@namzu/sdk 0.1.8 → 0.3.0

package/dist/session/__tests__/integration/summary-materialization-e2e.test.js

@@ -0,0 +1,201 @@
+/**
+ * Integration — SessionSummaryMaterializer + SessionStore atomic transition,
+ * plus the crash-recovery path.
+ *
+ * Covers roadmap §5 invariants: §8.1 (summary kernel-owned, no agent-callable
+ * emission surface), §8.1 atomic with terminal transition, recovery path
+ * when the status-flip lost to a mid-flight crash. `SessionAlreadySummarizedError`
+ * on concurrent re-materialize.
+ *
+ * The kernel-ownership assertion is expressed both structurally (the
+ * `materializedBy: 'kernel'` brand on the persisted record) and by routing
+ * every successful materialize through the Materializer — no test below calls
+ * `store.recordSummary` directly, and the compile-time type narrows the
+ * argument to `& { materializedBy: 'kernel' }` so an agent-constructed payload
+ * would fail typecheck (not just runtime validation).
+ */
+import { describe, expect, it } from 'vitest';
+import { InMemorySessionStore } from '../../../store/session/memory.js';
+import { SessionSummaryMaterializer } from '../../summary/materialize.js';
+import { SessionAlreadySummarizedError } from '../../summary/ref.js';
+import { DEFAULT_TENANT, agentActor } from './_fixtures.js';
+const TEST_THREAD_ID = 'thd_test';
+async function seedActive(store) {
+    const project = await store.createProject({ tenantId: DEFAULT_TENANT, name: 'summary' }, DEFAULT_TENANT);
+    const session = await store.createSession({ threadId: TEST_THREAD_ID, projectId: project.id, currentActor: agentActor('agt_worker') }, DEFAULT_TENANT);
+    await store.updateSession({ ...session, status: 'active' }, DEFAULT_TENANT);
+    return { project, session: { ...session, status: 'active' } };
+}
+function makeGen() {
+    let n = 0;
+    return () => `sum_materialize_${++n}`;
+}
+describe('Integration — summary materialization E2E', () => {
+    it('Materializer writes summary + flips session active→idle atomically', async () => {
+        const store = new InMemorySessionStore();
+        const { session } = await seedActive(store);
+        const materializer = new SessionSummaryMaterializer({
+            store,
+            generateSummaryId: makeGen(),
+        });
+        const summary = await materializer.materialize({
+            sessionId: session.id,
+            tenantId: DEFAULT_TENANT,
+            finalOutcome: { status: 'succeeded' },
+            agentSummary: 'done',
+            declaredDeliverables: [],
+            keyDecisions: [],
+        });
+        // Persisted.
+        const stored = await store.getSummary(session.id, DEFAULT_TENANT);
+        expect(stored?.id).toBe(summary.id);
+        expect(stored?.materializedBy).toBe('kernel');
+        // Status atomically flipped.
+        const reloaded = await store.getSession(session.id, DEFAULT_TENANT);
+        expect(reloaded?.status).toBe('idle');
+    });
+    it('§8.1 atomicity invariant: no external observer sees terminal without summary', async () => {
+        // With InMemorySessionStore the two writes happen inside a single Map
+        // method call — there is no observable mid-state. We assert by reading
+        // both resources immediately after a single awaited materialize: the
+        // terminal status and the summary are visible together.
+        const store = new InMemorySessionStore();
+        const { session } = await seedActive(store);
+        const materializer = new SessionSummaryMaterializer({
+            store,
+            generateSummaryId: makeGen(),
+        });
+        await materializer.materialize({
+            sessionId: session.id,
+            tenantId: DEFAULT_TENANT,
+            finalOutcome: { status: 'succeeded' },
+            agentSummary: '',
+            declaredDeliverables: [],
+            keyDecisions: [],
+        });
+        const [finalSession, finalSummary] = await Promise.all([
+            store.getSession(session.id, DEFAULT_TENANT),
+            store.getSummary(session.id, DEFAULT_TENANT),
+        ]);
+        // Atomic pairing: idle status AND persisted summary present together.
+        expect(finalSession?.status).toBe('idle');
+        expect(finalSummary).not.toBeNull();
+    });
+    it('concurrent re-materialize rejects with SessionAlreadySummarizedError', async () => {
+        const store = new InMemorySessionStore();
+        const { session } = await seedActive(store);
+        const materializer = new SessionSummaryMaterializer({
+            store,
+            generateSummaryId: makeGen(),
+        });
+        await materializer.materialize({
+            sessionId: session.id,
+            tenantId: DEFAULT_TENANT,
+            finalOutcome: { status: 'succeeded' },
+            agentSummary: 'first',
+            declaredDeliverables: [],
+            keyDecisions: [],
+        });
+        await expect(materializer.materialize({
+            sessionId: session.id,
+            tenantId: DEFAULT_TENANT,
+            finalOutcome: { status: 'succeeded' },
+            agentSummary: 'second',
+            declaredDeliverables: [],
+            keyDecisions: [],
+        })).rejects.toBeInstanceOf(SessionAlreadySummarizedError);
+    });
+    it('crash recovery: summary persisted + session still active → recover() replays idempotently', async () => {
+        const store = new InMemorySessionStore();
+        const { session } = await seedActive(store);
+        const materializer = new SessionSummaryMaterializer({
+            store,
+            generateSummaryId: makeGen(),
+        });
+        // Materialize once (happy path writes both). Then simulate a crash by
+        // forcing the session status back to `active` while the summary record
+        // stays intact — mimicking summary.json landing but session.json being
+        // lost to a mid-write power failure (see session/summary/materialize.ts
+        // `recover()` docs).
+        await materializer.materialize({
+            sessionId: session.id,
+            tenantId: DEFAULT_TENANT,
+            finalOutcome: { status: 'succeeded' },
+            agentSummary: '',
+            declaredDeliverables: [],
+            keyDecisions: [],
+        });
+        const mid = await store.getSession(session.id, DEFAULT_TENANT);
+        if (!mid)
+            throw new Error('mid session missing');
+        await store.updateSession({ ...mid, status: 'active' }, DEFAULT_TENANT);
+        // Recovery call re-triggers the store's flip path without minting a
+        // new summary id.
+        const recovered = await materializer.recover(session.id, DEFAULT_TENANT);
+        expect(recovered).not.toBeNull();
+        const reloaded = await store.getSession(session.id, DEFAULT_TENANT);
+        expect(reloaded?.status).toBe('idle');
+        // Second recover call with session already idle: still idempotent.
+        const recovered2 = await materializer.recover(session.id, DEFAULT_TENANT);
+        expect(recovered2?.id).toBe(recovered?.id);
+        const reloaded2 = await store.getSession(session.id, DEFAULT_TENANT);
+        expect(reloaded2?.status).toBe('idle');
+    });
+    it('agent cannot construct SessionSummaryRef directly: recordSummary rejects non-kernel payload', async () => {
+        // The SessionStore contract narrows `recordSummary` to
+        // `SessionSummaryRef & { materializedBy: 'kernel' }`. Agents cannot
+        // type-construct a brand literal of `'kernel'` without going through
+        // the Materializer (see session/summary/ref.ts module header). Even
+        // attempting to cast into the shape and call directly would bypass
+        // the materialize ordering (status-check, length-check,
+        // already-exists guard). This test exercises the runtime guard: a
+        // second kernel-branded record for an already-summarized session
+        // rejects with SessionAlreadySummarizedError.
+        const store = new InMemorySessionStore();
+        const { session } = await seedActive(store);
+        const materializer = new SessionSummaryMaterializer({
+            store,
+            generateSummaryId: makeGen(),
+        });
+        await materializer.materialize({
+            sessionId: session.id,
+            tenantId: DEFAULT_TENANT,
+            finalOutcome: { status: 'succeeded' },
+            agentSummary: '',
+            declaredDeliverables: [],
+            keyDecisions: [],
+        });
+        // Direct call with a fabricated "kernel" ref payload — rejected
+        // because a summary already exists (store guard). The kernel-brand
+        // check at the type layer prevents naive agent-side construction; the
+        // runtime guard here catches store-level re-entry (materialize goes
+        // through the same path).
+        await expect(store.recordSummary({
+            id: 'sum_fake',
+            sessionRef: session.id,
+            tenantId: DEFAULT_TENANT,
+            outcome: { status: 'succeeded' },
+            deliverables: [],
+            agentSummary: 'forged',
+            keyDecisions: [],
+            at: new Date(),
+            materializedBy: 'kernel',
+        }, DEFAULT_TENANT)).rejects.toBeInstanceOf(SessionAlreadySummarizedError);
+    });
+    it('missing session: materialize throws a not-found error', async () => {
+        const store = new InMemorySessionStore();
+        const materializer = new SessionSummaryMaterializer({
+            store,
+            generateSummaryId: makeGen(),
+        });
+        await expect(materializer.materialize({
+            sessionId: 'ses_never',
+            tenantId: DEFAULT_TENANT,
+            finalOutcome: { status: 'succeeded' },
+            agentSummary: '',
+            declaredDeliverables: [],
+            keyDecisions: [],
+        })).rejects.toThrow(/not found/);
+    });
+});
+//# sourceMappingURL=summary-materialization-e2e.test.js.map

package/dist/session/__tests__/integration/summary-materialization-e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"summary-materialization-e2e.test.js","sourceRoot":"","sources":["../../../../src/session/__tests__/integration/summary-materialization-e2e.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3D,MAAM,cAAc,GAAG,UAAsB,CAAA;AAE7C,KAAK,UAAU,UAAU,CAAC,KAA2B;IACpD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CACxC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,EAC7C,cAAc,CACd,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CACxC,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,EAC3F,cAAc,CACd,CAAA;IACD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAA;IAC3E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,OAAO;IACf,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAe,CAAA;AACnD,CAAC;AAED,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;YACnD,KAAK;YACL,iBAAiB,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC;YAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YACrC,YAAY,EAAE,MAAM;YACpB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;SAChB,CAAC,CAAA;QAEF,aAAa;QACb,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QACjE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAE7C,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QACnE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC7F,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;YACnD,KAAK;YACL,iBAAiB,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAA;QAEF,MAAM,YAAY,CAAC,WAAW,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YACrC,YAAY,EAAE,EAAE;YAChB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;SAChB,CAAC,CAAA;QAEF,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC;YAC5C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC;SAC5C,CAAC,CAAA;QACF,sEAAsE;QACtE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;YACnD,KAAK;YACL,iBAAiB,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAA;QAEF,MAAM,YAAY,CAAC,WAAW,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YACrC,YAAY,EAAE,OAAO;YACrB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;SAChB,CAAC,CAAA;QAEF,MAAM,MAAM,CACX,YAAY,CAAC,WAAW,CAAC;YACxB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YACrC,YAAY,EAAE,QAAQ;YACtB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;SAChB,CAAC,CACF,CAAC,OAAO,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;YACnD,KAAK;YACL,iBAAiB,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAA;QAEF,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,YAAY,CAAC,WAAW,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YACrC,YAAY,EAAE,EAAE;YAChB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QAC9D,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAChD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAA;QAEvE,oEAAoE;QACpE,kBAAkB;QAClB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QACxE,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;QAEhC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QACnE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAErC,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QACzE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QACpE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC5G,uDAAuD;QACvD,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,wDAAwD;QACxD,kEAAkE;QAClE,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;YACnD,KAAK;YACL,iBAAiB,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAA;QACF,MAAM,YAAY,CAAC,WAAW,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YACrC,YAAY,EAAE,EAAE;YAChB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;SAChB,CAAC,CAAA;QAEF,gEAAgE;QAChE,mEAAmE;QACnE,sEAAsE;QACtE,oEAAoE;QACpE,0BAA0B;QAC1B,MAAM,MAAM,CACX,KAAK,CAAC,aAAa,CAClB;YACC,EAAE,EAAE,UAAuB;YAC3B,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAChC,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,EAAE;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE;YACd,cAAc,EAAE,QAAQ;SACxB,EACD,cAAc,CACd,CACD,CAAC,OAAO,CAAC,cAAc,CAAC,6BAA6B,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;QACxC,MAAM,YAAY,GAAG,IAAI,0BAA0B,CAAC;YACnD,KAAK;YACL,iBAAiB,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAA;QAEF,MAAM,MAAM,CACX,YAAY,CAAC,WAAW,CAAC;YACxB,SAAS,EAAE,WAAwB;YACnC,QAAQ,EAAE,cAAc;YACxB,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YACrC,YAAY,EAAE,EAAE;YAChB,oBAAoB,EAAE,EAAE;YACxB,YAAY,EAAE,EAAE;SAChB,CAAC,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/session/__tests__/integration/tenant-isolation.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Integration — multi-tenant isolation enforcement at every store accessor
+ * and cross-store boundary.
+ *
+ * Covers roadmap §5 invariants: §12 `tenantId` denormalized on every
+ * persisted entity, §12.2 cross-tenant rejection (TenantIsolationError at
+ * every accessor), broadcast handoff rejecting when recipient tenant
+ * differs.
+ *
+ * Every assertion here crosses a kernel boundary with a mismatched tenantId
+ * and checks that the SDK rejects rather than silently re-scoping.
+ */
+export {};
+//# sourceMappingURL=tenant-isolation.test.d.ts.map

package/dist/session/__tests__/integration/tenant-isolation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolation.test.d.ts","sourceRoot":"","sources":["../../../../src/session/__tests__/integration/tenant-isolation.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/session/__tests__/integration/tenant-isolation.test.js

@@ -0,0 +1,189 @@
+/**
+ * Integration — multi-tenant isolation enforcement at every store accessor
+ * and cross-store boundary.
+ *
+ * Covers roadmap §5 invariants: §12 `tenantId` denormalized on every
+ * persisted entity, §12.2 cross-tenant rejection (TenantIsolationError at
+ * every accessor), broadcast handoff rejecting when recipient tenant
+ * differs.
+ *
+ * Every assertion here crosses a kernel boundary with a mismatched tenantId
+ * and checks that the SDK rejects rather than silently re-scoping.
+ */
+import { describe, expect, it } from 'vitest';
+import { InMemorySessionStore } from '../../../store/session/memory.js';
+import { createUserMessage } from '../../../types/message/index.js';
+import { TenantIsolationError } from '../../errors.js';
+import { DEFAULT_TENANT, OTHER_TENANT, agentActor, userActor } from './_fixtures.js';
+const TEST_THREAD_ID = 'thd_test';
+async function seedTenantAResources() {
+    const store = new InMemorySessionStore();
+    const project = await store.createProject({ tenantId: DEFAULT_TENANT, name: 'tenA' }, DEFAULT_TENANT);
+    const parent = await store.createSession({ threadId: TEST_THREAD_ID, projectId: project.id, currentActor: userActor('usr_a') }, DEFAULT_TENANT);
+    const child = await store.createSession({ threadId: TEST_THREAD_ID, projectId: project.id, currentActor: agentActor('agt_a') }, DEFAULT_TENANT);
+    const sub = await store.createSubSession({
+        parentSessionId: parent.id,
+        childSessionId: child.id,
+        kind: 'agent_spawn',
+        spawnedBy: userActor('usr_a'),
+    }, DEFAULT_TENANT);
+    return { store, project, parent, child, sub };
+}
+describe('Integration — tenant isolation', () => {
+    it('getProject with wrong tenantId → TenantIsolationError', async () => {
+        const { store, project } = await seedTenantAResources();
+        await expect(store.getProject(project.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('getSession with wrong tenantId → TenantIsolationError', async () => {
+        const { store, parent } = await seedTenantAResources();
+        await expect(store.getSession(parent.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('getSubSession with wrong tenantId → TenantIsolationError', async () => {
+        const { store, sub } = await seedTenantAResources();
+        await expect(store.getSubSession(sub.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('updateSession with wrong tenantId → TenantIsolationError', async () => {
+        const { store, parent } = await seedTenantAResources();
+        await expect(store.updateSession({ ...parent, status: 'active' }, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('createSubSession from a session owned by another tenant → TenantIsolationError', async () => {
+        const { store, parent, child } = await seedTenantAResources();
+        await expect(store.createSubSession({
+            parentSessionId: parent.id,
+            childSessionId: child.id,
+            kind: 'agent_spawn',
+            spawnedBy: userActor('usr_intruder', OTHER_TENANT),
+        }, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('appendMessage with wrong tenantId → TenantIsolationError', async () => {
+        const { store, child } = await seedTenantAResources();
+        await expect(store.appendMessage(child.id, createUserMessage('intruder'), OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('loadSessionMessages cross-tenant → TenantIsolationError', async () => {
+        const { store, child } = await seedTenantAResources();
+        await store.appendMessage(child.id, createUserMessage('legit'), DEFAULT_TENANT);
+        await expect(store.loadSessionMessages(child.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('loadMessages cross-tenant → TenantIsolationError', async () => {
+        const { store, child } = await seedTenantAResources();
+        await store.appendMessage(child.id, createUserMessage('legit'), DEFAULT_TENANT);
+        await expect(store.loadMessages(child.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('drill(sessionId, OTHER_TENANT) on an existing session → TenantIsolationError (pattern doc §12.2 hard reject)', async () => {
+        const { store, parent } = await seedTenantAResources();
+        // Existing session owned by DEFAULT_TENANT, caller supplies OTHER_TENANT.
+        // Pattern doc §12 specifies hard reject — no silent null masking.
+        await expect(store.drill(parent.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('drill on a missing session returns null (deny-by-default surface without leaking tenant info)', async () => {
+        const { store } = await seedTenantAResources();
+        const view = await store.drill('ses_never_existed', OTHER_TENANT);
+        // Missing session for the queried tenant returns null (Convention #5).
+        // The tenant check is conditional on the resource existing; absent
+        // resources don't leak tenant info via a thrown isolation error.
+        expect(view).toBeNull();
+    });
+    it('getChildren cross-tenant → TenantIsolationError', async () => {
+        const { store, parent } = await seedTenantAResources();
+        await expect(store.getChildren(parent.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('getAncestry cross-tenant → TenantIsolationError', async () => {
+        const { store, parent } = await seedTenantAResources();
+        await expect(store.getAncestry(parent.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('recordSummary with mismatched payload tenantId → TenantIsolationError', async () => {
+        const { store, parent } = await seedTenantAResources();
+        // Attempt to record a summary whose payload tenantId differs from the
+        // caller tenantId — runtime guard rejects.
+        await expect(store.recordSummary({
+            id: 'sum_intruder',
+            sessionRef: parent.id,
+            tenantId: OTHER_TENANT,
+            outcome: { status: 'succeeded' },
+            deliverables: [],
+            agentSummary: '',
+            keyDecisions: [],
+            at: new Date(),
+            materializedBy: 'kernel',
+        }, DEFAULT_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('getSummary cross-tenant → TenantIsolationError when a summary exists', async () => {
+        const { store, parent } = await seedTenantAResources();
+        await store.updateSession({ ...parent, status: 'active' }, DEFAULT_TENANT);
+        await store.recordSummary({
+            id: 'sum_ok',
+            sessionRef: parent.id,
+            tenantId: DEFAULT_TENANT,
+            outcome: { status: 'succeeded' },
+            deliverables: [],
+            agentSummary: '',
+            keyDecisions: [],
+            at: new Date(),
+            materializedBy: 'kernel',
+        }, DEFAULT_TENANT);
+        await expect(store.getSummary(parent.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('createProject with params.tenantId ≠ caller tenantId → TenantIsolationError (deep check)', async () => {
+        const store = new InMemorySessionStore();
+        await expect(store.createProject({ tenantId: OTHER_TENANT, name: 'mismatch' }, DEFAULT_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('createSession with project owned by another tenant → TenantIsolationError', async () => {
+        const { store, project } = await seedTenantAResources();
+        await expect(store.createSession({
+            threadId: TEST_THREAD_ID,
+            projectId: project.id,
+            currentActor: userActor('usr_intruder', OTHER_TENANT),
+        }, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('tenant denormalization: Session, SubSession records carry tenantId explicitly', async () => {
+        const { store, parent, sub } = await seedTenantAResources();
+        const parentReloaded = await store.getSession(parent.id, DEFAULT_TENANT);
+        expect(parentReloaded?.tenantId).toBe(DEFAULT_TENANT);
+        // SubSession record itself does not carry tenantId in its shape — the
+        // isolation is stored via the parent record tuple (subSessions map:
+        // { tenantId, subSession }). Getting it via the correct tenant succeeds;
+        // via the wrong tenant rejects — already covered above. This test just
+        // confirms the successful access path.
+        const reloaded = await store.getSubSession(sub.id, DEFAULT_TENANT);
+        expect(reloaded?.id).toBe(sub.id);
+    });
+    it('broadcast-style cross-tenant attempt: cannot createSubSession linking parents owned by another tenant', async () => {
+        // Pattern doc §12 requires recipient & source to share tenant. The
+        // store-level guard here catches the shape violation — createSubSession
+        // refuses to link parent/child across tenants.
+        const { store, parent } = await seedTenantAResources();
+        // Create a session in OTHER_TENANT with its own project.
+        const otherProject = await store.createProject({ tenantId: OTHER_TENANT, name: 'other' }, OTHER_TENANT);
+        const otherChild = await store.createSession({
+            threadId: TEST_THREAD_ID,
+            projectId: otherProject.id,
+            currentActor: userActor('usr_other', OTHER_TENANT),
+        }, OTHER_TENANT);
+        await expect(store.createSubSession({
+            parentSessionId: parent.id, // DEFAULT_TENANT
+            childSessionId: otherChild.id, // OTHER_TENANT
+            kind: 'agent_spawn',
+            spawnedBy: userActor('usr_a'),
+        }, DEFAULT_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('deleteSubSession cross-tenant → TenantIsolationError', async () => {
+        const { store, sub } = await seedTenantAResources();
+        await expect(store.deleteSubSession(sub.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('deleteSession cross-tenant → TenantIsolationError', async () => {
+        const { store } = await seedTenantAResources();
+        // Parent has a sub-session attached → deleteSession would fail anyway,
+        // but the tenant guard fires first. Use a standalone session.
+        const project = (await store.createProject({ tenantId: DEFAULT_TENANT, name: 'del' }, DEFAULT_TENANT)).id;
+        const lonely = await store.createSession({ threadId: TEST_THREAD_ID, projectId: project, currentActor: userActor('usr_lonely') }, DEFAULT_TENANT);
+        await expect(store.deleteSession(lonely.id, OTHER_TENANT)).rejects.toBeInstanceOf(TenantIsolationError);
+    });
+    it('missing sub-session returns null for correct tenant (not a leak channel)', async () => {
+        const { store } = await seedTenantAResources();
+        // Missing id via correct tenant → null, not thrown. Confirms the
+        // missing-resource fast-path doesn't pre-empt the tenant check.
+        const missing = await store.getSubSession('sub_never_existed', DEFAULT_TENANT);
+        expect(missing).toBeNull();
+    });
+});
+//# sourceMappingURL=tenant-isolation.test.js.map

package/dist/session/__tests__/integration/tenant-isolation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolation.test.js","sourceRoot":"","sources":["../../../../src/session/__tests__/integration/tenant-isolation.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAEnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAEpF,MAAM,cAAc,GAAG,UAAsB,CAAA;AAE7C,KAAK,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CACxC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,EAC1C,cAAc,CACd,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CACvC,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,EACrF,cAAc,CACd,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CACtC,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,EACtF,cAAc,CACd,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,CACvC;QACC,eAAe,EAAE,MAAM,CAAC,EAAE;QAC1B,cAAc,EAAE,KAAK,CAAC,EAAE;QACxB,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC;KAC7B,EACD,cAAc,CACd,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AAC9C,CAAC;AAED,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACvD,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC9E,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACtD,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC7E,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACnD,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC7E,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACtD,MAAM,MAAM,CACX,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,YAAY,CAAC,CAClE,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC7D,MAAM,MAAM,CACX,KAAK,CAAC,gBAAgB,CACrB;YACC,eAAe,EAAE,MAAM,CAAC,EAAE;YAC1B,cAAc,EAAE,KAAK,CAAC,EAAE;YACxB,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC;SAClD,EACD,YAAY,CACZ,CACD,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACrD,MAAM,MAAM,CACX,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,iBAAiB,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAC1E,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACrD,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAA;QAC/E,MAAM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CACrF,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACrD,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAA;QAC/E,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC9E,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC7H,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACtD,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC9G,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAC7B,mBAAwD,EACxD,YAAY,CACZ,CAAA;QACD,uEAAuE;QACvE,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACtD,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC9E,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACtD,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC9E,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACtD,sEAAsE;QACtE,2CAA2C;QAC3C,MAAM,MAAM,CACX,KAAK,CAAC,aAAa,CAClB;YACC,EAAE,EAAE,cAA2B;YAC/B,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAChC,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE;YACd,cAAc,EAAE,QAAQ;SACxB,EACD,cAAc,CACd,CACD,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACtD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,cAAc,CAAC,CAAA;QAC1E,MAAM,KAAK,CAAC,aAAa,CACxB;YACC,EAAE,EAAE,QAAqB;YACzB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;YAChC,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE;YACd,cAAc,EAAE,QAAQ;SACxB,EACD,cAAc,CACd,CAAA;QAED,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAC7E,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,KAAK,GAAG,IAAI,oBAAoB,EAAE,CAAA;QACxC,MAAM,MAAM,CACX,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,cAAc,CAAC,CACjF,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACvD,MAAM,MAAM,CACX,KAAK,CAAC,aAAa,CAClB;YACC,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,YAAY,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC;SACrD,EACD,YAAY,CACZ,CACD,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC3D,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QACxE,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAErD,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;QAClE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;QACtH,mEAAmE;QACnE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAEtD,yDAAyD;QACzD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,aAAa,CAC7C,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EACzC,YAAY,CACZ,CAAA;QACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAC3C;YACC,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,YAAY,CAAC,EAAE;YAC1B,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC;SAClD,EACD,YAAY,CACZ,CAAA;QAED,MAAM,MAAM,CACX,KAAK,CAAC,gBAAgB,CACrB;YACC,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,iBAAiB;YAC7C,cAAc,EAAE,UAAU,CAAC,EAAE,EAAE,eAAe;YAC9C,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC;SAC7B,EACD,cAAc,CACd,CACD,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QACnD,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAChF,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC9C,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,OAAO,GAAc,CAC1B,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,cAAc,CAAC,CACpF,CAAC,EAAE,CAAA;QACJ,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CACvC,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,EACvF,cAAc,CACd,CAAA;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAChF,oBAAoB,CACpB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAA;QAC9C,iEAAiE;QACjE,gEAAgE;QAChE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,mBAAmC,EAAE,cAAc,CAAC,CAAA;QAC9F,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/session/errors.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Typed errors for the session hierarchy module.
+ *
+ * See session-hierarchy.md §12.2 (cross-tenant rejection), §6.2 (workspace
+ * backend operation failures), §4.5 (intervention DAG). Each error carries a
+ * structured `details` payload so consumers can route without string parsing
+ * (Convention #5: deny-by-default, fail fast).
+ */
+import type { SessionId, TenantId } from '../types/ids/index.js';
+import type { ThreadId } from '../types/session/ids.js';
+import type { SessionStatus } from './hierarchy/session.js';
+import type { WorkspaceBackendKind } from './workspace/driver.js';
+/**
+ * Raised by {@link SessionStore} accessors when the supplied {@link TenantId}
+ * does not match the tenant owning the target resource. Convention #17:
+ * cross-tenant access is a hard error at the kernel boundary — there is no
+ * escape hatch. See session-hierarchy.md §12.2.
+ */
+export declare class TenantIsolationError extends Error {
+    readonly details: {
+        requested: TenantId;
+        resource: string;
+    };
+    constructor(details: {
+        requested: TenantId;
+        resource: string;
+    });
+}
+/**
+ * Raised by {@link SessionStore.getAncestry} / {@link SessionStore.drill}
+ * when walking parent sub-session links encounters a revisit. Indicates store
+ * corruption — the write path enforces acyclicity (session-hierarchy.md §4.5).
+ */
+export declare class AncestryCycleError extends Error {
+    readonly details: {
+        sessionId: SessionId;
+        cyclePath: readonly SessionId[];
+    };
+    constructor(details: {
+        sessionId: SessionId;
+        cyclePath: readonly SessionId[];
+    });
+}
+/**
+ * Raised by {@link WorkspaceBackendDriver} implementations on any I/O or
+ * invariant failure. Wraps the underlying cause; callers can match on
+ * `details.op` + `details.kind` for routing (Convention #0: no silent
+ * fallbacks — surface the failure). See session-hierarchy.md §6.2 / §7.
+ */
+export declare class WorkspaceBackendError extends Error {
+    readonly details: {
+        op: string;
+        kind: WorkspaceBackendKind;
+        cause?: unknown;
+    };
+    constructor(details: {
+        op: string;
+        kind: WorkspaceBackendKind;
+        cause?: unknown;
+    });
+}
+/**
+ * Raised by {@link import('../types/thread/store.js').ThreadStore.updateThread}
+ * when the supplied {@link Thread.ownerVersion} does not match the persisted
+ * record. The caller must re-read via `getThread`, re-apply its intended
+ * mutation on top of the fresh record, and retry. Mirrors the Session
+ * handoff CAS pattern (§6.1).
+ */
+export declare class StaleThreadError extends Error {
+    readonly details: {
+        threadId: ThreadId;
+        expectedVersion: number;
+        actualVersion: number;
+    };
+    constructor(details: {
+        threadId: ThreadId;
+        expectedVersion: number;
+        actualVersion: number;
+    });
+}
+/**
+ * Raised by the spawn path (and any caller that enforces the open-thread
+ * precondition) when a Thread is in `'archived'` state and would-be mutations
+ * require it to be `'open'`. Convention #5: deny-by-default — archival is a
+ * hard read-only boundary.
+ */
+export declare class ThreadClosedError extends Error {
+    readonly details: {
+        threadId: ThreadId;
+        op: string;
+    };
+    constructor(details: {
+        threadId: ThreadId;
+        op: string;
+    });
+}
+/**
+ * Raised by {@link import('../manager/thread/lifecycle.js').ThreadManager.archive}
+ * and `.delete` when the Thread's session-presence precondition is violated:
+ *
+ * - `op: 'archive'` — at least one Session under the Thread is in a
+ *   non-terminal state (`active | locked | awaiting_hitl | awaiting_merge`).
+ *   The caller must first quiesce those sessions (let them reach `idle`,
+ *   `failed`, or `archived`) before flipping the Thread to archived.
+ * - `op: 'delete'` — the Thread still has at least one attached Session.
+ *   Callers must either archive + tombstone those sessions (`deleteSession`)
+ *   before calling `deleteThread`, or accept that deletion is not yet safe.
+ *
+ * `blockingSessions` carries the first {@link THREAD_NOT_EMPTY_SAMPLE_LIMIT}
+ * offenders with their current status so operator tooling can surface an
+ * actionable list without unbounded error payloads on large threads.
+ * `totalBlockingSessions` holds the full count even when the sample is
+ * truncated. Convention #5: deny-by-default — no implicit cascade, no silent
+ * no-op.
+ */
+export declare const THREAD_NOT_EMPTY_SAMPLE_LIMIT = 50;
+export declare class ThreadNotEmptyError extends Error {
+    readonly details: {
+        threadId: ThreadId;
+        tenantId: TenantId;
+        op: 'archive' | 'delete';
+        blockingSessions: ReadonlyArray<{
+            sessionId: SessionId;
+            status: SessionStatus;
+        }>;
+        totalBlockingSessions: number;
+    };
+    constructor(details: {
+        threadId: ThreadId;
+        tenantId: TenantId;
+        op: 'archive' | 'delete';
+        blockingSessions: ReadonlyArray<{
+            sessionId: SessionId;
+            status: SessionStatus;
+        }>;
+        totalBlockingSessions: number;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/session/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/session/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAEjE;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE;QACjB,SAAS,EAAE,QAAQ,CAAA;QACnB,QAAQ,EAAE,MAAM,CAAA;KAChB,CAAA;gBAEW,OAAO,EAAE;QAAE,SAAS,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;CAK9D;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,OAAO,EAAE;QACjB,SAAS,EAAE,SAAS,CAAA;QACpB,SAAS,EAAE,SAAS,SAAS,EAAE,CAAA;KAC/B,CAAA;gBAEW,OAAO,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,SAAS,SAAS,EAAE,CAAA;KAAE;CAO9E;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE;QACjB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,oBAAoB,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;gBAEW,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,oBAAoB,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhF;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,EAAE,QAAQ,CAAA;QAClB,eAAe,EAAE,MAAM,CAAA;QACvB,aAAa,EAAE,MAAM,CAAA;KACrB,CAAA;gBAEW,OAAO,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;CAO3F;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,EAAE,QAAQ,CAAA;QAClB,EAAE,EAAE,MAAM,CAAA;KACV,CAAA;gBAEW,OAAO,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE;CAKvD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAE/C,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,EAAE,QAAQ,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,EAAE,EAAE,SAAS,GAAG,QAAQ,CAAA;QACxB,gBAAgB,EAAE,aAAa,CAAC;YAAE,SAAS,EAAE,SAAS,CAAC;YAAC,MAAM,EAAE,aAAa,CAAA;SAAE,CAAC,CAAA;QAChF,qBAAqB,EAAE,MAAM,CAAA;KAC7B,CAAA;gBAEW,OAAO,EAAE;QACpB,QAAQ,EAAE,QAAQ,CAAA;QAClB,QAAQ,EAAE,QAAQ,CAAA;QAClB,EAAE,EAAE,SAAS,GAAG,QAAQ,CAAA;QACxB,gBAAgB,EAAE,aAAa,CAAC;YAAE,SAAS,EAAE,SAAS,CAAC;YAAC,MAAM,EAAE,aAAa,CAAA;SAAE,CAAC,CAAA;QAChF,qBAAqB,EAAE,MAAM,CAAA;KAC7B;CAOD"}