@opengeni/db 6.0.1 → 6.0.3

package/dist/{chunk-MAMBI2HR.js → chunk-JPYN5XKV.js}

@@ -830,7 +830,10 @@ function parseBatchedBackfillMigration(file, sqlText) {
     statement
   };
 }
-async function executeMigrationFile(sql, file, sqlText) {
+async function executeMigrationFile(sql, file, sqlText, options) {
+  if (file === "0000_initial.sql" && options?.preinstalledVector) {
+    sqlText = await initialMigrationWithPreinstalledVector(sql, sqlText);
+  }
   if (sqlText.includes(SKILL_METADATA_MIGRATION_MARKER)) {
     if (file !== "0433_unified_skill_lifecycle.sql")
       throw new Error("Skill metadata stage is restricted to migration 0433");
@@ -903,6 +906,7 @@ async function executeMigrationFile(sql, file, sqlText) {
   if (!concurrentIndex) {
     await sql.unsafe(
       `SELECT
+  pg_catalog.set_config('lock_timeout', '5s', true),
   pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),
   pg_catalog.set_config('opengeni.session_variable_set_attachments_v1', '1', true);
 ${file === "0434_ordered_model_history.sql" ? "SET CONSTRAINTS ALL IMMEDIATE;\n" : ""}${sqlText}`
@@ -929,6 +933,36 @@ ${file === "0434_ordered_model_history.sql" ? "SET CONSTRAINTS ALL IMMEDIATE;\n"
     await sql`select set_config('lock_timeout', '0', false)`;
   }
 }
+var initialExtensionPreamble = "CREATE EXTENSION IF NOT EXISTS pgcrypto;\nCREATE EXTENSION IF NOT EXISTS vector;\n";
+async function initialMigrationWithPreinstalledVector(sql, sqlText) {
+  if (!sqlText.startsWith(initialExtensionPreamble)) {
+    throw new Error("0000 initial extension preamble changed; review managed Postgres admission");
+  }
+  const [installed] = await sql`
+    SELECT EXISTS (
+      SELECT 1 FROM pg_catalog.pg_extension extension
+      JOIN pg_catalog.pg_namespace namespace ON namespace.oid = extension.extnamespace
+      JOIN pg_catalog.pg_type type ON type.typnamespace = namespace.oid AND type.typname = 'vector'
+      JOIN pg_catalog.pg_depend dependency
+        ON dependency.classid = 'pg_catalog.pg_type'::regclass
+       AND dependency.objid = type.oid
+       AND dependency.refclassid = 'pg_catalog.pg_extension'::regclass
+       AND dependency.refobjid = extension.oid AND dependency.deptype = 'e'
+      WHERE extension.extname = 'vector' AND namespace.nspname = 'public'
+    ) AS present
+  `;
+  if (!installed?.present) {
+    throw new Error("Preinstalled public pgvector extension and type are required");
+  }
+  return "CREATE EXTENSION IF NOT EXISTS pgcrypto;\n" + sqlText.slice(initialExtensionPreamble.length);
+}
+function preinstalledVectorPolicy(options) {
+  if (options !== void 0) return options.preinstalledVector === true;
+  const configured = process.env.OPENGENI_MIGRATIONS_PREINSTALLED_VECTOR;
+  if (configured === void 0 || configured === "false") return false;
+  if (configured === "true") return true;
+  throw new Error("OPENGENI_MIGRATIONS_PREINSTALLED_VECTOR must be true or false");
+}
 function deploymentDepthPolicy(options) {
   const raw = options === void 0 ? process.env.OPENGENI_MAX_NESTED_AGENT_DEPTH?.trim() || void 0 : options.maxNestedAgentDepth;
   if (raw === void 0) {
@@ -1001,6 +1035,7 @@ async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_UR
   const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), "../drizzle");
   const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(".sql")).sort();
   const depthPolicy = deploymentDepthPolicy(runtimeOptions);
+  const preinstalledVector = preinstalledVectorPolicy(runtimeOptions);
   const sql = postgres(databaseUrl, { max: 1 });
   try {
     await sql`SELECT pg_advisory_lock(727458)`;
@@ -1041,7 +1076,7 @@ async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_UR
       if (sqlText === void 0) {
         throw new Error(`Pending migration source was not loaded: ${file}`);
       }
-      await executeMigrationFile(sql, file, sqlText);
+      await executeMigrationFile(sql, file, sqlText, { preinstalledVector });
       await sql`INSERT INTO "schema_migrations" ("name") VALUES (${file}) ON CONFLICT DO NOTHING`;
     }
     await persistDeploymentDepthPolicy(sql, depthPolicy);
@@ -1061,8 +1096,9 @@ export {
   parseConcurrentIndexMigration,
   parseBatchedBackfillMigration,
   executeMigrationFile,
+  initialMigrationWithPreinstalledVector,
   migrationApplicationRoles,
   migrate,
   runMigrations
 };
-//# sourceMappingURL=chunk-MAMBI2HR.js.map
+//# sourceMappingURL=chunk-JPYN5XKV.js.map

package/dist/chunk-JPYN5XKV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrate.ts","../src/skill-metadata-migration.ts","../src/knowledge-migration.ts","../src/skill-config-migration.ts","../src/migration-runner-settings.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport postgres from \"postgres\";\nimport { KNOWLEDGE_MIGRATION_MARKER, migrateRetainedKnowledge } from \"./knowledge-migration\";\nimport { migrateLegacySkillConfigurations } from \"./skill-config-migration\";\nimport { batchedBackfillTransactionLocalSetting } from \"./migration-runner-settings\";\nimport {\n  SKILL_METADATA_MIGRATION_MARKER,\n  createSkillMetadataMigrationStage,\n  stageSkillMetadataMigration,\n} from \"./skill-metadata-migration\";\n\nconst DEFAULT_DATABASE_URL = \"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\";\nconst DEFAULT_MAX_NESTED_AGENT_DEPTH = 3;\nconst MAX_NESTED_AGENT_DEPTH = 2_147_483_647;\nconst DEFAULT_APPLICATION_DATABASE_ROLE = \"opengeni_app\";\nconst MIGRATION_APPLICATION_ROLES_SETTING = \"opengeni.migration_application_roles\";\nconst MAX_MIGRATION_APPLICATION_ROLES = 16;\nconst batchedBackfillDirective =\n  /^-- opengeni:batched-backfill batch-size=(\\d+) lock-timeout=(\\d+(?:ms|s|min)) statement-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexStatement =\n  /^CREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+CONCURRENTLY\\s+(?:(IF\\s+NOT\\s+EXISTS)\\s+)?(?:\"((?:[^\"]|\"\")+)\"|([A-Za-z_][A-Za-z0-9_]*))\\s+ON\\b/is;\nconst governedLegacyConcurrentIndexMigrations = new Set([\n  \"0066_session_interruption_attempt_lookup.sql\",\n  \"0070_session_event_type_sequence_lookup.sql\",\n  \"0071_session_event_monitoring_tail.sql\",\n  \"0072_sessions_workspace_created_id_idx.sql\",\n  \"0073_sessions_workspace_updated_id_idx.sql\",\n  \"0075_sessions_workspace_activity_revision_idx.sql\",\n  \"0077_session_attempt_latest_lookup.sql\",\n]);\nexport interface ConcurrentIndexMigration {\n  indexName: string;\n  lockTimeout: string;\n  skipWhenValid: boolean;\n  statement: string;\n}\n\nexport type MigrationRuntimeOptions = {\n  maxNestedAgentDepth?: number;\n  /**\n   * For managed Postgres where an administrator preinstalls pgvector but the\n   * migration owner cannot execute CREATE EXTENSION, verify the public vector\n   * type and omit only 0000's exact vector installation statement. The default\n   * continues to execute the shipped migration verbatim.\n   */\n  preinstalledVector?: boolean;\n  /**\n   * Exact database login roles that may run an OpenGeni API or worker against\n   * this target. Maintenance cutovers use this list to reject a live mixed-\n   * version fleet, and rolling ACL migrations use it to preserve old-binary\n   * readiness until later role provisioning converges. Dedicated-schema and\n   * custom-role deployments must supply it.\n   */\n  applicationDatabaseRoles?: string[];\n};\n\ntype DeploymentDepthPolicy = {\n  maxNestedAgentDepth: number;\n  source: \"deployment\" | \"default\";\n};\n\n/** A bare Postgres identifier (schema/role name) safe to interpolate into DDL. */\nfunction assertIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\n/**\n * Most migration files intentionally execute as one implicit transaction.\n * PostgreSQL forbids CREATE INDEX CONCURRENTLY there, so a migration may opt\n * into one narrowly validated transactionless statement with:\n *\n *   -- opengeni:concurrent-index lock-timeout=5s\n *   CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS ...;\n *\n * The directive is deliberately not a generic \"no transaction\" escape hatch:\n * only one idempotent concurrent-index statement is accepted, lock acquisition\n * is always bounded, and an invalid artifact left by a failed concurrent build\n * is removed before retry. Seven governed historical migrations predate the\n * IF NOT EXISTS rule; only those exact filenames may use their immutable bare\n * statements, and the runner makes their retries idempotent by skipping an\n * already-valid index. This keeps additive large-table indexes online without\n * rewriting shipped history or making arbitrary partially-applied migration\n * scripts possible.\n */\nexport function parseConcurrentIndexMigration(\n  file: string,\n  sqlText: string,\n): ConcurrentIndexMigration | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const firstLine = lines[0]?.trim() ?? \"\";\n  const deploymentPrefixed = /^-- deployment-mode: (?:rolling|maintenance)$/.test(firstLine);\n  const directiveIndex = deploymentPrefixed ? 1 : 0;\n  const directiveLine = lines[directiveIndex]?.trim() ?? \"\";\n  const directive = concurrentIndexDirective.exec(directiveLine);\n  if (!directive) {\n    if (directiveLine.startsWith(\"-- opengeni:\")) {\n      throw new Error(`Unsupported OpenGeni migration directive in ${file}`);\n    }\n    return null;\n  }\n\n  const lockTimeout = directive[1]!;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const parsedStatement = concurrentIndexStatement.exec(withoutTrailingSemicolon);\n  if (!parsedStatement || withoutTrailingSemicolon.includes(\";\")) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires exactly one CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS statement with an unqualified index name`,\n    );\n  }\n  const idempotentInSql = parsedStatement[1] !== undefined;\n  if (!idempotentInSql && !governedLegacyConcurrentIndexMigrations.has(file)) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires IF NOT EXISTS; bare statements are supported only for governed historical migrations`,\n    );\n  }\n  return {\n    indexName: (parsedStatement[2] ?? parsedStatement[3]!).replaceAll('\"\"', '\"'),\n    lockTimeout,\n    skipWhenValid: !idempotentInSql,\n    statement,\n  };\n}\n\nexport function parseBatchedBackfillMigration(\n  file: string,\n  sqlText: string,\n): { batchSize: number; lockTimeout: string; statementTimeout: string; statement: string } | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const directiveIndex = /^-- deployment-mode: (?:rolling|maintenance)$/.test(\n    lines[0]?.trim() ?? \"\",\n  )\n    ? 1\n    : 0;\n  const directive = batchedBackfillDirective.exec(lines[directiveIndex]?.trim() ?? \"\");\n  if (!directive) return null;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .filter((line) => !line.trim().startsWith(\"--\"))\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const batchSize = Number(directive[1]!);\n  if (\n    !Number.isSafeInteger(batchSize) ||\n    batchSize < 1 ||\n    batchSize > 10_000 ||\n    !/^WITH\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bUPDATE\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bRETURNING\\b/is.test(withoutTrailingSemicolon) ||\n    !new RegExp(`\\\\bLIMIT\\\\s+${batchSize}\\\\b`, \"i\").test(withoutTrailingSemicolon) ||\n    withoutTrailingSemicolon.includes(\";\")\n  ) {\n    throw new Error(\n      `${file}: opengeni:batched-backfill requires one bounded WITH ... UPDATE ... RETURNING statement whose LIMIT matches batch-size`,\n    );\n  }\n  return {\n    batchSize,\n    lockTimeout: directive[2]!,\n    statementTimeout: directive[3]!,\n    statement,\n  };\n}\n\nexport async function executeMigrationFile(\n  sql: postgres.Sql,\n  file: string,\n  sqlText: string,\n  options?: Pick<MigrationRuntimeOptions, \"preinstalledVector\">,\n): Promise<void> {\n  if (file === \"0000_initial.sql\" && options?.preinstalledVector) {\n    sqlText = await initialMigrationWithPreinstalledVector(sql, sqlText);\n  }\n  if (sqlText.includes(SKILL_METADATA_MIGRATION_MARKER)) {\n    if (file !== \"0433_unified_skill_lifecycle.sql\")\n      throw new Error(\"Skill metadata stage is restricted to migration 0433\");\n    const parts = sqlText.split(SKILL_METADATA_MIGRATION_MARKER);\n    if (parts.length !== 2) throw new Error(\"0433 requires exactly one Skill metadata stage\");\n    await sql.begin(async (transaction) => {\n      await createSkillMetadataMigrationStage(transaction);\n      await transaction`SELECT\n        pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2','1',true),\n        pg_catalog.set_config('opengeni.session_variable_set_attachments_v1','1',true)`;\n      await transaction.unsafe(parts[0]!);\n      await stageSkillMetadataMigration(transaction);\n      await migrateLegacySkillConfigurations(transaction);\n      await transaction.unsafe(parts[1]!);\n      // Unlike historical one-query migrations, include this hook's ledger\n      // receipt in the same transaction so retry cannot rerun committed DDL.\n      await transaction`INSERT INTO schema_migrations(name) VALUES(${file}) ON CONFLICT DO NOTHING`;\n    });\n    return;\n  }\n  if (sqlText.includes(KNOWLEDGE_MIGRATION_MARKER)) {\n    if (file !== \"0461_unified_knowledge.sql\")\n      throw new Error(\"Knowledge conversion is restricted to migration 0461\");\n    const parts = sqlText.split(KNOWLEDGE_MIGRATION_MARKER);\n    if (parts.length !== 2) throw new Error(\"0461 requires exactly one Knowledge conversion stage\");\n    await sql.begin(async (transaction) => {\n      await transaction`CREATE TEMP TABLE knowledge_conversion_0461(completed boolean NOT NULL) ON COMMIT DROP`;\n      await transaction`SELECT\n        pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2','1',true),\n        pg_catalog.set_config('opengeni.session_variable_set_attachments_v1','1',true)`;\n      await transaction.unsafe(parts[0]!);\n      await migrateRetainedKnowledge(transaction);\n      await transaction`INSERT INTO pg_temp.knowledge_conversion_0461 VALUES(true)`;\n      await transaction.unsafe(parts[1]!);\n      await transaction`INSERT INTO schema_migrations(name) VALUES(${file}) ON CONFLICT DO NOTHING`;\n    });\n    return;\n  }\n  const batchedBackfill = parseBatchedBackfillMigration(file, sqlText);\n  if (batchedBackfill) {\n    await sql`select set_config('lock_timeout', ${batchedBackfill.lockTimeout}, false)`;\n    await sql`select set_config('statement_timeout', ${batchedBackfill.statementTimeout}, false)`;\n    try {\n      for (;;) {\n        const result = await sql.begin(async (transaction) => {\n          const transactionLocalSetting = batchedBackfillTransactionLocalSetting(file);\n          await transaction`select\n            pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),\n            pg_catalog.set_config(\n              'opengeni.session_variable_set_attachments_v1',\n              '1',\n              true\n            )`;\n          if (transactionLocalSetting) {\n            await transaction`select pg_catalog.set_config(\n              ${transactionLocalSetting.guc},\n              ${transactionLocalSetting.value},\n              true\n            )`;\n          }\n          return await transaction.unsafe(batchedBackfill.statement);\n        });\n        if (result.length === 0) break;\n      }\n    } finally {\n      await sql`select set_config('statement_timeout', '0', false)`;\n      await sql`select set_config('lock_timeout', '0', false)`;\n    }\n    return;\n  }\n  const concurrentIndex = parseConcurrentIndexMigration(file, sqlText);\n  if (!concurrentIndex) {\n    // Migration SQL is the only writer allowed to cross protocol generations.\n    // Keep the authority transaction-local and inside the same PostgreSQL simple\n    // query as the migration body: setting it in a prior statement would end\n    // that implicit transaction and silently lose the LOCAL value. This also\n    // makes a fresh database capable of applying maintenance migration 0138\n    // and later migrations capable of crossing the 0352 sessions policy\n    // without a process-global PGOPTIONS escape hatch.\n    // Bound ordinary DDL lock acquisition in that same implicit transaction.\n    // The migration body follows this preamble, so its own SET LOCAL can still\n    // override the default; a lock timeout aborts the whole body before the\n    // caller writes its separate success receipt.\n    await sql.unsafe(\n      `SELECT\n  pg_catalog.set_config('lock_timeout', '5s', true),\n  pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),\n  pg_catalog.set_config('opengeni.session_variable_set_attachments_v1', '1', true);\\n${file === \"0434_ordered_model_history.sql\" ? \"SET CONSTRAINTS ALL IMMEDIATE;\\n\" : \"\"}${sqlText}`,\n    );\n    return;\n  }\n\n  await sql`select set_config('lock_timeout', ${concurrentIndex.lockTimeout}, false)`;\n  try {\n    const [existing] = await sql<Array<{ valid: boolean; ready: boolean }>>`\n      select i.indisvalid as valid, i.indisready as ready\n      from pg_catalog.pg_class c\n      join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n      join pg_catalog.pg_index i on i.indexrelid = c.oid\n      where n.nspname = current_schema() and c.relname = ${concurrentIndex.indexName}\n    `;\n    if (existing && (!existing.valid || !existing.ready)) {\n      const quotedIndexName = `\"${concurrentIndex.indexName.replaceAll('\"', '\"\"')}\"`;\n      await sql.unsafe(`DROP INDEX CONCURRENTLY ${quotedIndexName}`);\n    } else if (existing && concurrentIndex.skipWhenValid) {\n      return;\n    }\n    await sql.unsafe(concurrentIndex.statement);\n  } finally {\n    await sql`select set_config('lock_timeout', '0', false)`;\n  }\n}\n\nconst initialExtensionPreamble =\n  \"CREATE EXTENSION IF NOT EXISTS pgcrypto;\\nCREATE EXTENSION IF NOT EXISTS vector;\\n\";\n\n/** Never rewrite arbitrary migrations or trust a same-named type in another schema. */\nexport async function initialMigrationWithPreinstalledVector(\n  sql: postgres.Sql,\n  sqlText: string,\n): Promise<string> {\n  if (!sqlText.startsWith(initialExtensionPreamble)) {\n    throw new Error(\"0000 initial extension preamble changed; review managed Postgres admission\");\n  }\n  const [installed] = await sql<Array<{ present: boolean }>>`\n    SELECT EXISTS (\n      SELECT 1 FROM pg_catalog.pg_extension extension\n      JOIN pg_catalog.pg_namespace namespace ON namespace.oid = extension.extnamespace\n      JOIN pg_catalog.pg_type type ON type.typnamespace = namespace.oid AND type.typname = 'vector'\n      JOIN pg_catalog.pg_depend dependency\n        ON dependency.classid = 'pg_catalog.pg_type'::regclass\n       AND dependency.objid = type.oid\n       AND dependency.refclassid = 'pg_catalog.pg_extension'::regclass\n       AND dependency.refobjid = extension.oid AND dependency.deptype = 'e'\n      WHERE extension.extname = 'vector' AND namespace.nspname = 'public'\n    ) AS present\n  `;\n  if (!installed?.present) {\n    throw new Error(\"Preinstalled public pgvector extension and type are required\");\n  }\n  return (\n    \"CREATE EXTENSION IF NOT EXISTS pgcrypto;\\n\" + sqlText.slice(initialExtensionPreamble.length)\n  );\n}\n\nfunction preinstalledVectorPolicy(options: MigrationRuntimeOptions | undefined): boolean {\n  if (options !== undefined) return options.preinstalledVector === true;\n  const configured = process.env.OPENGENI_MIGRATIONS_PREINSTALLED_VECTOR;\n  if (configured === undefined || configured === \"false\") return false;\n  if (configured === \"true\") return true;\n  throw new Error(\"OPENGENI_MIGRATIONS_PREINSTALLED_VECTOR must be true or false\");\n}\n\nfunction deploymentDepthPolicy(\n  options: MigrationRuntimeOptions | undefined,\n): DeploymentDepthPolicy {\n  const raw =\n    options === undefined\n      ? process.env.OPENGENI_MAX_NESTED_AGENT_DEPTH?.trim() || undefined\n      : options.maxNestedAgentDepth;\n  if (raw === undefined) {\n    return { maxNestedAgentDepth: DEFAULT_MAX_NESTED_AGENT_DEPTH, source: \"default\" };\n  }\n  const value = typeof raw === \"number\" ? raw : Number(raw);\n  if (\n    !Number.isSafeInteger(value) ||\n    value < 0 ||\n    value > MAX_NESTED_AGENT_DEPTH ||\n    (typeof raw === \"string\" && !/^(0|[1-9][0-9]*)$/.test(raw))\n  ) {\n    throw new Error(\n      `OPENGENI_MAX_NESTED_AGENT_DEPTH must be a non-negative 32-bit integer: ${raw}`,\n    );\n  }\n  return { maxNestedAgentDepth: value, source: \"deployment\" };\n}\n\nexport function migrationApplicationRoles(\n  schema: string | undefined,\n  options: MigrationRuntimeOptions | undefined,\n): string[] {\n  const configured = options?.applicationDatabaseRoles;\n  const environment = process.env.OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES?.trim();\n  const explicit =\n    configured !== undefined\n      ? configured\n      : environment\n        ? environment.split(\",\").map((role) => role.trim())\n        : undefined;\n\n  if (!explicit) {\n    const configuredRuntimeRoles = [\n      process.env.OPENGENI_APP_DATABASE_USER?.trim(),\n      process.env.OPENGENI_RUNTIME_DATABASE_ROLE?.trim(),\n    ].filter((role): role is string => Boolean(role) && role !== DEFAULT_APPLICATION_DATABASE_ROLE);\n    if (schema || configuredRuntimeRoles.length > 0) {\n      throw new Error(\n        \"Pending migrations require the exact application database roles via \" +\n          \"MigrationRuntimeOptions.applicationDatabaseRoles or \" +\n          \"OPENGENI_MIGRATION_APPLICATION_DATABASE_ROLES for dedicated-schema or custom-role deployments\",\n      );\n    }\n    return [DEFAULT_APPLICATION_DATABASE_ROLE];\n  }\n\n  if (\n    configured !== undefined &&\n    configured.some((role) => typeof role !== \"string\" || role !== role.trim())\n  ) {\n    throw new Error(\n      \"MigrationRuntimeOptions.applicationDatabaseRoles must contain canonical Postgres role names without surrounding whitespace\",\n    );\n  }\n  if (explicit.length < 1 || explicit.length > MAX_MIGRATION_APPLICATION_ROLES) {\n    throw new Error(\n      `Migration application database roles must contain 1-${MAX_MIGRATION_APPLICATION_ROLES} entries`,\n    );\n  }\n  const normalized = [...new Set(explicit)].sort((left, right) =>\n    Buffer.compare(Buffer.from(left, \"utf8\"), Buffer.from(right, \"utf8\")),\n  );\n  if (\n    normalized.length !== explicit.length ||\n    normalized.some((role) => role.length === 0 || Buffer.byteLength(role, \"utf8\") > 63)\n  ) {\n    throw new Error(\n      \"Migration application database roles must be unique, non-empty Postgres role names of at most 63 UTF-8 bytes\",\n    );\n  }\n  return normalized;\n}\n\nasync function persistDeploymentDepthPolicy(\n  sql: postgres.Sql,\n  policy: DeploymentDepthPolicy,\n): Promise<void> {\n  const [relation] = await sql<{ exists: boolean }[]>`\n    select to_regclass('nested_agent_depth_configuration') is not null as exists\n  `;\n  if (!relation?.exists) return;\n  await sql`\n    insert into \"nested_agent_depth_configuration\" (\n      \"singleton\", \"max_nested_agent_depth\", \"policy_source\", \"updated_at\"\n    ) values (true, ${policy.maxNestedAgentDepth}, ${policy.source}, now())\n    on conflict (\"singleton\") do update\n    set \"max_nested_agent_depth\" = excluded.\"max_nested_agent_depth\",\n        \"policy_source\" = excluded.\"policy_source\",\n        \"updated_at\" = now()\n    where \"nested_agent_depth_configuration\".\"max_nested_agent_depth\"\n            is distinct from excluded.\"max_nested_agent_depth\"\n       or \"nested_agent_depth_configuration\".\"policy_source\"\n            is distinct from excluded.\"policy_source\"\n  `;\n}\n\n/**\n * Apply the OpenGeni SQL migration chain.\n *\n * STANDALONE (default, unchanged): `migrate()` / `migrate(databaseUrl)` runs the\n * whole chain with NO search_path manipulation, so every unqualified\n * table/index/policy lands in the server default schema (`public`). This is the\n * byte-for-byte historical behavior — the migration test suite calls\n * `migrate(DB_URL)` and is unaffected.\n *\n * EMBEDDED SCHEMA MODE: pass a `schema` (or set\n * `OPENGENI_DB_SCHEMA`). The migrate session then `CREATE SCHEMA IF NOT EXISTS`\n * for both `<schema>` and `opengeni_private`, and sets\n * `search_path = \"<schema>\", \"opengeni_private\", \"public\"`, so EVERY unqualified\n * DDL statement lands in the dedicated schema with NO per-statement SQL rewrite\n * (the schema-isolation contract). Two things make this work and stay idempotent:\n *   1. The policy-existence guards in the migration SQL use `current_schema()`\n *      (not a hardcoded `'public'`) — so a re-run finds the policy it already\n *      created in `<schema>` and DROP/CREATEs idempotently instead of failing\n *      with \"policy already exists\". (This guard substitution is the migrate-\n *      time enabler for the runtime search_path approach; without it the SDK\n *      entry point silently fails on re-run — the migration replay hazard.)\n *   2. `public` stays LAST on the path so `gen_random_uuid()` (pgcrypto) and the\n *      `vector` type — both installed into `public` by 0000 — still resolve. The\n *      `opengeni_private.*` helpers are always called with an absolute prefix.\n * Dedicated-schema callers must also pass the exact API/worker database login\n * identities in `applicationDatabaseRoles`; maintenance cutovers cannot infer\n * host-managed or scoped runtime roles from the admin connection.\n *\n * `OPENGENI_DB_SCHEMA` defaults UNSET → `public` → standalone, so the default\n * binding never regresses.\n */\nexport async function migrate(\n  databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_URL ??\n    DEFAULT_DATABASE_URL,\n  schema: string | undefined = process.env.OPENGENI_DB_SCHEMA?.trim() || undefined,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), \"../drizzle\");\n  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(\".sql\")).sort();\n  const depthPolicy = deploymentDepthPolicy(runtimeOptions);\n  const preinstalledVector = preinstalledVectorPolicy(runtimeOptions);\n  const sql = postgres(databaseUrl, { max: 1 });\n  try {\n    // Serialize concurrent migrate() runs; the session-level lock is released\n    // when the connection closes.\n    await sql`SELECT pg_advisory_lock(727458)`;\n    if (schema) {\n      assertIdentifier(\"OPENGENI_DB_SCHEMA\", schema);\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"${schema}\"`);\n      // opengeni_private is also created by 0001 with an absolute prefix, but the\n      // session search_path must already resolve it for the policy predicates\n      // and the SECURITY DEFINER functions that inherit the caller's path.\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"opengeni_private\"`);\n      await sql.unsafe(`SET search_path = \"${schema}\", \"opengeni_private\", \"public\"`);\n    }\n    await sql`select set_config('opengeni.max_nested_agent_depth', ${String(depthPolicy.maxNestedAgentDepth)}, false)`;\n    await sql`select set_config('opengeni.nested_agent_depth_policy_source', ${depthPolicy.source}, false)`;\n    await sql.unsafe(\n      `CREATE TABLE IF NOT EXISTS \"schema_migrations\" (\"name\" text PRIMARY KEY, \"applied_at\" timestamptz NOT NULL DEFAULT now())`,\n    );\n    const appliedRows = await sql`SELECT \"name\" FROM \"schema_migrations\"`;\n    const applied = new Set(appliedRows.map((row) => row.name as string));\n    const pendingMigrationSources = new Map<string, string>();\n    for (const file of files) {\n      if (!applied.has(file)) {\n        pendingMigrationSources.set(file, await readFile(join(migrationsDir, file), \"utf8\"));\n      }\n    }\n    // Initialize this session GUC for every pending migration that consumes it,\n    // instead of maintaining a second filename list that can silently lag the\n    // shipped migration chain. The conservative source marker is intentional:\n    // setting the bounded role list for a migration that only mentions the GUC\n    // is harmless, while omitting it makes an otherwise valid upgrade fail.\n    if (\n      Array.from(pendingMigrationSources.values()).some((source) =>\n        source.includes(MIGRATION_APPLICATION_ROLES_SETTING),\n      )\n    ) {\n      const applicationRoles = migrationApplicationRoles(schema, runtimeOptions);\n      await sql`select set_config(\n        ${MIGRATION_APPLICATION_ROLES_SETTING},\n        ${JSON.stringify(applicationRoles)},\n        false\n      )`;\n    }\n    for (const file of files) {\n      if (applied.has(file)) {\n        continue;\n      }\n      const sqlText = pendingMigrationSources.get(file);\n      if (sqlText === undefined) {\n        throw new Error(`Pending migration source was not loaded: ${file}`);\n      }\n      await executeMigrationFile(sql, file, sqlText, { preinstalledVector });\n      await sql`INSERT INTO \"schema_migrations\" (\"name\") VALUES (${file}) ON CONFLICT DO NOTHING`;\n    }\n    // Reconcile even when all migration names were already recorded. This is\n    // the only supported way to change deployment policy in a live database.\n    await persistDeploymentDepthPolicy(sql, depthPolicy);\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * SDK entry point (Step I): run the migration chain over a host-supplied admin\n * connection string against an explicit target schema. This is the embedded\n * topology's named entry — a host calls `runMigrations(adminConnection,\n * targetSchema, { applicationDatabaseRoles })` from its own provisioning code\n * instead of relying on env vars.\n * `targetSchema` undefined → `public` → standalone behavior. Thin wrapper over\n * `migrate` so there is one migration engine.\n */\nexport async function runMigrations(\n  adminConnection: string,\n  targetSchema?: string,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  await migrate(adminConnection, targetSchema, runtimeOptions);\n}\n\nif (import.meta.main) {\n  await migrate();\n  console.log(\"Applied Drizzle SQL migrations.\");\n}\n","import { readSkillMetadata, type SkillFile } from \"@opengeni/contracts\";\nimport type postgres from \"postgres\";\n\n/** Exact runner seam for 0433, not a general callback or runtime capability. */\nexport const SKILL_METADATA_MIGRATION_MARKER = \"-- opengeni:skill-metadata-stage-v1\";\n\nexport function prepareLegacySkillFolder(\n  files: SkillFile[],\n  legacy: { id: string; title: string; description: string },\n): { files: SkillFile[]; name: string; description: string } {\n  const main = files.find((file) => file.path === \"SKILL.md\");\n  if (!main) throw new Error(`Skill ${legacy.id} requires SKILL.md before migration`);\n  let content = main.content;\n  // A header-looking document is never silently wrapped/repaired: missing end\n  // markers, invalid YAML, invalid metadata and duplicate keys must fail closed.\n  if (!/^\\s*---(?:\\r?\\n|$)/u.test(content)) {\n    const slug = legacy.title\n      .normalize(\"NFKD\")\n      .toLowerCase()\n      .replace(/[^a-z0-9]+/gu, \"-\")\n      .replace(/^-|-$/gu, \"\");\n    const name = slug && slug.length <= 64 ? slug : `legacy-${legacy.id.replaceAll(\"-\", \"\")}`;\n    content = `---\\nname: ${JSON.stringify(name)}\\ndescription: ${JSON.stringify(legacy.description)}\\n---\\n${content}`;\n  }\n  const metadata = readSkillMetadata(content);\n  return {\n    files: files.map((file) => (file.path === \"SKILL.md\" ? { ...file, content } : file)),\n    ...metadata,\n  };\n}\n\nexport async function createSkillMetadataMigrationStage(\n  tx: postgres.TransactionSql,\n): Promise<void> {\n  await tx`CREATE TEMP TABLE skill_metadata_0426 (\n    source_kind text NOT NULL, source_id uuid NOT NULL, account_id uuid NOT NULL,\n    workspace_id uuid, files jsonb NOT NULL, name text NOT NULL, description text NOT NULL\n  ) ON COMMIT DROP`;\n}\n\nexport async function stageSkillMetadataMigration(tx: postgres.TransactionSql): Promise<void> {\n  const sources = await tx<\n    Array<{\n      source_kind: string;\n      source_id: string;\n      account_id: string;\n      workspace_id: string | null;\n      title: string;\n      description: string;\n      files: SkillFile[];\n    }>\n  >`\n    SELECT 'installed' AS source_kind,sf.facet_id AS source_id,i.account_id,i.workspace_id,\n      sf.name AS title,sf.description,\n      coalesce(jsonb_agg(jsonb_build_object('path',ff.path,'content',ff.content) ORDER BY ff.path COLLATE \"C\")\n        FILTER (WHERE ff.id IS NOT NULL),'[]'::jsonb) AS files\n    FROM capability_plugin_installations i JOIN capability_facets f ON f.plugin_version_id=i.plugin_version_id\n    JOIN capability_skill_facets sf ON sf.facet_id=f.id LEFT JOIN capability_skill_files ff ON ff.skill_facet_id=sf.facet_id\n    WHERE i.status='active'\n    GROUP BY i.account_id,i.workspace_id,sf.facet_id\n    UNION ALL\n    SELECT 'authored',h.id,h.account_id,h.scope_workspace_id,r.title,r.description,\n      coalesce(r.skill_files,jsonb_build_array(jsonb_build_object('path','SKILL.md','content',r.content)))\n    FROM preference_registry_preferences h JOIN preference_registry_revisions r\n      ON r.id=h.active_revision_id AND r.preference_id=h.id AND r.account_id=h.account_id\n    WHERE h.status='active'\n  `;\n  for (const source of sources) {\n    let folder: ReturnType<typeof prepareLegacySkillFolder>;\n    try {\n      folder = prepareLegacySkillFolder(source.files, {\n        id: source.source_id,\n        title: source.title,\n        description: source.description,\n      });\n    } catch (cause) {\n      throw new Error(\n        `Skill ${source.source_kind}:${source.source_id} needs explicit frontmatter repair before 0433`,\n        { cause },\n      );\n    }\n    const [valid] = await tx`SELECT skill_files_valid(${tx.json(folder.files)}) AS valid`;\n    if (!valid?.valid)\n      throw new Error(\n        `Skill ${source.source_id} exceeds the valid folder limits after metadata migration`,\n      );\n    await tx`INSERT INTO pg_temp.skill_metadata_0426(source_kind,source_id,account_id,workspace_id,files,name,description)\n      VALUES(${source.source_kind},${source.source_id},${source.account_id},${source.workspace_id},${tx.json(folder.files)},${folder.name},${folder.description})`;\n  }\n}\n","import { prepareLegacySkillFolder } from \"./skill-metadata-migration\";\nimport { createHash } from \"node:crypto\";\nimport type postgres from \"postgres\";\nimport {\n  KnowledgeEntryContent,\n  KnowledgeSourceSyncAction,\n  knowledgeSourceAgentConfig,\n  StoredKnowledgeEntryContent,\n  type KnowledgeEntryScope,\n} from \"@opengeni/contracts\";\nimport {\n  fromPostgresLosslessText,\n  toPostgresLosslessJson,\n  toPostgresLosslessText,\n  LOSSLESS_CONTENT_CODEC_VERSION,\n} from \"./lossless-json\";\n\n/** Maintenance-only conversion. It is not a runtime fallback or a second writer. */\nexport const KNOWLEDGE_MIGRATION_MARKER = \"-- opengeni:unified-knowledge-copy-v1\";\nexport function knowledgeMigrationId(kind: string, id: string): string {\n  const hash = createHash(\"sha256\")\n    .update(`opengeni:knowledge:0461:${kind}:${id}`)\n    .digest(\"hex\")\n    .slice(0, 32);\n  return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-5${hash.slice(13, 16)}-8${hash.slice(17, 20)}-${hash.slice(20)}`;\n}\ntype Owner = {\n  accountId: string;\n  workspaceId: string;\n  scope: KnowledgeEntryScope;\n  subjectId: string | null;\n};\ntype Imported = Owner & {\n  id: string;\n  body: KnowledgeEntryContent;\n  createdAt: Date;\n  status: string;\n  sessionId?: string | null;\n  memoryId?: string;\n  documentId?: string;\n  legacySnapshot?: Record<string, unknown>;\n  legacyDocumentVersionId?: string;\n  legacyClaimId?: string;\n  legacyScopeWorkspaceId?: string | null;\n  originalActor?: Record<string, unknown>;\n  legacyScopeType?: string;\n  roleKey?: string | null;\n  scopeSessionId?: string | null;\n  validFrom?: Date;\n  validUntil?: Date | null;\n};\ntype LegacyMemory = {\n  id: string;\n  account_id: string;\n  workspace_id: string;\n  text: string;\n  text_codec_version: number | null;\n  kind: string;\n  status: string;\n  scope_type: string;\n  scope_subject_id: string | null;\n  scope_role_key: string | null;\n  scope_session_id: string | null;\n  created_by_session_id: string | null;\n  namespace: string;\n  labels: string[];\n  created_at: Date;\n  valid_from: Date;\n  valid_until: Date | null;\n  snapshot: Record<string, unknown>;\n  relationships: Array<{ entryId: string; relation: string }>;\n  confirmed_claim_id: string | null;\n};\ntype LegacyDocument = {\n  id: string;\n  account_id: string;\n  workspace_id: string;\n  file_id: string;\n  base_id: string;\n  base_name: string;\n  title: string;\n  authority_kind: KnowledgeEntryScope;\n  authority_subject_id: string | null;\n  source_uri: string | null;\n  source_external_id: string | null;\n  source_version: string | null;\n  created_at: Date;\n};\n\n/** Resolve only identities that still exist; missing evidence stays in the audit snapshot. */\nasync function migrateMemoryEvidence(\n  tx: postgres.TransactionSql,\n  memory: LegacyMemory,\n): Promise<KnowledgeEntryContent[\"evidence\"]> {\n  const evidence: KnowledgeEntryContent[\"evidence\"] = [];\n  const references = memory.snapshot.source_refs;\n  if (!Array.isArray(references)) return evidence;\n  for (const ref of references) {\n    if (\n      !ref ||\n      typeof ref !== \"object\" ||\n      typeof ref.id !== \"string\" ||\n      !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(ref.id)\n    )\n      continue;\n    let entryId: string | undefined;\n    let passage: string | undefined;\n    if (ref.kind === \"memory\") {\n      const [found] =\n        await tx`SELECT id FROM knowledge_memories WHERE account_id=${memory.account_id} AND id=${ref.id}`;\n      if (found && found.id !== memory.id) entryId = String(found.id);\n    } else if (ref.kind === \"document\" || ref.kind === \"document_chunk\") {\n      const [doc] =\n        ref.kind === \"document_chunk\"\n          ? await tx`SELECT d.id,d.status FROM document_chunks c JOIN documents d ON d.id=c.document_id AND d.account_id=c.account_id\n            WHERE c.account_id=${memory.account_id} AND c.id=${ref.id}`\n          : await tx`SELECT id,status FROM documents WHERE account_id=${memory.account_id} AND id=${ref.id}`;\n      if (doc) {\n        const [version] =\n          await tx`SELECT id FROM knowledge_document_versions WHERE account_id=${memory.account_id}\n          AND document_id=${doc.id} ORDER BY created_at DESC,id DESC LIMIT 1`;\n        // Only these identities are imported below. Failed/queued ordinary\n        // documents have no canonical source yet; preserve their exact reference\n        // in legacySnapshot instead of creating a dangling evidence edge.\n        if (version || doc.status === \"ready\")\n          entryId = knowledgeMigrationId(\n            version ? \"document-version\" : \"document\",\n            String(version?.id ?? doc.id),\n          );\n        if (ref.kind === \"document_chunk\") passage = `Legacy passage ${ref.id}`;\n      }\n    }\n    if (\n      entryId &&\n      !evidence.some((item) => item.entryId === entryId && item.location.passage === passage)\n    ) {\n      evidence.push({\n        entryId,\n        revisionId: knowledgeMigrationId(\"revision\", entryId),\n        location: passage ? { passage } : {},\n      });\n    }\n  }\n  return evidence;\n}\n\nasync function importEntry(tx: postgres.TransactionSql, input: Imported) {\n  const body = StoredKnowledgeEntryContent.parse(input.body);\n  const revisionId = knowledgeMigrationId(\"revision\", input.id);\n  const outcome = [\"active\", \"approved\", \"ready\"].includes(input.status)\n    ? \"published\"\n    : input.status === \"proposed\"\n      ? \"pending\"\n      : \"rejected\";\n  const archived = ![\"active\", \"approved\", \"ready\", \"proposed\"].includes(input.status);\n  const migrationActor = { kind: \"migration\", subjectId: \"service:knowledge-migration:0461\" };\n  const actor = input.originalActor ?? migrationActor;\n  const batchId =\n    outcome === \"pending\"\n      ? knowledgeMigrationId(\n          \"review-batch\",\n          `${input.accountId}:${input.workspaceId}:${input.scope}:${input.subjectId ?? \"\"}:${input.sessionId ?? input.id}`,\n        )\n      : null;\n  if (batchId)\n    await tx`INSERT INTO knowledge_review_batches(id,account_id,origin_workspace_id,owner_key,session_id,created_at)\n    VALUES(${batchId},${input.accountId},${input.workspaceId},${input.scope === \"personal\" ? `personal:${input.subjectId}` : `${input.scope}:${input.workspaceId}`},\n      ${input.sessionId ?? null},${input.createdAt}) ON CONFLICT(id) DO NOTHING`;\n  await tx`INSERT INTO knowledge_entries(id,account_id,origin_workspace_id,scope,scope_workspace_id,scope_subject_id,\n    version,published_revision_id,latest_revision_id,archived,legacy_memory_id,legacy_document_id,\n    legacy_scope_type,legacy_scope_role_key,legacy_scope_session_id,legacy_document_version_id,legacy_claim_id,legacy_scope_workspace_id,valid_from,valid_until,created_at,updated_at)\n    VALUES(${input.id},${input.accountId},${input.workspaceId},${input.scope},${input.scope === \"workspace\" ? input.workspaceId : null},\n      ${input.subjectId},1,${outcome === \"published\" ? revisionId : null},${revisionId},${archived},${input.memoryId ?? null},${input.documentId ?? null},\n      ${input.legacyScopeType ?? null},${input.roleKey ?? null},${input.scopeSessionId ?? null},${input.legacyDocumentVersionId ?? null},${input.legacyClaimId ?? null},${input.legacyScopeWorkspaceId ?? null},${input.validFrom ?? input.createdAt},\n      ${input.validUntil ?? null},${input.createdAt},${input.createdAt})`;\n  await tx`INSERT INTO knowledge_entry_revisions(id,account_id,entry_id,number,body,body_codec_version,preview,preview_codec_version,\n    actor,created_by_session_id,review_batch_id,legacy_snapshot,created_at)\n    VALUES(${revisionId},${input.accountId},${input.id},1,${tx.json(toPostgresLosslessJson(body) as postgres.JSONValue)},\n      ${LOSSLESS_CONTENT_CODEC_VERSION},${toPostgresLosslessText(body.content.slice(0, 512))},${LOSSLESS_CONTENT_CODEC_VERSION},\n      ${tx.json(actor as postgres.JSONValue)},${input.sessionId ?? null},${batchId},${input.legacySnapshot ? tx.json(input.legacySnapshot as postgres.JSONValue) : null},${input.createdAt})`;\n  await tx`INSERT INTO knowledge_entry_decisions(account_id,entry_id,revision_id,version,outcome,actor,created_at)\n    VALUES(${input.accountId},${input.id},${revisionId},1,${outcome},${tx.json(migrationActor)},${input.createdAt})`;\n  await tx`SELECT knowledge_index_revision(${input.accountId},${input.id},${revisionId},\n    ${toPostgresLosslessText(`${body.title}\\n${body.content}`)})`;\n}\n\nasync function importGroup(\n  tx: postgres.TransactionSql,\n  owner: Owner,\n  title: string,\n  sourceKey: string,\n) {\n  const id = knowledgeMigrationId(\n    \"group\",\n    `${owner.accountId}:${owner.scope}:${owner.scope === \"workspace\" ? owner.workspaceId : (owner.subjectId ?? \"\")}:${sourceKey}`,\n  );\n  const [existing] = await tx`SELECT id FROM knowledge_entries WHERE id=${id}`;\n  if (!existing)\n    await importEntry(tx, {\n      ...owner,\n      id,\n      status: \"ready\",\n      createdAt: new Date(),\n      body: { title, kind: \"group\", content: \"\", groupIds: [], evidence: [], relationships: [] },\n    });\n  return id;\n}\n\n/** Pending pre-Skill preference proposals stay in their native authority. A new\n * folder revision preserves the exact original body and links to the old revision;\n * conversion never activates a proposal or reuses its old human confirmation. */\nasync function migratePendingLegacySkills(tx: postgres.TransactionSql): Promise<void> {\n  let after: string | null = null;\n  for (;;) {\n    const candidates: Array<{\n      id: string;\n      workspace_id: string;\n      account_id: string;\n      preference_id: string;\n      revision_id: string;\n      content: string;\n      title: string;\n      description: string;\n      session_id: string;\n      active_revision_id: string | null;\n      scope_version: number;\n    }> = await tx<\n      Array<{\n        id: string;\n        workspace_id: string;\n        account_id: string;\n        preference_id: string;\n        revision_id: string;\n        content: string;\n        title: string;\n        description: string;\n        session_id: string;\n        active_revision_id: string | null;\n        scope_version: number;\n      }>\n    >`\n      SELECT receipt.id,receipt.workspace_id,receipt.account_id,receipt.preference_id,receipt.revision_id,\n        revision.content,revision.title,revision.description,receipt.session_id,head.active_revision_id,head.scope_version\n      FROM company_brain_preference_proposal_receipts receipt\n      JOIN preference_registry_preferences head ON head.id=receipt.preference_id AND head.account_id=receipt.account_id\n      JOIN preference_registry_revisions revision ON revision.id=receipt.revision_id AND revision.preference_id=head.id\n      JOIN knowledge_change_proposals proposal ON proposal.id=receipt.knowledge_proposal_id AND proposal.account_id=receipt.account_id\n      WHERE (${after}::uuid IS NULL OR receipt.id>${after}::uuid)\n        AND revision.skill_files IS NULL AND head.status NOT IN ('rejected','superseded')\n        AND proposal.status='proposed' AND proposal.target_kind='preference'\n        AND head.scope='workspace' AND head.scope_workspace_id=receipt.workspace_id\n        AND proposal.scope_workspace_id=receipt.workspace_id AND proposal.target_scope='workspace'\n        AND coalesce((SELECT review.state FROM knowledge_claim_reviews review WHERE review.claim_id=proposal.claim_id\n          AND review.account_id=receipt.account_id ORDER BY review.review_revision DESC LIMIT 1),'proposed') IN ('proposed','approved')\n        AND NOT EXISTS(SELECT 1 FROM preference_registry_events event WHERE event.preference_id=head.id\n          AND event.new_revision_id=revision.id AND event.type IN ('activated','corrected','rejected'))\n        AND NOT EXISTS(SELECT 1 FROM preference_registry_revisions newer WHERE newer.preference_id=head.id\n          AND newer.revision>revision.revision AND newer.created_by_subject_id<>'service:skill-migration:0433')\n      ORDER BY receipt.id LIMIT 100`;\n    if (!candidates.length) break;\n    for (const candidate of candidates) {\n      const folder = prepareLegacySkillFolder([{ path: \"SKILL.md\", content: candidate.content }], {\n        id: candidate.preference_id,\n        title: candidate.title,\n        description: candidate.description,\n      });\n      const main = folder.files.find((file) => file.path === \"SKILL.md\")!.content;\n      const revisionId = knowledgeMigrationId(\"pending-skill-revision\", candidate.id);\n      const operationId = knowledgeMigrationId(\"pending-skill-operation\", candidate.id);\n      await tx`INSERT INTO preference_registry_revisions(id,account_id,preference_id,title,description,content,content_hash,\n        precedence_rank,conflict_strategy,conflicts_with,provenance_source,provenance_source_id,trust,expires_at,\n        created_by_subject_id,corrects_revision_id,skill_files,skill_activation_mode)\n        SELECT ${revisionId}::uuid,account_id,preference_id,${folder.name},${folder.description},${main},\n          ${createHash(\"sha256\").update(main, \"utf8\").digest(\"hex\")},precedence_rank,conflict_strategy,conflicts_with,\n          provenance_source,provenance_source_id,trust,expires_at,'service:knowledge-migration:0461',id,\n          ${tx.json(folder.files)},'workspace_managed'\n        FROM preference_registry_revisions WHERE id=${candidate.revision_id}::uuid`;\n      await tx`INSERT INTO skill_write_receipts(account_id,workspace_id,operation_id,fingerprint,actor,receipt)\n        VALUES(${candidate.account_id}::uuid,${candidate.workspace_id}::uuid,${operationId}::uuid,\n          ${createHash(\"sha256\").update(operationId).digest(\"hex\")},\n          ${tx.json({\n            kind: \"migration\",\n            subjectId: \"service:knowledge-migration:0461\",\n            legacyProposalReceiptId: candidate.id,\n            legacyRevisionId: candidate.revision_id,\n            sessionId: candidate.session_id,\n          })},\n          ${tx.json({\n            operationId,\n            skillId: candidate.preference_id,\n            revisionId,\n            outcome: \"pending\",\n            pendingReason: \"approval\",\n            replayed: false,\n          })})`;\n    }\n    after = candidates.at(-1)!.id;\n  }\n}\n\n/** All source and destination FORCE-RLS windows are explicit in the SQL file. */\nexport async function migrateRetainedKnowledge(tx: postgres.TransactionSql): Promise<void> {\n  await migratePendingLegacySkills(tx);\n  await migrateSourceSchedules(tx);\n  let after: string | null = null;\n  for (;;) {\n    const memories: LegacyMemory[] = await tx<\n      LegacyMemory[]\n    >`SELECT m.id,m.account_id,m.workspace_id,m.text,m.text_codec_version,m.kind,m.status,m.scope_type,m.scope_subject_id,\n      m.scope_role_key,m.scope_session_id,m.created_by_session_id,\n      (SELECT r.claim_id FROM remember_knowledge_memory_materializations map\n        JOIN remember_knowledge_confirmation_receipts r ON r.id=map.confirmation_receipt_id\n        WHERE map.account_id=m.account_id AND map.memory_id=m.id) AS confirmed_claim_id,m.namespace_key AS namespace,m.labels,m.created_at,m.valid_from,m.valid_until,\n      (to_jsonb(m)-'embedding'-'text') || jsonb_build_object('relationships',coalesce((SELECT jsonb_agg(to_jsonb(edge) ORDER BY edge.id)\n        FROM knowledge_memory_relationships edge WHERE edge.account_id=m.account_id\n          AND (edge.source_memory_id=m.id OR edge.target_memory_id=m.id)),'[]'::jsonb),\n        'lifecycleEvents',coalesce((SELECT jsonb_agg(to_jsonb(event) ORDER BY event.created_at,event.id)\n          FROM knowledge_memory_lifecycle_events event WHERE event.account_id=m.account_id AND event.target_memory_id=m.id),'[]'::jsonb)) AS snapshot,\n      coalesce((SELECT jsonb_agg(jsonb_build_object('entryId',edge.target_memory_id,'relation',\n        CASE edge.relationship_type WHEN 'derived_from' THEN 'depends_on' WHEN 'corrects' THEN 'supersedes' ELSE edge.relationship_type END)\n        ORDER BY edge.id) FROM knowledge_memory_relationships edge\n        WHERE edge.account_id=m.account_id AND edge.source_memory_id=m.id AND edge.removed_at IS NULL),'[]'::jsonb) AS relationships\n      FROM knowledge_memories m WHERE (${after}::uuid IS NULL OR m.id>${after}::uuid) ORDER BY m.id LIMIT 200`;\n    if (!memories.length) break;\n    for (const memory of memories) {\n      const content = fromPostgresLosslessText(memory.text, memory.text_codec_version);\n      const owner: Owner = {\n        accountId: memory.account_id,\n        workspaceId: memory.workspace_id,\n        scope: memory.scope_type === \"user\" ? \"personal\" : \"workspace\",\n        subjectId: memory.scope_subject_id,\n      };\n      // Scope-specific legacy records retain their old selectors; do not put\n      // their labels or names in a more broadly visible group during migration.\n      const groupIds: string[] = [];\n      if (memory.scope_type === \"workspace\") {\n        if (memory.namespace && memory.namespace !== \"general\")\n          groupIds.push(\n            await importGroup(tx, owner, memory.namespace, `namespace:${memory.namespace}`),\n          );\n        for (const label of memory.labels)\n          groupIds.push(await importGroup(tx, owner, label, `label:${label}`));\n      }\n      await importEntry(tx, {\n        ...owner,\n        id: memory.id,\n        memoryId: memory.id,\n        ...(memory.confirmed_claim_id ? { legacyClaimId: memory.confirmed_claim_id } : {}),\n        legacySnapshot: memory.snapshot,\n        originalActor: {\n          kind: memory.snapshot.created_by_kind,\n          subjectId: memory.snapshot.created_by_subject_id,\n          context: memory.snapshot.created_by_context,\n        },\n        status: memory.status,\n        legacyScopeType: memory.scope_type,\n        roleKey: memory.scope_role_key,\n        scopeSessionId: memory.scope_session_id,\n        sessionId: memory.created_by_session_id,\n        createdAt: memory.created_at,\n        validFrom: memory.valid_from,\n        validUntil: memory.valid_until,\n        body: {\n          title: content.split(/\\r?\\n/u, 1)[0]?.slice(0, 160) || \"Imported knowledge\",\n          content,\n          kind:\n            memory.kind === \"episodic\"\n              ? \"incident\"\n              : memory.kind === \"semantic\"\n                ? \"fact\"\n                : memory.kind === \"decision\"\n                  ? \"decision\"\n                  : \"note\",\n          source: { kind: \"manual\", externalId: `memory:${memory.id}` },\n          groupIds: [...new Set(groupIds)],\n          evidence: await migrateMemoryEvidence(tx, memory),\n          relationships: memory.relationships.map((relationship) => ({\n            entryId: relationship.entryId,\n            relation:\n              relationship.relation as KnowledgeEntryContent[\"relationships\"][number][\"relation\"],\n          })),\n        },\n      });\n    }\n    after = memories.at(-1)!.id;\n  }\n  after = null;\n  for (;;) {\n    const documents: LegacyDocument[] = await tx<\n      LegacyDocument[]\n    >`SELECT d.id,d.account_id,d.workspace_id,d.file_id,d.base_id,b.name AS base_name,d.title,d.authority_kind,\n      d.authority_subject_id,d.source_uri,d.source_external_id,d.source_version,d.created_at\n      FROM documents d JOIN document_bases b ON b.id=d.base_id AND b.account_id=d.account_id\n      WHERE d.status='ready' AND NOT EXISTS(SELECT 1 FROM knowledge_document_versions v WHERE v.account_id=d.account_id AND v.document_id=d.id)\n        AND (${after}::uuid IS NULL OR d.id>${after}::uuid) ORDER BY d.id LIMIT 50`;\n    if (!documents.length) break;\n    for (const document of documents) {\n      const chunks = await tx<Array<{ text: string }>>`SELECT text FROM document_chunks\n        WHERE account_id=${document.account_id} AND document_id=${document.id} ORDER BY chunk_index`;\n      const owner: Owner = {\n        accountId: document.account_id,\n        workspaceId: document.workspace_id,\n        scope: document.authority_kind,\n        subjectId: document.authority_subject_id,\n      };\n      const groupIds =\n        document.authority_kind === \"workspace\" && document.base_name\n          ? [await importGroup(tx, owner, document.base_name, `document-base:${document.base_id}`)]\n          : [];\n      await importEntry(tx, {\n        ...owner,\n        id: knowledgeMigrationId(\"document\", document.id),\n        documentId: document.id,\n        status: \"ready\",\n        createdAt: document.created_at,\n        body: {\n          title: document.title,\n          kind: \"source\",\n          // Historical chunks may overlap. Preserve every retained passage;\n          // never claim to have reconstructed missing original full text.\n          content: chunks.map((chunk) => chunk.text).join(\"\\n\\n\"),\n          groupIds,\n          evidence: [],\n          relationships: [],\n          source: {\n            kind: \"file\",\n            fileId: document.file_id,\n            documentId: document.id,\n            retention: \"passages\",\n            ...(document.source_uri ? { uri: document.source_uri } : {}),\n            ...(document.source_external_id ? { externalId: document.source_external_id } : {}),\n            ...(document.source_version ? { version: document.source_version } : {}),\n          },\n        },\n      });\n    }\n    after = documents.at(-1)!.id;\n  }\n  await importScopedKnowledge(tx);\n  // Every endpoint exists before relationship constraints are checked.\n  await tx`INSERT INTO knowledge_entry_links(account_id,entry_id,revision_id,ordinal,target_entry_id,relation,target_revision_id)\n    SELECT r.account_id,r.entry_id,r.id,(g.ordinality-1)::integer,g.value::uuid,'group',NULL::uuid\n    FROM knowledge_entry_revisions r CROSS JOIN LATERAL jsonb_array_elements_text(r.body->'groupIds') WITH ORDINALITY g(value,ordinality)\n    UNION ALL\n    SELECT r.account_id,r.entry_id,r.id,jsonb_array_length(r.body->'groupIds')+(l.ordinality-1)::integer,\n      (l.value->>'entryId')::uuid,l.value->>'relation',NULL::uuid\n    FROM knowledge_entry_revisions r CROSS JOIN LATERAL jsonb_array_elements(r.body->'relationships') WITH ORDINALITY l(value,ordinality)\n    UNION ALL\n    SELECT r.account_id,r.entry_id,r.id,jsonb_array_length(r.body->'groupIds')+jsonb_array_length(r.body->'relationships')+(e.ordinality-1)::integer,\n      (e.value->>'entryId')::uuid,'evidence',(e.value->>'revisionId')::uuid\n    FROM knowledge_entry_revisions r CROSS JOIN LATERAL jsonb_array_elements(r.body->'evidence') WITH ORDINALITY e(value,ordinality)`;\n}\n\n/** Import the previously separate entity/claim graph into ordinary entries. */\nasync function importScopedKnowledge(tx: postgres.TransactionSql) {\n  type ScopedRow = {\n    id: string;\n    account_id: string;\n    scope_kind: KnowledgeEntryScope;\n    scope_workspace_id: string | null;\n    scope_subject_id: string | null;\n    created_at: Date;\n    actor_kind: string;\n    actor_subject_id: string;\n    initiating_human_subject_id: string | null;\n  };\n  function owner(row: ScopedRow): Owner {\n    return {\n      accountId: row.account_id,\n      // Some organization/user records never had a creating workspace. This\n      // deterministic import origin is provenance only and grants no access.\n      workspaceId: row.scope_workspace_id ?? knowledgeMigrationId(\"import-origin\", row.account_id),\n      scope: row.scope_kind,\n      subjectId: row.scope_subject_id,\n    };\n  }\n  function actor(row: ScopedRow) {\n    return {\n      kind: row.actor_kind,\n      subjectId: row.actor_subject_id,\n      initiatingHumanSubjectId: row.initiating_human_subject_id,\n    };\n  }\n  let after: string | null = null;\n  for (;;) {\n    const entities: Array<\n      ScopedRow & { display_name: string; aliases: string[]; snapshot: Record<string, unknown> }\n    > = await tx<\n      Array<\n        ScopedRow & { display_name: string; aliases: string[]; snapshot: Record<string, unknown> }\n      >\n    >`\n      SELECT e.*,to_jsonb(e) AS snapshot,coalesce((SELECT jsonb_agg(a.alias ORDER BY a.id)\n        FROM knowledge_entity_aliases a WHERE a.account_id=e.account_id AND a.entity_id=e.id),'[]'::jsonb) AS aliases\n      FROM knowledge_entities e WHERE (${after}::uuid IS NULL OR e.id>${after}::uuid)\n        AND (NOT EXISTS(SELECT 1 FROM knowledge_facts f JOIN knowledge_claims c ON c.fact_id=f.id\n          WHERE f.account_id=e.account_id AND (f.subject_entity_id=e.id OR f.object_entity_id=e.id))\n          OR EXISTS(SELECT 1 FROM knowledge_facts f JOIN knowledge_claims c ON c.fact_id=f.id\n            WHERE f.account_id=e.account_id AND (f.subject_entity_id=e.id OR f.object_entity_id=e.id)\n              AND NOT EXISTS(SELECT 1 FROM knowledge_change_proposals p WHERE p.claim_id=c.id AND p.account_id=c.account_id)))\n        ORDER BY e.id LIMIT 200`;\n    if (!entities.length) break;\n    for (const entity of entities)\n      await importEntry(tx, {\n        ...owner(entity),\n        id: knowledgeMigrationId(\"entity\", entity.id),\n        status: \"approved\",\n        createdAt: entity.created_at,\n        legacyScopeWorkspaceId: entity.scope_workspace_id,\n        originalActor: actor(entity),\n        legacySnapshot: { entity: entity.snapshot, aliases: entity.aliases },\n        body: {\n          title: entity.display_name,\n          kind: \"group\",\n          content: entity.aliases.join(\"\\n\"),\n          groupIds: [],\n          evidence: [],\n          relationships: [],\n        },\n      });\n    after = entities.at(-1)!.id;\n  }\n  after = null;\n  for (;;) {\n    const versions: Array<\n      ScopedRow & {\n        document_id: string | null;\n        file_id: string | null;\n        external_version_id: string;\n        title: string;\n        snapshot: Record<string, unknown>;\n        source_uri: string | null;\n      }\n    > = await tx<\n      Array<\n        ScopedRow & {\n          document_id: string | null;\n          file_id: string | null;\n          external_version_id: string;\n          title: string;\n          snapshot: Record<string, unknown>;\n          source_uri: string | null;\n        }\n      >\n    >`\n      SELECT v.*,coalesce(d.title,o.external_object_id) AS title,s.source_uri,\n        jsonb_build_object('version',to_jsonb(v),'source',to_jsonb(s),'object',to_jsonb(o),'provider',to_jsonb(p)) AS snapshot\n      FROM knowledge_document_versions v JOIN knowledge_source_objects o ON o.account_id=v.account_id AND o.id=v.object_id\n      JOIN knowledge_sources s ON s.account_id=v.account_id AND s.id=v.source_id\n      JOIN knowledge_providers p ON p.account_id=s.account_id AND p.id=s.provider_id\n      LEFT JOIN documents d ON d.account_id=v.account_id AND d.id=v.document_id\n      WHERE (${after}::uuid IS NULL OR v.id>${after}::uuid) ORDER BY v.id LIMIT 100`;\n    if (!versions.length) break;\n    for (const version of versions) {\n      const chunks = version.document_id\n        ? await tx<Array<{ text: string }>>`SELECT text FROM document_chunks\n        WHERE account_id=${version.account_id} AND document_id=${version.document_id} ORDER BY chunk_index`\n        : [];\n      await importEntry(tx, {\n        ...owner(version),\n        id: knowledgeMigrationId(\"document-version\", version.id),\n        legacyDocumentVersionId: version.id,\n        legacyScopeWorkspaceId: version.scope_workspace_id,\n        status: \"ready\",\n        createdAt: version.created_at,\n        originalActor: actor(version),\n        legacySnapshot: version.snapshot,\n        body: {\n          title: version.title,\n          kind: \"source\",\n          content: chunks.map((c) => c.text).join(\"\\n\\n\"),\n          groupIds: [],\n          evidence: [],\n          relationships: [],\n          source: {\n            kind: version.file_id ? \"file\" : \"connector\",\n            externalId: `knowledge-document-version:${version.id}`,\n            version: version.external_version_id,\n            retention: chunks.length ? \"passages\" : \"reference\",\n            ...(version.file_id ? { fileId: version.file_id } : {}),\n            ...(version.document_id ? { documentId: version.document_id } : {}),\n            ...(version.source_uri ? { uri: version.source_uri } : {}),\n          },\n        },\n      });\n    }\n    after = versions.at(-1)!.id;\n  }\n  after = null;\n  for (;;) {\n    const claims: Array<\n      ScopedRow & {\n        subject_entity_id: string;\n        object_entity_id: string | null;\n        subject_name: string;\n        object_name: string | null;\n        predicate_key: string;\n        object_value: unknown;\n        state: string;\n        extraction_method: string;\n        effective_at: Date;\n        expires_at: Date | null;\n        snapshot: Record<string, unknown>;\n      }\n    > = await tx<\n      Array<\n        ScopedRow & {\n          subject_entity_id: string;\n          object_entity_id: string | null;\n          subject_name: string;\n          object_name: string | null;\n          predicate_key: string;\n          object_value: unknown;\n          state: string;\n          extraction_method: string;\n          effective_at: Date;\n          expires_at: Date | null;\n          snapshot: Record<string, unknown>;\n        }\n      >\n    >`\n      SELECT c.*,f.subject_entity_id,f.object_entity_id,f.predicate_key,f.object_value,\n        subject.display_name AS subject_name,object.display_name AS object_name,\n        coalesce((SELECT state FROM knowledge_claim_reviews r WHERE r.account_id=c.account_id AND r.claim_id=c.id\n          ORDER BY r.review_revision DESC LIMIT 1),'proposed') AS state,\n        jsonb_build_object('claim',to_jsonb(c),'fact',to_jsonb(f),\n          'evidence',coalesce((SELECT jsonb_agg(to_jsonb(e) ORDER BY e.id) FROM knowledge_claim_evidence e\n            WHERE e.account_id=c.account_id AND e.claim_id=c.id),'[]'::jsonb),\n          'reviews',coalesce((SELECT jsonb_agg(to_jsonb(r) ORDER BY r.review_revision) FROM knowledge_claim_reviews r\n            WHERE r.account_id=c.account_id AND r.claim_id=c.id),'[]'::jsonb)) AS snapshot\n      FROM knowledge_claims c JOIN knowledge_facts f ON f.account_id=c.account_id AND f.id=c.fact_id\n      JOIN knowledge_entities subject ON subject.account_id=f.account_id AND subject.id=f.subject_entity_id\n      LEFT JOIN knowledge_entities object ON object.account_id=f.account_id AND object.id=f.object_entity_id\n      WHERE (${after}::uuid IS NULL OR c.id>${after}::uuid)\n        AND NOT EXISTS(SELECT 1 FROM knowledge_entries imported WHERE imported.legacy_claim_id=c.id)\n        AND NOT EXISTS(SELECT 1 FROM knowledge_change_proposals p WHERE p.account_id=c.account_id AND p.claim_id=c.id\n          )\n      ORDER BY c.id LIMIT 100`;\n    if (!claims.length) break;\n    for (const claim of claims) {\n      const retained = await tx<Array<{ document_version_id: string; locator: string | null }>>`\n        SELECT document_version_id,locator FROM knowledge_claim_evidence WHERE account_id=${claim.account_id}\n          AND claim_id=${claim.id} AND document_version_id IS NOT NULL ORDER BY id`;\n      const relations = await tx<\n        Array<{\n          to_claim_id: string;\n          imported_entry_id: string | null;\n          relation_type: \"supersedes\" | \"conflicts_with\";\n        }>\n      >`\n        SELECT r.to_claim_id,r.relation_type,(SELECT e.id FROM knowledge_entries e WHERE e.legacy_claim_id=r.to_claim_id) AS imported_entry_id FROM knowledge_claim_relations r\n        WHERE r.account_id=${claim.account_id} AND r.from_claim_id=${claim.id}\n          AND NOT EXISTS(SELECT 1 FROM knowledge_change_proposals p WHERE p.account_id=r.account_id AND p.claim_id=r.to_claim_id ) ORDER BY r.id`;\n      const objectText =\n        claim.object_name ??\n        (typeof claim.object_value === \"string\"\n          ? claim.object_value\n          : JSON.stringify(claim.object_value));\n      await importEntry(tx, {\n        ...owner(claim),\n        id: knowledgeMigrationId(\"claim\", claim.id),\n        legacyClaimId: claim.id,\n        legacyScopeWorkspaceId: claim.scope_workspace_id,\n        status: claim.state,\n        createdAt: claim.created_at,\n        validFrom: claim.effective_at,\n        validUntil: claim.expires_at,\n        originalActor: actor(claim),\n        legacySnapshot: claim.snapshot,\n        body: {\n          title: `${claim.subject_name}: ${claim.predicate_key}`,\n          kind: \"fact\",\n          content:\n            claim.extraction_method === \"task-note-promotion-v1\" &&\n            typeof claim.object_value === \"string\"\n              ? claim.object_value\n              : `${claim.subject_name} · ${claim.predicate_key}: ${objectText}`,\n          source: { kind: \"manual\", externalId: `knowledge-claim:${claim.id}` },\n          groupIds: [knowledgeMigrationId(\"entity\", claim.subject_entity_id)],\n          evidence: retained.map((e) => {\n            const id = knowledgeMigrationId(\"document-version\", e.document_version_id);\n            return {\n              entryId: id,\n              revisionId: knowledgeMigrationId(\"revision\", id),\n              location: e.locator ? { passage: e.locator } : {},\n            };\n          }),\n          relationships: [\n            ...relations.map((r) => ({\n              entryId: r.imported_entry_id ?? knowledgeMigrationId(\"claim\", r.to_claim_id),\n              relation: r.relation_type,\n            })),\n            ...(claim.object_entity_id\n              ? [\n                  {\n                    entryId: knowledgeMigrationId(\"entity\", claim.object_entity_id),\n                    relation: \"related_to\" as const,\n                  },\n                ]\n              : []),\n          ],\n        },\n      });\n    }\n    after = claims.at(-1)!.id;\n  }\n}\n\n/** Preserve source selection and schedule ids, but create a new ordinary task\n * revision. Old occurrence/history rows remain exact and never become agents. */\nasync function migrateSourceSchedules(tx: postgres.TransactionSql) {\n  await tx`ALTER TABLE scheduled_tasks NO FORCE ROW LEVEL SECURITY`;\n  await tx`ALTER TABLE scheduled_tasks DISABLE TRIGGER scheduled_task_tombstone_immutable`;\n  const tasks =\n    await tx`SELECT id,account_id,workspace_id,action,authority_revision FROM scheduled_tasks\n    WHERE action->>'kind'='knowledge_source_sync' AND deleted_at IS NULL ORDER BY id`;\n  for (const task of tasks) {\n    const source = KnowledgeSourceSyncAction.parse(task.action);\n    await tx`SELECT set_config('opengeni.account_id',${task.account_id},true),\n      set_config('opengeni.workspace_id',${task.workspace_id},true),\n      set_config('opengeni.subject_id',${source.initiatingSubjectId},true),\n      set_config('opengeni.initiating_human_subject_id',${source.initiatingSubjectId},true)`;\n    await tx`SELECT pg_advisory_xact_lock_shared(hashtextextended('session-tenancy:'||${task.workspace_id}::text,0))`;\n    await tx`SELECT id FROM workspaces WHERE id=${task.workspace_id} FOR UPDATE`;\n    const [authority] = await tx`SELECT id FROM organization_memberships m\n      WHERE m.account_id=${task.account_id} AND m.subject_id=${source.initiatingSubjectId}\n        AND m.status='active' AND m.revoked_at IS NULL\n        AND (m.personal_workspace_id=${task.workspace_id} OR EXISTS(SELECT 1 FROM workspace_memberships w\n          WHERE w.account_id=m.account_id AND w.workspace_id=${task.workspace_id} AND w.subject_id=m.subject_id))`;\n    // Old deterministic occurrences cannot resume as agent work. Preserve their\n    // audit rows and checkpoints, close their wakes, and let the next ordinary\n    // scheduled run continue from the retained provider cursor.\n    await tx`UPDATE scheduled_task_runs SET status='failed',completed_at=clock_timestamp(),\n      error='knowledge_source_agent_cutover',updated_at=clock_timestamp()\n      WHERE task_id=${task.id} AND action_kind='knowledge_source_sync' AND status IN ('queued','dispatched')`;\n    await tx`UPDATE knowledge_source_sync_wakes SET completed_at=clock_timestamp()\n      WHERE scheduled_task_id=${task.id} AND completed_at IS NULL`;\n    await tx`UPDATE knowledge_source_sync_states SET lease_id=NULL,lease_until=NULL,\n      buffered_wake=false,buffered_scheduled_task_run_id=NULL,pending_wake_count=0,updated_at=clock_timestamp()\n      WHERE scheduled_task_id=${task.id}`;\n    // A former owner's schedule is still useful configuration, but migration\n    // cannot invent authority for it. Re-enabling requires a current owner edit.\n    if (!authority)\n      await tx`UPDATE scheduled_tasks SET status='paused',\n      metadata=jsonb_set(metadata,'{knowledgeSourceSync}',coalesce(metadata->'knowledgeSourceSync','{}'::jsonb)\n        || '{\"sourceEnabled\":false,\"authorityRefreshRequired\":true}'::jsonb) WHERE id=${task.id}`;\n    const [updated] = await tx`UPDATE scheduled_tasks SET action='{\"kind\":\"agent_turn\"}',\n      agent_config=${JSON.stringify(knowledgeSourceAgentConfig(source))}::jsonb, authority_revision=authority_revision+1,\n      updated_at=clock_timestamp() WHERE id=${task.id} RETURNING authority_revision`;\n    if (!updated) throw new Error(\"Source schedule disappeared during maintenance\");\n    await tx`SELECT freeze_scheduled_task_personal_resources(${task.account_id}::uuid,\n      ${task.workspace_id}::uuid,${task.id}::uuid,${updated.authority_revision}::bigint)`;\n    if (authority)\n      await tx`SELECT record_scheduled_task_revision_authority(${task.account_id}::uuid,\n      ${task.workspace_id}::uuid,${task.id}::uuid,${updated.authority_revision}::bigint)`;\n  }\n  await tx`ALTER TABLE scheduled_tasks ENABLE TRIGGER scheduled_task_tombstone_immutable`;\n  await tx`ALTER TABLE scheduled_tasks FORCE ROW LEVEL SECURITY`;\n  await tx`SELECT set_config('opengeni.account_id','',true),set_config('opengeni.workspace_id','',true),\n    set_config('opengeni.subject_id','',true),set_config('opengeni.initiating_human_subject_id','',true)`;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  StoredSessionSkills,\n  StoredAutomationSessionTemplate,\n  validateSkillTextFiles,\n  type SkillFile,\n} from \"@opengeni/contracts\";\nimport type postgres from \"postgres\";\nimport { prepareLegacySkillFolder } from \"./skill-metadata-migration\";\n\ntype ObjectValue = Record<string, unknown>;\nfunction object(value: unknown): ObjectValue {\n  if (!value || typeof value !== \"object\" || Array.isArray(value))\n    throw new Error(\"Expected stored configuration object\");\n  return value as ObjectValue;\n}\n\n/** Only known execution fields, never arbitrary metadata or archived payloads. */\nexport function convertLegacyConfigSkills(value: unknown, identity: string): unknown[] {\n  if (!Array.isArray(value)) throw new Error(\"Expected stored Skill array\");\n  const names = new Set<string>();\n  const converted = value.map((entry, index) => {\n    const skill = object(entry);\n    if (!Array.isArray(skill.files)) throw new Error(\"Expected stored Skill folder\");\n    const files = skill.files.map((fileEntry) => {\n      const file = object(fileEntry);\n      if (typeof file.path !== \"string\" || typeof file.content !== \"string\")\n        throw new Error(\"Invalid stored Skill text file\");\n      if (Object.keys(file).some((key) => key !== \"path\" && key !== \"content\"))\n        throw new Error(\"Unexpected stored Skill file fields\");\n      return { path: file.path, content: file.content };\n    });\n    const main = files.find((file) => file.path === \"SKILL.md\");\n    const plain = main && !/^\\s*---(?:\\r?\\n|$)/u.test(main.content);\n    if (plain && (typeof skill.name !== \"string\" || typeof skill.description !== \"string\"))\n      throw new Error(\"Plain Skill requires historical name and description\");\n    const folder = prepareLegacySkillFolder(files as SkillFile[], {\n      id: createHash(\"sha256\").update(`${identity}:${index}`).digest(\"hex\").slice(0, 32),\n      title: typeof skill.name === \"string\" ? skill.name : \"\",\n      description: typeof skill.description === \"string\" ? skill.description : \"\",\n    });\n    validateSkillTextFiles(folder.files);\n    if (names.has(folder.name)) throw new Error(`Canonical Skill name collision: ${folder.name}`);\n    names.add(folder.name);\n    // Valid YAML requires no persistence change: cached descriptors are handled\n    // by the stored read projection. Preserve unknown fields and exact JSON.\n    return plain ? { ...skill, ...folder } : entry;\n  });\n  StoredSessionSkills.parse(converted);\n  return converted;\n}\n\nexport function convertLegacyPackConfig(value: unknown, identity: string): ObjectValue {\n  const pack = object(value);\n  const converted = { ...pack };\n  if (pack.skills !== undefined)\n    converted.skills = convertLegacyConfigSkills(pack.skills, identity);\n  if (Array.isArray(pack.automationTemplates))\n    converted.automationTemplates = pack.automationTemplates.map((entry, index) => {\n      const template = object(entry);\n      const sessionTemplate = object(template.sessionTemplate);\n      return {\n        ...template,\n        sessionTemplate: {\n          ...sessionTemplate,\n          ...(sessionTemplate.skills !== undefined\n            ? {\n                skills: convertLegacyConfigSkills(\n                  sessionTemplate.skills,\n                  `${identity}:template:${index}`,\n                ),\n              }\n            : {}),\n        },\n      };\n    });\n  // Historical migration 0433 only: validate the execution fields this\n  // conversion rewrites. The remaining archived manifest is opaque evidence,\n  // not an active capability or an admission contract.\n  if (converted.skills !== undefined) StoredSessionSkills.parse(converted.skills);\n  if (converted.automationTemplates !== undefined) {\n    if (!Array.isArray(converted.automationTemplates))\n      throw new Error(\"Expected historical automation template array\");\n    for (const entry of converted.automationTemplates)\n      StoredAutomationSessionTemplate.parse(object(entry).sessionTemplate);\n  }\n  return converted;\n}\n\nasync function assertSkillConfigurationMaintenanceWindow(\n  tx: postgres.TransactionSql,\n): Promise<void> {\n  const rows = await tx`SELECT c.oid FROM pg_class c\n    WHERE c.oid='sessions'::regclass AND pg_get_userbyid(c.relowner)=current_user\n      AND c.relrowsecurity AND NOT c.relforcerowsecurity\n      AND to_regclass('pg_temp.skill_metadata_0426') IS NOT NULL`;\n  if (rows.length !== 1)\n    throw new Error(\n      \"Skill configuration conversion requires the parser-backed maintenance owner window\",\n    );\n}\n\n/** Maintenance-only: caller holds the 0433 owner window and drained runtime fence. */\nexport async function migrateLegacySkillConfigurations(tx: postgres.TransactionSql): Promise<void> {\n  await assertSkillConfigurationMaintenanceWindow(tx);\n  await tx`SELECT pg_advisory_xact_lock(hashtextextended('session-tenancy:'||workspace_id::text,0))\n    FROM (SELECT DISTINCT workspace_id FROM sessions ORDER BY workspace_id) workspaces`;\n  // All candidates are read under table locks, preventing changes between\n  // inventory, archival, and replacement, including owner-side maintenance.\n  await tx`LOCK TABLE sessions, workspace_packs, session_turns, automation_triggers,\n    automation_trigger_revisions, automation_runs, automation_trigger_events, automation_run_event_links, pack_installations IN SHARE ROW EXCLUSIVE MODE`;\n  const pinned = await tx<Array<{ kind: string; id: string; value: unknown }>>`\n    SELECT 'pack-installation' AS kind,id::text,manifest_snapshot AS value FROM pack_installations\n      WHERE status <> 'disabled' AND manifest_snapshot IS NOT NULL\n    UNION ALL SELECT 'automation-current',t.id::text,jsonb_build_object('skills',r.session_template->'skills')\n      FROM automation_triggers t JOIN automation_trigger_revisions r ON r.trigger_id=t.id AND r.revision=t.current_revision\n      WHERE t.status IN ('active','paused') AND r.session_template ? 'skills'\n    UNION ALL SELECT 'automation-run',id::text,jsonb_build_object('skills',accepted_execution->'sessionTemplate'->'skills')\n      FROM automation_runs WHERE status IN ('queued','dispatching') AND accepted_execution->'sessionTemplate' ? 'skills'\n    UNION ALL SELECT 'automation-event',e.id::text,jsonb_build_object('skills',r.session_template->'skills')\n      FROM automation_trigger_events e CROSS JOIN LATERAL jsonb_array_elements(e.matched_trigger_revisions) matched\n      JOIN automation_trigger_revisions r ON r.trigger_id=(matched->>'triggerId')::uuid AND r.revision=(matched->>'revision')::integer\n      WHERE e.status='accepted' AND r.session_template ? 'skills'\n        AND NOT EXISTS (SELECT 1 FROM automation_runs run WHERE run.event_id=e.id AND run.trigger_id=r.trigger_id AND run.trigger_revision=r.revision)\n        AND NOT EXISTS (SELECT 1 FROM automation_run_event_links link WHERE link.event_id=e.id AND link.trigger_id=r.trigger_id)\n  `;\n  const blockers: string[] = [];\n  for (const source of pinned) {\n    try {\n      const original = object(source.value);\n      const converted =\n        source.kind === \"pack-installation\"\n          ? convertLegacyPackConfig(original, source.id)\n          : { ...original, skills: convertLegacyConfigSkills(original.skills, source.id) };\n      if (JSON.stringify(converted) !== JSON.stringify(original))\n        blockers.push(`${source.kind}:${source.id} (plain content)`);\n    } catch {\n      blockers.push(`${source.kind}:${source.id} (invalid content)`);\n    }\n  }\n  const candidates = await tx<\n    Array<{\n      kind: string;\n      id: string;\n      account_id: string;\n      workspace_id: string;\n      original: unknown;\n      pinned: boolean;\n    }>\n  >`\n    SELECT 'session' AS kind,s.id::text,s.account_id,s.workspace_id,s.skills AS original,\n      (s.active_turn_id IS NOT NULL OR EXISTS(SELECT 1 FROM session_turns t WHERE t.session_id=s.id AND t.status NOT IN ('completed','failed','cancelled'))) AS pinned\n      FROM sessions s WHERE s.skills <> '[]'::jsonb\n    UNION ALL SELECT 'workspace-pack',id::text,account_id,workspace_id,manifest,false FROM workspace_packs\n  `;\n  const changes: Array<{ source: (typeof candidates)[number]; converted: unknown }> = [];\n  for (const source of candidates) {\n    try {\n      const converted =\n        source.kind === \"session\"\n          ? convertLegacyConfigSkills(source.original, source.id)\n          : convertLegacyPackConfig(source.original, source.id);\n      if (source.kind === \"session\") StoredSessionSkills.parse(converted);\n      if (JSON.stringify(source.original) !== JSON.stringify(converted)) {\n        if (source.pinned) blockers.push(`${source.kind}:${source.id} (runnable accepted turn)`);\n        else changes.push({ source, converted });\n      }\n    } catch {\n      blockers.push(`${source.kind}:${source.id} (invalid content or canonical collision)`);\n    }\n  }\n  if (blockers.length)\n    throw new Error(\n      `0433 Skill configuration preflight: ${blockers.length} repair-required sources; drain or explicitly replace pinned sources before retry: ${blockers.slice(0, 30).join(\", \")}`,\n    );\n  for (const { source, converted } of changes) {\n    const original = tx.json(source.original as never);\n    const replacement = tx.json(converted as never);\n    await tx`INSERT INTO skill_config_conversion_receipts(account_id,workspace_id,source_kind,source_id,original_configuration,original_hash,replacement_hash)\n      VALUES(${source.account_id},${source.workspace_id},${source.kind},${source.id},${original},\n        encode(sha256(convert_to(${original}::jsonb::text,'UTF8')),'hex'),encode(sha256(convert_to(${replacement}::jsonb::text,'UTF8')),'hex'))`;\n    const updated =\n      source.kind === \"session\"\n        ? await tx`UPDATE sessions SET skills=${replacement} WHERE id=${source.id} AND account_id=${source.account_id} AND workspace_id=${source.workspace_id} AND skills=${original} RETURNING id`\n        : await tx`UPDATE workspace_packs SET manifest=${replacement} WHERE id=${source.id} AND account_id=${source.account_id} AND workspace_id=${source.workspace_id} AND manifest=${original} RETURNING id`;\n    if (updated.length !== 1)\n      throw new Error(`0433 Skill configuration CAS conflict: ${source.kind}:${source.id}`);\n  }\n}\n","export type BatchedBackfillTransactionLocalSetting = {\n  guc: `opengeni.${string}`;\n  value: string;\n};\n\n/**\n * Exact owner-capability settings established before one governed batched\n * backfill statement. Keep this closed by migration filename: these GUCs may\n * open a FORCE-RLS policy arm and must never become ambient migration state.\n */\nexport function batchedBackfillTransactionLocalSetting(\n  file: string,\n): BatchedBackfillTransactionLocalSetting | null {\n  if (file === \"0411_new_session_draft_project_provenance_backfill.sql\") {\n    return {\n      guc: \"opengeni.new_session_draft_project_provenance_backfill_v1\",\n      value: \"1\",\n    };\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,SAAS,gBAAgB;AAClC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,OAAO,cAAc;;;ACHrB,SAAS,yBAAyC;AAI3C,IAAM,kCAAkC;AAExC,SAAS,yBACd,OACA,QAC2D;AAC3D,QAAM,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU;AAC1D,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,SAAS,OAAO,EAAE,qCAAqC;AAClF,MAAI,UAAU,KAAK;AAGnB,MAAI,CAAC,sBAAsB,KAAK,OAAO,GAAG;AACxC,UAAM,OAAO,OAAO,MACjB,UAAU,MAAM,EAChB,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,QAAQ,WAAW,EAAE;AACxB,UAAM,OAAO,QAAQ,KAAK,UAAU,KAAK,OAAO,UAAU,OAAO,GAAG,WAAW,KAAK,EAAE,CAAC;AACvF,cAAU;AAAA,QAAc,KAAK,UAAU,IAAI,CAAC;AAAA,eAAkB,KAAK,UAAU,OAAO,WAAW,CAAC;AAAA;AAAA,EAAU,OAAO;AAAA,EACnH;AACA,QAAM,WAAW,kBAAkB,OAAO;AAC1C,SAAO;AAAA,IACL,OAAO,MAAM,IAAI,CAAC,SAAU,KAAK,SAAS,aAAa,EAAE,GAAG,MAAM,QAAQ,IAAI,IAAK;AAAA,IACnF,GAAG;AAAA,EACL;AACF;AAEA,eAAsB,kCACpB,IACe;AACf,QAAM;AAAA;AAAA;AAAA;AAIR;AAEA,eAAsB,4BAA4B,IAA4C;AAC5F,QAAM,UAAU,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0BtB,aAAW,UAAU,SAAS;AAC5B,QAAI;AACJ,QAAI;AACF,eAAS,yBAAyB,OAAO,OAAO;AAAA,QAC9C,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,QACd,aAAa,OAAO;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,SAAS,OAAO,WAAW,IAAI,OAAO,SAAS;AAAA,QAC/C,EAAE,MAAM;AAAA,MACV;AAAA,IACF;AACA,UAAM,CAAC,KAAK,IAAI,MAAM,8BAA8B,GAAG,KAAK,OAAO,KAAK,CAAC;AACzE,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,SAAS,OAAO,SAAS;AAAA,MAC3B;AACF,UAAM;AAAA,eACK,OAAO,WAAW,IAAI,OAAO,SAAS,IAAI,OAAO,UAAU,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,OAAO,KAAK,CAAC,IAAI,OAAO,IAAI,IAAI,OAAO,WAAW;AAAA,EAC7J;AACF;;;ACxFA,SAAS,kBAAkB;AAE3B;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AASA,IAAM,6BAA6B;AACnC,SAAS,qBAAqB,MAAc,IAAoB;AACrE,QAAM,OAAO,WAAW,QAAQ,EAC7B,OAAO,2BAA2B,IAAI,IAAI,EAAE,EAAE,EAC9C,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AACd,SAAO,GAAG,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;AACjH;AAiEA,eAAe,sBACb,IACA,QAC4C;AAC5C,QAAM,WAA8C,CAAC;AACrD,QAAM,aAAa,OAAO,SAAS;AACnC,MAAI,CAAC,MAAM,QAAQ,UAAU,EAAG,QAAO;AACvC,aAAW,OAAO,YAAY;AAC5B,QACE,CAAC,OACD,OAAO,QAAQ,YACf,OAAO,IAAI,OAAO,YAClB,CAAC,kEAAkE,KAAK,IAAI,EAAE;AAE9E;AACF,QAAI;AACJ,QAAI;AACJ,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,CAAC,KAAK,IACV,MAAM,wDAAwD,OAAO,UAAU,WAAW,IAAI,EAAE;AAClG,UAAI,SAAS,MAAM,OAAO,OAAO,GAAI,WAAU,OAAO,MAAM,EAAE;AAAA,IAChE,WAAW,IAAI,SAAS,cAAc,IAAI,SAAS,kBAAkB;AACnE,YAAM,CAAC,GAAG,IACR,IAAI,SAAS,mBACT,MAAM;AAAA,iCACe,OAAO,UAAU,aAAa,IAAI,EAAE,KACzD,MAAM,sDAAsD,OAAO,UAAU,WAAW,IAAI,EAAE;AACpG,UAAI,KAAK;AACP,cAAM,CAAC,OAAO,IACZ,MAAM,iEAAiE,OAAO,UAAU;AAAA,4BACtE,IAAI,EAAE;AAI1B,YAAI,WAAW,IAAI,WAAW;AAC5B,oBAAU;AAAA,YACR,UAAU,qBAAqB;AAAA,YAC/B,OAAO,SAAS,MAAM,IAAI,EAAE;AAAA,UAC9B;AACF,YAAI,IAAI,SAAS,iBAAkB,WAAU,kBAAkB,IAAI,EAAE;AAAA,MACvE;AAAA,IACF;AACA,QACE,WACA,CAAC,SAAS,KAAK,CAAC,SAAS,KAAK,YAAY,WAAW,KAAK,SAAS,YAAY,OAAO,GACtF;AACA,eAAS,KAAK;AAAA,QACZ;AAAA,QACA,YAAY,qBAAqB,YAAY,OAAO;AAAA,QACpD,UAAU,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrC,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,YAAY,IAA6B,OAAiB;AACvE,QAAM,OAAO,4BAA4B,MAAM,MAAM,IAAI;AACzD,QAAM,aAAa,qBAAqB,YAAY,MAAM,EAAE;AAC5D,QAAM,UAAU,CAAC,UAAU,YAAY,OAAO,EAAE,SAAS,MAAM,MAAM,IACjE,cACA,MAAM,WAAW,aACf,YACA;AACN,QAAM,WAAW,CAAC,CAAC,UAAU,YAAY,SAAS,UAAU,EAAE,SAAS,MAAM,MAAM;AACnF,QAAM,iBAAiB,EAAE,MAAM,aAAa,WAAW,mCAAmC;AAC1F,QAAM,QAAQ,MAAM,iBAAiB;AACrC,QAAM,UACJ,YAAY,YACR;AAAA,IACE;AAAA,IACA,GAAG,MAAM,SAAS,IAAI,MAAM,WAAW,IAAI,MAAM,KAAK,IAAI,MAAM,aAAa,EAAE,IAAI,MAAM,aAAa,MAAM,EAAE;AAAA,EAChH,IACA;AACN,MAAI;AACF,UAAM;AAAA,aACG,OAAO,IAAI,MAAM,SAAS,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,aAAa,YAAY,MAAM,SAAS,KAAK,GAAG,MAAM,KAAK,IAAI,MAAM,WAAW,EAAE;AAAA,QAC1J,MAAM,aAAa,IAAI,IAAI,MAAM,SAAS;AAChD,QAAM;AAAA;AAAA;AAAA,aAGK,MAAM,EAAE,IAAI,MAAM,SAAS,IAAI,MAAM,WAAW,IAAI,MAAM,KAAK,IAAI,MAAM,UAAU,cAAc,MAAM,cAAc,IAAI;AAAA,QAC9H,MAAM,SAAS,MAAM,YAAY,cAAc,aAAa,IAAI,IAAI,UAAU,IAAI,QAAQ,IAAI,MAAM,YAAY,IAAI,IAAI,MAAM,cAAc,IAAI;AAAA,QAChJ,MAAM,mBAAmB,IAAI,IAAI,MAAM,WAAW,IAAI,IAAI,MAAM,kBAAkB,IAAI,IAAI,MAAM,2BAA2B,IAAI,IAAI,MAAM,iBAAiB,IAAI,IAAI,MAAM,0BAA0B,IAAI,IAAI,MAAM,aAAa,MAAM,SAAS;AAAA,QAC5O,MAAM,cAAc,IAAI,IAAI,MAAM,SAAS,IAAI,MAAM,SAAS;AACpE,QAAM;AAAA;AAAA,aAEK,UAAU,IAAI,MAAM,SAAS,IAAI,MAAM,EAAE,MAAM,GAAG,KAAK,uBAAuB,IAAI,CAAuB,CAAC;AAAA,QAC/G,8BAA8B,IAAI,uBAAuB,KAAK,QAAQ,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,8BAA8B;AAAA,QACtH,GAAG,KAAK,KAA2B,CAAC,IAAI,MAAM,aAAa,IAAI,IAAI,OAAO,IAAI,MAAM,iBAAiB,GAAG,KAAK,MAAM,cAAoC,IAAI,IAAI,IAAI,MAAM,SAAS;AACxL,QAAM;AAAA,aACK,MAAM,SAAS,IAAI,MAAM,EAAE,IAAI,UAAU,MAAM,OAAO,IAAI,GAAG,KAAK,cAAc,CAAC,IAAI,MAAM,SAAS;AAC/G,QAAM,qCAAqC,MAAM,SAAS,IAAI,MAAM,EAAE,IAAI,UAAU;AAAA,MAChF,uBAAuB,GAAG,KAAK,KAAK;AAAA,EAAK,KAAK,OAAO,EAAE,CAAC;AAC9D;AAEA,eAAe,YACb,IACA,OACA,OACA,WACA;AACA,QAAM,KAAK;AAAA,IACT;AAAA,IACA,GAAG,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,MAAM,UAAU,cAAc,MAAM,cAAe,MAAM,aAAa,EAAG,IAAI,SAAS;AAAA,EAC7H;AACA,QAAM,CAAC,QAAQ,IAAI,MAAM,+CAA+C,EAAE;AAC1E,MAAI,CAAC;AACH,UAAM,YAAY,IAAI;AAAA,MACpB,GAAG;AAAA,MACH;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,oBAAI,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO,MAAM,SAAS,SAAS,IAAI,UAAU,CAAC,GAAG,UAAU,CAAC,GAAG,eAAe,CAAC,EAAE;AAAA,IAC3F,CAAC;AACH,SAAO;AACT;AAKA,eAAe,2BAA2B,IAA4C;AACpF,MAAI,QAAuB;AAC3B,aAAS;AACP,UAAM,aAYD,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAqBA,KAAK,gCAAgC,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYrD,QAAI,CAAC,WAAW,OAAQ;AACxB,eAAW,aAAa,YAAY;AAClC,YAAM,SAAS,yBAAyB,CAAC,EAAE,MAAM,YAAY,SAAS,UAAU,QAAQ,CAAC,GAAG;AAAA,QAC1F,IAAI,UAAU;AAAA,QACd,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,MACzB,CAAC;AACD,YAAM,OAAO,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU,EAAG;AACpE,YAAM,aAAa,qBAAqB,0BAA0B,UAAU,EAAE;AAC9E,YAAM,cAAc,qBAAqB,2BAA2B,UAAU,EAAE;AAChF,YAAM;AAAA;AAAA;AAAA,iBAGK,UAAU,mCAAmC,OAAO,IAAI,IAAI,OAAO,WAAW,IAAI,IAAI;AAAA,YAC3F,WAAW,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA;AAAA,YAEvD,GAAG,KAAK,OAAO,KAAK,CAAC;AAAA,sDACqB,UAAU,WAAW;AACrE,YAAM;AAAA,iBACK,UAAU,UAAU,UAAU,UAAU,YAAY,UAAU,WAAW;AAAA,YAC9E,WAAW,QAAQ,EAAE,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;AAAA,YACtD,GAAG,KAAK;AAAA,QACR,MAAM;AAAA,QACN,WAAW;AAAA,QACX,yBAAyB,UAAU;AAAA,QACnC,kBAAkB,UAAU;AAAA,QAC5B,WAAW,UAAU;AAAA,MACvB,CAAC,CAAC;AAAA,YACA,GAAG,KAAK;AAAA,QACR;AAAA,QACA,SAAS,UAAU;AAAA,QACnB;AAAA,QACA,SAAS;AAAA,QACT,eAAe;AAAA,QACf,UAAU;AAAA,MACZ,CAAC,CAAC;AAAA,IACR;AACA,YAAQ,WAAW,GAAG,EAAE,EAAG;AAAA,EAC7B;AACF;AAGA,eAAsB,yBAAyB,IAA4C;AACzF,QAAM,2BAA2B,EAAE;AACnC,QAAM,uBAAuB,EAAE;AAC/B,MAAI,QAAuB;AAC3B,aAAS;AACP,UAAM,WAA2B,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yCAgBF,KAAK,0BAA0B,KAAK;AACzE,QAAI,CAAC,SAAS,OAAQ;AACtB,eAAW,UAAU,UAAU;AAC7B,YAAM,UAAU,yBAAyB,OAAO,MAAM,OAAO,kBAAkB;AAC/E,YAAM,QAAe;AAAA,QACnB,WAAW,OAAO;AAAA,QAClB,aAAa,OAAO;AAAA,QACpB,OAAO,OAAO,eAAe,SAAS,aAAa;AAAA,QACnD,WAAW,OAAO;AAAA,MACpB;AAGA,YAAM,WAAqB,CAAC;AAC5B,UAAI,OAAO,eAAe,aAAa;AACrC,YAAI,OAAO,aAAa,OAAO,cAAc;AAC3C,mBAAS;AAAA,YACP,MAAM,YAAY,IAAI,OAAO,OAAO,WAAW,aAAa,OAAO,SAAS,EAAE;AAAA,UAChF;AACF,mBAAW,SAAS,OAAO;AACzB,mBAAS,KAAK,MAAM,YAAY,IAAI,OAAO,OAAO,SAAS,KAAK,EAAE,CAAC;AAAA,MACvE;AACA,YAAM,YAAY,IAAI;AAAA,QACpB,GAAG;AAAA,QACH,IAAI,OAAO;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,GAAI,OAAO,qBAAqB,EAAE,eAAe,OAAO,mBAAmB,IAAI,CAAC;AAAA,QAChF,gBAAgB,OAAO;AAAA,QACvB,eAAe;AAAA,UACb,MAAM,OAAO,SAAS;AAAA,UACtB,WAAW,OAAO,SAAS;AAAA,UAC3B,SAAS,OAAO,SAAS;AAAA,QAC3B;AAAA,QACA,QAAQ,OAAO;AAAA,QACf,iBAAiB,OAAO;AAAA,QACxB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB,YAAY,OAAO;AAAA,QACnB,MAAM;AAAA,UACJ,OAAO,QAAQ,MAAM,UAAU,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,GAAG,KAAK;AAAA,UACvD;AAAA,UACA,MACE,OAAO,SAAS,aACZ,aACA,OAAO,SAAS,aACd,SACA,OAAO,SAAS,aACd,aACA;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,YAAY,UAAU,OAAO,EAAE,GAAG;AAAA,UAC5D,UAAU,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC;AAAA,UAC/B,UAAU,MAAM,sBAAsB,IAAI,MAAM;AAAA,UAChD,eAAe,OAAO,cAAc,IAAI,CAAC,kBAAkB;AAAA,YACzD,SAAS,aAAa;AAAA,YACtB,UACE,aAAa;AAAA,UACjB,EAAE;AAAA,QACJ;AAAA,MACF,CAAC;AAAA,IACH;AACA,YAAQ,SAAS,GAAG,EAAE,EAAG;AAAA,EAC3B;AACA,UAAQ;AACR,aAAS;AACP,UAAM,YAA8B,MAAM;AAAA;AAAA;AAAA;AAAA,eAM/B,KAAK,0BAA0B,KAAK;AAC/C,QAAI,CAAC,UAAU,OAAQ;AACvB,eAAW,YAAY,WAAW;AAChC,YAAM,SAAS,MAAM;AAAA,2BACA,SAAS,UAAU,oBAAoB,SAAS,EAAE;AACvE,YAAM,QAAe;AAAA,QACnB,WAAW,SAAS;AAAA,QACpB,aAAa,SAAS;AAAA,QACtB,OAAO,SAAS;AAAA,QAChB,WAAW,SAAS;AAAA,MACtB;AACA,YAAM,WACJ,SAAS,mBAAmB,eAAe,SAAS,YAChD,CAAC,MAAM,YAAY,IAAI,OAAO,SAAS,WAAW,iBAAiB,SAAS,OAAO,EAAE,CAAC,IACtF,CAAC;AACP,YAAM,YAAY,IAAI;AAAA,QACpB,GAAG;AAAA,QACH,IAAI,qBAAqB,YAAY,SAAS,EAAE;AAAA,QAChD,YAAY,SAAS;AAAA,QACrB,QAAQ;AAAA,QACR,WAAW,SAAS;AAAA,QACpB,MAAM;AAAA,UACJ,OAAO,SAAS;AAAA,UAChB,MAAM;AAAA;AAAA;AAAA,UAGN,SAAS,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,EAAE,KAAK,MAAM;AAAA,UACtD;AAAA,UACA,UAAU,CAAC;AAAA,UACX,eAAe,CAAC;AAAA,UAChB,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,QAAQ,SAAS;AAAA,YACjB,YAAY,SAAS;AAAA,YACrB,WAAW;AAAA,YACX,GAAI,SAAS,aAAa,EAAE,KAAK,SAAS,WAAW,IAAI,CAAC;AAAA,YAC1D,GAAI,SAAS,qBAAqB,EAAE,YAAY,SAAS,mBAAmB,IAAI,CAAC;AAAA,YACjF,GAAI,SAAS,iBAAiB,EAAE,SAAS,SAAS,eAAe,IAAI,CAAC;AAAA,UACxE;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,YAAQ,UAAU,GAAG,EAAE,EAAG;AAAA,EAC5B;AACA,QAAM,sBAAsB,EAAE;AAE9B,QAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWR;AAGA,eAAe,sBAAsB,IAA6B;AAYhE,WAAS,MAAM,KAAuB;AACpC,WAAO;AAAA,MACL,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,aAAa,IAAI,sBAAsB,qBAAqB,iBAAiB,IAAI,UAAU;AAAA,MAC3F,OAAO,IAAI;AAAA,MACX,WAAW,IAAI;AAAA,IACjB;AAAA,EACF;AACA,WAAS,MAAM,KAAgB;AAC7B,WAAO;AAAA,MACL,MAAM,IAAI;AAAA,MACV,WAAW,IAAI;AAAA,MACf,0BAA0B,IAAI;AAAA,IAChC;AAAA,EACF;AACA,MAAI,QAAuB;AAC3B,aAAS;AACP,UAAM,WAEF,MAAM;AAAA;AAAA;AAAA,yCAO2B,KAAK,0BAA0B,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOzE,QAAI,CAAC,SAAS,OAAQ;AACtB,eAAW,UAAU;AACnB,YAAM,YAAY,IAAI;AAAA,QACpB,GAAG,MAAM,MAAM;AAAA,QACf,IAAI,qBAAqB,UAAU,OAAO,EAAE;AAAA,QAC5C,QAAQ;AAAA,QACR,WAAW,OAAO;AAAA,QAClB,wBAAwB,OAAO;AAAA,QAC/B,eAAe,MAAM,MAAM;AAAA,QAC3B,gBAAgB,EAAE,QAAQ,OAAO,UAAU,SAAS,OAAO,QAAQ;AAAA,QACnE,MAAM;AAAA,UACJ,OAAO,OAAO;AAAA,UACd,MAAM;AAAA,UACN,SAAS,OAAO,QAAQ,KAAK,IAAI;AAAA,UACjC,UAAU,CAAC;AAAA,UACX,UAAU,CAAC;AAAA,UACX,eAAe,CAAC;AAAA,QAClB;AAAA,MACF,CAAC;AACH,YAAQ,SAAS,GAAG,EAAE,EAAG;AAAA,EAC3B;AACA,UAAQ;AACR,aAAS;AACP,UAAM,WASF,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAkBC,KAAK,0BAA0B,KAAK;AAC/C,QAAI,CAAC,SAAS,OAAQ;AACtB,eAAW,WAAW,UAAU;AAC9B,YAAM,SAAS,QAAQ,cACnB,MAAM;AAAA,2BACW,QAAQ,UAAU,oBAAoB,QAAQ,WAAW,0BAC1E,CAAC;AACL,YAAM,YAAY,IAAI;AAAA,QACpB,GAAG,MAAM,OAAO;AAAA,QAChB,IAAI,qBAAqB,oBAAoB,QAAQ,EAAE;AAAA,QACvD,yBAAyB,QAAQ;AAAA,QACjC,wBAAwB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,MAAM,OAAO;AAAA,QAC5B,gBAAgB,QAAQ;AAAA,QACxB,MAAM;AAAA,UACJ,OAAO,QAAQ;AAAA,UACf,MAAM;AAAA,UACN,SAAS,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,MAAM;AAAA,UAC9C,UAAU,CAAC;AAAA,UACX,UAAU,CAAC;AAAA,UACX,eAAe,CAAC;AAAA,UAChB,QAAQ;AAAA,YACN,MAAM,QAAQ,UAAU,SAAS;AAAA,YACjC,YAAY,8BAA8B,QAAQ,EAAE;AAAA,YACpD,SAAS,QAAQ;AAAA,YACjB,WAAW,OAAO,SAAS,aAAa;AAAA,YACxC,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,QAAQ,IAAI,CAAC;AAAA,YACrD,GAAI,QAAQ,cAAc,EAAE,YAAY,QAAQ,YAAY,IAAI,CAAC;AAAA,YACjE,GAAI,QAAQ,aAAa,EAAE,KAAK,QAAQ,WAAW,IAAI,CAAC;AAAA,UAC1D;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,YAAQ,SAAS,GAAG,EAAE,EAAG;AAAA,EAC3B;AACA,UAAQ;AACR,aAAS;AACP,UAAM,SAcF,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eA6BC,KAAK,0BAA0B,KAAK;AAAA;AAAA;AAAA;AAAA;AAK/C,QAAI,CAAC,OAAO,OAAQ;AACpB,eAAW,SAAS,QAAQ;AAC1B,YAAM,WAAW,MAAM;AAAA,4FAC+D,MAAM,UAAU;AAAA,yBACnF,MAAM,EAAE;AAC3B,YAAM,YAAY,MAAM;AAAA;AAAA,6BAQD,MAAM,UAAU,wBAAwB,MAAM,EAAE;AAAA;AAEvE,YAAM,aACJ,MAAM,gBACL,OAAO,MAAM,iBAAiB,WAC3B,MAAM,eACN,KAAK,UAAU,MAAM,YAAY;AACvC,YAAM,YAAY,IAAI;AAAA,QACpB,GAAG,MAAM,KAAK;AAAA,QACd,IAAI,qBAAqB,SAAS,MAAM,EAAE;AAAA,QAC1C,eAAe,MAAM;AAAA,QACrB,wBAAwB,MAAM;AAAA,QAC9B,QAAQ,MAAM;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,YAAY,MAAM;AAAA,QAClB,eAAe,MAAM,KAAK;AAAA,QAC1B,gBAAgB,MAAM;AAAA,QACtB,MAAM;AAAA,UACJ,OAAO,GAAG,MAAM,YAAY,KAAK,MAAM,aAAa;AAAA,UACpD,MAAM;AAAA,UACN,SACE,MAAM,sBAAsB,4BAC5B,OAAO,MAAM,iBAAiB,WAC1B,MAAM,eACN,GAAG,MAAM,YAAY,SAAM,MAAM,aAAa,KAAK,UAAU;AAAA,UACnE,QAAQ,EAAE,MAAM,UAAU,YAAY,mBAAmB,MAAM,EAAE,GAAG;AAAA,UACpE,UAAU,CAAC,qBAAqB,UAAU,MAAM,iBAAiB,CAAC;AAAA,UAClE,UAAU,SAAS,IAAI,CAAC,MAAM;AAC5B,kBAAM,KAAK,qBAAqB,oBAAoB,EAAE,mBAAmB;AACzE,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,YAAY,qBAAqB,YAAY,EAAE;AAAA,cAC/C,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,YAClD;AAAA,UACF,CAAC;AAAA,UACD,eAAe;AAAA,YACb,GAAG,UAAU,IAAI,CAAC,OAAO;AAAA,cACvB,SAAS,EAAE,qBAAqB,qBAAqB,SAAS,EAAE,WAAW;AAAA,cAC3E,UAAU,EAAE;AAAA,YACd,EAAE;AAAA,YACF,GAAI,MAAM,mBACN;AAAA,cACE;AAAA,gBACE,SAAS,qBAAqB,UAAU,MAAM,gBAAgB;AAAA,gBAC9D,UAAU;AAAA,cACZ;AAAA,YACF,IACA,CAAC;AAAA,UACP;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AACA,YAAQ,OAAO,GAAG,EAAE,EAAG;AAAA,EACzB;AACF;AAIA,eAAe,uBAAuB,IAA6B;AACjE,QAAM;AACN,QAAM;AACN,QAAM,QACJ,MAAM;AAAA;AAER,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,0BAA0B,MAAM,KAAK,MAAM;AAC1D,UAAM,6CAA6C,KAAK,UAAU;AAAA,2CAC3B,KAAK,YAAY;AAAA,yCACnB,OAAO,mBAAmB;AAAA,0DACT,OAAO,mBAAmB;AAChF,UAAM,8EAA8E,KAAK,YAAY;AACrG,UAAM,wCAAwC,KAAK,YAAY;AAC/D,UAAM,CAAC,SAAS,IAAI,MAAM;AAAA,2BACH,KAAK,UAAU,qBAAqB,OAAO,mBAAmB;AAAA;AAAA,uCAElD,KAAK,YAAY;AAAA,+DACO,KAAK,YAAY;AAI5E,UAAM;AAAA;AAAA,sBAEY,KAAK,EAAE;AACzB,UAAM;AAAA,gCACsB,KAAK,EAAE;AACnC,UAAM;AAAA;AAAA,gCAEsB,KAAK,EAAE;AAGnC,QAAI,CAAC;AACH,YAAM;AAAA;AAAA,wFAE4E,KAAK,EAAE;AAC3F,UAAM,CAAC,OAAO,IAAI,MAAM;AAAA,qBACP,KAAK,UAAU,2BAA2B,MAAM,CAAC,CAAC;AAAA,8CACzB,KAAK,EAAE;AACjD,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,gDAAgD;AAC9E,UAAM,qDAAqD,KAAK,UAAU;AAAA,QACtE,KAAK,YAAY,UAAU,KAAK,EAAE,UAAU,QAAQ,kBAAkB;AAC1E,QAAI;AACF,YAAM,qDAAqD,KAAK,UAAU;AAAA,QACxE,KAAK,YAAY,UAAU,KAAK,EAAE,UAAU,QAAQ,kBAAkB;AAAA,EAC5E;AACA,QAAM;AACN,QAAM;AACN,QAAM;AAAA;AAER;;;ACxvBA,SAAS,cAAAA,mBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAKP,SAAS,OAAO,OAA6B;AAC3C,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAC5D,UAAM,IAAI,MAAM,sCAAsC;AACxD,SAAO;AACT;AAGO,SAAS,0BAA0B,OAAgB,UAA6B;AACrF,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,6BAA6B;AACxE,QAAM,QAAQ,oBAAI,IAAY;AAC9B,QAAM,YAAY,MAAM,IAAI,CAAC,OAAO,UAAU;AAC5C,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAC/E,UAAM,QAAQ,MAAM,MAAM,IAAI,CAAC,cAAc;AAC3C,YAAM,OAAO,OAAO,SAAS;AAC7B,UAAI,OAAO,KAAK,SAAS,YAAY,OAAO,KAAK,YAAY;AAC3D,cAAM,IAAI,MAAM,gCAAgC;AAClD,UAAI,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACrE,cAAM,IAAI,MAAM,qCAAqC;AACvD,aAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ;AAAA,IAClD,CAAC;AACD,UAAM,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,UAAU;AAC1D,UAAM,QAAQ,QAAQ,CAAC,sBAAsB,KAAK,KAAK,OAAO;AAC9D,QAAI,UAAU,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,gBAAgB;AAC3E,YAAM,IAAI,MAAM,sDAAsD;AACxE,UAAM,SAAS,yBAAyB,OAAsB;AAAA,MAC5D,IAAIC,YAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,MACjF,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO;AAAA,MACrD,aAAa,OAAO,MAAM,gBAAgB,WAAW,MAAM,cAAc;AAAA,IAC3E,CAAC;AACD,2BAAuB,OAAO,KAAK;AACnC,QAAI,MAAM,IAAI,OAAO,IAAI,EAAG,OAAM,IAAI,MAAM,mCAAmC,OAAO,IAAI,EAAE;AAC5F,UAAM,IAAI,OAAO,IAAI;AAGrB,WAAO,QAAQ,EAAE,GAAG,OAAO,GAAG,OAAO,IAAI;AAAA,EAC3C,CAAC;AACD,sBAAoB,MAAM,SAAS;AACnC,SAAO;AACT;AAEO,SAAS,wBAAwB,OAAgB,UAA+B;AACrF,QAAM,OAAO,OAAO,KAAK;AACzB,QAAM,YAAY,EAAE,GAAG,KAAK;AAC5B,MAAI,KAAK,WAAW;AAClB,cAAU,SAAS,0BAA0B,KAAK,QAAQ,QAAQ;AACpE,MAAI,MAAM,QAAQ,KAAK,mBAAmB;AACxC,cAAU,sBAAsB,KAAK,oBAAoB,IAAI,CAAC,OAAO,UAAU;AAC7E,YAAM,WAAW,OAAO,KAAK;AAC7B,YAAM,kBAAkB,OAAO,SAAS,eAAe;AACvD,aAAO;AAAA,QACL,GAAG;AAAA,QACH,iBAAiB;AAAA,UACf,GAAG;AAAA,UACH,GAAI,gBAAgB,WAAW,SAC3B;AAAA,YACE,QAAQ;AAAA,cACN,gBAAgB;AAAA,cAChB,GAAG,QAAQ,aAAa,KAAK;AAAA,YAC/B;AAAA,UACF,IACA,CAAC;AAAA,QACP;AAAA,MACF;AAAA,IACF,CAAC;AAIH,MAAI,UAAU,WAAW,OAAW,qBAAoB,MAAM,UAAU,MAAM;AAC9E,MAAI,UAAU,wBAAwB,QAAW;AAC/C,QAAI,CAAC,MAAM,QAAQ,UAAU,mBAAmB;AAC9C,YAAM,IAAI,MAAM,+CAA+C;AACjE,eAAW,SAAS,UAAU;AAC5B,sCAAgC,MAAM,OAAO,KAAK,EAAE,eAAe;AAAA,EACvE;AACA,SAAO;AACT;AAEA,eAAe,0CACb,IACe;AACf,QAAM,OAAO,MAAM;AAAA;AAAA;AAAA;AAInB,MAAI,KAAK,WAAW;AAClB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACJ;AAGA,eAAsB,iCAAiC,IAA4C;AACjG,QAAM,0CAA0C,EAAE;AAClD,QAAM;AAAA;AAIN,QAAM;AAAA;AAEN,QAAM,SAAS,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAerB,QAAM,WAAqB,CAAC;AAC5B,aAAW,UAAU,QAAQ;AAC3B,QAAI;AACF,YAAM,WAAW,OAAO,OAAO,KAAK;AACpC,YAAM,YACJ,OAAO,SAAS,sBACZ,wBAAwB,UAAU,OAAO,EAAE,IAC3C,EAAE,GAAG,UAAU,QAAQ,0BAA0B,SAAS,QAAQ,OAAO,EAAE,EAAE;AACnF,UAAI,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,QAAQ;AACvD,iBAAS,KAAK,GAAG,OAAO,IAAI,IAAI,OAAO,EAAE,kBAAkB;AAAA,IAC/D,QAAQ;AACN,eAAS,KAAK,GAAG,OAAO,IAAI,IAAI,OAAO,EAAE,oBAAoB;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,aAAa,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAezB,QAAM,UAA8E,CAAC;AACrF,aAAW,UAAU,YAAY;AAC/B,QAAI;AACF,YAAM,YACJ,OAAO,SAAS,YACZ,0BAA0B,OAAO,UAAU,OAAO,EAAE,IACpD,wBAAwB,OAAO,UAAU,OAAO,EAAE;AACxD,UAAI,OAAO,SAAS,UAAW,qBAAoB,MAAM,SAAS;AAClE,UAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,KAAK,UAAU,SAAS,GAAG;AACjE,YAAI,OAAO,OAAQ,UAAS,KAAK,GAAG,OAAO,IAAI,IAAI,OAAO,EAAE,2BAA2B;AAAA,YAClF,SAAQ,KAAK,EAAE,QAAQ,UAAU,CAAC;AAAA,MACzC;AAAA,IACF,QAAQ;AACN,eAAS,KAAK,GAAG,OAAO,IAAI,IAAI,OAAO,EAAE,2CAA2C;AAAA,IACtF;AAAA,EACF;AACA,MAAI,SAAS;AACX,UAAM,IAAI;AAAA,MACR,uCAAuC,SAAS,MAAM,sFAAsF,SAAS,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAC9K;AACF,aAAW,EAAE,QAAQ,UAAU,KAAK,SAAS;AAC3C,UAAM,WAAW,GAAG,KAAK,OAAO,QAAiB;AACjD,UAAM,cAAc,GAAG,KAAK,SAAkB;AAC9C,UAAM;AAAA,eACK,OAAO,UAAU,IAAI,OAAO,YAAY,IAAI,OAAO,IAAI,IAAI,OAAO,EAAE,IAAI,QAAQ;AAAA,mCAC5D,QAAQ,0DAA0D,WAAW;AAC5G,UAAM,UACJ,OAAO,SAAS,YACZ,MAAM,gCAAgC,WAAW,aAAa,OAAO,EAAE,mBAAmB,OAAO,UAAU,qBAAqB,OAAO,YAAY,eAAe,QAAQ,kBAC1K,MAAM,yCAAyC,WAAW,aAAa,OAAO,EAAE,mBAAmB,OAAO,UAAU,qBAAqB,OAAO,YAAY,iBAAiB,QAAQ;AAC3L,QAAI,QAAQ,WAAW;AACrB,YAAM,IAAI,MAAM,0CAA0C,OAAO,IAAI,IAAI,OAAO,EAAE,EAAE;AAAA,EACxF;AACF;;;AClLO,SAAS,uCACd,MAC+C;AAC/C,MAAI,SAAS,0DAA0D;AACrE,WAAO;AAAA,MACL,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;;;AJPA,IAAM,uBAAuB;AAC7B,IAAM,iCAAiC;AACvC,IAAM,yBAAyB;AAC/B,IAAM,oCAAoC;AAC1C,IAAM,sCAAsC;AAC5C,IAAM,kCAAkC;AACxC,IAAM,2BACJ;AACF,IAAM,2BAA2B;AACjC,IAAM,2BACJ;AACF,IAAM,0CAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAiCD,SAAS,iBAAiB,MAAc,OAAuB;AAC7D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,wCAAwC,KAAK,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAoBO,SAAS,8BACd,MACA,SACiC;AACjC,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,YAAY,MAAM,CAAC,GAAG,KAAK,KAAK;AACtC,QAAM,qBAAqB,gDAAgD,KAAK,SAAS;AACzF,QAAM,iBAAiB,qBAAqB,IAAI;AAChD,QAAM,gBAAgB,MAAM,cAAc,GAAG,KAAK,KAAK;AACvD,QAAM,YAAY,yBAAyB,KAAK,aAAa;AAC7D,MAAI,CAAC,WAAW;AACd,QAAI,cAAc,WAAW,cAAc,GAAG;AAC5C,YAAM,IAAI,MAAM,+CAA+C,IAAI,EAAE;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,UAAU,CAAC;AAC/B,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,kBAAkB,yBAAyB,KAAK,wBAAwB;AAC9E,MAAI,CAAC,mBAAmB,yBAAyB,SAAS,GAAG,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,kBAAkB,gBAAgB,CAAC,MAAM;AAC/C,MAAI,CAAC,mBAAmB,CAAC,wCAAwC,IAAI,IAAI,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY,gBAAgB,CAAC,KAAK,gBAAgB,CAAC,GAAI,WAAW,MAAM,GAAG;AAAA,IAC3E;AAAA,IACA,eAAe,CAAC;AAAA,IAChB;AAAA,EACF;AACF;AAEO,SAAS,8BACd,MACA,SACgG;AAChG,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,iBAAiB,gDAAgD;AAAA,IACrE,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,EACtB,IACI,IACA;AACJ,QAAM,YAAY,yBAAyB,KAAK,MAAM,cAAc,GAAG,KAAK,KAAK,EAAE;AACnF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,WAAW,IAAI,CAAC,EAC9C,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,YAAY,OAAO,UAAU,CAAC,CAAE;AACtC,MACE,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAY,KACZ,YAAY,OACZ,CAAC,YAAY,KAAK,wBAAwB,KAC1C,CAAC,eAAe,KAAK,wBAAwB,KAC7C,CAAC,kBAAkB,KAAK,wBAAwB,KAChD,CAAC,IAAI,OAAO,eAAe,SAAS,OAAO,GAAG,EAAE,KAAK,wBAAwB,KAC7E,yBAAyB,SAAS,GAAG,GACrC;AACA,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,UAAU,CAAC;AAAA,IACxB,kBAAkB,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,eAAsB,qBACpB,KACA,MACA,SACA,SACe;AACf,MAAI,SAAS,sBAAsB,SAAS,oBAAoB;AAC9D,cAAU,MAAM,uCAAuC,KAAK,OAAO;AAAA,EACrE;AACA,MAAI,QAAQ,SAAS,+BAA+B,GAAG;AACrD,QAAI,SAAS;AACX,YAAM,IAAI,MAAM,sDAAsD;AACxE,UAAM,QAAQ,QAAQ,MAAM,+BAA+B;AAC3D,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,gDAAgD;AACxF,UAAM,IAAI,MAAM,OAAO,gBAAgB;AACrC,YAAM,kCAAkC,WAAW;AACnD,YAAM;AAAA;AAAA;AAGN,YAAM,YAAY,OAAO,MAAM,CAAC,CAAE;AAClC,YAAM,4BAA4B,WAAW;AAC7C,YAAM,iCAAiC,WAAW;AAClD,YAAM,YAAY,OAAO,MAAM,CAAC,CAAE;AAGlC,YAAM,yDAAyD,IAAI;AAAA,IACrE,CAAC;AACD;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,0BAA0B,GAAG;AAChD,QAAI,SAAS;AACX,YAAM,IAAI,MAAM,sDAAsD;AACxE,UAAM,QAAQ,QAAQ,MAAM,0BAA0B;AACtD,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAC9F,UAAM,IAAI,MAAM,OAAO,gBAAgB;AACrC,YAAM;AACN,YAAM;AAAA;AAAA;AAGN,YAAM,YAAY,OAAO,MAAM,CAAC,CAAE;AAClC,YAAM,yBAAyB,WAAW;AAC1C,YAAM;AACN,YAAM,YAAY,OAAO,MAAM,CAAC,CAAE;AAClC,YAAM,yDAAyD,IAAI;AAAA,IACrE,CAAC;AACD;AAAA,EACF;AACA,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,iBAAiB;AACnB,UAAM,wCAAwC,gBAAgB,WAAW;AACzE,UAAM,6CAA6C,gBAAgB,gBAAgB;AACnF,QAAI;AACF,iBAAS;AACP,cAAM,SAAS,MAAM,IAAI,MAAM,OAAO,gBAAgB;AACpD,gBAAM,0BAA0B,uCAAuC,IAAI;AAC3E,gBAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAON,cAAI,yBAAyB;AAC3B,kBAAM;AAAA,gBACF,wBAAwB,GAAG;AAAA,gBAC3B,wBAAwB,KAAK;AAAA;AAAA;AAAA,UAGnC;AACA,iBAAO,MAAM,YAAY,OAAO,gBAAgB,SAAS;AAAA,QAC3D,CAAC;AACD,YAAI,OAAO,WAAW,EAAG;AAAA,MAC3B;AAAA,IACF,UAAE;AACA,YAAM;AACN,YAAM;AAAA,IACR;AACA;AAAA,EACF;AACA,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,CAAC,iBAAiB;AAYpB,UAAM,IAAI;AAAA,MACR;AAAA;AAAA;AAAA;AAAA,EAGiF,SAAS,mCAAmC,qCAAqC,EAAE,GAAG,OAAO;AAAA,IAChL;AACA;AAAA,EACF;AAEA,QAAM,wCAAwC,gBAAgB,WAAW;AACzE,MAAI;AACF,UAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,2DAK8B,gBAAgB,SAAS;AAAA;AAEhF,QAAI,aAAa,CAAC,SAAS,SAAS,CAAC,SAAS,QAAQ;AACpD,YAAM,kBAAkB,IAAI,gBAAgB,UAAU,WAAW,KAAK,IAAI,CAAC;AAC3E,YAAM,IAAI,OAAO,2BAA2B,eAAe,EAAE;AAAA,IAC/D,WAAW,YAAY,gBAAgB,eAAe;AACpD;AAAA,IACF;AACA,UAAM,IAAI,OAAO,gBAAgB,SAAS;AAAA,EAC5C,UAAE;AACA,UAAM;AAAA,EACR;AACF;AAEA,IAAM,2BACJ;AAGF,eAAsB,uCACpB,KACA,SACiB;AACjB,MAAI,CAAC,QAAQ,WAAW,wBAAwB,GAAG;AACjD,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,CAAC,SAAS,IAAI,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAa1B,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SACE,+CAA+C,QAAQ,MAAM,yBAAyB,MAAM;AAEhG;AAEA,SAAS,yBAAyB,SAAuD;AACvF,MAAI,YAAY,OAAW,QAAO,QAAQ,uBAAuB;AACjE,QAAM,aAAa,QAAQ,IAAI;AAC/B,MAAI,eAAe,UAAa,eAAe,QAAS,QAAO;AAC/D,MAAI,eAAe,OAAQ,QAAO;AAClC,QAAM,IAAI,MAAM,+DAA+D;AACjF;AAEA,SAAS,sBACP,SACuB;AACvB,QAAM,MACJ,YAAY,SACR,QAAQ,IAAI,iCAAiC,KAAK,KAAK,SACvD,QAAQ;AACd,MAAI,QAAQ,QAAW;AACrB,WAAO,EAAE,qBAAqB,gCAAgC,QAAQ,UAAU;AAAA,EAClF;AACA,QAAM,QAAQ,OAAO,QAAQ,WAAW,MAAM,OAAO,GAAG;AACxD,MACE,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ,0BACP,OAAO,QAAQ,YAAY,CAAC,oBAAoB,KAAK,GAAG,GACzD;AACA,UAAM,IAAI;AAAA,MACR,0EAA0E,GAAG;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,EAAE,qBAAqB,OAAO,QAAQ,aAAa;AAC5D;AAEO,SAAS,0BACd,QACA,SACU;AACV,QAAM,aAAa,SAAS;AAC5B,QAAM,cAAc,QAAQ,IAAI,+CAA+C,KAAK;AACpF,QAAM,WACJ,eAAe,SACX,aACA,cACE,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,IAChD;AAER,MAAI,CAAC,UAAU;AACb,UAAM,yBAAyB;AAAA,MAC7B,QAAQ,IAAI,4BAA4B,KAAK;AAAA,MAC7C,QAAQ,IAAI,gCAAgC,KAAK;AAAA,IACnD,EAAE,OAAO,CAAC,SAAyB,QAAQ,IAAI,KAAK,SAAS,iCAAiC;AAC9F,QAAI,UAAU,uBAAuB,SAAS,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,WAAO,CAAC,iCAAiC;AAAA,EAC3C;AAEA,MACE,eAAe,UACf,WAAW,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,SAAS,KAAK,KAAK,CAAC,GAC1E;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,SAAS,KAAK,SAAS,SAAS,iCAAiC;AAC5E,UAAM,IAAI;AAAA,MACR,uDAAuD,+BAA+B;AAAA,IACxF;AAAA,EACF;AACA,QAAM,aAAa,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE;AAAA,IAAK,CAAC,MAAM,UACpD,OAAO,QAAQ,OAAO,KAAK,MAAM,MAAM,GAAG,OAAO,KAAK,OAAO,MAAM,CAAC;AAAA,EACtE;AACA,MACE,WAAW,WAAW,SAAS,UAC/B,WAAW,KAAK,CAAC,SAAS,KAAK,WAAW,KAAK,OAAO,WAAW,MAAM,MAAM,IAAI,EAAE,GACnF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,6BACb,KACA,QACe;AACf,QAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAGzB,MAAI,CAAC,UAAU,OAAQ;AACvB,QAAM;AAAA;AAAA;AAAA,sBAGc,OAAO,mBAAmB,KAAK,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlE;AAiCA,eAAsB,QACpB,cAAc,QAAQ,IAAI,oCACxB,QAAQ,IAAI,yBACZ,sBACF,SAA6B,QAAQ,IAAI,oBAAoB,KAAK,KAAK,QACvE,gBACe;AACf,QAAM,gBAAgB,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,YAAY;AAChF,QAAM,SAAS,MAAM,QAAQ,aAAa,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AAC1F,QAAM,cAAc,sBAAsB,cAAc;AACxD,QAAM,qBAAqB,yBAAyB,cAAc;AAClE,QAAM,MAAM,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AAC5C,MAAI;AAGF,UAAM;AACN,QAAI,QAAQ;AACV,uBAAiB,sBAAsB,MAAM;AAC7C,YAAM,IAAI,OAAO,gCAAgC,MAAM,GAAG;AAI1D,YAAM,IAAI,OAAO,gDAAgD;AACjE,YAAM,IAAI,OAAO,sBAAsB,MAAM,iCAAiC;AAAA,IAChF;AACA,UAAM,2DAA2D,OAAO,YAAY,mBAAmB,CAAC;AACxG,UAAM,qEAAqE,YAAY,MAAM;AAC7F,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,UAAU,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAc,CAAC;AACpE,UAAM,0BAA0B,oBAAI,IAAoB;AACxD,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,gCAAwB,IAAI,MAAM,MAAM,SAAS,KAAK,eAAe,IAAI,GAAG,MAAM,CAAC;AAAA,MACrF;AAAA,IACF;AAMA,QACE,MAAM,KAAK,wBAAwB,OAAO,CAAC,EAAE;AAAA,MAAK,CAAC,WACjD,OAAO,SAAS,mCAAmC;AAAA,IACrD,GACA;AACA,YAAM,mBAAmB,0BAA0B,QAAQ,cAAc;AACzE,YAAM;AAAA,UACF,mCAAmC;AAAA,UACnC,KAAK,UAAU,gBAAgB,CAAC;AAAA;AAAA;AAAA,IAGtC;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,IAAI,IAAI,GAAG;AACrB;AAAA,MACF;AACA,YAAM,UAAU,wBAAwB,IAAI,IAAI;AAChD,UAAI,YAAY,QAAW;AACzB,cAAM,IAAI,MAAM,4CAA4C,IAAI,EAAE;AAAA,MACpE;AACA,YAAM,qBAAqB,KAAK,MAAM,SAAS,EAAE,mBAAmB,CAAC;AACrE,YAAM,uDAAuD,IAAI;AAAA,IACnE;AAGA,UAAM,6BAA6B,KAAK,WAAW;AAAA,EACrD,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAWA,eAAsB,cACpB,iBACA,cACA,gBACe;AACf,QAAM,QAAQ,iBAAiB,cAAc,cAAc;AAC7D;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,QAAQ;AACd,UAAQ,IAAI,iCAAiC;AAC/C;","names":["createHash","createHash"]}

package/dist/{chunk-LSLNMENV.js → chunk-KZXWUXWV.js}

@@ -1,15 +1,15 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-CSVHCF3R.js";
+} from "./chunk-IB3SW3JW.js";
 import {
   withSessionActivityRlsContext
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 import {
   sandboxRetainedProcesses,
   sessionBackgroundCommands,
   sessionEvents,
   sessions
-} from "./chunk-GSB4ISHE.js";
+} from "./chunk-IIPWNNVR.js";
 import {
   fromPostgresLosslessJson,
   withLosslessContentWriteVersion
@@ -128,4 +128,4 @@ async function appendSessionCommandOutput(db, input) {
 export {
   appendSessionCommandOutput
 };
-//# sourceMappingURL=chunk-LSLNMENV.js.map
+//# sourceMappingURL=chunk-KZXWUXWV.js.map

package/dist/{chunk-LO6BVXXH.js → chunk-LD52IFS3.js}

@@ -6,7 +6,7 @@ import {
   rlsContextForWorkspace,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 
 // src/organization-integration-policy.ts
 import {
@@ -153,4 +153,4 @@ export {
   withOrganizationIntegrationPolicyFence,
   withOrganizationIntegrationAcquisition
 };
-//# sourceMappingURL=chunk-LO6BVXXH.js.map
+//# sourceMappingURL=chunk-LD52IFS3.js.map

package/dist/{chunk-JILAWE26.js → chunk-M5Z6II2P.js}

@@ -5,7 +5,7 @@ import {
   withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -502,4 +502,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-JILAWE26.js.map
+//# sourceMappingURL=chunk-M5Z6II2P.js.map

package/dist/{chunk-PGIFHEBA.js → chunk-RVEOGRMF.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -318,4 +318,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-PGIFHEBA.js.map
+//# sourceMappingURL=chunk-RVEOGRMF.js.map

package/dist/{chunk-H7BC444C.js → chunk-SRAMNVHT.js}

@@ -623,6 +623,10 @@ var XAI_AUTHORITY_TABLES = [
 var UNIFIED_KNOWLEDGE_ROUTINES = [
   "knowledge_index_claim(text, integer, integer)",
   "knowledge_index_work(uuid, uuid, uuid, jsonb)",
+  "knowledge_index_billing_policy(uuid, uuid, uuid, text, timestamp with time zone, bigint)",
+  "knowledge_index_wait_for_funding(uuid, uuid, uuid)",
+  "knowledge_index_paid_publication_guard(uuid, uuid, uuid)",
+  "knowledge_visible_index_status(uuid, uuid, jsonb, jsonb, text)",
   "knowledge_entry_apply(uuid, uuid, jsonb, jsonb)",
   "knowledge_entry_confirm_legacy(uuid, uuid, jsonb, jsonb)",
   "agent_instruction_apply(uuid, uuid, jsonb, jsonb)",
@@ -4074,6 +4078,18 @@ BEGIN
     IF to_regprocedure(format('%I.knowledge_entry_apply(uuid,uuid,jsonb,jsonb)', ${literal(schema)})) IS NOT NULL THEN
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_claim(text,integer,integer) TO %I', ${literal(schema)}, ${literal(role)});
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_work(uuid,uuid,uuid,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+      IF to_regprocedure(format('%I.knowledge_index_billing_policy(uuid,uuid,uuid,text,timestamptz,bigint)', ${literal(schema)})) IS NOT NULL THEN
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_billing_policy(uuid,uuid,uuid,text,timestamptz,bigint) TO %I', ${literal(schema)}, ${literal(role)});
+      END IF;
+      IF to_regprocedure(format('%I.knowledge_index_wait_for_funding(uuid,uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_wait_for_funding(uuid,uuid,uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      END IF;
+      IF to_regprocedure(format('%I.knowledge_index_paid_publication_guard(uuid,uuid,uuid)', ${literal(schema)})) IS NOT NULL THEN
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_index_paid_publication_guard(uuid,uuid,uuid) TO %I', ${literal(schema)}, ${literal(role)});
+      END IF;
+      IF to_regprocedure(format('%I.knowledge_visible_index_status(uuid,uuid,jsonb,jsonb,text)', ${literal(schema)})) IS NOT NULL THEN
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_visible_index_status(uuid,uuid,jsonb,jsonb,text) TO %I', ${literal(schema)}, ${literal(role)});
+      END IF;
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.agent_instruction_apply(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_apply(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
       EXECUTE format('GRANT EXECUTE ON FUNCTION %I.knowledge_entry_confirm_legacy(uuid,uuid,jsonb,jsonb) TO %I', ${literal(schema)}, ${literal(role)});
@@ -5582,4 +5598,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-H7BC444C.js.map
+//# sourceMappingURL=chunk-SRAMNVHT.js.map