@opengeni/api-router 0.30.3 → 2.2.0-canary.0

package/dist/index.js

@@ -1,15 +1,18 @@
 import {
+  InteractionFrameProxyTransport,
   SlackBotProviderError,
+  cleanupScheduledTaskConnectorAuthorization,
   createAppComposition,
   createOpenGeniSlackBotInteractionClient,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-WCXHI3FF.js";
+} from "./chunk-3TP54PPX.js";
 
 // src/index.ts
 import {
   dbSearchPath,
   getSettings,
+  resolveFirstPartyDelegationSecret,
   resolveNatsCalloutConfig,
   resolveNatsControlPlaneAuth,
   retryStartupDependency,
@@ -68,14 +71,20 @@ import {
   resolveEnrollmentSigningSecret
 } from "@opengeni/config";
 import { verifyEnrollmentBearer } from "@opengeni/contracts";
-import { getEnrollment } from "@opengeni/db";
+import { claimEnrollmentConnection, getEnrollment } from "@opengeni/db";
 import {
   createResponderConnection,
   decodeAuthRequest,
   mintAuthResponse,
   mintUserJwt,
+  parseAgentConnectionName,
   workspaceAgentPermissions
 } from "@opengeni/events";
+
+// src/sandbox/connection-authority.ts
+var AGENT_CONNECTION_LEASE_MS = 2e4;
+
+// src/sandbox/auth-callout.ts
 var AUTH_CALLOUT_SUBJECT = "$SYS.REQ.USER.AUTH";
 var NATS_USER_JWT_TTL_SECONDS = 5 * 60;
 async function handleAuthorizationRequest(deps, requestBytes) {
@@ -121,7 +130,29 @@ async function handleAuthorizationRequest(deps, requestBytes) {
   if (enrollment.credentialGeneration !== claims.credentialGeneration) {
     return deny("enrollment credential generation mismatch");
   }
-  const permissions = workspaceAgentPermissions(claims.workspaceId);
+  const connectionInstanceId = parseAgentConnectionName(decoded.name);
+  if (!connectionInstanceId) {
+    return deny("missing or invalid agent connection instance");
+  }
+  const claim = await claimEnrollmentConnection(deps.db, {
+    workspaceId: claims.workspaceId,
+    enrollmentId: claims.enrollmentId,
+    credentialGeneration: claims.credentialGeneration,
+    connectionInstanceId,
+    leaseMs: AGENT_CONNECTION_LEASE_MS
+  });
+  if (!claim.claimed) {
+    deps.observability?.warn?.("auth-callout: denied a duplicate live runner", {
+      workspaceId: claims.workspaceId,
+      agentId: claims.agentId
+    });
+    return deny("another runner instance currently owns this enrollment");
+  }
+  const permissions = workspaceAgentPermissions(
+    claims.workspaceId,
+    claims.agentId,
+    connectionInstanceId
+  );
   const nowSeconds = Math.floor(Date.now() / 1e3);
   const userJwt = mintUserJwt({
     userPublicKey: decoded.userNkey,
@@ -145,7 +176,8 @@ async function handleAuthorizationRequest(deps, requestBytes) {
   });
   deps.observability?.info?.("auth-callout: granted a workspace-scoped NATS credential", {
     workspaceId: claims.workspaceId,
-    agentId: claims.agentId
+    agentId: claims.agentId,
+    connectionGeneration: claim.connectionGeneration
   });
   return Buffer.from(response, "utf8");
 }
@@ -170,35 +202,44 @@ async function startAuthCalloutResponder(deps, natsUrl) {
 import {
   clearEnrollmentWentOffline,
   disconnectAttachedBrowserDevices,
+  advanceEnrollmentAgentUpdate,
   getEnrollment as getEnrollment2,
+  getLiveEnrollmentConnection,
   ingestMachineMetricsSample,
   reconcileAttachedBrowserInventory,
+  releaseEnrollmentConnection,
+  renewEnrollmentConnection,
   sessionsWithActiveOpOnEnrollment,
   setEnrollmentDisplayState,
-  setEnrollmentOpStreamState,
-  setEnrollmentWentOffline,
-  touchEnrollmentLastSeen
+  setEnrollmentAgentRuntime,
+  setEnrollmentOpStreamState
 } from "@opengeni/db";
 import {
   AttachedBrowserInventorySnapshot as AttachedBrowserInventoryContract
 } from "@opengeni/contracts";
 import { appendAndPublishEvents } from "@opengeni/events";
+import { normalizeConnectedMachineWorkspaceRoot } from "@opengeni/runtime/sandbox";
 import {
   AgentEvent,
+  AgentUpdateStage,
   Arch,
   GoingOfflineReason,
   Hello,
   Os,
   goingOfflineReasonToJSON
 } from "@opengeni/agent-proto";
-var AGENT_EVENTS_SUBJECT = "agent.*.*.events";
-var AGENT_HELLO_SUBJECT = "agent.*.*.hello";
+var AGENT_EVENTS_SUBJECT = "agent.*.*.connection.*.events";
+var AGENT_HELLO_SUBJECT = "agent.*.*.connection.*.hello";
 function parseAgentSubject(subject, tail) {
   const parts = subject.split(".");
-  if (parts.length !== 4 || parts[0] !== "agent" || parts[3] !== tail) {
+  if (parts.length !== 6 || parts[0] !== "agent" || parts[3] !== "connection" || !parts[4] || parts[5] !== tail) {
     return null;
   }
-  return { workspaceId: parts[1], agentId: parts[2] };
+  return {
+    workspaceId: parts[1],
+    agentId: parts[2],
+    connectionInstanceId: parts[4]
+  };
 }
 function parseAgentEventSubject(subject) {
   return parseAgentSubject(subject, "events");
@@ -294,19 +335,10 @@ async function ingestAttachedBrowserInventory(db, input) {
     snapshot: wireAttachedBrowserInventoryToContract(input.inventory)
   });
 }
-async function ingestHeartbeat(db, input) {
-  const enrollment = await getEnrollment2(db, input.workspaceId, input.agentId);
-  if (!enrollment) {
-    return { ingested: false, seriesAppended: false };
-  }
+async function ingestHeartbeatMetrics(db, input) {
   const sample = wireSampleToDbSample(input.sample);
-  await touchEnrollmentLastSeen(db, {
-    accountId: enrollment.accountId,
-    workspaceId: input.workspaceId,
-    enrollmentId: input.agentId
-  });
   const result = await ingestMachineMetricsSample(db, {
-    accountId: enrollment.accountId,
+    accountId: input.accountId,
     workspaceId: input.workspaceId,
     enrollmentId: input.agentId,
     sample
@@ -356,17 +388,19 @@ async function handleAgentEventPayload(db, observability, payload, subject, bus)
       labels: { reason }
     });
     try {
-      const enrollment = await getEnrollment2(db, ids.workspaceId, ids.agentId);
-      if (enrollment) {
-        await setEnrollmentWentOffline(db, {
-          accountId: enrollment.accountId,
+      const enrollment2 = await getEnrollment2(db, ids.workspaceId, ids.agentId);
+      if (enrollment2) {
+        const released = await releaseEnrollmentConnection(db, {
+          accountId: enrollment2.accountId,
           workspaceId: ids.workspaceId,
           enrollmentId: ids.agentId,
+          connectionInstanceId: ids.connectionInstanceId,
           reason
         });
+        if (!released.released) return;
         try {
           await disconnectAttachedBrowserDevices(db, {
-            accountId: enrollment.accountId,
+            accountId: enrollment2.accountId,
             workspaceId: ids.workspaceId,
             enrollmentId: ids.agentId
           });
@@ -408,10 +442,75 @@ async function handleAgentEventPayload(db, observability, payload, subject, bus)
     }
     return;
   }
+  if (event.event?.$case === "agentUpdateProgress") {
+    const enrollment2 = await getEnrollment2(db, ids.workspaceId, ids.agentId).catch(() => null);
+    if (!enrollment2 || enrollment2.connectionInstanceId !== ids.connectionInstanceId) return;
+    const progress = event.event.agentUpdateProgress;
+    const status = (() => {
+      switch (progress.stage) {
+        case AgentUpdateStage.AGENT_UPDATE_STAGE_ACCEPTED:
+          return "accepted";
+        case AgentUpdateStage.AGENT_UPDATE_STAGE_WAITING_FOR_IDLE:
+          return "waiting_for_idle";
+        case AgentUpdateStage.AGENT_UPDATE_STAGE_DOWNLOADING:
+          return "downloading";
+        case AgentUpdateStage.AGENT_UPDATE_STAGE_VERIFYING:
+          return "verifying";
+        case AgentUpdateStage.AGENT_UPDATE_STAGE_APPLYING:
+          return "applying";
+        case AgentUpdateStage.AGENT_UPDATE_STAGE_RESTARTING:
+          return "restarting";
+        case AgentUpdateStage.AGENT_UPDATE_STAGE_FAILED:
+          return "failed";
+        default:
+          return null;
+      }
+    })();
+    if (!status) return;
+    try {
+      await advanceEnrollmentAgentUpdate(db, {
+        accountId: enrollment2.accountId,
+        workspaceId: ids.workspaceId,
+        enrollmentId: ids.agentId,
+        connectionInstanceId: ids.connectionInstanceId,
+        connectionGeneration: enrollment2.connectionGeneration,
+        operationId: progress.operationId,
+        status,
+        expectedBinarySha256: /^[0-9a-f]{64}$/.test(progress.expectedBinarySha256) ? progress.expectedBinarySha256 : null,
+        errorCode: progress.errorCode || null,
+        retryable: progress.retryable,
+        rolledBack: progress.rolledBack
+      });
+    } catch (error) {
+      observability?.warn?.("Failed to ingest a machine self-update progress event", {
+        subject,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    return;
+  }
   if (event.event?.$case !== "heartbeat") {
     return;
   }
   const heartbeat = event.event.heartbeat;
+  const enrollment = await getEnrollment2(db, ids.workspaceId, ids.agentId).catch(() => null);
+  if (!enrollment || enrollment.connectionInstanceId !== ids.connectionInstanceId) return;
+  try {
+    const renewed = await renewEnrollmentConnection(db, {
+      accountId: enrollment.accountId,
+      workspaceId: ids.workspaceId,
+      enrollmentId: ids.agentId,
+      connectionInstanceId: ids.connectionInstanceId,
+      leaseMs: AGENT_CONNECTION_LEASE_MS
+    });
+    if (!renewed.renewed) return;
+  } catch (error) {
+    observability?.warn?.("Failed to renew a machine connection heartbeat", {
+      subject,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return;
+  }
   if (heartbeat.attachedBrowserInventory) {
     try {
       await ingestAttachedBrowserInventory(db, {
@@ -429,7 +528,8 @@ async function handleAgentEventPayload(db, observability, payload, subject, bus)
   const metrics = heartbeat.metrics;
   if (!metrics) return;
   try {
-    await ingestHeartbeat(db, {
+    await ingestHeartbeatMetrics(db, {
+      accountId: enrollment.accountId,
       workspaceId: ids.workspaceId,
       agentId: ids.agentId,
       sample: metrics
@@ -464,6 +564,33 @@ function helloDesktopUnavailableReason(hello) {
 function helloReportsOpStream(hello) {
   return hello.capabilities?.opStream === true;
 }
+function helloRuntimeCapabilities(hello) {
+  const caps = hello.capabilities;
+  if (!caps) return {};
+  return {
+    exec: caps.exec === true,
+    filesystem: caps.filesystem === true,
+    git: caps.git === true,
+    pty: caps.pty === true,
+    desktop: caps.desktop === true,
+    opStream: caps.opStream === true,
+    browserBridge: caps.browserBridge === true,
+    operationResourcePolicy: caps.operationResourcePolicy === true,
+    operationCpuQuota: caps.operationCpuQuota === true
+  };
+}
+function helloCompletedUpdate(hello) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+    hello.completedUpdateOperationId
+  ) || !/^(?:v)?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(hello.completedUpdateTargetVersion) || !/^[0-9a-f]{64}$/.test(hello.completedUpdateBinarySha256)) {
+    return null;
+  }
+  return {
+    operationId: hello.completedUpdateOperationId,
+    targetVersion: hello.completedUpdateTargetVersion,
+    binarySha256: hello.completedUpdateBinarySha256
+  };
+}
 async function refreshEnrollmentDisplay(db, input) {
   const desktopUnavailableReason = input.desktopUnavailableReason ?? null;
   const enrollment = await getEnrollment2(db, input.workspaceId, input.agentId);
@@ -478,7 +605,8 @@ async function refreshEnrollmentDisplay(db, input) {
     workspaceId: input.workspaceId,
     enrollmentId: input.agentId,
     hasDisplay: input.hasDisplay,
-    desktopUnavailableReason
+    desktopUnavailableReason,
+    ...input.connectionInstanceId ? { connectionInstanceId: input.connectionInstanceId } : {}
   });
 }
 async function refreshEnrollmentOpStream(db, input) {
@@ -493,7 +621,8 @@ async function refreshEnrollmentOpStream(db, input) {
     accountId: enrollment.accountId,
     workspaceId: input.workspaceId,
     enrollmentId: input.agentId,
-    opStream: input.opStream
+    opStream: input.opStream,
+    ...input.connectionInstanceId ? { connectionInstanceId: input.connectionInstanceId } : {}
   });
 }
 async function handleHelloPayload(db, observability, payload, subject, bus) {
@@ -511,17 +640,53 @@ async function handleHelloPayload(db, observability, payload, subject, bus) {
     });
     return;
   }
+  const authority = await getLiveEnrollmentConnection(db, ids.workspaceId, ids.agentId).catch(
+    () => null
+  );
+  if (!authority || authority.connectionInstanceId !== ids.connectionInstanceId) {
+    observability?.warn?.("Ignored a Hello from a superseded runner instance", {
+      workspaceId: ids.workspaceId,
+      agentId: ids.agentId
+    });
+    return;
+  }
+  let workspaceRoot;
+  if (hello.workspaceRoot.length > 0) {
+    try {
+      workspaceRoot = normalizeConnectedMachineWorkspaceRoot(hello.workspaceRoot, authority.os);
+    } catch (error) {
+      observability?.warn?.("Ignored an invalid Connected Machine workspace root", {
+        workspaceId: ids.workspaceId,
+        agentId: ids.agentId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
   try {
     await refreshEnrollmentDisplay(db, {
       workspaceId: ids.workspaceId,
       agentId: ids.agentId,
       hasDisplay: helloReportsDisplay(hello),
-      desktopUnavailableReason: helloDesktopUnavailableReason(hello)
+      desktopUnavailableReason: helloDesktopUnavailableReason(hello),
+      connectionInstanceId: ids.connectionInstanceId
     });
     await refreshEnrollmentOpStream(db, {
       workspaceId: ids.workspaceId,
       agentId: ids.agentId,
-      opStream: helloReportsOpStream(hello)
+      opStream: helloReportsOpStream(hello),
+      connectionInstanceId: ids.connectionInstanceId
+    });
+    await setEnrollmentAgentRuntime(db, {
+      accountId: authority.accountId,
+      workspaceId: ids.workspaceId,
+      enrollmentId: ids.agentId,
+      connectionInstanceId: ids.connectionInstanceId,
+      agentVersion: hello.agentVersion.trim() || null,
+      binarySha256: /^[0-9a-f]{64}$/.test(hello.binarySha256) ? hello.binarySha256 : null,
+      updateChannel: hello.updateChannel === "stable" || hello.updateChannel === "beta" ? hello.updateChannel : null,
+      capabilities: helloRuntimeCapabilities(hello),
+      ...workspaceRoot !== void 0 ? { workspaceRoot } : {},
+      completedUpdate: helloCompletedUpdate(hello)
     });
   } catch (error) {
     observability?.warn?.("Failed to refresh an enrollment's capabilities from a Hello", {
@@ -530,23 +695,21 @@ async function handleHelloPayload(db, observability, payload, subject, bus) {
     });
   }
   try {
-    const enrollment = await getEnrollment2(db, ids.workspaceId, ids.agentId);
-    if (enrollment) {
-      const { cleared } = await clearEnrollmentWentOffline(db, {
-        accountId: enrollment.accountId,
-        workspaceId: ids.workspaceId,
-        enrollmentId: ids.agentId
-      });
-      if (cleared && bus) {
-        await fanOutMachineLinkEvents(
-          db,
-          bus,
-          observability,
-          ids.workspaceId,
-          ids.agentId,
-          (activeTurnId) => [{ type: "machine.link.restored", turnId: activeTurnId, payload: {} }]
-        );
-      }
+    const { cleared } = await clearEnrollmentWentOffline(db, {
+      accountId: authority.accountId,
+      workspaceId: ids.workspaceId,
+      enrollmentId: ids.agentId,
+      connectionInstanceId: ids.connectionInstanceId
+    });
+    if (cleared && bus) {
+      await fanOutMachineLinkEvents(
+        db,
+        bus,
+        observability,
+        ids.workspaceId,
+        ids.agentId,
+        (activeTurnId) => [{ type: "machine.link.restored", turnId: activeTurnId, payload: {} }]
+      );
     }
   } catch (error) {
     observability?.warn?.("Failed to clear a machine going-offline marker on a Hello", {
@@ -741,7 +904,7 @@ import {
   encodeEditableArtifactLiveServerWireFrame
 } from "@opengeni/core";
 var EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PATH = "/v1/editable-artifacts/live";
-var EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL = "opengeni-artifact-v1";
+var EDITABLE_ARTIFACT_LIVE_WEBSOCKET_PROTOCOL = "opengeni-artifact-v2";
 var EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES = 8 * 1024 * 1024 + 64 * 1024;
 var MAX_QUEUED_MESSAGES = 64;
 var MAX_QUEUED_BYTES = 12 * 1024 * 1024;
@@ -999,7 +1162,6 @@ import {
   editableArtifactId
 } from "@opengeni/core/editable-artifacts";
 import {
-  EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION,
   EditableArtifactApplication,
   EditableArtifactCompatibilityError,
   EditableArtifactLiveServer,
@@ -1007,6 +1169,7 @@ import {
   SystemEditableArtifactLiveScheduler,
   WebCryptoEditableArtifactLiveTokens
 } from "@opengeni/core/editable-artifact-live";
+import { currentEditableArtifactCompatibility } from "@opengeni/contracts/editable-artifacts";
 import {
   PostgresEditableArtifactLiveReadStore,
   PostgresEditableArtifactLiveTicketStore,
@@ -1093,6 +1256,13 @@ import {
 } from "@opengeni/contracts/editable-artifact-causal-frontier";
 import { decodeEditableArtifactSerializedCommit } from "@opengeni/contracts/editable-artifact-serialized-commit";
 import { decodeEditableArtifactMutationIntent } from "@opengeni/contracts/editable-artifacts";
+import {
+  COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
+  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,
+  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
+  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
+} from "@opengeni/contracts/editable-artifact-versions";
 import {
   MAX_EDITABLE_ARTIFACT_SNAPSHOT_BYTES,
   causalFrontiersEqual,
@@ -1101,9 +1271,6 @@ import {
   editableArtifactReplicaId,
   editableArtifactStateHash
 } from "@opengeni/core";
-var MODEL_SCHEMA_VERSION = 1;
-var OPERATION_PROTOCOL_VERSION = 1;
-var CRDT_STATE_VERSION = 1;
 var SNAPSHOT_CHUNK_BYTES = 1024 * 1024;
 async function loadVerifiedNativeArtifactRuntimeBinding() {
   const location = await doctorConfiguredArtifactRuntime();
@@ -1136,7 +1303,7 @@ var NativeEditableArtifactKernelAdapter = class {
           modality: "spreadsheet",
           committedTransactionBytes,
           kernelVersion: this.runtime.buildIdentity,
-          modelSchemaVersion: MODEL_SCHEMA_VERSION
+          modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION
         });
       }
       if (session.modality !== request.modality) {
@@ -1148,7 +1315,7 @@ var NativeEditableArtifactKernelAdapter = class {
         nativeReceiptBytes,
         resultingStateHash: editableArtifactStateHash(session.stateHash()),
         kernelVersion: this.runtime.buildIdentity,
-        modelSchemaVersion: MODEL_SCHEMA_VERSION
+        modelSchemaVersion: modelSchemaVersionFor(request.modality)
       });
     } finally {
       session.dispose();
@@ -1202,7 +1369,7 @@ var NativeEditableArtifactKernelAdapter = class {
         ),
         stateHash: editableArtifactStateHash(session.stateHash()),
         coveredHeadSequence: 0,
-        modelSchemaVersion: MODEL_SCHEMA_VERSION,
+        modelSchemaVersion: modelSchemaVersionFor(input.modality),
         kernelVersion: this.runtime.buildIdentity
       };
       if (session.modality === "spreadsheet") {
@@ -1210,8 +1377,8 @@ var NativeEditableArtifactKernelAdapter = class {
           ...common,
           modality: "spreadsheet",
           coveredCausalFrontier: domainFrontier(session.frontier()),
-          operationProtocolVersion: OPERATION_PROTOCOL_VERSION,
-          crdtStateVersion: CRDT_STATE_VERSION
+          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
         });
       }
       return Object.freeze({
@@ -1249,7 +1416,7 @@ var NativeEditableArtifactKernelAdapter = class {
         ),
         stateHash: editableArtifactStateHash(session.stateHash()),
         coveredHeadSequence: input.state.artifact.headSequence,
-        modelSchemaVersion: MODEL_SCHEMA_VERSION,
+        modelSchemaVersion: modelSchemaVersionFor(input.state.modality),
         kernelVersion: this.runtime.buildIdentity
       };
       if (session.modality === "spreadsheet") {
@@ -1258,8 +1425,8 @@ var NativeEditableArtifactKernelAdapter = class {
           ...common,
           modality: session.modality,
           coveredCausalFrontier: domainFrontier(session.frontier()),
-          operationProtocolVersion: OPERATION_PROTOCOL_VERSION,
-          crdtStateVersion: CRDT_STATE_VERSION
+          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
         });
       }
       if (session.modality !== input.state.modality) throw new Error("Native modality mismatch");
@@ -1312,12 +1479,12 @@ var NativeEditableArtifactKernelAdapter = class {
           canonicalContentHash,
           coveredHeadSequence,
           stateHash,
-          modelSchemaVersion: MODEL_SCHEMA_VERSION,
+          modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
           kernelVersion: this.runtime.buildIdentity,
           fullCrdtStateVerified: true,
           coveredCausalFrontier,
-          operationProtocolVersion: OPERATION_PROTOCOL_VERSION,
-          crdtStateVersion: CRDT_STATE_VERSION,
+          operationProtocolVersion: COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+          crdtStateVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,
           ...replayedTarget2 ? { replayedTarget: replayedTarget2 } : {}
         });
       }
@@ -1339,7 +1506,7 @@ var NativeEditableArtifactKernelAdapter = class {
         canonicalContentHash,
         coveredHeadSequence,
         stateHash,
-        modelSchemaVersion: MODEL_SCHEMA_VERSION,
+        modelSchemaVersion: modelSchemaVersionFor(session.modality),
         kernelVersion: this.runtime.buildIdentity,
         nativeRevision,
         ...replayedTarget ? { replayedTarget } : {}
@@ -1349,6 +1516,10 @@ var NativeEditableArtifactKernelAdapter = class {
     }
   }
 };
+function modelSchemaVersionFor(modality) {
+  if (modality === "spreadsheet") return SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION;
+  return modality === "document" ? DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION : PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION;
+}
 function assertRuntime(candidate, location) {
   if (typeof candidate !== "object" || candidate === null) {
     throw new Error("Verified artifact facade returned no runtime");
@@ -1581,7 +1752,8 @@ import {
 import { requireLiveAgentAttemptAuthorization } from "@opengeni/core";
 import { getFilesForSubject } from "@opengeni/db";
 import {
-  MAX_BOUNDED_OBJECT_CHUNK_BYTES
+  MAX_BOUNDED_OBJECT_CHUNK_BYTES,
+  retryWhileMissing
 } from "@opengeni/storage";
 var SNAPSHOT_MIME = "application/vnd.opengeni.editable-artifact-snapshot";
 var EditableArtifactOfficeImportAdapter = class {
@@ -1712,7 +1884,19 @@ function officeFilenameMatches(filename, modality) {
 }
 async function readVerifiedWorkspaceFile(storage, file, signal) {
   throwIfAborted2(signal);
-  const before = await storage.headFile(file);
+  const before = await retryWhileMissing(async () => {
+    try {
+      return await storage.headFile(file);
+    } catch (error) {
+      if (typeof storage.fileExists === "function" && !await storage.fileExists(file)) {
+        return null;
+      }
+      throw error;
+    }
+  });
+  if (!before) {
+    throw new EditableArtifactOfficeImportError("source_changed");
+  }
   if (before.ContentLength !== file.sizeBytes || before.ContentType !== file.contentType || before.Metadata?.sha256 !== file.sha256 || typeof before.VersionToken !== "string" || before.VersionToken.length < 1) {
     throw new EditableArtifactOfficeImportError("source_changed");
   }
@@ -1721,14 +1905,26 @@ async function readVerifiedWorkspaceFile(storage, file, signal) {
   for (let start = 0; start < file.sizeBytes; start += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {
     throwIfAborted2(signal);
     const end = Math.min(file.sizeBytes, start + MAX_BOUNDED_OBJECT_CHUNK_BYTES) - 1;
-    const chunk = await storage.getFileRange(file, { start, end });
+    const chunk = await retryWhileMissing(async () => storage.getFileRange(file, { start, end }));
     if (!chunk || chunk.byteLength !== end - start + 1) {
       throw new EditableArtifactOfficeImportError("source_changed");
     }
     bytes.set(chunk, start);
     digest.update(chunk);
   }
-  const after = await storage.headFile(file);
+  const after = await retryWhileMissing(async () => {
+    try {
+      return await storage.headFile(file);
+    } catch (error) {
+      if (typeof storage.fileExists === "function" && !await storage.fileExists(file)) {
+        return null;
+      }
+      throw error;
+    }
+  });
+  if (!after) {
+    throw new EditableArtifactOfficeImportError("source_changed");
+  }
   const sha256 = digest.digest("hex");
   if (after.ContentLength !== before.ContentLength || after.ContentType !== before.ContentType || after.Metadata?.sha256 !== before.Metadata?.sha256 || after.VersionToken !== before.VersionToken || sha256 !== file.sha256) {
     throw new EditableArtifactOfficeImportError("source_changed");
@@ -1768,6 +1964,7 @@ function throwIfAborted2(signal) {
 // src/editable-artifact-workspace-files.ts
 import { createHash as createHash3 } from "crypto";
 import { completeFileUpload, prepareGeneratedWorkspaceFile } from "@opengeni/db";
+import { retryWhileMissing as retryWhileMissing2 } from "@opengeni/storage";
 var UPLOAD_INTENT_TTL_MS = 60 * 6e4;
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
 var EditableArtifactWorkspaceFileAdapter = class {
@@ -1824,7 +2021,7 @@ var EditableArtifactWorkspaceFileAdapter = class {
         if (existing) {
           assertStoredExport(existing, download.byteSize, download.mimeType, sha256);
         } else {
-          await storage.putObjectStreamIfAbsent({
+          const created = await storage.putObjectStreamIfAbsent({
             key: objectKey,
             contentType: download.mimeType,
             chunks: download.chunks(input.signal ? { signal: input.signal } : {}),
@@ -1832,18 +2029,28 @@ var EditableArtifactWorkspaceFileAdapter = class {
             sha256,
             ...input.signal ? { signal: input.signal } : {}
           });
-          const stored = await storage.headObject(objectKey);
-          assertStoredExport(stored, download.byteSize, download.mimeType, sha256);
+          if (!created) {
+            await assertVisibleExport(
+              storage,
+              objectKey,
+              download.byteSize,
+              download.mimeType,
+              sha256,
+              input.signal
+            );
+          }
         }
         await download.assertUnchanged(input.signal);
         throwIfAborted3(input.signal);
         file = await this.completeFile(this.dependencies.db, input.scope.workspaceId, uploadId);
       } else {
-        assertStoredExport(
-          await storage.headObject(objectKey),
+        await assertVisibleExport(
+          storage,
+          objectKey,
           download.byteSize,
           download.mimeType,
-          sha256
+          sha256,
+          input.signal
         );
         await download.assertUnchanged(input.signal);
       }
@@ -1867,6 +2074,13 @@ var EditableArtifactWorkspaceFileAdapter = class {
     }
   }
 };
+async function assertVisibleExport(storage, objectKey, byteSize, contentType, sha256, signal) {
+  const head = await retryWhileMissing2(
+    async () => await storage.headObject(objectKey),
+    signal ? { signal } : {}
+  );
+  assertStoredExport(head, byteSize, contentType, sha256);
+}
 function assertStoredExport(head, byteSize, contentType, sha256) {
   if (!head || head.ContentLength !== byteSize || head.ContentType !== contentType || head.Metadata?.sha256 !== sha256 || typeof head.VersionToken !== "string" || head.VersionToken.length < 1) {
     throw new Error("Workspace export object differs from its durable materialization");
@@ -1998,7 +2212,8 @@ async function createStandaloneEditableArtifactApplication(input) {
   });
   const compatibility = Object.freeze({
     assertCompatible(request) {
-      if (request.protocolVersion !== EDITABLE_ARTIFACT_LIVE_PROTOCOL_VERSION || request.modelSchemaVersion !== 1 || request.kernelVersion !== runtime.buildIdentity) {
+      const current = currentEditableArtifactCompatibility(request.artifact.modality);
+      if (request.modality !== request.artifact.modality || request.liveProtocolVersion !== current.liveProtocolVersion || request.modelSchemaVersion !== current.modelSchemaVersion || request.snapshotVersion !== current.snapshotVersion || request.commandProtocolVersion !== current.commandProtocolVersion || request.committedTransactionProtocolVersion !== current.committedTransactionProtocolVersion) {
         throw new EditableArtifactCompatibilityError();
       }
     }
@@ -2117,7 +2332,8 @@ var RandomEditableArtifactDurableExportIds = class {
   }
 };
 function materializationProfiles(capabilities) {
-  if (capabilities.protocol !== "OGAMC001" || capabilities.runtimeKind !== "native" || capabilities.maxOutputBytes !== EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES || capabilities.codecVersions["opengeni.xlsx"] === void 0 || !capabilities.supportedModelSchemaVersions.includes(1) || !capabilities.supportedOperationProtocolVersions.includes(1) || !capabilities.supportedSnapshotProtocolVersions.includes(1)) {
+  const spreadsheetCompatibility = currentEditableArtifactCompatibility("spreadsheet");
+  if (capabilities.protocol !== "OGAMC001" || capabilities.runtimeKind !== "native" || capabilities.maxOutputBytes !== EDITABLE_ARTIFACT_EXPORT_MAX_DOWNLOAD_BYTES || capabilities.codecVersions["opengeni.xlsx"] === void 0 || capabilities.supportedModelSchemaVersions[0] !== spreadsheetCompatibility.modelSchemaVersion || capabilities.supportedOperationProtocolVersions[0] !== spreadsheetCompatibility.committedTransactionProtocolVersion || capabilities.supportedSnapshotProtocolVersions[0] !== spreadsheetCompatibility.snapshotVersion) {
     throw new Error("Verified artifact materializer profile is incompatible");
   }
   const codecVersion = capabilities.codecVersions["opengeni.xlsx"];
@@ -2207,6 +2423,19 @@ async function createTemporalWorkflowClient(settings, db) {
     namespace: settings.temporalNamespace
   });
   const client = {
+    triggerAutomationRun: async ({ accountId, workspaceId, runId }) => {
+      try {
+        await temporal.workflow.start("automationRunWorkflow", {
+          taskQueue: settings.temporalTaskQueue,
+          workflowId: `automation-run:${runId}`,
+          workflowIdReusePolicy: "REJECT_DUPLICATE",
+          args: [{ accountId, workspaceId, runId }]
+        });
+      } catch (error) {
+        if (isWorkflowAlreadyStarted(error)) return;
+        throw error;
+      }
+    },
     signalUserMessage: async ({ eventId, workflowId }) => {
       await temporal.workflow.getHandle(workflowId).signal("userMessage", eventId);
     },
@@ -2396,6 +2625,7 @@ async function startApi() {
   const observability = createObservability(settings, { component: "api" });
   const searchPath = dbSearchPath(settings);
   const dbClient = createDb(settings.databaseUrl, {
+    max: 32,
     ...searchPath ? { searchPath } : {},
     rlsStrategy: settings.rlsStrategy
   });
@@ -2406,10 +2636,17 @@ async function startApi() {
   const databasePosture = {
     rlsStrategy: settings.rlsStrategy,
     expectedRole: settings.runtimeDatabaseRole,
-    targetSchema: settings.dbSchema.trim() || "public"
+    targetSchema: settings.dbSchema.trim() || "public",
+    organizationTenancyCanonicalActivationEnabled: settings.organizationTenancyCanonicalActivationEnabled
   };
   const controlPlaneAuth = resolveNatsControlPlaneAuth(settings);
   try {
+    const { ensureModalRegistryImage } = await import("@opengeni/runtime/sandbox");
+    await retryStartupDependency(
+      "Modal private-registry image",
+      () => ensureModalRegistryImage(settings),
+      { ...retryOptions, onRetry }
+    );
     await retryStartupDependency(
       "PostgreSQL runtime posture",
       () => assertRuntimeDatabasePosture(dbClient.db, databasePosture),
@@ -2482,11 +2719,17 @@ async function startApi() {
     });
   }
   const artifactWebSockets = new EditableArtifactWebSocketTransport(routeDeps.editableArtifacts);
+  const interactionFrameProxies = new InteractionFrameProxyTransport(
+    resolveFirstPartyDelegationSecret(settings)
+  );
   const server = Bun.serve({
     hostname: settings.apiHost,
     port: settings.apiPort,
     idleTimeout: 255,
     fetch: (request, bunServer) => {
+      if (interactionFrameProxies.handles(request)) {
+        return interactionFrameProxies.upgrade(request, bunServer);
+      }
       if (artifactWebSockets.handles(request)) {
         return artifactWebSockets.upgrade(request, bunServer);
       }
@@ -2496,15 +2739,16 @@ async function startApi() {
       maxPayloadLength: EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,
       backpressureLimit: 16 * 1024 * 1024,
       closeOnBackpressureLimit: true,
-      open: (socket) => artifactWebSockets.websocket.open(socket),
-      message: (socket, message) => artifactWebSockets.websocket.message(socket, message),
-      close: (socket) => artifactWebSockets.websocket.close(socket)
+      open: (socket) => socket.data.attach(socket),
+      message: (socket, message) => socket.data.receive(message),
+      close: (socket) => socket.data.transportClosed()
     }
   });
   const stopSlackInteractionPump = settings.slackSigningSecret ? startSlackInteractionPump(routeDeps) : void 0;
   const stopMemorySlackPublicationPump = startMemorySlackPublicationPump(routeDeps);
   const stopTemporalScheduleCleanupPump = startTemporalScheduleCleanupPump({
     db: dbClient.db,
+    cleanupConnectorAuthorization: async (claim) => await cleanupScheduledTaskConnectorAuthorization(routeDeps, claim),
     deleteSchedule: async (temporalScheduleId) => {
       await workflowClient.client.deleteScheduledTaskSchedule({ temporalScheduleId });
     },