@opengeni/api-router 0.30.1 → 1.0.0

package/dist/sandbox/viewer.d.ts

@@ -2,6 +2,7 @@ import type { Settings } from "@opengeni/config";
 import { type Session } from "@opengeni/contracts";
 import { type Database, type LeaseSnapshot, type SandboxRecord } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
+import type { ObjectStorage } from "@opengeni/storage";
 import { establishSandboxSessionFromEnvelope, type EstablishedSandboxSession } from "@opengeni/runtime/sandbox";
 /** The minimal services a viewer op needs: the DB + settings (lease cadence +
  *  the sandbox client construction the leaf reads from settings). The bus is
@@ -11,6 +12,7 @@ export type ViewerServices = {
     db: Database;
     settings: Settings;
     bus?: EventBus;
+    objectStorage?: ObjectStorage | null;
     /** Provider-establish dependency used by API-direct readiness and stream
      *  operations. Production uses the runtime leaf; isolated tests may supply a
      *  deterministic provider without replacing a process-global module. */
@@ -51,7 +53,10 @@ export type ViewerAttachResult = {
  * cannot change manifest environment variables" whenever a viewer attach (an open
  * session page) won the cold-create race against the first turn.
  */
-export declare function sessionAttachEnvironment(services: ViewerServices, workspaceId: string, session: Session): Promise<Record<string, string>>;
+export declare function sessionAttachEnvironment(services: ViewerServices, workspaceId: string, session: Session, 
+/** The authenticated route subject driving this attach (0282); recorded on
+ *  the materialization audit fact. Null records the legacy service sentinel. */
+attachSubjectId: string | null): Promise<Record<string, string>>;
 /**
  * Acquire a `viewer` holder on the group lease, spinning up the box IN-PROCESS
  * when cold. Mirrors the worker's resumeBoxForTurn spawner/attached branches,
@@ -65,6 +70,9 @@ export declare function attachViewer(services: ViewerServices, input: {
     workspaceId: string;
     session: Session;
     viewerId?: string;
+    /** The authenticated subject attaching this viewer (0281): recorded on
+     *  the holder row together with the live session authority epoch. */
+    viewerSubjectId?: string;
     /** Cancel lifecycle waiting when the originating HTTP request disconnects. */
     waitSignal?: AbortSignal;
 }): Promise<ViewerAttachResult>;
@@ -84,6 +92,10 @@ export declare function ensureSessionGroupReady(services: ViewerServices, input:
     accountId: string;
     workspaceId: string;
     session: Session;
+    /** The authenticated subject driving the fleet attach/swap (0282): recorded
+     *  on the viewer holder and the materialization audit fact. Omitting it
+     *  records the explicit service sentinel, so forward the route subject. */
+    subjectId?: string | null;
 }): Promise<SessionGroupReadinessHold>;
 /**
  * Refresh a viewer holder's TTL (the app-level viewer heartbeat). Epoch-fenced:
@@ -148,6 +160,11 @@ export type DesktopStreamMint = {
 export type MintDesktopStreamInput = {
     accountId: string;
     workspaceId: string;
+    resourceSubjectId?: string;
+    /** True when the route grant is a signed delegated token (metadata.delegated):
+     *  its authority is the token, not membership rows, so the mint-time
+     *  live-authority recheck does not apply. */
+    resourceSubjectDelegated?: boolean;
     session: Session;
     /** The viewer holder id the scoped token is minted for. */
     viewerId: string;
@@ -197,6 +214,9 @@ type SelfhostedStreamMint = Omit<TerminalStreamMint, "transport">;
 export type MintTerminalStreamInput = {
     accountId: string;
     workspaceId: string;
+    resourceSubjectId?: string;
+    /** See MintDesktopStreamInput.resourceSubjectDelegated. */
+    resourceSubjectDelegated?: boolean;
     session: Session;
     /** The viewer holder / principal id the scoped token is minted for. */
     viewerId: string;
@@ -233,6 +253,11 @@ export type MintSelfhostedStreamInput = {
      *  THIS as its leaseEpoch claim so the relay rejects a stale-epoch (swapped-away)
      *  viewer. */
     activeEpoch: number;
+    /** 0281 viewer authority claims stamped into the relay stream token. */
+    viewerAuthority?: {
+        subjectId?: string;
+        authorityEpoch: number;
+    };
     /** The exposed stream port (6080 desktop / 7681 terminal). */
     port: number;
     /** The resolvable selfhosted session (the routing proxy resolves the active

package/dist/sandbox-file-artifacts.d.ts

@@ -0,0 +1,50 @@
+import { SandboxFileArtifactReceipt, type AccessGrant, type Session } from "@opengeni/contracts";
+import { type ApiRouteDeps, type AccessGrantAuthorization } from "@opengeni/core";
+import { getFile } from "@opengeni/db";
+import { type SandboxChannelAService } from "@opengeni/runtime/sandbox";
+/** Original bytes inherit the already-authorized source session's ownership. */
+export declare function publishSandboxFileArtifact(deps: ApiRouteDeps, input: Parameters<typeof publishSandboxFileArtifactInScope>[1]): Promise<SandboxFileArtifactReceipt>;
+declare function publishSandboxFileArtifactInScope(deps: ApiRouteDeps, input: {
+    grant: AccessGrant;
+    authorization?: AccessGrantAuthorization;
+    session: Session;
+    path: string;
+    signal?: AbortSignal | undefined;
+}): Promise<SandboxFileArtifactReceipt>;
+/** Use the root captured by the same fenced Channel-A service that reads bytes,
+ * not the session's placement-home label or a caller-supplied root. */
+export declare function readSandboxArtifactFile(service: Pick<SandboxChannelAService, "capabilities" | "fsRead">, value: string, maxBytes: number): Promise<{
+    path: string;
+    sandboxPath: string;
+    read: {
+        path: string;
+        encoding: "base64" | "utf8";
+        content: string;
+        sizeBytes: number;
+        truncated: boolean;
+        isBinary: boolean;
+        revision: number;
+    };
+}>;
+export declare function sandboxArtifactRelativePath(value: string, workspaceRoot?: string): string;
+export declare function sandboxArtifactSafeFilename(filename: string): string;
+export declare function sandboxFileContentType(filename: string): string;
+export declare function sandboxArtifactIdentity(input: {
+    workspaceId: string;
+    sessionId: string;
+    path: string;
+    sha256: string;
+}): {
+    fileId: string;
+    uploadId: string;
+};
+export declare function assertSandboxArtifactFile(file: NonNullable<Awaited<ReturnType<typeof getFile>>>, expected: {
+    filename: string;
+    safeFilename: string;
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+    bucket: string;
+    objectKey: string;
+}): void;
+export {};

package/dist/scheduled-task-deletion.d.ts

@@ -0,0 +1,13 @@
+import type { AccessGrant, ScheduledTask as ScheduledTaskValue } from "@opengeni/contracts";
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { TemporalScheduleCleanupClaim } from "@opengeni/db";
+/** Execute one exact connector obligation frozen into the tombstone outbox row. */
+export declare function cleanupScheduledTaskConnectorAuthorization(deps: ApiRouteDeps, claim: TemporalScheduleCleanupClaim): Promise<void>;
+/** Shared HTTP/MCP domain operation: authorize, tombstone, persist, then accelerate cleanup. */
+export declare function deleteScheduledTaskWithDurableCleanup(deps: ApiRouteDeps, request: {
+    grant: AccessGrant;
+    taskId: string;
+}): Promise<{
+    task: ScheduledTaskValue;
+    changed: boolean;
+}>;

package/dist/session-create-observability.d.ts

@@ -0,0 +1,5 @@
+import { type Observability } from "@opengeni/observability";
+type SessionCreatePhase = "authorization" | "body_read" | "site_origin" | "core_create" | "response_projection";
+/** Content-free child boundaries within the existing HTTP request span. */
+export declare function measureSessionCreatePhase<T>(observability: Pick<Observability, "startSpan"> | null | undefined, phase: SessionCreatePhase, work: () => Promise<T>): Promise<T>;
+export {};

package/dist/session-event-view-MPS2OZD3.js

@@ -0,0 +1,292 @@
+import "./chunk-OGQDXVXY.js";
+
+// src/mcp/session-event-view.ts
+import { z } from "zod";
+import {
+  assistantMessagePhase
+} from "@opengeni/contracts";
+var SESSION_EVENT_VIEW_MAX_BYTES = 16 * 1024;
+var selectionSchema = z.object({
+  sessionId: z.string().uuid(),
+  view: z.enum(["conversation", "results", "tools"]),
+  includeArguments: z.boolean(),
+  includeOutput: z.boolean(),
+  callId: z.string().max(512).refine(
+    (value) => Buffer.byteLength(JSON.stringify(value), "utf8") <= 2048,
+    "callId exceeds the encoded cursor budget"
+  ).nullable(),
+  toolName: z.string().min(1).max(256).refine(
+    (value) => Buffer.byteLength(JSON.stringify(value), "utf8") <= 512,
+    "toolName exceeds the encoded cursor budget"
+  ).nullable().default(null),
+  limit: z.number().int().min(1).max(50).optional(),
+  direction: z.enum(["before", "after"]),
+  after: z.number().int().nonnegative(),
+  before: z.number().int().positive().nullable()
+});
+var cursorSchema = z.object({
+  v: z.union([z.literal(1), z.literal(2)]),
+  selection: selectionSchema,
+  sequence: z.number().int().positive().nullable(),
+  offset: z.number().int().nonnegative().max(2147483647)
+});
+var types = {
+  conversation: ["user.message", "agent.message.completed"],
+  // Final turn output is authoritative: do not repeat message.completed text.
+  results: ["turn.completed", "turn.failed", "goal.completed", "goal.paused", "tool.auth_needed"],
+  tools: ["agent.toolCall.created", "agent.toolCall.output"]
+};
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+var bytes = (value) => Buffer.byteLength(JSON.stringify(value, null, 2), "utf8");
+var encode = (selection, sequence = null, offset = 0, v = 2) => Buffer.from(JSON.stringify({ v, selection, sequence, offset })).toString("base64url");
+function resolveSessionEventView(input) {
+  let continuation = null;
+  if (input.cursor !== void 0) {
+    if (input.cursor.length > 4096)
+      throw new Error("session_events cursor exceeds 4096 characters");
+    try {
+      continuation = cursorSchema.parse(
+        JSON.parse(Buffer.from(input.cursor, "base64url").toString())
+      );
+    } catch {
+      throw new Error("Invalid session_events cursor");
+    }
+    const previous = continuation.selection;
+    for (const key of [
+      "sessionId",
+      "view",
+      "includeArguments",
+      "includeOutput",
+      "callId",
+      "toolName",
+      "direction",
+      "after",
+      "before"
+    ]) {
+      if (input[key] !== void 0 && input[key] !== previous[key]) {
+        throw new Error(`session_events cursor cannot change ${key}`);
+      }
+    }
+  }
+  const selection = continuation?.selection ?? selectionSchema.parse({
+    sessionId: input.sessionId,
+    view: input.view ?? "conversation",
+    includeArguments: input.includeArguments ?? false,
+    includeOutput: input.includeOutput ?? false,
+    callId: input.callId ?? null,
+    toolName: input.toolName ?? null,
+    direction: input.direction ?? (input.before !== void 0 || input.after === void 0 ? "before" : "after"),
+    after: input.after ?? 0,
+    before: input.before ?? null
+  });
+  selection.limit = z.number().int().min(1).max(50).parse(input.limit ?? selection.limit ?? 10);
+  if (selection.toolName && selection.includeOutput)
+    throw new Error(
+      "toolName selects named calls. Read a result with its callId and includeOutput=true."
+    );
+  if (selection.view !== "tools" && (selection.callId || selection.toolName || selection.includeArguments || selection.includeOutput)) {
+    throw new Error("callId/toolName/includeArguments/includeOutput require view=tools");
+  }
+  if (continuation && (continuation.sequence === null && continuation.offset !== 0 || continuation.sequence !== null && (continuation.sequence <= selection.after || selection.before !== null && continuation.sequence >= selection.before)))
+    throw new Error("Invalid session_events cursor position");
+  return { selection, continuation };
+}
+function project(event, selection) {
+  if (event.duplicateOfEventId || event.turnAssociation && event.turnAssociation !== "current")
+    return null;
+  const p = record(event.payload);
+  const base = { sequence: event.sequence, ...event.turnId ? { turnId: event.turnId } : {} };
+  if (selection.view === "conversation") {
+    const phase = event.type === "agent.message.completed" ? assistantMessagePhase(p) : null;
+    return typeof p.text === "string" && p.text.length > 0 ? {
+      ...base,
+      role: event.type === "user.message" ? "user" : "assistant",
+      ...phase ? { phase } : {},
+      text: p.text
+    } : null;
+  }
+  if (selection.view === "results") {
+    if (event.type === "turn.completed" && ("maintenance" in p || "segmentLimit" in p)) return null;
+    const value2 = event.type === "turn.completed" ? p.output ?? p.result : p;
+    if (value2 === void 0 || value2 === "") return null;
+    return {
+      ...base,
+      type: event.type,
+      text: typeof value2 === "string" ? value2 : JSON.stringify(value2)
+    };
+  }
+  if (selection.toolName && (event.type !== "agent.toolCall.created" || p.name !== selection.toolName))
+    return null;
+  const callId = p.callId ?? p.call_id ?? p.id;
+  if (selection.callId !== null && selection.callId !== callId) return null;
+  const output = event.type === "agent.toolCall.output";
+  const value = output ? p.output : p.arguments ?? p.args;
+  return {
+    ...base,
+    callId,
+    kind: output ? "result" : "call",
+    ...typeof p.name === "string" ? { name: p.name } : {},
+    ...p.identityOmitted === true ? { identityOmitted: true } : {},
+    ...p.isError === true || record(value).isError === true ? { isError: true } : {},
+    ...(output ? selection.includeOutput : selection.includeArguments) && value !== void 0 ? {
+      text: typeof value === "string" ? value : JSON.stringify(value),
+      encoding: typeof value === "string" ? "text" : "json"
+    } : {}
+  };
+}
+async function readSessionEventView(input, read) {
+  const { selection, continuation } = resolveSessionEventView(input);
+  const limit = selection.limit;
+  let after = continuation?.sequence && selection.direction === "after" ? continuation.sequence - 1 : selection.after;
+  let before = continuation?.sequence && selection.direction === "before" ? continuation.sequence + 1 : selection.before;
+  const events = [];
+  let hasMore = false;
+  let nextCursor = null;
+  let sourceExact = true;
+  let edge = null;
+  let legacyActive = continuation?.v === 1 && continuation.sequence !== null;
+  const page = () => ({
+    view: selection.view,
+    effectiveLimit: limit,
+    direction: selection.direction,
+    events,
+    nextAfter: selection.direction === "after" ? edge ?? selection.after : null,
+    nextBefore: selection.direction === "before" ? edge ?? selection.before : null,
+    hasMore,
+    nextCursor,
+    sourceExact,
+    ...!sourceExact ? {
+      sourceLoss: {
+        reason: "structured_value_exceeds_budget",
+        completeTextAvailable: false,
+        message: "An oversized structured value was omitted. Scalar text remains retrievable through continuation; omitted structured values are not complete JSON results."
+      }
+    } : {},
+    maxBytes: SESSION_EVENT_VIEW_MAX_BYTES
+  });
+  const resume = (sequence, offset = 0) => {
+    hasMore = true;
+    nextCursor = encode(
+      { ...selection, after, before },
+      sequence,
+      offset,
+      legacyActive && sequence === continuation?.sequence ? 1 : 2
+    );
+  };
+  for (let scan = 0; scan < 64; scan += 1) {
+    const source = await read({
+      after,
+      ...before === null ? {} : { before },
+      direction: selection.direction,
+      limit: 8,
+      includeTypes: selection.toolName ? ["agent.toolCall.created"] : types[selection.view],
+      ...selection.toolName ? { toolName: selection.toolName } : {},
+      ...selection.callId ? { callId: selection.callId } : {},
+      payloadMode: "full",
+      excludeUnclaimedHumanPrompts: true,
+      maxBytes: 1024 * 1024,
+      legacyUtf16: legacyActive,
+      view: selection.view,
+      includeArguments: selection.includeArguments,
+      includeOutput: selection.includeOutput,
+      ...continuation?.sequence ? { sourceSequence: continuation.sequence, sourceOffset: continuation.offset } : {}
+    });
+    sourceExact &&= source.fullPayloadsExact;
+    const ordered = selection.direction === "before" ? [...source.events].reverse() : source.events;
+    for (const event of ordered) {
+      const slice = source.slices?.[event.sequence];
+      const item = project(event, selection);
+      if (item) {
+        const offset = continuation?.sequence === event.sequence ? continuation.offset : 0;
+        if (slice?.omitted) {
+          delete item.text;
+          item.sourceOmitted = { reason: "structured_value_exceeds_budget", complete: false };
+        }
+        const advance = (text) => slice?.unit === "codepoint" ? Array.from(text).length : text.length;
+        if (!slice && offset > (item.text?.length ?? 0))
+          throw new Error("Invalid message continuation offset");
+        if (!slice && offset > 0 && item.text && /[\uD800-\uDBFF]/.test(item.text[offset - 1]) && /[\uDC00-\uDFFF]/.test(item.text[offset] ?? "")) {
+          throw new Error("Invalid message continuation offset: splits a surrogate pair");
+        }
+        if (!slice && offset > 0 && item.text) item.text = item.text.slice(offset);
+        events.push(item);
+        if (bytes(page()) > SESSION_EVENT_VIEW_MAX_BYTES - 4096) {
+          events.pop();
+          if (events.length > 0) {
+            resume(event.sequence, offset);
+            if (selection.direction === "before") events.reverse();
+            return page();
+          }
+          if (!item.text) throw new Error("Session event identity exceeds page budget");
+          const text = item.text;
+          let low = 0;
+          let high = text.length;
+          while (low < high) {
+            const mid = Math.ceil((low + high) / 2);
+            if (bytes({ ...item, text: text.slice(0, mid) }) <= SESSION_EVENT_VIEW_MAX_BYTES - 6e3)
+              low = mid;
+            else high = mid - 1;
+          }
+          if (low > 0 && /[\uD800-\uDBFF]/.test(text[low - 1])) low -= 1;
+          if (low === 0) throw new Error("Session event identity exceeds page budget");
+          events.push({
+            ...item,
+            text: text.slice(0, low),
+            fragment: {
+              offset,
+              nextOffset: offset + advance(text.slice(0, low)),
+              complete: false,
+              unit: slice?.unit ?? "utf16"
+            }
+          });
+          resume(event.sequence, offset + advance(text.slice(0, low)));
+          return page();
+        }
+        const nextOffset = offset + advance(item.text ?? "");
+        if (slice && !slice.omitted && nextOffset < slice.total) {
+          item.fragment = { offset, nextOffset, complete: false, unit: slice.unit };
+          resume(event.sequence, nextOffset);
+          if (selection.direction === "before") events.reverse();
+          return page();
+        }
+        if (offset > 0)
+          item.fragment = {
+            offset,
+            nextOffset,
+            complete: true,
+            unit: slice?.unit ?? "utf16"
+          };
+      }
+      edge = event.sequence;
+      legacyActive = false;
+      if (selection.direction === "after") after = event.sequence;
+      else before = event.sequence;
+      if (events.length >= limit) {
+        hasMore = source.hasMore || event !== ordered.at(-1);
+        nextCursor = hasMore ? encode({ ...selection, after, before }) : null;
+        if (selection.direction === "before") events.reverse();
+        return page();
+      }
+    }
+    if (source.coveredSequence) {
+      if (selection.direction === "after") after = Math.max(after, source.coveredSequence.last);
+      else before = Math.min(before ?? Infinity, source.coveredSequence.first);
+    }
+    if (!source.hasMore) {
+      hasMore = false;
+      nextCursor = null;
+      if (selection.direction === "before") events.reverse();
+      return page();
+    }
+    hasMore = true;
+    nextCursor = encode({ ...selection, after, before });
+  }
+  if (selection.direction === "before") events.reverse();
+  return page();
+}
+export {
+  SESSION_EVENT_VIEW_MAX_BYTES,
+  readSessionEventView,
+  resolveSessionEventView
+};
+//# sourceMappingURL=session-event-view-MPS2OZD3.js.map

package/dist/session-event-view-MPS2OZD3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp/session-event-view.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  assistantMessagePhase,\n  type SessionEvent,\n  type SessionEventType,\n} from \"@opengeni/contracts\";\nimport type {\n  SessionEventSliceOptions,\n  SessionEventSlicePage,\n} from \"@opengeni/db/session-event-slices\";\n\nexport const SESSION_EVENT_VIEW_MAX_BYTES = 16 * 1024;\nconst selectionSchema = z.object({\n  sessionId: z.string().uuid(),\n  view: z.enum([\"conversation\", \"results\", \"tools\"]),\n  includeArguments: z.boolean(),\n  includeOutput: z.boolean(),\n  callId: z\n    .string()\n    .max(512)\n    .refine(\n      (value) => Buffer.byteLength(JSON.stringify(value), \"utf8\") <= 2048,\n      \"callId exceeds the encoded cursor budget\",\n    )\n    .nullable(),\n  toolName: z\n    .string()\n    .min(1)\n    .max(256)\n    .refine(\n      (value) => Buffer.byteLength(JSON.stringify(value), \"utf8\") <= 512,\n      \"toolName exceeds the encoded cursor budget\",\n    )\n    .nullable()\n    .default(null),\n  limit: z.number().int().min(1).max(50).optional(),\n  direction: z.enum([\"before\", \"after\"]),\n  after: z.number().int().nonnegative(),\n  before: z.number().int().positive().nullable(),\n});\nconst cursorSchema = z.object({\n  v: z.union([z.literal(1), z.literal(2)]),\n  selection: selectionSchema,\n  sequence: z.number().int().positive().nullable(),\n  offset: z.number().int().nonnegative().max(2_147_483_647),\n});\ntype Selection = z.infer<typeof selectionSchema>;\nexport type SessionEventViewInput = {\n  sessionId: string;\n  view?: Selection[\"view\"] | undefined;\n  after?: number | undefined;\n  before?: number | undefined;\n  direction?: Selection[\"direction\"] | undefined;\n  limit?: number | undefined;\n  cursor?: string | undefined;\n  callId?: string | undefined;\n  toolName?: string | undefined;\n  includeArguments?: boolean | undefined;\n  includeOutput?: boolean | undefined;\n};\ntype Item = { sequence: number; turnId?: string; role?: string; text?: string } & Record<\n  string,\n  unknown\n>;\ntype ReadPage = (options: SessionEventSliceOptions) => Promise<SessionEventSlicePage>;\nconst types: Record<Selection[\"view\"], SessionEventType[]> = {\n  conversation: [\"user.message\", \"agent.message.completed\"],\n  // Final turn output is authoritative: do not repeat message.completed text.\n  results: [\"turn.completed\", \"turn.failed\", \"goal.completed\", \"goal.paused\", \"tool.auth_needed\"],\n  tools: [\"agent.toolCall.created\", \"agent.toolCall.output\"],\n};\nconst record = (value: unknown): Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : {};\nconst bytes = (value: unknown) => Buffer.byteLength(JSON.stringify(value, null, 2), \"utf8\");\nconst encode = (selection: Selection, sequence: number | null = null, offset = 0, v = 2) =>\n  Buffer.from(JSON.stringify({ v, selection, sequence, offset })).toString(\"base64url\");\n\n/** A cursor is a bounded selector, never authority. The caller reauthorizes every read. */\nexport function resolveSessionEventView(input: SessionEventViewInput) {\n  let continuation: z.infer<typeof cursorSchema> | null = null;\n  if (input.cursor !== undefined) {\n    if (input.cursor.length > 4096)\n      throw new Error(\"session_events cursor exceeds 4096 characters\");\n    try {\n      continuation = cursorSchema.parse(\n        JSON.parse(Buffer.from(input.cursor, \"base64url\").toString()),\n      );\n    } catch {\n      throw new Error(\"Invalid session_events cursor\");\n    }\n    const previous = continuation.selection;\n    for (const key of [\n      \"sessionId\",\n      \"view\",\n      \"includeArguments\",\n      \"includeOutput\",\n      \"callId\",\n      \"toolName\",\n      \"direction\",\n      \"after\",\n      \"before\",\n    ] as const) {\n      if (input[key] !== undefined && input[key] !== previous[key]) {\n        throw new Error(`session_events cursor cannot change ${key}`);\n      }\n    }\n  }\n  const selection =\n    continuation?.selection ??\n    selectionSchema.parse({\n      sessionId: input.sessionId,\n      view: input.view ?? \"conversation\",\n      includeArguments: input.includeArguments ?? false,\n      includeOutput: input.includeOutput ?? false,\n      callId: input.callId ?? null,\n      toolName: input.toolName ?? null,\n      direction:\n        input.direction ??\n        (input.before !== undefined || input.after === undefined ? \"before\" : \"after\"),\n      after: input.after ?? 0,\n      before: input.before ?? null,\n    });\n  selection.limit = z\n    .number()\n    .int()\n    .min(1)\n    .max(50)\n    .parse(input.limit ?? selection.limit ?? 10);\n  if (selection.toolName && selection.includeOutput)\n    throw new Error(\n      \"toolName selects named calls. Read a result with its callId and includeOutput=true.\",\n    );\n  if (\n    selection.view !== \"tools\" &&\n    (selection.callId ||\n      selection.toolName ||\n      selection.includeArguments ||\n      selection.includeOutput)\n  ) {\n    throw new Error(\"callId/toolName/includeArguments/includeOutput require view=tools\");\n  }\n  if (\n    continuation &&\n    ((continuation.sequence === null && continuation.offset !== 0) ||\n      (continuation.sequence !== null &&\n        (continuation.sequence <= selection.after ||\n          (selection.before !== null && continuation.sequence >= selection.before))))\n  )\n    throw new Error(\"Invalid session_events cursor position\");\n  return { selection, continuation };\n}\n\nfunction project(event: SessionEvent, selection: Selection): Item | null {\n  if (event.duplicateOfEventId || (event.turnAssociation && event.turnAssociation !== \"current\"))\n    return null;\n  const p = record(event.payload);\n  const base = { sequence: event.sequence, ...(event.turnId ? { turnId: event.turnId } : {}) };\n  if (selection.view === \"conversation\") {\n    // Commentary stays in the conversation, labelled so a reader can tell a\n    // progress note from an answer.\n    const phase = event.type === \"agent.message.completed\" ? assistantMessagePhase(p) : null;\n    return typeof p.text === \"string\" && p.text.length > 0\n      ? {\n          ...base,\n          role: event.type === \"user.message\" ? \"user\" : \"assistant\",\n          ...(phase ? { phase } : {}),\n          text: p.text,\n        }\n      : null;\n  }\n  if (selection.view === \"results\") {\n    if (event.type === \"turn.completed\" && (\"maintenance\" in p || \"segmentLimit\" in p)) return null;\n    const value = event.type === \"turn.completed\" ? (p.output ?? p.result) : p;\n    if (value === undefined || value === \"\") return null;\n    return {\n      ...base,\n      type: event.type,\n      text: typeof value === \"string\" ? value : JSON.stringify(value),\n    };\n  }\n  if (\n    selection.toolName &&\n    (event.type !== \"agent.toolCall.created\" || p.name !== selection.toolName)\n  )\n    return null;\n  const callId = p.callId ?? p.call_id ?? p.id;\n  if (selection.callId !== null && selection.callId !== callId) return null;\n  const output = event.type === \"agent.toolCall.output\";\n  // Choose one canonical slot. Never ship the raw receipt beside its parsed copy.\n  const value = output ? p.output : (p.arguments ?? p.args);\n  return {\n    ...base,\n    callId,\n    kind: output ? \"result\" : \"call\",\n    ...(typeof p.name === \"string\" ? { name: p.name } : {}),\n    ...(p.identityOmitted === true ? { identityOmitted: true } : {}),\n    ...(p.isError === true || record(value).isError === true ? { isError: true } : {}),\n    ...((output ? selection.includeOutput : selection.includeArguments) && value !== undefined\n      ? {\n          text: typeof value === \"string\" ? value : JSON.stringify(value),\n          encoding: typeof value === \"string\" ? \"text\" : \"json\",\n        }\n      : {}),\n  };\n}\n\n/** Read-only projection over the existing RLS/audit query. No command observations. */\nexport async function readSessionEventView(input: SessionEventViewInput, read: ReadPage) {\n  const { selection, continuation } = resolveSessionEventView(input);\n  const limit = selection.limit!;\n  let after =\n    continuation?.sequence && selection.direction === \"after\"\n      ? continuation.sequence - 1\n      : selection.after;\n  let before =\n    continuation?.sequence && selection.direction === \"before\"\n      ? continuation.sequence + 1\n      : selection.before;\n  const events: Item[] = [];\n  let hasMore = false;\n  let nextCursor: string | null = null;\n  let sourceExact = true;\n  let edge: number | null = null;\n  let legacyActive = continuation?.v === 1 && continuation.sequence !== null;\n  const page = () => ({\n    view: selection.view,\n    effectiveLimit: limit,\n    direction: selection.direction,\n    events,\n    nextAfter: selection.direction === \"after\" ? (edge ?? selection.after) : null,\n    nextBefore: selection.direction === \"before\" ? (edge ?? selection.before) : null,\n    hasMore,\n    nextCursor,\n    sourceExact,\n    ...(!sourceExact\n      ? {\n          sourceLoss: {\n            reason: \"structured_value_exceeds_budget\" as const,\n            completeTextAvailable: false as const,\n            message:\n              \"An oversized structured value was omitted. Scalar text remains retrievable through continuation; omitted structured values are not complete JSON results.\",\n          },\n        }\n      : {}),\n    maxBytes: SESSION_EVENT_VIEW_MAX_BYTES,\n  });\n  const resume = (sequence: number, offset = 0) => {\n    hasMore = true;\n    nextCursor = encode(\n      { ...selection, after, before },\n      sequence,\n      offset,\n      legacyActive && sequence === continuation?.sequence ? 1 : 2,\n    );\n  };\n  // Bound work even when a sparse exact callId lookup matches nothing. The\n  // returned cursor advances the scan without claiming the lookup is exhausted.\n  for (let scan = 0; scan < 64; scan += 1) {\n    const source = await read({\n      after,\n      ...(before === null ? {} : { before }),\n      direction: selection.direction,\n      limit: 8,\n      includeTypes: selection.toolName ? [\"agent.toolCall.created\"] : types[selection.view],\n      ...(selection.toolName ? { toolName: selection.toolName } : {}),\n      ...(selection.callId ? { callId: selection.callId } : {}),\n      payloadMode: \"full\",\n      excludeUnclaimedHumanPrompts: true,\n      maxBytes: 1024 * 1024,\n      legacyUtf16: legacyActive,\n      view: selection.view,\n      includeArguments: selection.includeArguments,\n      includeOutput: selection.includeOutput,\n      ...(continuation?.sequence\n        ? { sourceSequence: continuation.sequence, sourceOffset: continuation.offset }\n        : {}),\n    });\n    sourceExact &&= source.fullPayloadsExact;\n    const ordered = selection.direction === \"before\" ? [...source.events].reverse() : source.events;\n    for (const event of ordered) {\n      const slice = source.slices?.[event.sequence];\n      const item = project(event, selection);\n      if (item) {\n        const offset = continuation?.sequence === event.sequence ? continuation.offset : 0;\n        if (slice?.omitted) {\n          delete item.text;\n          item.sourceOmitted = { reason: \"structured_value_exceeds_budget\", complete: false };\n        }\n        const advance = (text: string) =>\n          slice?.unit === \"codepoint\" ? Array.from(text).length : text.length;\n        if (!slice && offset > (item.text?.length ?? 0))\n          throw new Error(\"Invalid message continuation offset\");\n        if (\n          !slice &&\n          offset > 0 &&\n          item.text &&\n          /[\\uD800-\\uDBFF]/.test(item.text[offset - 1]!) &&\n          /[\\uDC00-\\uDFFF]/.test(item.text[offset] ?? \"\")\n        ) {\n          throw new Error(\"Invalid message continuation offset: splits a surrogate pair\");\n        }\n        if (!slice && offset > 0 && item.text) item.text = item.text.slice(offset);\n        events.push(item);\n        // Reserve enough for the bounded cursor and fragment facts.\n        if (bytes(page()) > SESSION_EVENT_VIEW_MAX_BYTES - 4096) {\n          events.pop();\n          if (events.length > 0) {\n            resume(event.sequence, offset);\n            if (selection.direction === \"before\") events.reverse();\n            return page();\n          }\n          if (!item.text) throw new Error(\"Session event identity exceeds page budget\");\n          const text = item.text;\n          let low = 0;\n          let high = text.length;\n          while (low < high) {\n            const mid = Math.ceil((low + high) / 2);\n            if (bytes({ ...item, text: text.slice(0, mid) }) <= SESSION_EVENT_VIEW_MAX_BYTES - 6000)\n              low = mid;\n            else high = mid - 1;\n          }\n          // Do not split a UTF-16 surrogate pair (UTF-8 remains lossless).\n          if (low > 0 && /[\\uD800-\\uDBFF]/.test(text[low - 1]!)) low -= 1;\n          if (low === 0) throw new Error(\"Session event identity exceeds page budget\");\n          events.push({\n            ...item,\n            text: text.slice(0, low),\n            fragment: {\n              offset,\n              nextOffset: offset + advance(text.slice(0, low)),\n              complete: false,\n              unit: slice?.unit ?? \"utf16\",\n            },\n          });\n          resume(event.sequence, offset + advance(text.slice(0, low)));\n          return page();\n        }\n        const nextOffset = offset + advance(item.text ?? \"\");\n        if (slice && !slice.omitted && nextOffset < slice.total) {\n          item.fragment = { offset, nextOffset, complete: false, unit: slice.unit };\n          resume(event.sequence, nextOffset);\n          if (selection.direction === \"before\") events.reverse();\n          return page();\n        }\n        if (offset > 0)\n          item.fragment = {\n            offset,\n            nextOffset,\n            complete: true,\n            unit: slice?.unit ?? \"utf16\",\n          };\n      }\n      edge = event.sequence;\n      legacyActive = false;\n      if (selection.direction === \"after\") after = event.sequence;\n      else before = event.sequence;\n      if (events.length >= limit) {\n        hasMore = source.hasMore || event !== ordered.at(-1);\n        nextCursor = hasMore ? encode({ ...selection, after, before }) : null;\n        if (selection.direction === \"before\") events.reverse();\n        return page();\n      }\n    }\n    // Metadata selection can advance over stale/duplicate rows without a\n    // projected payload. Use its covered edge rather than repeating the page.\n    if (source.coveredSequence) {\n      if (selection.direction === \"after\") after = Math.max(after, source.coveredSequence.last);\n      else before = Math.min(before ?? Infinity, source.coveredSequence.first);\n    }\n    if (!source.hasMore) {\n      hasMore = false;\n      nextCursor = null;\n      if (selection.direction === \"before\") events.reverse();\n      return page();\n    }\n    hasMore = true;\n    nextCursor = encode({ ...selection, after, before });\n  }\n  if (selection.direction === \"before\") events.reverse();\n  return page();\n}\n"],"mappings":";;;AAAA,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,OAGK;AAMA,IAAM,+BAA+B,KAAK;AACjD,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,MAAM,EAAE,KAAK,CAAC,gBAAgB,WAAW,OAAO,CAAC;AAAA,EACjD,kBAAkB,EAAE,QAAQ;AAAA,EAC5B,eAAe,EAAE,QAAQ;AAAA,EACzB,QAAQ,EACL,OAAO,EACP,IAAI,GAAG,EACP;AAAA,IACC,CAAC,UAAU,OAAO,WAAW,KAAK,UAAU,KAAK,GAAG,MAAM,KAAK;AAAA,IAC/D;AAAA,EACF,EACC,SAAS;AAAA,EACZ,UAAU,EACP,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,IACC,CAAC,UAAU,OAAO,WAAW,KAAK,UAAU,KAAK,GAAG,MAAM,KAAK;AAAA,IAC/D;AAAA,EACF,EACC,SAAS,EACT,QAAQ,IAAI;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAChD,WAAW,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC/C,CAAC;AACD,IAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,GAAG,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AAAA,EACvC,WAAW;AAAA,EACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,UAAa;AAC1D,CAAC;AAoBD,IAAM,QAAuD;AAAA,EAC3D,cAAc,CAAC,gBAAgB,yBAAyB;AAAA;AAAA,EAExD,SAAS,CAAC,kBAAkB,eAAe,kBAAkB,eAAe,kBAAkB;AAAA,EAC9F,OAAO,CAAC,0BAA0B,uBAAuB;AAC3D;AACA,IAAM,SAAS,CAAC,UACd,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC9D,QACD,CAAC;AACP,IAAM,QAAQ,CAAC,UAAmB,OAAO,WAAW,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAC1F,IAAM,SAAS,CAAC,WAAsB,WAA0B,MAAM,SAAS,GAAG,IAAI,MACpF,OAAO,KAAK,KAAK,UAAU,EAAE,GAAG,WAAW,UAAU,OAAO,CAAC,CAAC,EAAE,SAAS,WAAW;AAG/E,SAAS,wBAAwB,OAA8B;AACpE,MAAI,eAAoD;AACxD,MAAI,MAAM,WAAW,QAAW;AAC9B,QAAI,MAAM,OAAO,SAAS;AACxB,YAAM,IAAI,MAAM,+CAA+C;AACjE,QAAI;AACF,qBAAe,aAAa;AAAA,QAC1B,KAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,WAAW,EAAE,SAAS,CAAC;AAAA,MAC9D;AAAA,IACF,QAAQ;AACN,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,UAAM,WAAW,aAAa;AAC9B,eAAW,OAAO;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,GAAY;AACV,UAAI,MAAM,GAAG,MAAM,UAAa,MAAM,GAAG,MAAM,SAAS,GAAG,GAAG;AAC5D,cAAM,IAAI,MAAM,uCAAuC,GAAG,EAAE;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AACA,QAAM,YACJ,cAAc,aACd,gBAAgB,MAAM;AAAA,IACpB,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM,QAAQ;AAAA,IACpB,kBAAkB,MAAM,oBAAoB;AAAA,IAC5C,eAAe,MAAM,iBAAiB;AAAA,IACtC,QAAQ,MAAM,UAAU;AAAA,IACxB,UAAU,MAAM,YAAY;AAAA,IAC5B,WACE,MAAM,cACL,MAAM,WAAW,UAAa,MAAM,UAAU,SAAY,WAAW;AAAA,IACxE,OAAO,MAAM,SAAS;AAAA,IACtB,QAAQ,MAAM,UAAU;AAAA,EAC1B,CAAC;AACH,YAAU,QAAQ,EACf,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,MAAM,SAAS,UAAU,SAAS,EAAE;AAC7C,MAAI,UAAU,YAAY,UAAU;AAClC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,MACE,UAAU,SAAS,YAClB,UAAU,UACT,UAAU,YACV,UAAU,oBACV,UAAU,gBACZ;AACA,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MACE,iBACE,aAAa,aAAa,QAAQ,aAAa,WAAW,KACzD,aAAa,aAAa,SACxB,aAAa,YAAY,UAAU,SACjC,UAAU,WAAW,QAAQ,aAAa,YAAY,UAAU;AAEvE,UAAM,IAAI,MAAM,wCAAwC;AAC1D,SAAO,EAAE,WAAW,aAAa;AACnC;AAEA,SAAS,QAAQ,OAAqB,WAAmC;AACvE,MAAI,MAAM,sBAAuB,MAAM,mBAAmB,MAAM,oBAAoB;AAClF,WAAO;AACT,QAAM,IAAI,OAAO,MAAM,OAAO;AAC9B,QAAM,OAAO,EAAE,UAAU,MAAM,UAAU,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC,EAAG;AAC3F,MAAI,UAAU,SAAS,gBAAgB;AAGrC,UAAM,QAAQ,MAAM,SAAS,4BAA4B,sBAAsB,CAAC,IAAI;AACpF,WAAO,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,SAAS,IACjD;AAAA,MACE,GAAG;AAAA,MACH,MAAM,MAAM,SAAS,iBAAiB,SAAS;AAAA,MAC/C,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,MACzB,MAAM,EAAE;AAAA,IACV,IACA;AAAA,EACN;AACA,MAAI,UAAU,SAAS,WAAW;AAChC,QAAI,MAAM,SAAS,qBAAqB,iBAAiB,KAAK,kBAAkB,GAAI,QAAO;AAC3F,UAAMA,SAAQ,MAAM,SAAS,mBAAoB,EAAE,UAAU,EAAE,SAAU;AACzE,QAAIA,WAAU,UAAaA,WAAU,GAAI,QAAO;AAChD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,MAAM,MAAM;AAAA,MACZ,MAAM,OAAOA,WAAU,WAAWA,SAAQ,KAAK,UAAUA,MAAK;AAAA,IAChE;AAAA,EACF;AACA,MACE,UAAU,aACT,MAAM,SAAS,4BAA4B,EAAE,SAAS,UAAU;AAEjE,WAAO;AACT,QAAM,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE;AAC1C,MAAI,UAAU,WAAW,QAAQ,UAAU,WAAW,OAAQ,QAAO;AACrE,QAAM,SAAS,MAAM,SAAS;AAE9B,QAAM,QAAQ,SAAS,EAAE,SAAU,EAAE,aAAa,EAAE;AACpD,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,MAAM,SAAS,WAAW;AAAA,IAC1B,GAAI,OAAO,EAAE,SAAS,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,IACrD,GAAI,EAAE,oBAAoB,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAAA,IAC9D,GAAI,EAAE,YAAY,QAAQ,OAAO,KAAK,EAAE,YAAY,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,IAChF,IAAK,SAAS,UAAU,gBAAgB,UAAU,qBAAqB,UAAU,SAC7E;AAAA,MACE,MAAM,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAAA,MAC9D,UAAU,OAAO,UAAU,WAAW,SAAS;AAAA,IACjD,IACA,CAAC;AAAA,EACP;AACF;AAGA,eAAsB,qBAAqB,OAA8B,MAAgB;AACvF,QAAM,EAAE,WAAW,aAAa,IAAI,wBAAwB,KAAK;AACjE,QAAM,QAAQ,UAAU;AACxB,MAAI,QACF,cAAc,YAAY,UAAU,cAAc,UAC9C,aAAa,WAAW,IACxB,UAAU;AAChB,MAAI,SACF,cAAc,YAAY,UAAU,cAAc,WAC9C,aAAa,WAAW,IACxB,UAAU;AAChB,QAAM,SAAiB,CAAC;AACxB,MAAI,UAAU;AACd,MAAI,aAA4B;AAChC,MAAI,cAAc;AAClB,MAAI,OAAsB;AAC1B,MAAI,eAAe,cAAc,MAAM,KAAK,aAAa,aAAa;AACtE,QAAM,OAAO,OAAO;AAAA,IAClB,MAAM,UAAU;AAAA,IAChB,gBAAgB;AAAA,IAChB,WAAW,UAAU;AAAA,IACrB;AAAA,IACA,WAAW,UAAU,cAAc,UAAW,QAAQ,UAAU,QAAS;AAAA,IACzE,YAAY,UAAU,cAAc,WAAY,QAAQ,UAAU,SAAU;AAAA,IAC5E;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,CAAC,cACD;AAAA,MACE,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,uBAAuB;AAAA,QACvB,SACE;AAAA,MACJ;AAAA,IACF,IACA,CAAC;AAAA,IACL,UAAU;AAAA,EACZ;AACA,QAAM,SAAS,CAAC,UAAkB,SAAS,MAAM;AAC/C,cAAU;AACV,iBAAa;AAAA,MACX,EAAE,GAAG,WAAW,OAAO,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,MACA,gBAAgB,aAAa,cAAc,WAAW,IAAI;AAAA,IAC5D;AAAA,EACF;AAGA,WAAS,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AACvC,UAAM,SAAS,MAAM,KAAK;AAAA,MACxB;AAAA,MACA,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,OAAO;AAAA,MACpC,WAAW,UAAU;AAAA,MACrB,OAAO;AAAA,MACP,cAAc,UAAU,WAAW,CAAC,wBAAwB,IAAI,MAAM,UAAU,IAAI;AAAA,MACpF,GAAI,UAAU,WAAW,EAAE,UAAU,UAAU,SAAS,IAAI,CAAC;AAAA,MAC7D,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,CAAC;AAAA,MACvD,aAAa;AAAA,MACb,8BAA8B;AAAA,MAC9B,UAAU,OAAO;AAAA,MACjB,aAAa;AAAA,MACb,MAAM,UAAU;AAAA,MAChB,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,MACzB,GAAI,cAAc,WACd,EAAE,gBAAgB,aAAa,UAAU,cAAc,aAAa,OAAO,IAC3E,CAAC;AAAA,IACP,CAAC;AACD,oBAAgB,OAAO;AACvB,UAAM,UAAU,UAAU,cAAc,WAAW,CAAC,GAAG,OAAO,MAAM,EAAE,QAAQ,IAAI,OAAO;AACzF,eAAW,SAAS,SAAS;AAC3B,YAAM,QAAQ,OAAO,SAAS,MAAM,QAAQ;AAC5C,YAAM,OAAO,QAAQ,OAAO,SAAS;AACrC,UAAI,MAAM;AACR,cAAM,SAAS,cAAc,aAAa,MAAM,WAAW,aAAa,SAAS;AACjF,YAAI,OAAO,SAAS;AAClB,iBAAO,KAAK;AACZ,eAAK,gBAAgB,EAAE,QAAQ,mCAAmC,UAAU,MAAM;AAAA,QACpF;AACA,cAAM,UAAU,CAAC,SACf,OAAO,SAAS,cAAc,MAAM,KAAK,IAAI,EAAE,SAAS,KAAK;AAC/D,YAAI,CAAC,SAAS,UAAU,KAAK,MAAM,UAAU;AAC3C,gBAAM,IAAI,MAAM,qCAAqC;AACvD,YACE,CAAC,SACD,SAAS,KACT,KAAK,QACL,kBAAkB,KAAK,KAAK,KAAK,SAAS,CAAC,CAAE,KAC7C,kBAAkB,KAAK,KAAK,KAAK,MAAM,KAAK,EAAE,GAC9C;AACA,gBAAM,IAAI,MAAM,8DAA8D;AAAA,QAChF;AACA,YAAI,CAAC,SAAS,SAAS,KAAK,KAAK,KAAM,MAAK,OAAO,KAAK,KAAK,MAAM,MAAM;AACzE,eAAO,KAAK,IAAI;AAEhB,YAAI,MAAM,KAAK,CAAC,IAAI,+BAA+B,MAAM;AACvD,iBAAO,IAAI;AACX,cAAI,OAAO,SAAS,GAAG;AACrB,mBAAO,MAAM,UAAU,MAAM;AAC7B,gBAAI,UAAU,cAAc,SAAU,QAAO,QAAQ;AACrD,mBAAO,KAAK;AAAA,UACd;AACA,cAAI,CAAC,KAAK,KAAM,OAAM,IAAI,MAAM,4CAA4C;AAC5E,gBAAM,OAAO,KAAK;AAClB,cAAI,MAAM;AACV,cAAI,OAAO,KAAK;AAChB,iBAAO,MAAM,MAAM;AACjB,kBAAM,MAAM,KAAK,MAAM,MAAM,QAAQ,CAAC;AACtC,gBAAI,MAAM,EAAE,GAAG,MAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,+BAA+B;AACjF,oBAAM;AAAA,gBACH,QAAO,MAAM;AAAA,UACpB;AAEA,cAAI,MAAM,KAAK,kBAAkB,KAAK,KAAK,MAAM,CAAC,CAAE,EAAG,QAAO;AAC9D,cAAI,QAAQ,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAC3E,iBAAO,KAAK;AAAA,YACV,GAAG;AAAA,YACH,MAAM,KAAK,MAAM,GAAG,GAAG;AAAA,YACvB,UAAU;AAAA,cACR;AAAA,cACA,YAAY,SAAS,QAAQ,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,cAC/C,UAAU;AAAA,cACV,MAAM,OAAO,QAAQ;AAAA,YACvB;AAAA,UACF,CAAC;AACD,iBAAO,MAAM,UAAU,SAAS,QAAQ,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAC3D,iBAAO,KAAK;AAAA,QACd;AACA,cAAM,aAAa,SAAS,QAAQ,KAAK,QAAQ,EAAE;AACnD,YAAI,SAAS,CAAC,MAAM,WAAW,aAAa,MAAM,OAAO;AACvD,eAAK,WAAW,EAAE,QAAQ,YAAY,UAAU,OAAO,MAAM,MAAM,KAAK;AACxE,iBAAO,MAAM,UAAU,UAAU;AACjC,cAAI,UAAU,cAAc,SAAU,QAAO,QAAQ;AACrD,iBAAO,KAAK;AAAA,QACd;AACA,YAAI,SAAS;AACX,eAAK,WAAW;AAAA,YACd;AAAA,YACA;AAAA,YACA,UAAU;AAAA,YACV,MAAM,OAAO,QAAQ;AAAA,UACvB;AAAA,MACJ;AACA,aAAO,MAAM;AACb,qBAAe;AACf,UAAI,UAAU,cAAc,QAAS,SAAQ,MAAM;AAAA,UAC9C,UAAS,MAAM;AACpB,UAAI,OAAO,UAAU,OAAO;AAC1B,kBAAU,OAAO,WAAW,UAAU,QAAQ,GAAG,EAAE;AACnD,qBAAa,UAAU,OAAO,EAAE,GAAG,WAAW,OAAO,OAAO,CAAC,IAAI;AACjE,YAAI,UAAU,cAAc,SAAU,QAAO,QAAQ;AACrD,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAGA,QAAI,OAAO,iBAAiB;AAC1B,UAAI,UAAU,cAAc,QAAS,SAAQ,KAAK,IAAI,OAAO,OAAO,gBAAgB,IAAI;AAAA,UACnF,UAAS,KAAK,IAAI,UAAU,UAAU,OAAO,gBAAgB,KAAK;AAAA,IACzE;AACA,QAAI,CAAC,OAAO,SAAS;AACnB,gBAAU;AACV,mBAAa;AACb,UAAI,UAAU,cAAc,SAAU,QAAO,QAAQ;AACrD,aAAO,KAAK;AAAA,IACd;AACA,cAAU;AACV,iBAAa,OAAO,EAAE,GAAG,WAAW,OAAO,OAAO,CAAC;AAAA,EACrD;AACA,MAAI,UAAU,cAAc,SAAU,QAAO,QAAQ;AACrD,SAAO,KAAK;AACd;","names":["value"]}

package/dist/site-session-origin.d.ts

@@ -0,0 +1,13 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+/** Validates a caller-asserted Site association, not browser execution or authority. */
+export declare function resolveSiteSessionOrigin(db: ApiRouteDeps["db"], workspaceId: string, siteId?: string, versionId?: string): Promise<{
+    siteId: string;
+    title: string;
+} | null>;
+/**
+ * Run a follow-up command (Send or Steer) inside the request's Site scope when
+ * the published Site bridge supplied a valid origin, so its turn records the
+ * `site` surface. Provenance only: a missing or unverifiable origin leaves the
+ * command unscoped instead of rejecting a message that is otherwise valid.
+ */
+export declare function withOptionalSiteCommandOrigin<T>(db: ApiRouteDeps["db"], workspaceId: string, siteId: string | undefined, versionId: string | undefined, run: () => Promise<T>): Promise<T>;

package/dist/site-uploads.d.ts

@@ -0,0 +1,41 @@
+import { type AccessGrant } from "@opengeni/contracts";
+import type { ApiRouteDeps, ObjectStorageDependency } from "@opengeni/core";
+import { prepareWorkspaceArtifactContent, type PreparedWorkspaceArtifactContent } from "./workspace-artifact-content.js";
+type Storage = NonNullable<ObjectStorageDependency>;
+export declare const MAX_SITE_SOURCE_BYTES: number;
+export declare function validateSiteSource(storage: Storage, key: string, sizeBytes: number): Promise<void>;
+export declare function prepareWorkspaceArtifactUpload(deps: ApiRouteDeps, grant: AccessGrant): Promise<{
+    uploadId: string;
+    html: {
+        putUrl: string;
+        requiredHeaders: Record<string, string>;
+    };
+    source: {
+        putUrl: string;
+        requiredHeaders: Record<string, string>;
+    };
+    expiresAt: string;
+}>;
+/** Provider version-pinned reads, without Site SHA checks or full HTML buffering. */
+export declare function readArtifactObject(storage: Storage, key: string, expectedHead?: Awaited<ReturnType<NonNullable<Storage["headObject"]>>>): AsyncGenerator<Uint8Array<ArrayBufferLike>, void, unknown>;
+type Input = Partial<Parameters<typeof prepareWorkspaceArtifactContent>[2]> & {
+    uploadId?: string;
+};
+export declare function prepareWorkspaceArtifactPublication(deps: ApiRouteDeps, grant: AccessGrant, input: Input): Promise<PreparedWorkspaceArtifactContent & {
+    uploadId?: string;
+}>;
+export declare function workspaceArtifactDownloads(storage: Storage, ref: {
+    contentKey: string;
+    sourceKey: string | null;
+}, audience: "sandbox" | "public"): Promise<{
+    html: {
+        url: string;
+        expiresAt: Date;
+    };
+    source: {
+        url: string;
+        expiresAt: Date;
+        format: string;
+    } | null;
+}>;
+export {};

package/dist/slack-reaction-files.d.ts

@@ -1,6 +1,6 @@
 import type { FileResourceRef } from "@opengeni/contracts";
 import { completeFileUpload, prepareGeneratedWorkspaceFile, type Database } from "@opengeni/db";
-import type { ObjectStorage } from "@opengeni/storage";
+import { type ObjectStorage } from "@opengeni/storage";
 import type { DownloadedSlackReactionImage } from "./integrations/slack-bot.js";
 export type SlackReactionImageImportSource = Readonly<{
     accountId: string;

package/dist/temporal-schedule-cleanup.d.ts

@@ -2,6 +2,7 @@ import { type Database, type TemporalScheduleCleanupClaim } from "@opengeni/db";
 import type { Observability } from "@opengeni/observability";
 type TemporalScheduleCleanupDependencies = {
     db: Database;
+    cleanupConnectorAuthorization?: (claim: TemporalScheduleCleanupClaim) => Promise<void>;
     deleteSchedule: (temporalScheduleId: string) => Promise<void>;
     observability?: Pick<Observability, "info" | "warn" | "error">;
 };

package/dist/temporal-schedule-sync.d.ts

@@ -0,0 +1,26 @@
+import type { ScheduledTask } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+type TemporalScheduleSyncDependencies = {
+    db: Database;
+    withDeadline<T>(deadline: number, work: () => Promise<T>): Promise<T>;
+    upsert(task: ScheduledTask): Promise<void>;
+    /** Idempotent: an absent Temporal schedule is already removed. */
+    remove(temporalScheduleId: string): Promise<void>;
+};
+/**
+ * Serialize external writes across API replicas, independently of task edits.
+ * A queued sync rereads the newest committed row after acquiring this lock;
+ * input snapshots never become desired state. Cleanup uses the same key, so
+ * an in-flight upsert finishes before its tombstone's external deletion.
+ * Failure compensation commits before releasing the lock, so a queued writer
+ * cannot read the row being restored and then publish that failed edit.
+ *
+ * Deadlines bound both lock admission and network occupancy. A thrown network
+ * error retains its unknown-outcome semantics; this is not durable recovery
+ * for a process crash or a lost Temporal acknowledgement.
+ */
+export declare function createTemporalScheduleSynchronizer(deps: TemporalScheduleSyncDependencies): {
+    sync(task: Pick<ScheduledTask, "id" | "workspaceId" | "temporalScheduleId">, onFailure?: (tx: Database, error: unknown) => Promise<Error>): Promise<void>;
+    remove(temporalScheduleId: string): Promise<void>;
+};
+export {};

package/dist/transcription/providers/xai-subscription.d.ts

@@ -6,3 +6,4 @@ export declare function createXaiSubscriptionTranscriptionProvider(input: {
     db: Database;
     fetch?: typeof fetch;
 }): TranscriptionProvider;
+export declare function isXaiInvalidCredentialResponse(response: Response): Promise<boolean>;

package/dist/transcription/service.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import { type TranscriptionAvailabilityContext, type TranscriptionService } from "@opengeni/core";
+import { type TranscriptionAvailabilityContext, type TranscriptionProvider, type TranscriptionService } from "@opengeni/core";
 import type { Database } from "@opengeni/db";
 export declare function createTranscriptionService(input: {
     settings: Settings;
@@ -13,3 +13,4 @@ export declare function createTranscriptionService(input: {
     now?: () => Date;
 }): TranscriptionService;
 export declare function remainingTranscriptionProviderRequestMilliseconds(providerDeadlineAt: Date, now: Date): number;
+export declare function orderedProviders(providers: readonly TranscriptionProvider[], context: TranscriptionAvailabilityContext): TranscriptionProvider[];

package/dist/work-discovery-observability.d.ts

@@ -0,0 +1,33 @@
+import type { WorkDiscoveryMatchClass } from "@opengeni/contracts";
+import type { Observability } from "@opengeni/observability";
+export type WorkDiscoverySurface = "first_party_mcp" | "agent_topology";
+export type WorkDiscoveryMode = "browse" | "query" | "subject";
+export type WorkDiscoveryOutcome = "ok" | "empty" | "disabled" | "error";
+export type WorkDiscoveryAuthorizationScope = "workspace" | "scoped";
+export type WorkDiscoveryObservation = {
+    surface: WorkDiscoverySurface;
+    mode: WorkDiscoveryMode;
+    outcome: WorkDiscoveryOutcome;
+    authorizationScope: WorkDiscoveryAuthorizationScope;
+    durationMs: number;
+    responseBytes: number;
+    resultCount: number;
+    overlapCount: number;
+    matchCounts: Partial<Record<WorkDiscoveryMatchClass, number>>;
+};
+type WorkDiscoveryObservedRow = {
+    relatedWork?: {
+        match: {
+            class: WorkDiscoveryMatchClass;
+        } | null;
+        possibleOverlap: boolean;
+    };
+};
+export declare function summarizeWorkDiscoveryRows(rows: readonly WorkDiscoveryObservedRow[]): Pick<WorkDiscoveryObservation, "resultCount" | "overlapCount" | "matchCounts">;
+/**
+ * Low-cardinality work-discovery telemetry. Identifiers, search text, subject
+ * keys, titles, goals, claim labels, versions, and provenance are excluded by
+ * construction. An observability failure never changes product behavior.
+ */
+export declare function observeWorkDiscovery(observability: Observability | null | undefined, observation: WorkDiscoveryObservation): void;
+export {};