@byok-sdk/cloud-dataplane 0.12.0 → 0.14.0

package/dist/runtime.js

@@ -1,5 +1,5 @@
 import pg from 'pg';
-import { DEDUP_RING_CAPACITY, NONCE_TTL_MS, validateActivityAppend, projectTimelineEvents, ByokCloudError, validateApprovalTimelineAppend, ApprovalObservationSchema, AllowAllRateLimiter, TruthCommitError, TruthCommitResponseSchema, truthRecordMetadata, TRUTH_REQUEST_ID_MAX_LENGTH, parseTimelineEvents, activityCursor, parseApprovalObservations, approvalTimelineCursor } from '@byok-sdk/cloud';
+import { DEDUP_RING_CAPACITY, NONCE_TTL_MS, assertTaskAttemptListLimit, validateActivityAppend, projectTimelineEvents, activitySourceBatchState, ByokCloudError, validateApprovalTimelineAppend, ApprovalObservationSchema, validateApprovalTimelineResolve, AllowAllRateLimiter, TruthCommitError, TruthCommitResponseSchema, truthRecordMetadata, TRUTH_REQUEST_ID_MAX_LENGTH, parseTimelineEvents, activityCursor, parseApprovalObservations, approvalTimelineCursor } from '@byok-sdk/cloud';
 import { contentHash, ByokCoreError, assertCanonicalTimestamp, isContentHash, tenantObjectKey, objectKeyPrefix, CoreConflictError, isLegalBoardTransition, checkSkillPackManifest, checkSkillPackEntry, SKILL_PACK_ENTRY_PATH, SKILL_PACK_MANIFEST_SCHEMA_ID } from '@byok-sdk/core';
 import { AwsClient } from 'aws4fetch';
 import { XMLParser } from 'fast-xml-parser';
@@ -1034,23 +1034,31 @@ var PostgresInboundDedupStore = class {
     this.#capacity = capacity;
   }
   async checkAndRecord(tenant, deviceId, envelopeId) {
+    return this.#checkAndRecord(tenant, deviceId, "", "", envelopeId);
+  }
+  async checkAndRecordAgent(tenant, deviceId, agentRef, envelopeId) {
+    return this.#checkAndRecord(tenant, deviceId, agentRef.agentId, agentRef.profileRevision, envelopeId);
+  }
+  async #checkAndRecord(tenant, deviceId, agentId, agentProfileRevision, envelopeId) {
     const inserted = await this.#pool.query(
-      `INSERT INTO inbound_dedup (tenant_id, device_id, envelope_id)
-       VALUES ($1, $2, $3)
-       ON CONFLICT (tenant_id, device_id, envelope_id) DO NOTHING
+      `INSERT INTO inbound_dedup (tenant_id, device_id, agent_id, agent_profile_revision, envelope_id)
+       VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (tenant_id, device_id, agent_id, agent_profile_revision, envelope_id) DO NOTHING
        RETURNING 1`,
-      [tenant, deviceId, envelopeId]
+      [tenant, deviceId, agentId, agentProfileRevision, envelopeId]
     );
     if (inserted.rowCount === 0) return true;
     await this.#pool.query(
       `DELETE FROM inbound_dedup
         WHERE tenant_id = $1 AND device_id = $2
+          AND agent_id = $3 AND agent_profile_revision = $4
           AND recorded_seq <= (
             SELECT recorded_seq FROM inbound_dedup
              WHERE tenant_id = $1 AND device_id = $2
+               AND agent_id = $3 AND agent_profile_revision = $4
              ORDER BY recorded_seq DESC
-             OFFSET $3 LIMIT 1)`,
-      [tenant, deviceId, this.#capacity]
+             OFFSET $5 LIMIT 1)`,
+      [tenant, deviceId, agentId, agentProfileRevision, this.#capacity]
     );
     return false;
   }
@@ -1344,7 +1352,7 @@ var PostgresProofRequestReceiptStore = class {
     return row === void 0 ? void 0 : toReceipt2(row);
   }
 };
-var TASK_SELECT_COLUMNS = "tenant_id, task_id, device_id, agent_id, agent_profile_revision, owner_device_id, status, terminal_cause, cancel_requested_at, cancel_reason, cancel_message_id, updated_at";
+var TASK_SELECT_COLUMNS = "tenant_id, task_id, device_id, agent_id, agent_profile_revision, owner_device_id, status, terminal_cause, cancel_requested_at, cancel_reason, cancel_message_id, claimed_runtime, claimed_runtime_capabilities, updated_at";
 var AGENT_MESSAGE_ADMISSION_SELECT_COLUMNS = "message_id, payload_body, terminal_body";
 function admissionRowToRecord(row) {
   return {
@@ -1370,6 +1378,10 @@ function taskRowToAttempt(row) {
     // former.
     ...row.owner_device_id === null ? {} : { ownerDeviceId: row.owner_device_id },
     status: row.status,
+    // `claimed_runtime` is written only by the guarded claim UPDATE below, so a
+    // non-null value here is always the winning claim's own self-report.
+    ...row.claimed_runtime === null ? {} : { claimedRuntime: row.claimed_runtime },
+    ...row.claimed_runtime_capabilities === null ? {} : { claimedRuntimeCapabilities: row.claimed_runtime_capabilities },
     ...row.terminal_cause == null ? {} : { terminalCause: row.terminal_cause },
     ...row.cancel_requested_at === null ? {} : {
       cancellation: {
@@ -1438,6 +1450,16 @@ var PostgresTaskAttemptStore = class {
         [tenant, input.taskId]
       );
       const attempt = selected.rows[0];
+      const existing = await client.query(
+        `SELECT message_id, payload_body FROM agent_message_admission
+          WHERE tenant_id = $1 AND device_id = $2 AND task_id = $3`,
+        [tenant, input.deviceId, input.taskId]
+      );
+      const admission = existing.rows[0];
+      if (admission !== void 0) {
+        await client.query("COMMIT");
+        return admission.message_id === input.messageId && admission.payload_body === input.payloadBody ? "pending" : "rejected";
+      }
       if (attempt === void 0 || attempt.device_id !== input.deviceId || attempt.cancel_requested_at !== null || !["offered", "claimed", "running"].includes(attempt.status)) {
         await client.query("COMMIT");
         return "rejected";
@@ -1454,14 +1476,14 @@ var PostgresTaskAttemptStore = class {
         await client.query("COMMIT");
         return "reserved";
       }
-      const existing = await client.query(
+      const raced = await client.query(
         `SELECT message_id, payload_body FROM agent_message_admission
           WHERE tenant_id = $1 AND device_id = $2 AND task_id = $3`,
         [tenant, input.deviceId, input.taskId]
       );
-      const admission = existing.rows[0];
+      const racedAdmission = raced.rows[0];
       await client.query("COMMIT");
-      return admission?.message_id === input.messageId && admission.payload_body === input.payloadBody ? "pending" : "rejected";
+      return racedAdmission?.message_id === input.messageId && racedAdmission.payload_body === input.payloadBody ? "pending" : "rejected";
     } catch (cause) {
       await client.query("ROLLBACK").catch(() => {
       });
@@ -1508,14 +1530,44 @@ var PostgresTaskAttemptStore = class {
     );
     return result.rows.map(taskRowToAttempt);
   }
+  async list(tenant, query) {
+    assertTaskAttemptListLimit(query.limit);
+    const result = await this.#pool.query(
+      `SELECT ${TASK_SELECT_COLUMNS}
+         FROM task
+        WHERE tenant_id = $1 AND ($2::text IS NULL OR task_id > $2)
+        ORDER BY task_id
+        LIMIT $3`,
+      [tenant, query.cursor ?? null, query.limit + 1]
+    );
+    const rows = result.rows.slice(0, query.limit);
+    const attempts = rows.map(taskRowToAttempt);
+    const hasMore = result.rows.length > rows.length;
+    const last = attempts.at(-1);
+    return {
+      attempts,
+      ...hasMore && last !== void 0 ? { nextCursor: last.taskId } : {}
+    };
+  }
   async claim(tenant, input) {
     const claimed = await this.#pool.query(
       `UPDATE task
-          SET owner_device_id = $3, status = 'claimed', updated_at = $4
-        WHERE tenant_id = $1 AND task_id = $2 AND owner_device_id IS NULL
+          SET owner_device_id = $3,
+              status = 'claimed',
+              claimed_runtime = $5,
+              claimed_runtime_capabilities = $6::jsonb,
+              updated_at = $4
+        WHERE tenant_id = $1 AND task_id = $2 AND device_id = $3 AND owner_device_id IS NULL
           AND cancel_requested_at IS NULL AND status = 'offered'
       RETURNING ${TASK_SELECT_COLUMNS}`,
-      [tenant, input.taskId, input.deviceId, this.#now()]
+      [
+        tenant,
+        input.taskId,
+        input.deviceId,
+        this.#now(),
+        input.runtime ?? null,
+        input.capabilities === void 0 ? null : JSON.stringify(input.capabilities)
+      ]
     );
     const won = claimed.rows[0];
     if (won !== void 0) return taskRowToAttempt(won);
@@ -1680,9 +1732,36 @@ var PostgresMailboxStore = class {
       // Nothing above was mutated, so an identical call replays the same page.
       // The returned position is a READ cursor and moves no ack.
       nextSeq: page.at(-1)?.seq ?? query.afterSeq,
-      hasMore: result.rows.length > page.length
+      hasMore: result.rows.length > page.length,
+      recoverableFrom: await this.#recoverableFrom(tenant, query.deviceId)
     };
   }
+  /**
+   * One past the highest row this device lost, which is exactly the highest
+   * `expired` seq — `1` when it has lost nothing.
+   *
+   * No column and no migration, because `collectRetired` never deletes an
+   * unacked row: §12.7.5 keeps the dead letter, so the loss is already durable
+   * in `outbox` and a stored floor would be a second authority free to drift
+   * from the sweep that moved it. Whatever eventually reaps dead letters (S4B,
+   * O-009) is the change that has to carry this floor forward instead.
+   *
+   * `acked` rows are not counted: a consumed row is not a lost one.
+   *
+   * Read AFTER the page on purpose. A sweep landing between the two reads can
+   * only report a floor HIGHER than the page it accompanies, which makes the
+   * caller fail closed over a page that may already be missing rows; reading
+   * the floor first would report one too low and serve that gap silently.
+   */
+  async #recoverableFrom(tenant, deviceId) {
+    const result = await this.#pool.query(
+      `SELECT (COALESCE(MAX(seq), 0) + 1)::bigint AS recoverable_from
+         FROM outbox
+        WHERE tenant_id = $1 AND device_id = $2 AND state = 'expired'`,
+      [tenant, deviceId]
+    );
+    return Number(result.rows[0].recoverable_from);
+  }
   async advanceCursor(tenant, input) {
     this.#requireDeviceId(input.deviceId);
     const now = this.#now();
@@ -1943,8 +2022,35 @@ var PostgresActivityStore = class {
     const receivedAt = now.toISOString();
     const incoming = projectTimelineEvents(input, receivedAt);
     const expiresAt = new Date(now.getTime() + input.ttlMs).toISOString();
-    const result = await this.pool.query(
-      `WITH incoming AS (
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        `SELECT pg_advisory_xact_lock(hashtextextended($1 || E'\\x1f' || $2, 0))`,
+        [tenant, input.taskId]
+      );
+      const locked = await client.query(
+        `SELECT tenant_id, task_id, entries, dropped, capacity, expires_at
+           FROM activity_tail
+          WHERE tenant_id = $1 AND task_id = $2
+          FOR UPDATE`,
+        [tenant, input.taskId]
+      );
+      const stored = locked.rows[0];
+      const live = stored !== void 0 && receivedAt < stored.expires_at ? toTail(stored) : void 0;
+      const sourceState = activitySourceBatchState(live?.entries ?? [], input);
+      if (sourceState === "same") {
+        await client.query("COMMIT");
+        return live;
+      }
+      if (sourceState === "conflict") {
+        throw new ByokCloudError(
+          "coordination_input_invalid",
+          `Activity source envelope ${input.sourceEnvelopeId} already belongs to another canonical batch.`
+        );
+      }
+      const result = await client.query(
+        `WITH incoming AS (
          SELECT entry
            FROM jsonb_array_elements($4::jsonb) AS element(entry)
        ), trimmed AS (
@@ -2011,16 +2117,24 @@ var PostgresActivityStore = class {
               )
            )
        RETURNING tenant_id, task_id, entries, dropped, capacity, expires_at`,
-      [tenant, input.taskId, receivedAt, JSON.stringify(incoming), input.dropped, capacity, expiresAt]
-    );
-    const row = result.rows[0];
-    if (row === void 0) {
-      throw new ByokCloudError(
-        "coordination_input_invalid",
-        `Activity batch ${input.batchSeq} conflicts with the existing typed tail authority.`
+        [tenant, input.taskId, receivedAt, JSON.stringify(incoming), input.dropped, capacity, expiresAt]
       );
+      const row = result.rows[0];
+      if (row === void 0) {
+        throw new ByokCloudError(
+          "coordination_input_invalid",
+          `Activity batch ${input.batchSeq} conflicts with the existing typed tail authority.`
+        );
+      }
+      await client.query("COMMIT");
+      return toTail(row);
+    } catch (caught) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw caught;
+    } finally {
+      client.release();
     }
-    return toTail(row);
   }
   async read(tenant, taskId) {
     const result = await this.pool.query(
@@ -2139,6 +2253,79 @@ var PostgresApprovalTimelineStore = class {
       client.release();
     }
   }
+  async resolvePending(tenant, input) {
+    const { capacity, ttlMs, event } = validateApprovalTimelineResolve(input);
+    const now = this.clock.now();
+    const receivedAt = now.toISOString();
+    const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        `SELECT pg_advisory_xact_lock(hashtextextended($1 || E'\\x1f' || $2, 0))`,
+        [tenant, input.taskId]
+      );
+      const stored = await readLocked(client, tenant, input.taskId);
+      const live = stored !== void 0 && receivedAt < stored.expires_at ? toTail2(stored) : void 0;
+      if (live === void 0) {
+        await client.query("COMMIT");
+        return { status: "absent" };
+      }
+      const duplicate = live.entries.find((entry) => entry.sourceEnvelopeId === input.sourceEnvelopeId);
+      if (duplicate !== void 0) {
+        await client.query("COMMIT");
+        return JSON.stringify(duplicate.event) === JSON.stringify(event) ? { status: "replayed", tail: live } : { status: "conflict", tail: live };
+      }
+      const pending = pendingObservation(live.entries);
+      if (pending === void 0) {
+        await client.query("COMMIT");
+        return { status: "absent", tail: live };
+      }
+      if (pending.sourceEnvelopeId !== input.expectedSourceEnvelopeId || pending.revision !== input.expectedRevision) {
+        await client.query("COMMIT");
+        return { status: "superseded", tail: live };
+      }
+      const revision = Number(stored.next_revision);
+      const expectedRevision = (live.cursor ?? 0) + 1;
+      if (!Number.isSafeInteger(revision) || revision <= 0 || revision !== expectedRevision) {
+        throw new ByokCloudError(
+          "coordination_input_invalid",
+          "Approval timeline revision authority is malformed."
+        );
+      }
+      const observation = ApprovalObservationSchema.parse({
+        taskId: input.taskId,
+        sourceEnvelopeId: input.sourceEnvelopeId,
+        revision,
+        receivedAt,
+        event
+      });
+      const allEntries = [...live.entries, observation];
+      const evicted = Math.max(allEntries.length - capacity, 0);
+      const entries = allEntries.slice(evicted);
+      const dropped = live.dropped + evicted;
+      const result = await client.query(
+        `INSERT INTO approval_timeline_tail
+           (tenant_id, task_id, entries, next_revision, dropped, capacity, expires_at)
+         VALUES ($1, $2, $3::jsonb, $4, $5, $6, $7)
+         ON CONFLICT (tenant_id, task_id) DO UPDATE
+           SET entries = EXCLUDED.entries,
+               next_revision = EXCLUDED.next_revision,
+               dropped = EXCLUDED.dropped,
+               capacity = EXCLUDED.capacity,
+               expires_at = EXCLUDED.expires_at
+         RETURNING tenant_id, task_id, entries, next_revision, dropped, capacity, expires_at`,
+        [tenant, input.taskId, JSON.stringify(entries), revision + 1, dropped, capacity, expiresAt]
+      );
+      await client.query("COMMIT");
+      return { status: "applied", tail: toTail2(result.rows[0]) };
+    } catch (caught) {
+      await client.query("ROLLBACK");
+      throw caught;
+    } finally {
+      client.release();
+    }
+  }
   async read(tenant, taskId) {
     const result = await this.pool.query(
       `SELECT tenant_id, task_id, entries, next_revision, dropped, capacity, expires_at
@@ -2150,6 +2337,19 @@ var PostgresApprovalTimelineStore = class {
     return row === void 0 ? void 0 : toTail2(row);
   }
 };
+function pendingObservation(entries) {
+  let pending;
+  for (const entry of entries) {
+    if (entry.event.type === "approval_requested") {
+      pending = entry;
+      continue;
+    }
+    if (pending !== void 0 && (pending.event.approvalId === void 0 || pending.event.approvalId === entry.event.approvalId)) {
+      pending = void 0;
+    }
+  }
+  return pending;
+}
 var SELECT_COLUMNS4 = [
   "tenant_id",
   "device_id",
@@ -2196,7 +2396,7 @@ var PostgresAgentEgressStore = class {
     const inserted = await this.pool.query(
       `INSERT INTO agent_egress_event (${SELECT_COLUMNS4})
        VALUES ($1, $2, $3::uuid, $4, $5, $6, $7, $8::bigint, $9::jsonb, $10, $11::integer, $12::uuid, $13)
-       ON CONFLICT (tenant_id, device_id, event_id) DO NOTHING
+       ON CONFLICT (tenant_id, device_id, agent_id, agent_profile_revision, event_id) DO NOTHING
        RETURNING ${SELECT_COLUMNS4}`,
       [
         tenant,
@@ -2216,16 +2416,18 @@ var PostgresAgentEgressStore = class {
     );
     const row = inserted.rows[0];
     if (row !== void 0) return { record: toRecord2(row), created: true };
-    const existing = await this.get(tenant, input.deviceId, payload.eventId);
+    const existing = await this.get(tenant, input.deviceId, payload.agentRef, payload.eventId);
     if (existing === void 0) throw new Error(`Agent egress ${payload.eventId} vanished during first-write record.`);
     return { record: existing, created: false };
   }
-  async get(tenant, deviceId, eventId) {
+  async get(tenant, deviceId, agentRef, eventId) {
     const result = await this.pool.query(
       `SELECT ${SELECT_COLUMNS4}
          FROM agent_egress_event
-        WHERE tenant_id = $1 AND device_id = $2 AND event_id = $3::uuid`,
-      [tenant, deviceId, eventId]
+        WHERE tenant_id = $1 AND device_id = $2
+          AND agent_id = $3 AND agent_profile_revision = $4
+          AND event_id = $5::uuid`,
+      [tenant, deviceId, agentRef.agentId, agentRef.profileRevision, eventId]
     );
     const row = result.rows[0];
     return row === void 0 ? void 0 : toRecord2(row);