@namzu/sdk 13.1.0 → 14.0.0

package/dist/types/project/entity.d.ts

@@ -25,15 +25,32 @@ export interface ProjectConfig {
     sharedDeliverables?: boolean;
     retentionPolicy?: RetentionPolicy;
 }
+/**
+ * Whether the workspace accepts new work.
+ *
+ * Owner-managed, like the status it replaces: a project does not derive
+ * `archived` from having no live sessions, because "empty right now" and
+ * "closed" are different facts and only one of them is a decision.
+ */
+export type ProjectStatus = 'open' | 'archived';
 /**
  * Long-lived goal scope that owns shared memory, vaults, knowledge bases,
  * and deliverables across sessions. See session-hierarchy.md §4.2.
+ *
+ * `status` is the gate the ingress paths read: an archived project accepts no
+ * new session and no handoff. It lives here rather than on Thread because the
+ * project is the thing a tenant actually closes — a workspace with its own
+ * limits, its own environment, and its own memory — and closing it has to mean
+ * something to the code, not only to a listing.
  */
 export interface Project {
     id: ProjectId;
     tenantId: TenantId;
     name: string;
     config: ProjectConfig;
+    status: ProjectStatus;
+    /** CAS counter for status transitions. Mirrors `Session.ownerVersion`. */
+    ownerVersion: number;
     createdAt: Date;
     updatedAt: Date;
 }

package/dist/types/project/entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../../../src/types/project/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa;IAC7B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,oBAAoB,EAAE,MAAM,CAAA;IAC5B,kBAAkB,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC9C,YAAY,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;IAClC,oBAAoB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAA;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,SAAS,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,aAAa,CAAA;IACrB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CACf"}
+{"version":3,"file":"entity.d.ts","sourceRoot":"","sources":["../../../src/types/project/entity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa;IAC7B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,oBAAoB,EAAE,MAAM,CAAA;IAC5B,kBAAkB,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC9C,YAAY,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAA;IAClC,oBAAoB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAA;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,UAAU,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,SAAS,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,aAAa,CAAA;IACrB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,IAAI,CAAA;IACf,SAAS,EAAE,IAAI,CAAA;CACf"}

package/dist/types/session/store.d.ts

@@ -5,7 +5,7 @@
  * access rejects with `TenantIsolationError`. Convention #0: no speculative
  * API — extensions land alongside their consumers.
  */
-import type { Project } from '../../types/project/entity.js';
+import type { Project, ProjectStatus } from '../../types/project/entity.js';
 import type { ActorRef } from '../../types/session/actor.js';
 import type { Session } from '../../types/session/entity.js';
 import type { SessionMessage } from '../../types/session/messages.js';
@@ -136,6 +136,23 @@ export interface SessionStore {
      * nothing else — there is no level above Project to filter by.
      */
     listProjects?(tenantId: TenantId): Promise<readonly Project[]>;
+    /**
+     * Open or close a workspace. OPTIONAL, same reasoning as the two above.
+     *
+     * Compare-and-set on {@link Project.ownerVersion}: pass the version you
+     * read, and a concurrent writer makes this throw `StaleProjectError`
+     * instead of silently winning. On success the stored version is bumped.
+     *
+     * Both directions, because a workspace is long-lived and closing one by
+     * mistake should not be permanent — unlike the Thread status this replaces,
+     * which only ever went one way. Returns `null` if the project does not
+     * exist; writing to another tenant's project throws.
+     *
+     * This is the store-level write. The precondition that no live session is
+     * attached belongs to {@link import('../../manager/project/lifecycle.js').ProjectManager},
+     * because the store deliberately holds no view of what is running.
+     */
+    setProjectStatus?(projectId: ProjectId, status: ProjectStatus, tenantId: TenantId, expectedOwnerVersion: number): Promise<Project | null>;
     createSession(params: CreateSessionParams, tenantId: TenantId): Promise<Session>;
     getSession(sessionId: SessionId, tenantId: TenantId): Promise<Session | null>;
     /**
@@ -184,6 +201,16 @@ export interface SessionStore {
      * ThreadStore stays unaware of session layout (Convention #0).
      */
     listSessions(threadId: ThreadId, tenantId: TenantId): Promise<readonly Session[]>;
+    /**
+     * Every Session attached to a workspace, oldest first. OPTIONAL.
+     *
+     * The project-scoped sibling of {@link SessionStore.listSessions}, and the
+     * one the archive precondition reads: closing a workspace has to know what
+     * is still running in it, and "what is running in this thread" was never
+     * the question — a project can hold sessions across many threads, and after
+     * the Thread level is removed it is the only grouping left.
+     */
+    listSessionsByProject?(projectId: ProjectId, tenantId: TenantId): Promise<readonly Session[]>;
     /**
      * Hard-delete a session. Idempotent — absent sessions succeed as a no-op.
      * Rejects with `TenantIsolationError` on cross-tenant access.

package/dist/types/session/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/types/session/store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AACrE,OAAO,KAAK,EACX,cAAc,EACd,WAAW,EACX,UAAU,EACV,cAAc,EACd,MAAM,oCAAoC,CAAA;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAErF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB;;;;OAIG;IACH,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,SAAS,CAAA;IAC1B,cAAc,EAAE,SAAS,CAAA;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IAClC,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAA;IAC/B,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAG5B,aAAa,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEhF,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE7E;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CACb,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE1B;;;;;OAKG;IACH,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IAI9D,aAAa,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEhF,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjG;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IAEjF;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAItE,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAEzF,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEzF,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3E;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAI/E;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAE7F;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IAEnF;;;;;;;;;OASG;IACH,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAA;IAIjG;;;OAGG;IACH,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IAErF;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;IAEpF;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAI5E;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CACZ,OAAO,EAAE,iBAAiB,GAAG;QAAE,cAAc,EAAE,QAAQ,CAAA;KAAE,EACzD,QAAQ,EAAE,QAAQ,GAChB,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB;;;;OAIG;IACH,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CACvF;AAED;;;GAGG;AACH,YAAY,EAAE,SAAS,EAAE,CAAA"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/types/session/store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AACrE,OAAO,KAAK,EACX,cAAc,EACd,WAAW,EACX,UAAU,EACV,cAAc,EACd,MAAM,oCAAoC,CAAA;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAErF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,SAAS,CAAA;IACpB;;;;OAIG;IACH,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACtC,eAAe,EAAE,SAAS,CAAA;IAC1B,cAAc,EAAE,SAAS,CAAA;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB,SAAS,EAAE,QAAQ,CAAA;IACnB,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IAClC,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IAEZ;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAA;IAC/B,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAG5B,aAAa,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEhF,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE7E;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,CACb,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE1B;;;;;OAKG;IACH,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IAE9D;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,CAAC,CAChB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,QAAQ,EAClB,oBAAoB,EAAE,MAAM,GAC1B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAI1B,aAAa,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEhF,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjG;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IAEjF;;;;;;;;OAQG;IACH,qBAAqB,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IAE7F;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAItE,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAEzF,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEzF,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3E;;;;;;OAMG;IACH,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAI/E;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAE7F;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IAEnF;;;;;;;;;OASG;IACH,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAA;IAIjG;;;OAGG;IACH,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IAErF;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;IAEpF;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAI5E;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,CACZ,OAAO,EAAE,iBAAiB,GAAG;QAAE,cAAc,EAAE,QAAQ,CAAA;KAAE,EACzD,QAAQ,EAAE,QAAQ,GAChB,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB;;;;OAIG;IACH,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CACvF;AAED;;;GAGG;AACH,YAAY,EAAE,SAAS,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sdk",
-  "version": "13.1.0",
+  "version": "14.0.0",
   "description": "Open-source AI agent SDK with a built-in runtime. Nothing between you and your agents.",
   "license": "FSL-1.1-MIT",
   "type": "module",

package/src/agents/runAgent.ts

@@ -22,6 +22,15 @@ import {
  * point: auto-generating alone would make each call its own session, which is
  * right for a one-shot and silently wrong for a conversation — the second turn
  * would start with no history and no shared budget, and nothing would say so.
+ *
+ * **A generated id is a correlation label, not a store handle.** `runAgent`
+ * takes no `SessionStore` and creates no records, so a `projectId` it mints
+ * names no `Project`. Carrying one into a store-backed `AgentManager` is
+ * refused at the first delegation with `Project <id> not found for tenant
+ * <id> — spawn rejected`, which is the enforcement site behaving correctly:
+ * delegation limits live on the project, and a missing project has no limits
+ * to read. A run that has to delegate should be given the id returned by
+ * `store.createProject()`.
  */
 export interface AgentIdentity {
 	sessionId?: SessionId

package/src/connector/mcp/__tests__/a-transport-forgets-its-listeners.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, it } from 'vitest'
+
+import type { MCPJsonRpcMessage } from '../../../types/connector/index.js'
+import { HttpSseTransport } from '../http-sse.js'
+import { StreamableHttpTransport } from '../streamable-http.js'
+
+/**
+ * Handler registration was append-only and nothing ever dropped it.
+ *
+ * `MCPClient.connect()` calls `onMessage`, `onClose` and `onError` once each,
+ * and it is reachable again after `disconnect()` — the guard only refuses when
+ * the status is already `connected`. So every reconnect stacked another set on
+ * the last: after n cycles one inbound message dispatched to n handlers, n-1
+ * of them closures over dead sessions. `rejectAllPending` and `emitLifecycle`
+ * fired n times per close, and the stale closures held their old client state
+ * alive for as long as the transport object did.
+ *
+ * The two HTTP transports are exercised here because they notify inside
+ * `close()`. `StdioTransport` notifies from the child process's own `close`
+ * event, so its handlers deliberately outlive the `close()` call and are
+ * dropped after that event fires — clearing them earlier would leave the
+ * client believing it was still connected, and its next `connect()` would be
+ * refused with "already connected". That ordering is the reason the obvious
+ * one-line fix is wrong there.
+ */
+
+const MESSAGE = { jsonrpc: '2.0', method: 'ping' } as MCPJsonRpcMessage
+
+interface Transport {
+	close(): Promise<void>
+	onMessage(handler: (message: MCPJsonRpcMessage) => void): void
+	onClose(handler: () => void): void
+}
+
+/**
+ * `open` puts the transport in the state where `close()` notifies.
+ *
+ * They differ, and the difference is real rather than a test artefact:
+ * `StreamableHttpTransport.close()` returns early when it was never connected,
+ * `HttpSseTransport.close()` notifies regardless. Streamable's `connect()`
+ * does no I/O — it sets a flag — so opening it here reaches no network. The
+ * divergence itself is left alone; making the two agree changes what a host
+ * observes and deserves its own decision.
+ */
+const IMPLEMENTATIONS: ReadonlyArray<
+	readonly [string, () => Transport, (t: Transport) => Promise<void>]
+> = [
+	[
+		'http-sse',
+		() => new HttpSseTransport({ url: 'http://127.0.0.1:1/mcp' } as never),
+		async () => {},
+	],
+	[
+		'streamable-http',
+		() => new StreamableHttpTransport({ url: 'http://127.0.0.1:1/mcp' } as never),
+		async (t) => {
+			await (t as unknown as { connect(): Promise<void> }).connect()
+		},
+	],
+]
+
+describe.each(IMPLEMENTATIONS)(
+	'a %s transport forgets its listeners on close',
+	(_n, build, open) => {
+		it('notifies each close handler exactly once per registration', async () => {
+			const transport = build()
+			await open(transport)
+			let closes = 0
+			transport.onClose(() => {
+				closes++
+			})
+
+			await transport.close()
+			// A second registration is what a reconnect does. If the first
+			// survived the close, this close fires twice.
+			await open(transport)
+			transport.onClose(() => {
+				closes++
+			})
+			await transport.close()
+
+			expect(closes).toBe(2)
+		})
+
+		it('does not dispatch a message to a handler from a closed session', async () => {
+			// The consequence a host actually sees: work done twice, by a
+			// closure that belongs to a session that ended.
+			const seen: string[] = []
+			const transport = build()
+			await open(transport)
+			transport.onMessage(() => seen.push('first'))
+
+			await transport.close()
+			await open(transport)
+			transport.onMessage(() => seen.push('second'))
+			dispatch(transport, MESSAGE)
+
+			expect(seen).toEqual(['second'])
+		})
+
+		it('still notifies the handlers registered for the session being closed', async () => {
+			// The failure mode of clearing too eagerly: close arrives, nobody is
+			// told, and the client believes it is still connected.
+			const transport = build()
+			await open(transport)
+			const order: string[] = []
+			transport.onClose(() => order.push('notified'))
+
+			await transport.close()
+
+			expect(order).toEqual(['notified'])
+		})
+	},
+)
+
+/**
+ * Reach the private dispatch the way an inbound frame does. Both transports
+ * loop `messageHandlers` from their own parse path; there is no public method
+ * that pushes a message in, and adding one for a test would be a surface
+ * nobody asked for.
+ */
+function dispatch(transport: Transport, message: MCPJsonRpcMessage): void {
+	const handlers = (
+		transport as unknown as { messageHandlers: Array<(m: MCPJsonRpcMessage) => void> }
+	).messageHandlers
+	for (const handler of handlers) handler(message)
+}

package/src/connector/mcp/http-sse.ts

@@ -51,6 +51,23 @@ export class HttpSseTransport implements MCPTransport {
 		this.abortController?.abort()
 		this.abortController = null
 		for (const handler of this.closeHandlers) handler()
+		// After the notification, never before it.
+		this.clearHandlers()
+	}
+
+	/**
+	 * Drop every registered handler.
+	 *
+	 * `onMessage`/`onClose`/`onError` append, and `MCPClient.connect()` calls
+	 * all three every time — and is reachable again after `disconnect()`. So
+	 * without this each reconnect duplicated the set, and after n cycles one
+	 * inbound message dispatched to n handlers, n-1 of them closures over dead
+	 * sessions that kept their old client state alive.
+	 */
+	private clearHandlers(): void {
+		this.messageHandlers = []
+		this.closeHandlers = []
+		this.errorHandlers = []
 	}
 
 	async send(message: MCPJsonRpcMessage): Promise<void> {

package/src/connector/mcp/stdio.ts

@@ -12,6 +12,8 @@ export class StdioTransport implements MCPTransport {
 	private closeHandlers: Array<() => void> = []
 	private errorHandlers: Array<(error: Error) => void> = []
 	private connected = false
+	/** True between kill and the process's own `close` event. */
+	private exitPending = false
 	private buffer = ''
 	private log: Logger
 
@@ -41,6 +43,10 @@ export class StdioTransport implements MCPTransport {
 			this.connected = false
 			this.log.info(`MCP server process exited with code ${code}`)
 			for (const handler of this.closeHandlers) handler()
+			// After the notification, not before it: this event is what tells
+			// `MCPClient` the session ended.
+			this.exitPending = false
+			this.clearHandlers()
 		})
 
 		this.process.on('error', (err) => {
@@ -55,11 +61,38 @@ export class StdioTransport implements MCPTransport {
 	}
 
 	async close(): Promise<void> {
-		if (!this.process) return
+		if (!this.process) {
+			// Nothing was spawned, or the exit already ran. No `close` event is
+			// coming, so this is the only chance to drop what `connect()`
+			// registered — and without it a retry after a failed spawn stacks a
+			// second set of handlers on the first.
+			if (!this.exitPending) this.clearHandlers()
+			return
+		}
 		this.connected = false
+		this.exitPending = true
 		this.process.kill('SIGTERM')
 		this.process = null
 		this.buffer = ''
+		// The handlers deliberately survive this call. `process.on('close')`
+		// fires them when the process actually exits, and dropping them here
+		// would leave `MCPClient` believing it is still connected — so its next
+		// `connect()` would be refused with "already connected".
+	}
+
+	/**
+	 * Drop every registered handler.
+	 *
+	 * `onMessage`/`onClose`/`onError` append, and `MCPClient.connect()` calls
+	 * all three every time — and is reachable again after `disconnect()`. So
+	 * without this each reconnect duplicated the set, and after n cycles one
+	 * inbound message dispatched to n handlers, n-1 of them closures over dead
+	 * sessions that kept their old client state alive.
+	 */
+	private clearHandlers(): void {
+		this.messageHandlers = []
+		this.closeHandlers = []
+		this.errorHandlers = []
 	}
 
 	async send(message: MCPJsonRpcMessage): Promise<void> {

package/src/connector/mcp/streamable-http.ts

@@ -26,9 +26,23 @@ export class StreamableHttpTransport implements MCPTransport {
 	}
 
 	async close(): Promise<void> {
-		if (!this.connected) return
+		if (!this.connected) {
+			// Never connected, or already closed: nothing will notify, so this is
+			// the only chance to drop what `connect()` registered before it failed.
+			this.clearHandlers()
+			return
+		}
 		this.connected = false
 		for (const handler of this.closeHandlers) handler()
+		// After the notification, never before it.
+		this.clearHandlers()
+	}
+
+	/** See {@link StdioTransport} — the same append-only handler leak. */
+	private clearHandlers(): void {
+		this.messageHandlers = []
+		this.closeHandlers = []
+		this.errorHandlers = []
 	}
 
 	async send(message: MCPJsonRpcMessage): Promise<void> {

package/src/contracts/__tests__/an-id-the-sdk-mints-passes-its-own-schema.test.ts

@@ -0,0 +1,84 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+
+import {
+	DefaultFilesystemMigrator,
+	NOOP_FILESYSTEM_MIGRATION_SINK,
+} from '../../session/migration/filesystem.js'
+import { generateProjectId } from '../../utils/id.js'
+import { ProjectIdSchema } from '../schemas.js'
+
+/**
+ * `ProjectIdSchema` was `/^prj_[a-z0-9]+$/` while the v0.2.0 filesystem
+ * migration minted `prj_legacy_<suffix>`. So the SDK's own public validator
+ * rejected ids the SDK itself had written to disk: a host that validated an
+ * inbound project id — the reason the schema is exported at all — refused
+ * every project it had migrated, with "Invalid project ID format" and no hint
+ * that the id came from the SDK.
+ *
+ * Both minters are driven here rather than restated. A test that spells out
+ * `prj_legacy_abc` as a literal would still pass if the migration changed its
+ * shape tomorrow; running the migration means the two cannot drift apart
+ * without this failing.
+ */
+
+const dirs: string[] = []
+afterEach(async () => {
+	await Promise.all(dirs.map((d) => rm(d, { recursive: true, force: true })))
+	dirs.length = 0
+})
+
+describe('every project id the SDK mints passes the schema the SDK exports', () => {
+	it('accepts what the id generator produces', () => {
+		// 200 draws, because the generator is random over [0-9a-z] and one
+		// sample proves nothing about the alphabet it can reach.
+		for (let i = 0; i < 200; i++) {
+			const id = generateProjectId()
+			const parsed = ProjectIdSchema.safeParse(id)
+			expect({ id, ok: parsed.success }).toEqual({ id, ok: true })
+		}
+	})
+
+	it('accepts what the filesystem migration produces', async () => {
+		const root = await mkdtemp(join(tmpdir(), 'namzu-idschema-'))
+		dirs.push(root)
+		const runDir = join(root, 'threads', 'thd_a1b2c3d4e5f6', 'runs', 'run_seed')
+		await mkdir(runDir, { recursive: true })
+		await writeFile(join(runDir, 'run.json'), JSON.stringify({ id: 'run_seed' }), 'utf-8')
+
+		const result = await new DefaultFilesystemMigrator(NOOP_FILESYSTEM_MIGRATION_SINK).migrate(root)
+
+		expect(result.kind).toBe('migrated')
+		expect(result.migratedThreads).toHaveLength(1)
+		for (const { newProjectId } of result.migratedThreads) {
+			const parsed = ProjectIdSchema.safeParse(newProjectId)
+			expect({ newProjectId, ok: parsed.success }).toEqual({ newProjectId, ok: true })
+		}
+	})
+
+	it('still refuses what no minter produces, because the id is also a directory name', () => {
+		// Widening to accept the legacy form must not widen to accept a path.
+		// Everything here would be joined onto the store root if it got through.
+		const refused = [
+			'prj_../../etc',
+			'prj_..',
+			'prj_a/b',
+			'prj_a\\b',
+			'prj_',
+			'prj_legacy_',
+			'prj_ABC',
+			'prj_a-b',
+			'prj_a b',
+			'proj_abc',
+			'thd_abc',
+			'',
+		]
+
+		for (const candidate of refused) {
+			const parsed = ProjectIdSchema.safeParse(candidate)
+			expect({ candidate, ok: parsed.success }).toEqual({ candidate, ok: false })
+		}
+	})
+})

package/src/contracts/schemas.ts

@@ -1,6 +1,23 @@
 import { z } from 'zod'
 
-export const ProjectIdSchema = z.string().regex(/^prj_[a-z0-9]+$/, 'Invalid project ID format')
+/**
+ * The two shapes the SDK mints, and nothing else.
+ *
+ * `prj_<12 lowercase alphanumerics>` comes from `generateProjectId()`.
+ * `prj_legacy_<suffix>` comes from the v0.2.0 filesystem migration, which
+ * synthesises a project per legacy `thd_*` folder. The `legacy_` segment is
+ * spelled out rather than covered by a permissive character class, because a
+ * project id is also a directory name: everything this accepts is joined to a
+ * path, so the set it accepts is a containment boundary, not a formatting
+ * preference.
+ *
+ * A host that supplies its own `SessionStore` and mints its own ids should
+ * validate with its own schema — `ProjectId` is `prj_${string}` at the type
+ * level and this schema is deliberately narrower.
+ */
+export const ProjectIdSchema = z
+	.string()
+	.regex(/^prj_(legacy_)?[a-z0-9]+$/, 'Invalid project ID format')
 export const RunIdSchema = z.string().regex(/^run_[a-z0-9]+$/, 'Invalid run ID format')
 export const MessageIdSchema = z.string().regex(/^msg_[a-z0-9]+$/, 'Invalid message ID format')
 

package/src/manager/agent/lifecycle.ts

@@ -36,6 +36,7 @@ import { ZERO_COST } from '../../utils/cost.js'
 import { toErrorMessage } from '../../utils/error.js'
 import { generateTaskId } from '../../utils/id.js'
 import { type Logger, getRootLogger } from '../../utils/logger.js'
+import { requireOpenProject } from '../project/lifecycle.js'
 import type { ThreadManager } from '../thread/lifecycle.js'
 
 /**
@@ -593,12 +594,11 @@ export class AgentManager {
 			)
 		}
 
-		const project = await store.getProject(context.projectId, context.tenantId)
-		if (!project) {
-			throw new Error(
-				`Project ${context.projectId} not found for tenant ${context.tenantId} — spawn rejected`,
-			)
-		}
+		// Same read that loads the limits, now also the gate: an archived
+		// workspace accepts no new session. It replaces a bare `getProject` +
+		// null check rather than adding a round-trip, because a gate that costs
+		// something is a gate someone eventually moves.
+		const project = await requireOpenProject(store, context.projectId, context.tenantId, 'spawn')
 
 		// Capacity: depth + width. Depth uses the parent session's ancestry
 		// chain; width counts existing direct children of the parent.

package/src/manager/index.ts

@@ -20,3 +20,6 @@ export { ThreadManager } from './thread/lifecycle.js'
 export type { ThreadManagerDeps } from './thread/lifecycle.js'
 
 export { AgentManager } from './agent/lifecycle.js'
+
+export { ProjectManager, requireOpenProject } from './project/lifecycle.js'
+export type { ProjectManagerDeps } from './project/lifecycle.js'