@axiom-lattice/pg-stores 3.3.13 → 4.0.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/pg-stores@3.3.13 build /home/runner/work/agentic/agentic/packages/pg-stores
+> @axiom-lattice/pg-stores@4.0.0 build /home/runner/work/agentic/agentic/packages/pg-stores
 > tsup src/index.ts --format cjs,esm --dts --sourcemap
 
 CLI Building entry: src/index.ts
@@ -8,13 +8,13 @@
 CLI Target: es2020
 CJS Build start
 ESM Build start
-ESM dist/index.mjs     438.60 KB
-ESM dist/index.mjs.map 820.28 KB
-ESM ⚡️ Build success in 879ms
-CJS dist/index.js     447.25 KB
-CJS dist/index.js.map 820.59 KB
-CJS ⚡️ Build success in 880ms
+CJS dist/index.js     528.09 KB
+CJS dist/index.js.map 960.67 KB
+CJS ⚡️ Build success in 969ms
+ESM dist/index.mjs     518.65 KB
+ESM dist/index.mjs.map 960.39 KB
+ESM ⚡️ Build success in 1032ms
 DTS Build start
-DTS ⚡️ Build success in 11763ms
-DTS dist/index.d.ts  93.45 KB
-DTS dist/index.d.mts 93.45 KB
+DTS ⚡️ Build success in 11614ms
+DTS dist/index.d.ts  110.68 KB
+DTS dist/index.d.mts 110.68 KB

package/CHANGELOG.md

@@ -1,5 +1,213 @@
 # @axiom-lattice/pg-stores
 
+## 4.0.0
+
+### Major Changes
+
+- 80c8dca: Release the chat, task, store, and sandbox updates together.
+
+  - Chat: frosted-glass user-message navigator, breathing run status bar, streaming auto-follow that stops when the reader scrolls away, and stop notices routed through the status bar.
+  - Crons: workspace/project-scoped crons, tenant-validated scope, Console project selector/card/filter.
+  - Store: long-term Store rebuilt as a toolbar + master-detail drawer with namespace editor, JSON validation, and TTL presets.
+  - Workspace menu: optional `requiredTenantRoles` gating; Store, Audit Log, API Keys, Observability, and System Info are owner/admin-only.
+  - Execution: durable runs re-pin the shared agent to the authoritative scope, absent scheduled scope stays unscoped, subagent breaker state is isolated, first run of a locally-constructed thread is admitted, and `TaskListFilter.threadId` authorizes isolated task threads.
+  - Recursion: default budget 500 with `AGENT_RECURSION_LIMIT` override.
+  - Uploads: default request body and upload limit raised to 500 MB.
+  - Sandbox: default memory aligned to 1024 MiB and service body limit raised to 500 MB.
+  - PostgreSQL: run availability defaults to the database clock, so clock drift cannot make fresh runs briefly unclaimable.
+
+  Breaking: default recursion budget (1000 -> 500), request/upload limit (100 MB -> 500 MB), sandbox memory (512/2048 -> 1024 MiB), and durable-run scope authority change observable behavior without extra configuration.
+
+### Minor Changes
+
+- ae1535e: Make eval safe on the existing worker pool: a global `eval:execution` lease
+  allows any replica to run one eval at a time, cancellation is a durable
+  `cancel_requested` flag polled by the executing worker, and aborted runs settle
+  as `aborted`. The compatibility progress stream now polls the shared EvalStore
+  instead of the owner's process-local EventEmitter.
+
+### Patch Changes
+
+- Updated dependencies [c5a4a88]
+- Updated dependencies [ae1535e]
+- Updated dependencies [e71979f]
+- Updated dependencies [80c8dca]
+- Updated dependencies [c650a59]
+- Updated dependencies [ae1535e]
+- Updated dependencies [ae1535e]
+  - @axiom-lattice/core@10.0.0
+  - @axiom-lattice/protocols@6.0.0
+
+## 3.4.0
+
+### Minor Changes
+
+- d5dc506: Agent run history retention
+
+  - Add `IAgentRunLedger.deleteTerminalBefore(cutoffMs, limit)` for bounded,
+    oldest-first deletion of terminal runs; pending and running rows are never
+    deleted.
+  - Implement the method for the in-memory and PostgreSQL ledgers, including a
+    partial terminal-`finished_at` index (migration v201).
+  - Add a gateway retention job controlled by `AGENT_RUN_RETENTION_DAYS` (default
+    30 days; `0`/invalid disables) and stop it during graceful shutdown.
+
+- f1f8840: Durable cross-replica public-channel replies (Phase B)
+
+  - Add a durable `ChannelReplyJob` protocol, in-memory/PostgreSQL stores, and a
+    `lattice_channel_reply_jobs` migration (v200) with lease-based claim, bounded
+    reschedule, and terminal delivery state.
+  - Route non-Room public ingress for adapters declaring `durableReply: true`
+    through a reply job plus a pending `source='run_api'` run (job written first,
+    with compensation on run-create failure). Lark opts in; WeCom/WeChat/Room stay
+    legacy because their reply transport is connection-bound/process-local.
+  - Add `ChannelReplyDispatcher`, which polls due jobs on any replica, waits for
+    the run ledger to become terminal, reads the final assistant text from the
+    thread checkpoint, sends it through the adapter, and marks the job delivered.
+    Empty output and loader/send failures retry with capped exponential backoff;
+    sends have a 15s deadline; missing runs converge after a 30s grace window;
+    cancelled runs do not send a waiting notice. Terminal jobs are pruned after
+    24h.
+  - Keep Room/trusted dispatch and `ChannelConnectionLeader` unchanged. Durable
+    replies are at-least-once; outbound metadata carries `inputMessageId` for
+    channel-side deduplication. Ingress falls back to legacy when the dispatcher
+    runtime is not registered. Opt out with `CHANNEL_DURABLE_RUNS=false`.
+
+- 8285b9a: Execution substrate: durable agent-run ledger and opt-in fleet worker
+
+  - Add `IAgentRunLedger` + PostgreSQL implementation (migration v193, one running run per thread).
+  - Record agent runs observationally (fire-and-forget begin/heartbeat/settle); lease remains the execution authority.
+  - Add opt-in `ThreadExecutionSupervisor` worker discovery with fair rotating scan, cooldowns, orphan recovery via the existing resume path, and readiness guidance.
+  - Add `probeThreadRunOwner` (owner/free/unknown) and `hasPending` discovery metadata.
+
+- ea90717: `keep_latest` checkpoint pruning (M2-B2b)
+
+  - Add `CheckpointMaintenance.pruneThread` and transactional per-namespace latest-N checkpoint retention with blob retention derived from `channel_versions`.
+  - Add `POST .../prune { strategy: "keep_latest", keep?: 1..100 }`; `delete` is unchanged.
+  - Reuse strict ownership, thread-run lease, and empty-inbox guards; keep the thread row and chunk stream.
+
+- 1fde314: Pending run task queue (Phase 1)
+
+  - Make `lattice_agent_runs` the durable task queue for the new single-run API: create writes `pending`, a worker claims/executes through `Agent.executeRun`, and recovery reclaims expired rows in place and completes durable rollback work.
+  - Add run lifecycle `join` (bounded terminal wait), `cancel?action=interrupt|rollback`, and HITL command runs; Web App runtime mirrors the same handlers.
+  - Add `client.runs.join` / cancel `action` / create `command`, and single-run HITL with `ThreadStream.openRun`. `RunCreateResult` is now `{ runId, messageId?, status: "pending" }`: the old queue-first `status: "queued"` / `queued: true` shape and the required `messageId` are gone (command runs have no user message).
+  - Keep the legacy message queue, Room, Project Task, A2A, and legacy HITL on `source='legacy'`; the two executors share the `thread-run` lease.
+
+- 1236db0: feat(run-queue): add a per-tenant execution concurrency cap
+
+  `RUN_TASK_MAX_RUNNING_PER_TENANT` bounds concurrently `running`
+  `source='run_api'` rows per tenant, independently of the admission quota
+  (`RUN_TASK_MAX_ACTIVE_PER_TENANT`, which counts pending + running and rejects
+  creates). Pending rows stay queued; scans skip tenants at their cap so other
+  tenants remain listable. InMemory enforces on list/claim, PostgreSQL adds a
+  per-candidate count predicate and serializes capped claims with a
+  transaction-scoped tenant advisory lock. The global `N_JOBS_PER_WORKER` pool and
+  existing claim ordering are unchanged; this is best-effort cross-tenant
+  visibility, not strict round-robin fairness.
+
+- 5c5550b: Per-tenant run queue admission quota
+
+  - Add optional `maxActiveRunsForTenant` to `CreatePendingAgentRunInput` and
+    `AgentRunTenantQuotaExceededError` (`RUN_TENANT_QUOTA_EXCEEDED`); both stores
+    reject before insert when the tenant already has that many active
+    (`pending`/`running`) `source='run_api'` runs.
+  - PostgreSQL serializes tenant creates with
+    `pg_advisory_xact_lock(hashtext($tenantId))` before counting; no migration.
+  - Gateway reads `RUN_TASK_MAX_ACTIVE_PER_TENANT` (positive safe integer else
+    unlimited) for run-lifecycle, legacy `/api/runs` background/streaming, and A2A
+    creation; HTTP creates return 429 before SSE hijack.
+  - Admission control only: pending rows count, worker claim order is unchanged,
+    and this is not fair scheduling or per-tenant execution concurrency.
+
+- e732b92: Execute Project Task on the durable AgentRun queue while preserving TaskItem lifecycle, roster authority, HITL, and Room projection.
+
+  Project Task now creates `source="project_task"` runs with a canonical `taskId`; the worker rebuilds trusted Project/roster context from persisted rows, and a terminal hook settles error/interrupted/cancelled outcomes. Production composition no longer requires `threadMessageQueue`. Adds the active-run-by-task ledger query and PG migrations v203 (task identity) / v204 (one running row across `run_api` and `project_task`). A2A remains `source="run_api"` with unchanged semantics; run success is not task completion.
+
+- da5294d: Tenant-scoped namespaced KV store (M2-C)
+
+  - Add `StoreProtocol` (put/get/delete/search/listNamespaces/deleteExpired) with deep JSONB filters, substring query, and TTL.
+  - Add InMemory, Local SQLite, and PostgreSQL implementations (PG migration v195 with GIN and partial expiry indexes).
+  - Add `/api/store/*` routes and a single-flight store TTL sweeper.
+  - `index` hints are accepted but vector indexing and semantic search remain deferred.
+
+- 2609f3b: Thread copy and prune-delete (M2-B1)
+
+  - Add `CheckpointMaintenance` and transactional `copyThread` / `deleteThread` to `PostgreSQLCheckpointStorage`, with a typed `CHECKPOINT_TARGET_NOT_EMPTY` conflict and metadata `thread_id` rewrite.
+  - Add owner-scoped, busy-guarded copy and prune-delete routes; prune clears the thread's chunk stream best-effort and retains run-ledger rows.
+  - Share the thread ownership resolver between read and maintenance controllers.
+
+- 12ce057: Thread read model (M2-A)
+
+  - Add `Agent.getStateHistory` / `Agent.getStateAtCheckpoint` (bounded to 50 checkpoints).
+  - Add `CheckpointStorage` / `ThreadCheckpointStorage` protocols and a read-only `PostgreSQLCheckpointStorage` over the built-in `PostgresSaver` tables.
+  - Add tenant/assistant-scoped read-only routes for thread status, checkpoint history, checkpoint state, and checkpoint storage usage; missing checkpoints and foreign threads return 404 and unexpected errors are sanitized.
+
+- 23902af: Per-thread TTL and expiry sweeper (M2-B2a)
+
+  - Add optional `expiresAt` to `Thread`/`CreateThreadRequest` and `listExpiredThreads` to `ThreadStore`.
+  - Persist `expires_at` in InMemory, Local SQLite, and PostgreSQL stores (PG migration v194 + partial index).
+  - Accept `ttlSeconds`/`expiresAt` when creating a thread (invalid values return 400).
+  - Add a lease/inbox/maintenance-guarded TTL sweeper with `THREAD_TTL_SWEEP_*` configuration.
+  - Copy does not inherit TTL; run-ledger rows are retained on sweep.
+
+### Patch Changes
+
+- c1f4f54: fix: do not let stale legacy running rows block run_api claims
+
+  Legacy message-queue ledger rows and durable `run_api` rows share
+  `lattice_agent_runs`. A crashed legacy owner could leave a `running` row behind
+  and the `(tenant, thread) WHERE status='running'` unique index made every later
+  `run_api` pending row unclaimable after the thread-run lease expired.
+
+  Pending scans/claims now ignore legacy running rows, and migration v202 scopes
+  the one-running-row partial unique index to `source='run_api'`. Actual execution
+  exclusion remains the shared `thread-run` lease.
+
+- 5f0aeff: feat(run-task): interleave pending scans fairly across tenants
+
+  `ListPendingRunsOptions.fairTenants` (default `false`) returns each tenant's
+  oldest claimable pending run first, then each tenant's second-oldest, and so on,
+  with `(availableAt, createdAt, runId, tenantId)` tie-breakers. Existing due,
+  active-thread, rollback and `maxRunningPerTenant` filters still apply before
+  ranking. InMemory and PostgreSQL use the same ordering; PostgreSQL ranks with a
+  tenant-partitioned `row_number()` window. Fair mode rejects the global keyset
+  `after` cursor with `RangeError`, and the run-task worker now always scans fair
+  without a cursor. This is best-effort interleaving at scan time, not strict
+  global round-robin scheduling.
+
+- Updated dependencies [1fde314]
+- Updated dependencies [9a6579c]
+- Updated dependencies [c1f4f54]
+- Updated dependencies [d5dc506]
+- Updated dependencies [f1f8840]
+- Updated dependencies [8285b9a]
+- Updated dependencies [5f0aeff]
+- Updated dependencies [dcbe47b]
+- Updated dependencies [235b4a4]
+- Updated dependencies [c07db86]
+- Updated dependencies [ea90717]
+- Updated dependencies [e33c7c3]
+- Updated dependencies [2d61ef6]
+- Updated dependencies [351b0e9]
+- Updated dependencies [1fde314]
+- Updated dependencies [1236db0]
+- Updated dependencies [5c5550b]
+- Updated dependencies [e732b92]
+- Updated dependencies [2422cdd]
+- Updated dependencies [bfb7c42]
+- Updated dependencies [ced17aa]
+- Updated dependencies [8f9dd0d]
+- Updated dependencies [da5294d]
+- Updated dependencies [03e9984]
+- Updated dependencies [2609f3b]
+- Updated dependencies [4a74c70]
+- Updated dependencies [12ce057]
+- Updated dependencies [66daf89]
+- Updated dependencies [23902af]
+- Updated dependencies [fad0bd0]
+  - @axiom-lattice/core@9.0.0
+  - @axiom-lattice/protocols@5.0.0
+
 ## 3.3.13
 
 ### Patch Changes