from __future__ import annotations

import re


def migration_role_statement(role: str | None) -> str | None:
    """Return a safely quoted SET ROLE statement for an admitted owner role."""
    if not role:
        return None
    if not re.fullmatch(r"[a-z_][a-z0-9_]{0,62}", role):
        raise ValueError("HUB_CORE_MIGRATION_ROLE is not a safe PostgreSQL role name")
    return f'SET ROLE "{role}"'