iBAAW,KAAK,8DAA8D,QAAQ,IAAI,EAAE;AAAA,IAC9F;AACA,QAAI,QAAQ,eAAe;AACzB,iBAAW;AAAA,QACT,gEAAgE,QAAQ,IAAI;AAAA,MAC9E;AAAA,IACF;AACA,UAAM,mBAAmB;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,IACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,MAC7I;AAAA,IACF;AAAA,EACF;AAEA,QAAM,4BAA4B,QAAQ,cAAc;AAAA,IACtD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,8BAA8B,QAAQ,gBAAgB;AAAA,IAC1D,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC;AACA,MAAI,0BAA0B,WAAW,GAAG;AAC1C,eAAW;AAAA,MACT,gDAAgD,4CAA4C;AAAA,IAC9F;AAAA,EACF;AACA,MAAI,4BAA4B,WAAW,GAAG;AAC5C,eAAW;AAAA,MACT,oDAAoD,wDAAwD;AAAA,IAC9G;AAAA,EACF;AACA,MAAI,0BAA0B,WAAW,KAAK,4BAA4B,WAAW,GAAG;AACtF,UAAM,QAAQ,0BAA0B,CAAC;AACzC,UAAM,UAAU,4BAA4B,CAAC;AAC7C,QAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,iBAAW;AAAA,QACT,oDAAoD,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,MACnI;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,iBAAiB;AAC5B,iBAAW;AAAA,QACT,oDAAoD,QAAQ,IAAI;AAAA,MAClE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS;AACpB,iBAAW;AAAA,QACT,uEAAuE,QAAQ,IAAI;AAAA,MACrF;AAAA,IACF;AACA,QAAI,QAAQ,eAAe;AACzB,iBAAW;AAAA,QACT,yEAAyE,QAAQ,IAAI;AAAA,MACvF;AAAA,IACF;AACA,UAAM,mBAAmB;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,IACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,MAC7I;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,oBAAoB,QAAW;AACzC,UAAM,8BAA8B,QAAQ,cAAc;AAAA,MACxD,CAAC,UAAU,MAAM,SAAS;AAAA,IAC5B;AACA,UAAM,gCAAgC,QAAQ,gBAAgB;AAAA,MAC5D,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QAAI,4BAA4B,WAAW,GAAG;AAC5C,iBAAW;AAAA,QACT,iCAAiC,6BAA6B;AAAA,MAChE;AAAA,IACF;AACA,QAAI,8BAA8B,WAAW,GAAG;AAC9C,iBAAW;AAAA,QACT,qCAAqC,yCAAyC;AAAA,MAChF;AAAA,IACF;AACA,QAAI,4BAA4B,WAAW,KAAK,8BAA8B,WAAW,GAAG;AAC1F,YAAM,QAAQ,4BAA4B,CAAC;AAC3C,YAAM,UAAU,8BAA8B,CAAC;AAC/C,UAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,mBAAW;AAAA,UACT,qCAAqC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,QACpH;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,qCAAqC,QAAQ,IAAI;AAAA,QACnD;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW,KAAK,wDAAwD,QAAQ,IAAI,EAAE;AAAA,MACxF;AACA,UAAI,QAAQ,eAAe;AACzB,mBAAW,KAAK,0DAA0D,QAAQ,IAAI,EAAE;AAAA,MAC1F;AACA,YAAM,mBAAmB;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,UAAI,iBAAiB,SAAS,GAAG;AAC/B,mBAAW;AAAA,UACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,QAC7I;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB,QAAQ,cAAc;AAAA,MAClD,CAAC,UAAU,MAAM,SAAS;AAAA,IAC5B;AACA,UAAM,0BAA0B,QAAQ,gBAAgB;AAAA,MACtD,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QAAI,sBAAsB,WAAW,GAAG;AACtC,iBAAW,KAAK,0BAA0B,sBAAsB,0BAA0B;AAAA,IAC5F;AACA,QAAI,wBAAwB,WAAW,GAAG;AACxC,iBAAW;AAAA,QACT,8BAA8B,kCAAkC;AAAA,MAClE;AAAA,IACF;AACA,QAAI,sBAAsB,WAAW,KAAK,wBAAwB,WAAW,GAAG;AAC9E,YAAM,QAAQ,sBAAsB,CAAC;AACrC,YAAM,UAAU,wBAAwB,CAAC;AACzC,UAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,mBAAW;AAAA,UACT,8BAA8B,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,QAC7G;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW,KAAK,8BAA8B,QAAQ,IAAI,0BAA0B;AAAA,MACtF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW,KAAK,iDAAiD,QAAQ,IAAI,EAAE;AAAA,MACjF;AACA,UAAI,QAAQ,eAAe;AACzB,mBAAW,KAAK,mDAAmD,QAAQ,IAAI,EAAE;AAAA,MACnF;AACA,YAAM,mBAAmB;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,UAAI,iBAAiB,SAAS,GAAG;AAC/B,mBAAW;AAAA,UACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,QAC7I;AAAA,MACF;AAAA,IACF;AACA,UAAM,gCAAgC,QAAQ,cAAc;AAAA,MAC1D,CAAC,UAAU,MAAM,SAAS;AAAA,IAC5B;AACA,UAAM,kCAAkC,QAAQ,gBAAgB;AAAA,MAC9D,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QAAI,8BAA8B,WAAW,GAAG;AAC9C,iBAAW;AAAA,QACT,mCAAmC,+BAA+B;AAAA,MACpE;AAAA,IACF;AACA,QAAI,gCAAgC,WAAW,GAAG;AAChD,iBAAW;AAAA,QACT,uCAAuC,2CAA2C;AAAA,MACpF;AAAA,IACF;AACA,QACE,8BAA8B,WAAW,KACzC,gCAAgC,WAAW,GAC3C;AACA,YAAM,QAAQ,8BAA8B,CAAC;AAC7C,YAAM,UAAU,gCAAgC,CAAC;AACjD,UAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,mBAAW;AAAA,UACT,uCAAuC,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,QACtH;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,iBAAiB;AAC5B,mBAAW;AAAA,UACT,uCAAuC,QAAQ,IAAI;AAAA,QACrD;AAAA,MACF;AACA,UAAI,CAAC,QAAQ,SAAS;AACpB,mBAAW,KAAK,0DAA0D,QAAQ,IAAI,EAAE;AAAA,MAC1F;AACA,UAAI,QAAQ,eAAe;AACzB,mBAAW,KAAK,4DAA4D,QAAQ,IAAI,EAAE;AAAA,MAC5F;AACA,YAAM,mBAAmB;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,QACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,UAAI,iBAAiB,SAAS,GAAG;AAC/B,mBAAW;AAAA,UACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,QAC7I;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,gBAAgB,WAAW,GAAG;AACxC,eAAW,KAAK,yCAAyC;AAAA,EAC3D;AAIA,QAAM,oBAAoB,QAAQ,cAAc;AAAA,IAC9C,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,mBAAmB,QAAQ,cAAc;AAAA,IAC7C,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,CAAC,kBAAkB;AACrB,eAAW,KAAK,wDAAwD;AAC1E,MACE,qBACC,iBAAiB,UAAU,gBAC1B,iBAAiB,UACjB,iBAAiB,UACjB,iBAAiB,SACnB;AACA,eAAW,KAAK,6EAA6E;AAAA,EAC/F;AACA,MAAI,CAAC,mBAAmB;AACtB,eAAW,KAAK,0CAA0C;AAAA,EAC5D,WAAW,CAAC,kBAAkB,QAAQ;AACpC,eAAW,KAAK,sDAAsD;AAAA,EACxE;AACA,MACE,sBACC,kBAAkB,UAAU,gBAC3B,kBAAkB,UAClB,kBAAkB,UAClB,kBAAkB,SACpB;AACA,eAAW,KAAK,2EAA2E;AAAA,EAC7F;AACA,QAAM,mBAAmB,QAAQ,cAAc;AAAA,IAC7C,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MACE,qBACC,iBAAiB,UAAU,gBAC1B,iBAAiB,UACjB,iBAAiB,UACjB,iBAAiB,SACnB;AACA,eAAW;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAIA,QAAM,wBAAwB,QAAQ,cAAc;AAAA,IAClD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MACE,0BACC,sBAAsB,UAAU,gBAC/B,sBAAsB,UACtB,sBAAsB,UACtB,sBAAsB,SACxB;AACA,eAAW;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qCAAqC,QAAQ,cAAc;AAAA,IAC/D,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,uCAAuC,QAAQ,gBAAgB;AAAA,IACnE,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC;AACA,MAAI,mCAAmC,WAAW,GAAG;AACnD,eAAW;AAAA,MACT,gDAAgD,4CAA4C;AAAA,IAC9F;AAAA,EACF;AACA,MAAI,qCAAqC,WAAW,GAAG;AACrD,eAAW;AAAA,MACT,oDAAoD,wDAAwD;AAAA,IAC9G;AAAA,EACF;AACA,MACE,mCAAmC,WAAW,KAC9C,qCAAqC,WAAW,GAChD;AACA,UAAM,QAAQ,mCAAmC,CAAC;AAClD,UAAM,UAAU,qCAAqC,CAAC;AACtD,QAAI,QAAQ,UAAU,MAAM,OAAO;AACjC,iBAAW;AAAA,QACT,oDAAoD,QAAQ,IAAI,UAAU,QAAQ,KAAK,+BAA+B,MAAM,KAAK;AAAA,MACnI;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,iBAAiB;AAC5B,iBAAW;AAAA,QACT,oDAAoD,QAAQ,IAAI;AAAA,MAClE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS;AACpB,iBAAW;AAAA,QACT,uEAAuE,QAAQ,IAAI;AAAA,MACrF;AAAA,IACF;AACA,QAAI,QAAQ,eAAe;AACzB,iBAAW;AAAA,QACT,yEAAyE,QAAQ,IAAI;AAAA,MACvF;AAAA,IACF;AACA,UAAM,mBAAmB;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,MACvB,CAAC,UAAU,MAAM,MAAM;AAAA,IACzB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,OAAO;AACjC,QAAI,iBAAiB,SAAS,GAAG;AAC/B,iBAAW;AAAA,QACT,iEAAiE,MAAM,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS,EAAE,KAAK,IAAI,CAAC;AAAA,MAC7I;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,QAAQ,cAAc;AAAA,IAC9C,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,kBAAkB,WAAW,GAAG;AAClC,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,mEAAmE;AAAA,EACvF,OAAO;AACL,UAAM,QAAQ,kBAAkB,CAAC;AACjC,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc,MAAM,eAAe,KAAK,GAAG;AAC7F,iBAAW,KAAK,yEAAyE;AAAA,IAC3F;AACA,QACE,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UAAU,cAChB;AACA,iBAAW,KAAK,sEAAsE;AAAA,IACxF;AACA,UAAM,aAAa,YAAY,IAAI,OAAO,GAAG;AAC7C,QAAI,cAAc,MAAM,UAAU;AAChC,iBAAW,KAAK,8DAA8D;AAChF,eAAW,QAAQ,2CAA2C;AAC5D,YAAM,WAAW,QAAQ,gBAAgB,OAAO,CAAC,YAAY,QAAQ,SAAS,IAAI;AAClF,YAAM,eAAe,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AAC3D,YAAM,cAAc,oBAAI,IAAI;AAAA,QAC1B,2BAA2B,YAAY;AAAA,QACvC,2BAA2B,qBAAqB,KAAK,YAAY,IAAI,eAAe,YAAY;AAAA,MAClG,CAAC;AACD,UACE,SAAS,WAAW,KACpB,CAAC,SAAS,CAAC,EAAG,WACd,SAAS,CAAC,EAAG,iBACb,CAAC,SAAS,CAAC,EAAG,mBACd,SAAS,CAAC,EAAG,UAAU,MAAM,SAC7B,CAAC,SAAS,CAAC,EAAG,eAAe,KAAK,CAAC,kBAAkB,YAAY,IAAI,aAAa,CAAC,GACnF;AACA,mBAAW,KAAK,uCAAuC,IAAI,uBAAuB;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,cAAc,OAAO,CAAC,UAAU,MAAM,SAAS,mBAAmB;AAC5F,MAAI,UAAU,WAAW,GAAG;AAC1B,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,uDAAuD;AAAA,EAC3E,OAAO;AACL,UAAM,QAAQ,UAAU,CAAC;AACzB,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc,MAAM,eAAe,KAAK;AAC1F,iBAAW,KAAK,kEAAkE;AACpF,QACE,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,YACN,MAAM,cACN,MAAM,WACN,MAAM,iBAAiB,UACvB,MAAM,UAAU;AAEhB,iBAAW,KAAK,0DAA0D;AAC5E,QAAI,YAAY,IAAI,OAAO,GAAG,SAAS,MAAM,UAAU,YAAY,IAAI,OAAO,EAAG;AAC/E,iBAAW,KAAK,uDAAuD;AACzE,UAAM,eAAe,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AAC3D,UAAM,cAAc,oBAAI,IAAI;AAAA,MAC1B,2BAA2B,YAAY;AAAA,MACvC,2BAA2B,qBAAqB,KAAK,YAAY,IAAI,eAAe,YAAY;AAAA,IAClG,CAAC;AACD,eAAW,QAAQ,+BAA+B;AAChD,YAAM,WAAW,QAAQ,gBAAgB,OAAO,CAAC,YAAY,QAAQ,SAAS,IAAI;AAClF,UACE,SAAS,WAAW,KACpB,CAAC,SAAS,CAAC,EAAG,WACd,SAAS,CAAC,EAAG,iBACb,CAAC,SAAS,CAAC,EAAG,mBACd,SAAS,CAAC,EAAG,UAAU,MAAM,SAC7B,CAAC,SAAS,CAAC,EAAG,eAAe,KAAK,CAAC,kBAAkB,YAAY,IAAI,aAAa,CAAC;AAEnF,mBAAW,KAAK,2BAA2B,IAAI,uBAAuB;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,wBAAwB,QAAQ,cAAc;AAAA,IAClD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,sBAAsB,WAAW,GAAG;AACtC,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,4DAA4D;AAAA,EAChF,OAAO;AACL,UAAM,QAAQ,sBAAsB,CAAC;AACrC,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc,MAAM,eAAe,KAAK,GAAG;AAC7F,iBAAW,KAAK,qEAAqE;AAAA,IACvF;AACA,QACE,CAAC,MAAM,UACP,CAAC,MAAM,UACP,CAAC,MAAM,UACP,MAAM,UACN,MAAM,UAAU,cAChB;AACA,iBAAW,KAAK,6DAA6D;AAAA,IAC/E;AACA,UAAM,eAAe,YAAY,IAAI,UAAU,GAAG;AAClD,QAAI,gBAAgB,MAAM,UAAU;AAClC,iBAAW,KAAK,0DAA0D;AAAA,EAC9E;AAEA,QAAM,8BAA8B,QAAQ,cAAc;AAAA,IACxD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,4BAA4B,WAAW,GAAG;AAC5C,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,sEAAsE;AAAA,EAC1F,OAAO;AACL,UAAM,QAAQ,4BAA4B,CAAC;AAC3C,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc,MAAM,eAAe,KAAK,GAAG;AAC7F,iBAAW,KAAK,uEAAuE;AAAA,IACzF;AACA,QACE,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UAAU,cAChB;AACA,iBAAW,KAAK,yEAAyE;AAAA,IAC3F;AACA,UAAM,kBAAkB,YAAY,IAAI,2BAA2B,GAAG;AACtE,QAAI,mBAAmB,MAAM,UAAU;AACrC,iBAAW,KAAK,uEAAuE;AACzF,eAAW,QAAQ,8CAA8C;AAC/D,YAAM,WAAW,QAAQ,gBAAgB,OAAO,CAAC,YAAY,QAAQ,SAAS,IAAI;AAClF,YAAM,eAAe,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AAC3D,YAAM,cAAc,oBAAI,IAAI;AAAA,QAC1B,2BAA2B,YAAY;AAAA,QACvC,2BAA2B,qBAAqB,KAAK,YAAY,IAAI,eAAe,YAAY;AAAA,MAClG,CAAC;AACD,UACE,SAAS,WAAW,KACpB,CAAC,SAAS,CAAC,EAAG,WACd,SAAS,CAAC,EAAG,iBACb,CAAC,SAAS,CAAC,EAAG,mBACd,SAAS,CAAC,EAAG,UAAU,MAAM,SAC7B,CAAC,SAAS,CAAC,EAAG,eAAe,KAAK,CAAC,kBAAkB,YAAY,IAAI,aAAa,CAAC,GACnF;AACA,mBAAW,KAAK,0CAA0C,IAAI,uBAAuB;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,kBAAkB,QAAQ,cAAc;AAAA,IAC5C,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,gBAAgB,WAAW,GAAG;AAChC,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,gEAAgE;AAAA,EACpF,OAAO;AACL,UAAM,QAAQ,gBAAgB,CAAC;AAC/B,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc,MAAM,eAAe,KAAK;AAC1F,iBAAW,KAAK,gEAAgE;AAClF,QACE,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,YACN,MAAM,cACN,MAAM,WACN,MAAM,UAAU;AAEhB,iBAAW,KAAK,2EAA2E;AAC7F,QAAI,MAAM,UAAU,4BAA4B,CAAC,GAAG;AAClD,iBAAW,KAAK,yEAAyE;AAAA,EAC7F;AAEA,QAAM,sBAAsB,QAAQ,cAAc;AAAA,IAChD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,oBAAoB,WAAW,GAAG;AACpC,QAAI,CAAC,QAAQ;AACX,iBAAW,KAAK,uEAAuE;AAAA,EAC3F,OAAO;AACL,UAAM,QAAQ,oBAAoB,CAAC;AACnC,QAAI,CAAC,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc,MAAM,eAAe,KAAK,GAAG;AAC7F,iBAAW,KAAK,wEAAwE;AAAA,IAC1F;AACA,QACE,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UAAU,cAChB;AACA,iBAAW,KAAK,0EAA0E;AAAA,IAC5F;AACA,UAAM,eAAe,YAAY,IAAI,UAAU,GAAG;AAClD,QAAI,gBAAgB,MAAM,UAAU;AAClC,iBAAW,KAAK,qEAAqE;AACvF,UAAM,eAAe,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AAC3D,UAAM,cAAc,oBAAI,IAAI;AAAA,MAC1B,2BAA2B,YAAY;AAAA,MACvC,2BAA2B,qBAAqB,KAAK,YAAY,IAAI,eAAe,YAAY;AAAA,IAClG,CAAC;AACD,eAAW,QAAQ,+CAA+C;AAChE,YAAM,WAAW,QAAQ,gBAAgB,OAAO,CAAC,YAAY,QAAQ,SAAS,IAAI;AAClF,UACE,SAAS,WAAW,KACpB,CAAC,SAAS,CAAC,EAAG,WACd,SAAS,CAAC,EAAG,iBACb,CAAC,SAAS,CAAC,EAAG,mBACd,SAAS,CAAC,EAAG,UAAU,MAAM,SAC7B,CAAC,SAAS,CAAC,EAAG,eAAe,KAAK,CAAC,kBAAkB,YAAY,IAAI,aAAa,CAAC,GACnF;AACA,mBAAW,KAAK,2CAA2C,IAAI,uBAAuB;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AAEA,aAAW,QAAQ,CAAC,4BAA4B,gCAAgC,GAAG;AACjF,UAAM,QAAQ,QAAQ,cAAc,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAC/E,QAAI,CAAC,OAAO;AACV,UAAI,CAAC,QAAQ;AACX,mBAAW,KAAK,+BAA+B,IAAI,aAAa;AAClE;AAAA,IACF;AACA,QACE,MAAM,UAAU,gBAChB,MAAM,UAAU,YAAY,IAAI,OAAO,GAAG,SAC1C,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM;AAEN,iBAAW,KAAK,+BAA+B,IAAI,uBAAuB;AAC5E,QACE,SAAS,+BACR,CAAC,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,cAAc,MAAM,eAAe,KAAK;AAEzF,iBAAW,KAAK,oDAAoD;AACtE,UAAM,WACJ,SAAS,6BACL;AAAA,MACE;AAAA,MACA;AAAA,IACF,IACA,CAAC,6CAA6C;AACpD,eAAW,aAAa,UAAU;AAChC,YAAM,UAAU,QAAQ,gBAAgB,KAAK,CAAC,cAAc,UAAU,SAAS,SAAS;AACxF,YAAM,eAAe,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AAC3D,YAAM,QACJ,SAAS,mCACL,CAAC,iCAAiC,IAClC;AAAA,QACE,2BAA2B,YAAY;AAAA,QACvC,2BAA2B,YAAY;AAAA,MACzC;AACN,UACE,CAAC,WACD,CAAC,QAAQ,WACT,QAAQ,iBACR,CAAC,QAAQ,mBACT,QAAQ,UAAU,MAAM,SACxB,CAAC,QAAQ,eAAe,KAAK,CAAC,UAAU,MAAM,SAAS,KAAK,CAAC;AAE7D,mBAAW,KAAK,iCAAiC,SAAS,uBAAuB;AAAA,IACrF;AAAA,EACF;AAEA,QAAM,sBAAsB,QAAQ,cAAc;AAAA,IAChD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,qBAAqB;AACvB,QACE,oBAAoB,UAAU,gBAC9B,oBAAoB,UAAU,YAAY,IAAI,UAAU,GAAG,SAC3D,CAAC,oBAAoB,cACrB,CAAC,oBAAoB,aACrB,CAAC,oBAAoB,cACpB,oBAAoB,eAAe,KAAK,KACzC,oBAAoB,UACpB,oBAAoB,UACpB,oBAAoB,UACpB,oBAAoB,UACpB,oBAAoB,YACpB,oBAAoB,cACpB,oBAAoB;AAEpB,iBAAW,KAAK,qEAAqE;AACvF,UAAM,eAAe,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AAC3D,UAAM,QAAQ;AAAA,MACZ,2BAA2B,YAAY;AAAA,MACvC,2BAA2B,YAAY;AAAA,IACzC;AACA,eAAW,aAAa;AAAA,MACtB;AAAA,MACA;AAAA,IACF,GAAG;AACD,YAAM,UAAU,QAAQ,gBAAgB,KAAK,CAAC,cAAc,UAAU,SAAS,SAAS;AACxF,UACE,CAAC,WACD,CAAC,QAAQ,WACT,QAAQ,iBACR,CAAC,QAAQ,mBACT,QAAQ,UAAU,oBAAoB,SACtC,CAAC,QAAQ,eAAe,KAAK,CAAC,UAAU,MAAM,SAAS,KAAK,CAAC;AAE7D,mBAAW,KAAK,8BAA8B,SAAS,uBAAuB;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,8BAA8B,QAAQ,cAAc;AAAA,IACxD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,2BAA2B,QAAQ,cAAc;AAAA,IACrD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,aAAW,aAAa,CAAC,yBAAyB,oCAAoC,GAAG;AACvF,UAAM,wBAAwB,QAAQ,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,SAAS;AAC5F,QACE,0BACC,sBAAsB,UAAU,gBAC/B,sBAAsB,UAAU,YAAY,IAAI,YAAY,GAAG,SAC/D,sBAAsB,UACtB,sBAAsB,UACtB,sBAAsB,UACtB,sBAAsB,UACtB,sBAAsB,YACtB,sBAAsB,cACtB,sBAAsB;AAExB,iBAAW;AAAA,QACT,2BAA2B,SAAS;AAAA,MACtC;AAAA,EACJ;AACA,MAAI,CAAC,QAAQ,mBAAmB,0BAA0B;AACxD,UAAM,iBAAiB,YAAY,IAAI,YAAY,GAAG;AACtD,eAAW,QAAQ,kCAAkC;AACnD,YAAM,QAAQ,QAAQ,cAAc,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAC/E,UACE,CAAC,SACD,MAAM,UAAU,gBAChB,MAAM,UAAU,kBAChB,CAAC,MAAM,cACP,CAAC,MAAM,aACP,CAAC,MAAM,cACN,MAAM,eAAe,KAAK,KAC3B,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,YACN,MAAM,cACN,MAAM,SACN;AACA,mBAAW,KAAK,iCAAiC,IAAI,uBAAuB;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACA,MACE,6BACC,yBAAyB,UAAU,gBAClC,yBAAyB,UACvB,QAAQ,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,4BAA4B,GAAG,SACtF,yBAAyB,UACzB,yBAAyB,UACzB,yBAAyB,UACzB,yBAAyB,SAC3B;AACA,eAAW,KAAK,0EAA0E;AAAA,EAC5F;AACA,QAAM,uBAAuB,QAAQ,cAAc;AAAA,IACjD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MACE,yBACC,qBAAqB,UACpB,QAAQ,cAAc,KAAK,CAAC,UAAU,MAAM,SAAS,4BAA4B,GAAG,SACpF,CAAC,qBAAqB,cACtB,CAAC,qBAAqB,aACtB,CAAC,qBAAqB,YACxB;AACA,eAAW,KAAK,0EAA0E;AAAA,EAC5F;AACA,QAAM,8BAA8B,QAAQ,cAAc;AAAA,IACxD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,CAAC,QAAQ,mBAAmB,6BAA6B;AAC3D,UAAM,iBAAiB,YAAY,IAAI,YAAY,GAAG;AACtD,eAAW,QAAQ,4CAA4C;AAC7D,YAAM,QAAQ,QAAQ,cAAc,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAC/E,UACE,CAAC,SACD,MAAM,UAAU,gBAChB,MAAM,UAAU,kBAChB,CAAC,MAAM,cACP,CAAC,MAAM,aACP,CAAC,MAAM,cACN,MAAM,eAAe,KAAK,KAC3B,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,YACN,MAAM,cACN,MAAM,SACN;AACA,mBAAW,KAAK,qCAAqC,IAAI,uBAAuB;AAAA,MAClF;AAAA,IACF;AACA,QACE,CAAC,+BACD,4BAA4B,UAAU,gBACtC,4BAA4B,UAAU,kBACtC,4BAA4B,UAC5B,4BAA4B,UAC5B,4BAA4B,UAC5B,4BAA4B,UAC5B,4BAA4B,UAC5B;AACA,iBAAW;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,yBAAyB,QAAQ,cAAc;AAAA,IACnD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,+BAA+B,QAAQ,eAAe;AAAA,IAC1D,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC;AACA,OACG,gCAAgC,4BAChC,CAAC,0BACA,uBAAuB,UAAU,gBACjC,uBAAuB,UAAU,YAAY,IAAI,UAAU,GAAG,SAC9D,uBAAuB,UAAU,YAAY,IAAI,0BAA0B,GAAG,SAC9E,CAAC,uBAAuB,cACxB,CAAC,uBAAuB,aACxB,CAAC,uBAAuB,aACxB,uBAAuB,UACvB,uBAAuB,UACvB,uBAAuB,UACvB,uBAAuB,UACvB,uBAAuB,YACvB,uBAAuB,cACvB,uBAAuB;AAEzB,eAAW,KAAK,wEAAwE;AAC1F,QAAM,2BAA2B,QAAQ,cAAc;AAAA,IACrD,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,MAAI,0BAA0B;AAC5B,UAAM,aAAa;AACnB,UAAM,YAAY,QAAQ,gBAAgB;AAAA,MACxC,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QACE,WAAW,UAAU,gBACrB,WAAW,UAAU,YAAY,IAAI,gBAAgB,GAAG,SACxD,WAAW,UACX,WAAW,UACX,WAAW,UACX,WAAW,UACX,CAAC,WAAW,WACZ,CAAC,UAAU,mBACX,UAAU,iBACV,UAAU,UAAU,WAAW,SAC/B,CAAC,UAAU,eAAe,SAAS,wBAAwB,GAC3D;AACA,iBAAW,KAAK,wEAAwE;AAAA,IAC1F;AACA,UAAM,kBAAkB,QAAQ,gBAAgB;AAAA,MAC9C,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QACE,oBACC,CAAC,gBAAgB,WAChB,gBAAgB,iBAChB,CAAC,gBAAgB,mBACjB,gBAAgB,UAAU,WAAW,SACrC,CAAC,gBAAgB,eAAe,SAAS,wBAAwB,IACnE;AACA,iBAAW,KAAK,oEAAoE;AAAA,IACtF;AACA,UAAM,sBAAsB,QAAQ,gBAAgB;AAAA,MAClD,CAAC,YAAY,QAAQ,SAAS;AAAA,IAChC;AACA,QACE,wBACC,CAAC,oBAAoB,WACpB,oBAAoB,iBACpB,CAAC,oBAAoB,mBACrB,oBAAoB,UAAU,WAAW,SACzC,CAAC,oBAAoB,eAAe,SAAS,wBAAwB,IACvE;AACA,iBAAW,KAAK,0EAA0E;AAAA,IAC5F;AAAA,EACF;AACA,MAAI,6BAA6B;AAC/B,UAAM,aAAa;AACnB,QACE,WAAW,UAAU,gBACrB,WAAW,UAAU,YAAY,IAAI,cAAc,GAAG,SACtD,WAAW,UACX,WAAW,UACX,WAAW,UACX,WAAW,QACX;AACA,iBAAW;AAAA,QACT;AAAA,MACF;AAAA,IACF;AACA,UAAM,mBAAmB,QAAQ,gBAAgB;AAAA,MAC/C,CAAC,YACC,QAAQ,SACR;AAAA,IACJ;AACA,QACE,CAAC,oBACD,CAAC,iBAAiB,mBAClB,CAAC,iBAAiB,WAClB,iBAAiB,iBACjB,iBAAiB,UAAU,WAAW,OACtC;AACA,iBAAW,KAAK,8DAA8D;AAAA,IAChF;AAAA,EACF;AACA,QAAM,mBAAmB,QAAQ,cAAc;AAAA,IAC7C,CAAC,UAAU,MAAM,SAAS;AAAA,EAC5B;AACA,QAAM,4BAA4B,QAAQ,eAAe;AAAA,IACvD,CAAC,YAAY,QAAQ,SAAS;AAAA,EAChC;AACA,QAAM,2BAA2B,QAAQ,gBAAgB;AAAA,IAAO,CAAC,YAC9D,mCAAyD,SAAS,QAAQ,IAAI;AAAA,EACjF;AAGA,MACE,CAAC,QAAQ,mBACT,oBACA,0BAA0B,UAC1B,yBAAyB,QACzB;AACA,QACE,CAAC,oBACD,iBAAiB,UAAU,gBAC3B,iBAAiB,UAAU,YAAY,IAAI,UAAU,GAAG,SACxD,iBAAiB,UACjB,iBAAiB,UACjB,iBAAiB,UACjB,iBAAiB,UACjB,iBAAiB,YACjB,iBAAiB,cACjB,iBAAiB;AAEjB,iBAAW,KAAK,0DAA0D;AAC5E,UAAM,YAAY,0BAA0B,CAAC;AAC7C,QACE,0BAA0B,WAAW,KACrC,CAAC,WAAW,mBACZ,CAAC,UAAU,WACX,CAAC,UAAU,iBACX,UAAU,UAAU,kBAAkB,SACtC,CAAC,UAAU,eAAe,SAAS,wBAAwB;AAE3D,iBAAW,KAAK,yDAAyD;AAC3E,eAAW,QAAQ,oCAAoC;AACrD,YAAM,UAAU,yBAAyB,OAAO,CAACA,aAAYA,SAAQ,SAAS,IAAI;AAClF,YAAM,UAAU,QAAQ,CAAC;AACzB,UACE,QAAQ,WAAW,KACnB,CAAC,SAAS,mBACV,CAAC,QAAQ,WACT,QAAQ,iBACR,QAAQ,UAAU,kBAAkB,SACpC,EAAE,KAAK,WAAW,MAAM,IACpB,QAAQ,eAAe,SAAS,wBAAwB,IACxD,eAAe,OAAO;AAE1B,mBAAW,KAAK,6BAA6B,IAAI,uBAAuB;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,sBAAsB,YAAY,IAAI,kBAAkB,GAAG;AACjE,QAAM,8BAA8B,IAAI;AAAA,IACtC,QAAQ,+BAA+B,+BAA+B,IAAI,CAAC,CAAC,IAAI,MAAM,IAAI;AAAA,EAC5F;AACA,MAAI,wBAAwB,QAAW;AACrC,eAAW,CAAC,MAAM,SAAS,KAAK,gCAAgC;AAC9D,YAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,IAAI;AAGjF,UAAI,QAAQ,WAAW,KAAK,CAAC,4BAA4B,IAAI,IAAI,EAAG;AACpE,YAAM,UAAU,QAAQ,CAAC;AACzB,UACE,QAAQ,WAAW,KACnB,CAAC,SAAS,mBACV,CAAC,QAAQ,WACT,QAAQ,iBACR,QAAQ,UAAU,qBAClB;AACA,mBAAW,KAAK,SAAS;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qBAAqB;AAAA,IACzB;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,CAAC,gDAAgD,mCAAmC,IAAI;AAAA,IACxF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,0BAA0B,IAAI,aAAa,WAAW,KAAK,IAAI,CAAC;AACtE,QAAM,yBAAyB;AAAA,IAC7B,2BAA2B,uBAAuB;AAAA,IAClD,2BAA2B,qBAAqB,KAAK,YAAY,IAAI,eAAe,uBAAuB;AAAA,EAC7G;AAIA,aAAW,CAAC,MAAM,WAAW,WAAW,KAAK,iCAAiC;AAC5E,UAAM,SACJ,gBAAgB,WAAW,QAAQ,iBAAiB,QAAQ,iBAC5D,KAAK,CAAC,UAAU,MAAM,SAAS,SAAS;AAC1C,QAAI,CAAC,MAAO;AACZ,UAAM,UAAU,QAAQ,gBAAgB,OAAO,CAACA,aAAYA,SAAQ,SAAS,IAAI;AACjF,UAAM,UAAU,QAAQ,CAAC;AACzB,QACE,QAAQ,WAAW,KACnB,CAAC,WACD,QAAQ,UAAU,MAAM,SACxB,CAAC,QAAQ,mBACT,QAAQ,iBACR,CAAC,QAAQ,WACT,CAAC,QAAQ,eAAe,SAAS,wBAAwB,GACzD;AACA,iBAAW,KAAK,0BAA0B,IAAI,mCAAmC;AAAA,IACnF;AAAA,EACF;AACA,MACE,CAAC,QAAQ,mBACT,QAAQ,cAAc,KAAK,CAAC,UAAU,yBAAyB,SAAS,MAAM,IAAI,CAAC,GACnF;AACA,UAAM,QAAQ,YAAY,IAAI,YAAY,GAAG;AAC7C,eAAW,QAAQ,4BAA4B;AAC7C,YAAM,QAAQ,QAAQ,cAAc,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AAC/E,UACE,CAAC,SACD,MAAM,UAAU,SAChB,MAAM,UAAU,gBAChB,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,UACN,MAAM,YACN,MAAM,cACN,MAAM,SACN;AACA,mBAAW,KAAK,2BAA2B,IAAI,sCAAsC;AAAA,MACvF;AAAA,IACF;AACA,eAAW,QAAQ,kCAAkC;AACnD,YAAM,UAAU,QAAQ,gBAAgB,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI;AACnF,UACE,CAAC,WACD,QAAQ,UAAU,SAClB,QAAQ,WACR,QAAQ,iBACR,CAAC,QAAQ,eAAe;AAAA,QACtB,CAAC,UAAU,UAAU,4BAA4B,uBAAuB,SAAS,KAAK;AAAA,MACxF,GACA;AACA,mBAAW,KAAK,4BAA4B,IAAI,uBAAuB;AAAA,MACzE;AAAA,IACF;AACA,eAAW,QAAQ;AAAA,MACjB;AAAA,MACA;AAAA,IACF,GAAG;AACD,YAAM,aAAa,QAAQ,gBAAgB,KAAK,CAAC,YAAY,QAAQ,SAAS,IAAI;AAClF,UACE,CAAC,cACD,WAAW,UAAU,SACrB,CAAC,WAAW,mBACZ,CAAC,WAAW,WACZ,WAAW,iBACX,CAAC,WAAW,eAAe,SAAS,wBAAwB,GAC5D;AACA,mBAAW,KAAK,+BAA+B,IAAI,uBAAuB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,IAAI,mCAAmC,GAAG;AACxD,eAAW,CAAC,IAAI,KAAK,oBAAoB;AACvC,UAAI,QAAQ,gBAAgB,OAAO,CAAC,YAAY,QAAQ,SAAS,IAAI,EAAE,WAAW,GAAG;AACnF,mBAAW,KAAK,uBAAuB,IAAI,0BAA0B;AAAA,MACvE;AAAA,IACF;AAAA,EACF;AACA,aAAW,WAAW,QAAQ,iBAAiB;AAC7C,QAAI,QAAQ,UAAU,cAAc;AAClC,iBAAW,KAAK,qCAAqC,QAAQ,IAAI,EAAE;AAAA,IACrE;AACA,QAAI,CAAC,0BAA0B,IAAI,QAAQ,IAAI,GAAG;AAChD,iBAAW,KAAK,GAAG,yBAAyB,SAAS,oBAAoB,YAAY,CAAC;AAAA,IACxF;AACA,QAAI,QAAQ,SAAS,iDAAiD;AACpE,UACE,CAAC,QAAQ,WACT,QAAQ,iBACR,CAAC,QAAQ,mBACT,CAAC,QAAQ,eAAe,SAAS,wBAAwB,KACzD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,CAAC,SAAS,QAAQ,UAAU,YAAY,IAAI,IAAI,GAAG,KAAK,GAC/D;AACA,mBAAW,KAAK,uEAAuE;AAAA,MACzF;AAAA,IACF;AACA,QACE,QAAQ,SAAS,+CAChB,CAAC,QAAQ,WACR,QAAQ,iBACR,QAAQ,mBACR,CAAC,QAAQ,eAAe,SAAS,wBAAwB,KACzD,QAAQ,UAAU,YAAY,IAAI,kBAAkB,GAAG,QACzD;AACA,iBAAW,KAAK,yEAAyE;AAAA,IAC3F;AACA,QACE,QAAQ,SAAS,sEACjB,QAAQ,SAAS,6CACjB,QAAQ,SAAS,2DACjB,QAAQ,SAAS,gEACjB;AACA,YAAM,aAAa,QAAQ,gBAAgB;AAAA,QACzC,CAAC,UAAU,MAAM,SAAS;AAAA,MAC5B;AACA,UACE,CAAC,cACD,QAAQ,UAAU,WAAW,SAC7B,CAAC,QAAQ,mBACT,QAAQ,iBACR,CAAC,QAAQ,WACT,CAAC,QAAQ,eAAe,SAAS,wBAAwB,GACzD;AACA,mBAAW;AAAA,UACT,yBAAyB,QAAQ,IAAI;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AACA,UAAM,sBAAsB,mBAAmB,KAAK,CAAC,CAAC,IAAI,MAAM,SAAS,QAAQ,IAAI;AACrF,QAAI,qBAAqB;AACvB,YAAM,CAAC,EAAE,WAAW,OAAO,IAAI;AAC/B,UACE,QAAQ,iBACR,CAAC,QAAQ,WACT,QAAQ,oBAAoB,WAC5B,QAAQ,UAAU,YAAY,IAAI,SAAS,GAAG,SAC9C,CAAC,QAAQ,eAAe,KAAK,CAAC,UAAU,uBAAuB,SAAS,KAAK,CAAC,GAC9E;AACA,mBAAW;AAAA,UACT,uBAAuB,QAAQ,IAAI;AAAA,QACrC;AAAA,MACF;AAAA,IACF;AACA,UAAM,uBAAuB,gCAAgC,IAAI,QAAQ,IAAI;AAC7E,QACE,CAAC,gCAAgC,uCAAuC,EAAE;AAAA,MACxE,QAAQ;AAAA,IACV,MACC,QAAQ,WACP,QAAQ,iBACR,CAAC,QAAQ,mBACT,QAAQ,UAAU,YAAY,IAAI,YAAY,GAAG,SACjD,CAAC,QAAQ,eAAe;AAAA,MAAK,CAAC,UAC5B;AAAA,QACE;AAAA,QACA,2BAA2B,YAAY;AAAA,QACvC,2BAA2B,uBAAuB;AAAA,MACpD,EAAE,SAAS,KAAK;AAAA,IAClB;AAEF,iBAAW,KAAK,4BAA4B,QAAQ,IAAI,qBAAqB;AAC/E,QACE,CAAC,+CAA+C,8BAA8B,EAAE;AAAA,MAC9E,QAAQ;AAAA,IACV,GACA;AACA,UAAI,QAAQ,WAAW,QAAQ,eAAe;AAC5C,mBAAW;AAAA,UACT,mFAAmF,QAAQ,IAAI;AAAA,QACjG;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,YAAY,IAAI,eAAe,GAAG,OAAO;AAC7D,mBAAW;AAAA,UACT,wCAAwC,QAAQ,IAAI;AAAA,QACtD;AAAA,MACF;AACA,UAAI,QAAQ,qBAAqB,QAAQ,SAAS,iCAAiC;AACjF,mBAAW;AAAA,UACT,wCAAwC,QAAQ,IAAI;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AACA,QACE,QAAQ,SAAS,qDAChB,QAAQ,WAAW,QAAQ,gBAC5B;AACA,iBAAW,KAAK,kEAAkE;AAAA,IACpF;AACA,QACE;AAAA,MACE;AAAA,MACA;AAAA,IACF,EAAE,SAAS,QAAQ,IAAI,GACvB;AACA,UAAI,QAAQ,WAAW,QAAQ,eAAe;AAC5C,mBAAW;AAAA,UACT,6EAA6E,QAAQ,IAAI;AAAA,QAC3F;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,YAAY,IAAI,gBAAgB,GAAG,OAAO;AAC9D,mBAAW;AAAA,UACT,kCAAkC,QAAQ,IAAI;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AACA,QACE;AAAA,MACE;AAAA,MACA;AAAA,IACF,EAAE,SAAS,QAAQ,IAAI,MACtB,QAAQ,WAAW,QAAQ,gBAC5B;AACA,iBAAW;AAAA,QACT,kEAAkE,QAAQ,IAAI;AAAA,MAChF;AAAA,IACF;AAGA,QACE,0BAA0B,IAAI,QAAQ,IAAI,KAC1C,CAAC,QAAQ,WACT,CAAC,wBACD,CAAC,yBAAyB,IAAI,QAAQ,IAAI,GAC1C;AACA,iBAAW,KAAK,iDAAiD,QAAQ,IAAI,EAAE;AAAA,IACjF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,6BACpB,IACA,SACiC;AACjC,QAAM,UAAU,MAAM,8BAA8B,IAAI,OAAO;AAC/D,QAAM,aAAa,+BAA+B,SAAS,OAAO;AAClE,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,IAAI,4BAA4B,UAAU;AAAA,EAClD;AACA,SAAO;AACT;AAEO,SAAS,0BACd,IACA,SACqB;AACrB,SAAO,YAAY;AACjB,UAAM,6BAA6B,IAAI,OAAO;AAAA,EAChD;AACF;;;ADpgMA,eAAsB,eACpB,iBACA,UAAiC,CAAC,GACR;AAC1B,QAAM,SAAS,mBAAmB,gBAAgB,QAAQ,gBAAgB,QAAQ;AAClF,QAAM,cAA2B,QAAQ,eAAe;AAExD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,YAAY,QAAQ,IAAI,4BAA4B,KAAK,KAAK;AAAA,EACxE;AACA,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,+BAA+B;AAAA,IACnC;AAAA,IACA,QAAQ,iCACL,QAAQ,IAAI,wCAAwC,KAAK,KACxD;AAAA,EACN;AACA,QAAM,mCACJ,QAAQ,oCACR,QAAQ,IAAI;AACd,QAAM,2BAA2B;AAAA,IAC/B;AAAA,IACA,QAAQ,6BACL,QAAQ,IAAI,8CAA8C,KAAK,KAC9D;AAAA,EACN;AACA,QAAM,+BACJ,QAAQ,gCACR,QAAQ,IAAI;AACd,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA,QAAQ,mBACL,QAAQ,IAAI,oCAAoC,KAAK,KAAK;AAAA,EAC/D;AACA,QAAM,qBACJ,QAAQ,sBAAsB,QAAQ,IAAI;AAC5C,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,QAAQ,iBACL,QAAQ,IAAI,iCAAiC,KAAK,KAAK;AAAA,EAC5D;AACA,QAAM,mBACJ,QAAQ,oBAAoB,QAAQ,IAAI;AAC1C,QAAM,qBACJ,QAAQ,qBACR,eAAe,QAAQ,IAAI,+BAA+B,8BAA8B,GACxF,IAAI,CAAC,SAAS,mBAAmB,qBAAqB,IAAI,CAAC;AAE7D,QAAMC,OAAM,SAAS,iBAAiB,EAAE,KAAK,GAAG,GAAG,2BAA2B,eAAe,EAAE,CAAC;AAChG,MAAI;AAIF,UAAMA,KAAI,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oCAWe;AAIhC,QAAI,qBAAoC;AACxC,QAAI,gBAAgB,SAAS;AAC3B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAOA,YAAM,6BAA6BA,MAAK,OAAO;AAC/C,YAAM,6BAA6BA,MAAK,SAAS,WAAW;AAC5D,2BAAqB;AAAA,IACvB;AAEA,QAAI,0CAAyD;AAC7D,QAAI,kCAAkC;AACpC,YAAM,6BAA6BA,MAAK,4BAA4B;AACpE,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,gDAA0C;AAAA,IAC5C;AAEA,QAAI,sCAAqD;AACzD,QAAI,8BAA8B;AAChC,YAAM,6BAA6BA,MAAK,wBAAwB;AAChE,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM;AAAA,QACJA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,4CAAsC;AAAA,IACxC;AAEA,QAAI,kBAAkB;AACpB,YAAM,gBAAgBA,MAAK,cAAc,gBAAgB;AACzD,iBAAW,YAAY,mBAAmB;AACxC,cAAM,eAAeA,MAAK,UAAU,YAAY;AAChD,cAAM,4BAA4B,iBAAiB,UAAU,YAAY;AAAA,MAC3E;AAAA,IACF;AAEA,QAAI,oBAAoB;AACtB,YAAM,gBAAgBA,MAAK,gBAAgB,kBAAkB;AAC7D,YAAM,kCAAkCA,MAAK,cAAc;AAAA,IAC7D;AAEA,QAAI,gBAAgB,SAAS;AAC3B,YAAM,2BAA2BA,MAAK,SAAS,MAAM;AAAA,IACvD;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,8BAA8B;AAAA,MAC9B,0BAA0B;AAAA,MAC1B,gBAAgB,qBAAqB,iBAAiB;AAAA,MACtD,cAAc,mBAAmB,eAAe;AAAA,MAChD,mBAAmB,mBAAmB,oBAAoB,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAMA,KAAI,IAAI;AAAA,EAChB;AACF;AAOA,eAAe,kCAAkCA,MAAmB,MAA6B;AAC/F,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA;AAAA,yEAIsD,QAAQ,IAAI,CAAC;AAAA,4FACM,QAAQ,IAAI,CAAC;AAAA,iHACQ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAG7H;AACD;AAEA,eAAe,0CACbA,MACA,MACA,YACA,YACe;AACf,QAAM,WACJ,eAAe,WACX;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IACA;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACN,QAAM,eAAe,SAAS,SAAS,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAC9D,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA;AAAA,0DAIuC,QAAQ,UAAU,CAAC;AAAA;AAAA;AAAA,+EAGE,QAAQ,IAAI,CAAC;AAAA,uDACrC,QAAQ,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qEACvB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,QAG1E,QAAQ,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,QAIrC,QAAQ,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,QAIrC,QAAQ,IAAI,CAAC;AAAA;AAAA,yCAEoB,YAAY;AAAA;AAAA;AAAA;AAAA,+BAItB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAM3C;AACD;AAEA,eAAe,gBAAgBA,MAAmB,MAAc,UAAiC;AAC/F,QAAM;AAAA,IACJA;AAAA,IACA;AAAA;AAAA;AAAA,0DAGsD,QAAQ,IAAI,CAAC;AAAA,yDACd,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA,wDAEpC,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,EAIzF;AACF;AAEA,eAAe,6BACbA,MACA,MACA,UACe;AACf,QAAM;AAAA,IACJA;AAAA,IACA;AAAA;AAAA;AAAA,0DAGsD,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,QAG/D,QAAQ,IAAI,CAAC;AAAA,QACb,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,QAKjB,QAAQ,IAAI,CAAC;AAAA,QACb,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUjB,QAAQ,IAAI,CAAC;AAAA,QACb,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB;AACF;AAEA,IAAM,gCAAgC;AAEtC,SAAS,kCAAkC,OAAyB;AAClE,QAAM,UAAU;AAKhB,SACG,QAAQ,SAAS,WAChB,QAAQ,YAAY,gCACpB,QAAQ,YAAY,wBACrB,QAAQ,SAAS,WAChB,OAAO,QAAQ,YAAY,YAC3B,8BAA8B,KAAK,QAAQ,OAAO;AAExD;AAEA,eAAe,uBAAuBA,MAAmB,WAAkC;AAMzF,WAAS,UAAU,GAAG,WAAW,+BAA+B,WAAW,GAAG;AAC5E,QAAI;AACF,YAAMA,KAAI,OAAO,SAAS;AAC1B;AAAA,IACF,SAAS,OAAO;AACd,UAAI,CAAC,kCAAkC,KAAK,KAAK,YAAY,+BAA+B;AAC1F,cAAM;AAAA,MACR;AACA,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,KAAK,IAAI,KAAK,SAAS,GAAG,CAAC,CAAC;AAAA,IACjF;AAAA,EACF;AACF;AAOA,eAAe,6BAA6BA,MAAmB,MAA6B;AAC1F,QAAM,SAAS,MAAMA;AAAA,2DACoC,IAAI;AAAA;AAE7D,MAAI,CAAC,OAAO,CAAC,GAAG,QAAQ;AACtB;AAAA,EACF;AAEA,QAAM,CAAC,cAAc,IAAI,MAAMA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAiBP,IAAI;AAAA;AAE5B,MAAI,kBAAkB,CAAC,eAAe,yBAAyB;AAC7D,UAAM,sBAAsB;AAAA,MAC1B,eAAe,gBAAgB,cAAc;AAAA,MAC7C,eAAe,iBAAiB,cAAc;AAAA,MAC9C,eAAe,sBAAsB,aAAa;AAAA,MAClD,eAAe,kBAAkB,gBAAgB;AAAA,IACnD,EAAE,OAAO,CAAC,cAAmC,cAAc,IAAI;AAC/D,QAAI,oBAAoB,SAAS,GAAG;AAClC,YAAM,IAAI;AAAA,QACR,kCAAkC,IAAI,sEAAsE,oBAAoB,KAAK,IAAI,CAAC;AAAA,MAC5I;AAAA,IACF;AAAA,EACF;AAEA,QAAM,mBAAmB,MAAMA,KAAI;AAAA,IACjC,8BAA8B,IAAI;AAAA,IAClC,CAAC,IAAI;AAAA,EACP;AACA,QAAM,EAAE,oBAAoB,IAAI,0BAA0B,gBAAgB;AAC1E,MAAI,oBAAoB,SAAS,GAAG;AAClC,UAAM,IAAI;AAAA,MACR,kCAAkC,IAAI,wDAAwD,oBAAoB,KAAK,IAAI,CAAC;AAAA,IAC9H;AAAA,EACF;AAEA,QAAM,eAAe,MAAMA;AAAA;AAAA;AAAA;AAAA,4BAID,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,4BAKJ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAQJ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAWJ,IAAI;AAAA;AAAA;AAAA;AAAA;AAK9B,MAAI,aAAa,SAAS,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,kCAAkC,IAAI,mCAAmC,aACtE,IAAI,CAAC,QAAQ,IAAI,WAAW,EAC5B,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AACF;AAEA,eAAe,eAAeA,MAAmB,UAAkB,OAA8B;AAC/F,QAAM,WAAW,MAAMA;AAAA,8DACqC,QAAQ;AAAA;AAEpE,MAAI,CAAC,SAAS,CAAC,GAAG,QAAQ;AACxB,UAAMA,KAAI,OAAO,mBAAmB,WAAW,QAAQ,CAAC,UAAU,WAAW,KAAK,CAAC,EAAE;AAAA,EACvF;AACA,QAAMA,KAAI;AAAA,IACR,oCAAoC,WAAW,QAAQ,CAAC,OAAO,WAAW,KAAK,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,4BACb,iBACA,UACA,MACe;AACf,QAAM,cAAc,eAAe,iBAAiB,QAAQ;AAC5D,QAAM,cAAc,SAAS,aAAa,EAAE,KAAK,GAAG,GAAG,2BAA2B,WAAW,EAAE,CAAC;AAChG,MAAI;AACF,UAAM,YAAY,OAAO,2CAA2C,WAAW,IAAI,CAAC,EAAE;AAAA,EACxF,UAAE;AACA,UAAM,YAAY,IAAI;AAAA,EACxB;AACF;AAQA,eAAe,2BACbA,MACA,MACA,QACe;AACf,QAAM,uBAAuB,SAAS,wBAAwB,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACrF,QAAM,wBAAwB,SAAS,yBAAyB,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AACvF,QAAM,0BAA0B,SAAS,2BAA2B,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAC3F,QAAM,0BAA0B,SAAS,2BAA2B,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAC3F,QAAM,gCAAgC,SAAS,kCAAkC,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAExG,QAAM,wBAAwB,SAAS,OAAO,QAAQ,qCAAqC,EACxF;AAAA,IAAQ,CAAC,CAAC,UAAU,MAAM,MACzB,OAAO,IAAI,CAAC,UAAU,SAAS,QAAQ,QAAQ,CAAC,KAAK,QAAQ,KAAK,CAAC,GAAG;AAAA,EACxE,EACC,KAAK,IAAI,CAAC;AACb,QAAM,8BAA8B,SAAS,+BAA+B,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAMnG,QAAM,QAAQ,IAAI,IAAY,wCAAwC;AACtE,QAAM,4BAA4B,SAAS;AAAA,IACzC,GAAG,8BAA8B;AAAA,MAC/B,CAAC,EAAE,QAAQ,MAAM,UAAU,MACzB,SAAS,YAAY,CAAC,MAAM,IAAI,SAAS,KAAK,CAAC,UAAU,SAAS,IAAI;AAAA,IAC1E,EAAE,IAAI,CAAC,EAAE,QAAQ,MAAM,UAAU,MAAM,GAAG,IAAI,IAAI,SAAS,EAAE;AAAA,IAC7D,GAAG,8BAA8B,IAAI,CAAC,EAAE,QAAQ,MAAM,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE;AAAA,EACpF,EACG,IAAI,OAAO,EACX,KAAK,IAAI,CAAC;AACb,QAAM,0CAA0C,SAAS;AAAA,IACvD;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACG,IAAI,OAAO,EACX,KAAK,IAAI,CAAC;AACb,QAAM,gCAAgC,SAAS;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACG,IAAI,OAAO,EACX,KAAK,IAAI,CAAC;AACb,QAAM,+BAA+B,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACF,EACG,IAAI,OAAO,EACX,KAAK,IAAI,CAAC;AACb,QAAMA,KAAI,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+EAS4D,QAAQ,IAAI,CAAC;AAAA,0DAClC,QAAQ,MAAM,CAAC;AAAA,8EACK,QAAQ,MAAM,CAAC;AAAA,wGACW,QAAQ,MAAM,CAAC;AAAA,qGAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,uDAE/E,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,6HAEqC,QAAQ,IAAI,CAAC;AAAA;AAAA,2DAE/E,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,iFACX,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qCAC7E,oBAAoB;AAAA,uCAClB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,qBAAqB;AAAA,uCACnB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,uBAAuB;AAAA,uCACrB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,uBAAuB;AAAA,uCACrB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qCAIY,6BAA6B;AAAA,uCAC3B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4CAMmB,qBAAqB;AAAA,uCAC1B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAW1C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oEAW2C,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIzE,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,qEAG8C,QAAQ,MAAM,CAAC;AAAA,8GAC0B,QAAQ,MAAM,CAAC;AAAA,4IACe,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,kGAC/F,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,0NACuF,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,uHAC5K,QAAQ,MAAM,CAAC,IAAI,QAAQ,IAAI,CAAC;AAAA,2JACI,QAAQ,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,IAAI,QAAQ,IAAI,CAAC;AAAA,yEACrI,QAAQ,MAAM,CAAC;AAAA,+FACO,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,+EAEjD,QAAQ,MAAM,CAAC;AAAA,qGACO,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yFAO7C,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,iEAIrC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,yEAKL,QAAQ,MAAM,CAAC;AAAA,kHAC0B,QAAQ,MAAM,CAAC;AAAA;AAAA,UAEvH,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,yFAI9F,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,iEAIrC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAiBnC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,YAK9C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAYf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2CAYoB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,YAK9C,QAAQ,MAAM,CAAC;AAAA;AAAA,YAEf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6DAQsC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIlE,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,mFAG4D,QAAQ,MAAM,CAAC;AAAA,0GACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,sFACrD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,mFAEpC,QAAQ,MAAM,CAAC;AAAA,yGACO,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,wGAClC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,+GAC1B,QAAQ,MAAM,CAAC;AAAA,sIACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,yFAE9E,QAAQ,MAAM,CAAC;AAAA,gHACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,+FAElD,QAAQ,MAAM,CAAC;AAAA,sHACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,mGAEpD,QAAQ,MAAM,CAAC;AAAA,0HACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,4GAE/C,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,0GACnC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,mHACxB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,yGAC3C,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,iHACzB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,8GACpC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,0GACrC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,4DAG/E,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIjE,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UASb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,oDAK6B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIzD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,8EAIuD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAInF,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,0FAImE,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI/F,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4EAQqD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIjF,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,iFAI0D,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAItF,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,mFAI4D,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIxF,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,wFAIiE,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI7F,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yCAOkB,2BAA2B;AAAA,2CACzB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG9C,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,wBAAwB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOtD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,sEAI+C,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI3E,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,6EAKsD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIlF,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,gEAIyC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIrE,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAUb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAUb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,yCAGkB,uCAAuC;AAAA,2CACrC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG9C,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,wBAAwB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,iFAIiB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,UAGtF,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,0FAGmE,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,UAG/F,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,oFAG6D,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,UAGzF,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,0HAGmG,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,UAG/H,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,qFAG8D,QAAQ,MAAM,CAAC;AAAA,4GACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,yCAEpG,6BAA6B;AAAA,2CAC3B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG9C,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,wBAAwB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,yCAIvB,4BAA4B;AAAA,2CAC1B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAG9C,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,wBAAwB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWtD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,uEAIgD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI5E,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,gFAIyD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIrF,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qEAI8C,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI1E,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,uEAIgD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI5E,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,0EAI+B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI/E,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,iEAIsB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAItE,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,qFAK0C,QAAQ,MAAM,CAAC;AAAA,+GACW,QAAQ,MAAM,CAAC;AAAA,2GACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,+CAE7F,CAAC,GAAG,oCAAoC,GAAG,uCAAuC,EAAE,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,2CAC/G,QAAQ,MAAM,CAAC;AAAA,qEACW,QAAQ,MAAM,CAAC;AAAA,kEAClB,QAAQ,MAAM,CAAC,wBAAwB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,yHAGG,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,kGAGtC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,mFAG5B,QAAQ,MAAM,CAAC;AAAA,6GACW,QAAQ,MAAM,CAAC;AAAA,yGACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,kFAGxD,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIvF,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,6EAKkC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIlF,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,iFAIsC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAItF,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,+CAGI,yCAAyC,IAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,2CACpE,QAAQ,MAAM,CAAC;AAAA,qEACW,QAAQ,MAAM,CAAC;AAAA,kEAClB,QAAQ,MAAM,CAAC,wBAAwB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAM5G,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,gFAGyD,QAAQ,MAAM,CAAC;AAAA,0GACW,QAAQ,MAAM,CAAC;AAAA,uGAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,uGAEjC,QAAQ,MAAM,CAAC;AAAA;AAAA,0GAEZ,QAAQ,MAAM,CAAC;AAAA,sGACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,kJACW,QAAQ,MAAM,CAAC;AAAA,8IACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,4GACnE,QAAQ,MAAM,CAAC;AAAA,wGACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qIACJ,QAAQ,MAAM,CAAC;AAAA,kIAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,2JACR,QAAQ,MAAM,CAAC;AAAA,wJAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,kHACvE,QAAQ,MAAM,CAAC;AAAA,+GAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,oIACZ,QAAQ,MAAM,CAAC;AAAA,iIAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,gJAElB,QAAQ,MAAM,CAAC;AAAA,uLACwB,QAAQ,MAAM,CAAC;AAAA,oLAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,wFAG7H,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAI7F,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,wEAIX,QAAQ,MAAM,CAAC;AAAA;AAAA,qHAE8B,QAAQ,MAAM,CAAC;AAAA,kHAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,uHAC5B,QAAQ,MAAM,CAAC;AAAA,oHAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,wIACb,QAAQ,MAAM,CAAC;AAAA,oIACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,wIAC7B,QAAQ,MAAM,CAAC;AAAA,qIAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,+HAEvC,QAAQ,IAAI,CAAC;AAAA,2HACjB,QAAQ,IAAI,CAAC;AAAA,iHACvB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,gHAClC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,gHACjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,0DAGvF,QAAQ,MAAM,CAAC;AAAA;AAAA,qGAE4B,QAAQ,MAAM,CAAC;AAAA,kGAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,8JAC2B,QAAQ,MAAM,CAAC;AAAA,2JAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,gHAC5E,QAAQ,MAAM,CAAC;AAAA,6GAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,sHAExB,QAAQ,IAAI,CAAC;AAAA,kHACjB,QAAQ,IAAI,CAAC;AAAA,8FACjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,iHACd,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,oNACkE,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,6EAEhN,QAAQ,MAAM,CAAC;AAAA;AAAA,wHAE4B,QAAQ,MAAM,CAAC;AAAA,qHAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,wHAC9B,QAAQ,MAAM,CAAC;AAAA,qHAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,gIACtB,QAAQ,MAAM,CAAC;AAAA,6HAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,mHAC3C,QAAQ,MAAM,CAAC;AAAA,+GACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,mHAC7B,QAAQ,MAAM,CAAC;AAAA,+GACnB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,4GACpC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,wFAIrD,QAAQ,MAAM,CAAC;AAAA;AAAA,sIAE+B,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qHAClD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,0GAC5C,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,mKACwB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,4JACxC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,sJACvC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,iIACtD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,4FACtE,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qGACxB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,yDAG7E,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAOzB,uBAAuB,IAAI,CAAC,YAAY,QAAQ,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,+CAGpE,QAAQ,MAAM,CAAC;AAAA,yEACW,QAAQ,MAAM,CAAC;AAAA,sEAClB,QAAQ,MAAM,CAAC,oBAAoB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,6CAGzE,aAAa,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,2EACxB,QAAQ,MAAM,CAAC,kBAAkB,QAAQ,IAAI,CAAC;AAAA;AAAA,iHAER,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,oFAI1C,QAAQ,MAAM,CAAC;AAAA;AAAA,mIAEgC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,4GACxD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,iGAC5C,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,8IACY,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,6JAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,6GACjF,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,kGAC5C,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,mFAChD,QAAQ,MAAM,CAAC;AAAA,0GACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,+GAE5B,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,+IACD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,qJAC3B,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,2JAC3B,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,sHACtE,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,wHAC/B,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,kGAEvD,QAAQ,MAAM,CAAC;AAAA;AAAA,gJAE+B,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,gJACjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA,qHAE5D,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,mGACnD,QAAQ,MAAM,CAAC;AAAA,0HACQ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,uJACJ,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,yIAC/C,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,iQACmE,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMhU,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA,qLAE8J,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,YAGxL,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,YAIf,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIrD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,YAIjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKnC,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,UAIf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,UAKf,QAAQ,MAAM,CAAC;AAAA,UACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,gFAGyD,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,QAIzG,QAAQ,MAAM,CAAC;AAAA,QACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,QAKb,QAAQ,MAAM,CAAC;AAAA,QACf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,qEAIgD,QAAQ,IAAI,CAAC;AAAA,yEACT,QAAQ,IAAI,CAAC;AAAA,wFACE,QAAQ,IAAI,CAAC;AAAA,+CACtD,iCAAiC,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC;AAAA;AAAA;AAAA,+BAGvE,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,yCAGH,yBAAyB;AAAA;AAAA;AAAA,+BAGnC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAmEhC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UASf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+BAgDQ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAmBhC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0IAYiH,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sIAOjB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uDAO5F,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA,kFAIY,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uEAexB,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uFA+BC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,8FAKN,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIjG,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yGAMkF,QAAQ,IAAI,CAAC;AAAA,oJAC8B,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6GAYpD,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,kIAGQ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gGAS/C,QAAQ,IAAI,CAAC;AAAA,+IACkC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,gGAG5D,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,yGAGJ,QAAQ,IAAI,CAAC;AAAA;AAAA,yGAEb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,2GAGX,QAAQ,IAAI,CAAC;AAAA;AAAA,2GAEb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,8GAKV,QAAQ,IAAI,CAAC;AAAA;AAAA,8GAEb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,iHAKV,QAAQ,IAAI,CAAC;AAAA;AAAA,iHAEb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,4GAGlB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8GA8BX,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,mIAGQ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oGAS5C,QAAQ,IAAI,CAAC;AAAA,qKACoD,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,6FAIrF,QAAQ,IAAI,CAAC;AAAA,mMACyF,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,0GAKtG,QAAQ,IAAI,CAAC;AAAA,uJACgC,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,iJAKnB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,iGAK7D,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6FASjB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMhG,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oGAY6E,QAAQ,IAAI,CAAC;AAAA;AAAA,oHAEG,QAAQ,IAAI,CAAC;AAAA,gGACjC,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,oGAC7B,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,oGAKf,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qGAQZ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,qGAKb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kGAiChB,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMvG,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQX,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UASb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UASb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UASb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UASb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UASb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,UAIb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,iFAG0D,QAAQ,MAAM,CAAC;AAAA;AAAA;AAAA,UAGtF,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAgB/B,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMxB;AACD;AAEA,SAAS,eAAe,OAAyB;AAC/C,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACnB;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,6CAA6C,KAAK,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,QAAQ,OAAuB;AACtC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,eAAe,OAAe,UAA0B;AAC/D,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,WAAW,IAAI,QAAQ;AAC3B,SAAO,IAAI,SAAS;AACtB;AAQA,eAAsB,uBAAsC;AAC1D,QAAM,WACJ,QAAQ,IAAI,oCACZ,QAAQ,IAAI,+BACZ,QAAQ,IAAI;AACd,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,UAAU;AAAA,IAC5C,GAAI,QAAQ,IAAI,oBAAoB,KAAK,IACrC,EAAE,cAAc,QAAQ,IAAI,mBAAmB,KAAK,EAAE,IACtD,CAAC;AAAA,EACP,CAAC;AACD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;AAEA,IAAI,YAAY,KAAM,OAAM,qBAAqB;","names":["routine","sql"]}