@opengeni/core 2.2.0-canary.0 → 2.4.0-canary.1

package/dist/index.js

@@ -1250,10 +1250,9 @@ function rigProviderImageSetupHash(definition) {
 function rigProviderImageContentHash(input) {
   return sha256(
     stableJson({
-      version: 1,
+      version: 2,
       backend: input.backend,
       sourceImage: input.sourceImage,
-      image: input.definition.image,
       setupScript: input.definition.setupScript,
       checks: input.definition.checks,
       credentialHooks: input.definition.credentialHooks,
@@ -1324,13 +1323,8 @@ function settingsWithPackSandboxImage(settings, sandboxImage, sandboxProviderIma
   };
 }
 function settingsWithRigImage(settings, rigImage) {
-  if (!rigImage) return settings;
-  return {
-    ...settings,
-    dockerImage: rigImage,
-    modalImageRef: rigImage,
-    modalImageId: void 0
-  };
+  void rigImage;
+  return settings;
 }
 function rigProviderImageSourceImage(settings, backend) {
   if (backend === "modal") return settings.modalImageId ?? settings.modalImageRef ?? null;
@@ -1434,10 +1428,7 @@ async function resolveSessionSandboxRuntime(db, settings, session) {
     throw new Error(`Frozen rig version ${session.rigVersionId} is unavailable`);
   }
   const legacy = legacySandboxRuntimeFromPacks(packs2);
-  const logicalSettings = settingsWithRigImage(
-    settingsWithPackSandboxImage(settings, legacy.sandboxImage, legacy.sandboxProviderImages),
-    rigVersion?.image ?? null
-  );
+  const logicalSettings = rigVersion ? settings : settingsWithPackSandboxImage(settings, legacy.sandboxImage, legacy.sandboxProviderImages);
   return {
     settings: {
       ...logicalSettings,
@@ -1650,7 +1641,8 @@ async function resolveAccessContext(c, deps) {
         userId: session.user.id,
         email: session.user.email,
         name: session.user.name,
-        emailVerified: session.user.emailVerified
+        emailVerified: session.user.emailVerified,
+        provisionFallbackOrganization: false
       });
       canonicalManagedCookieContexts.add(context);
       return context;
@@ -3174,8 +3166,8 @@ async function resolvePackRig(db, workspaceId, pack, requestedRigId, storedRigId
       image: null
     };
   }
-  const image = rig.activeVersion.image ?? null;
-  const status = pack.sandboxImage && image !== pack.sandboxImage ? "mismatch" : pack.rig?.requireVerified && rig.activeVersionHealth?.checkHealth !== "passing" ? "unverified" : "ready";
+  const image = null;
+  const status = pack.sandboxImage ? "mismatch" : pack.rig?.requireVerified && rig.activeVersionHealth?.checkHealth !== "passing" ? "unverified" : "ready";
   return {
     required,
     status,
@@ -3194,7 +3186,7 @@ function packRigBlocker(rig, legacyImage) {
     return "Verify the selected compute environment before installing this Pack";
   }
   if (legacyImage) {
-    return `The selected compute environment must use the Pack's previous image ${legacyImage}; the Pack will not replace workspace compute`;
+    return `This Pack requires the retired explicit sandbox image ${legacyImage}; Rig-bound Packs currently must use the deployment-managed platform sandbox`;
   }
   return "The selected compute environment does not satisfy this Pack's requirement";
 }
@@ -5206,7 +5198,7 @@ async function createRigForApi(deps, grant, payload, options = {}) {
     description: payload.description ?? null,
     createdBy,
     initialVersion: {
-      image: payload.image ?? null,
+      image: null,
       setupScript: payload.setupScript ?? null,
       checks: payload.checks,
       credentialHooks: payload.credentialHooks,
@@ -5355,7 +5347,7 @@ async function promoteSetupAppendChange(deps, grant, rig, change) {
     });
   }
   const nextDefinition = {
-    image: base.image,
+    image: null,
     setupScript: appendRigSetupCommand(base.setupScript, payload.command),
     checks: base.checks,
     credentialHooks: base.credentialHooks,
@@ -5421,7 +5413,7 @@ async function promoteVerifiedDefinitionEditChangeForApi(deps, grant, rig, chang
   }
   const payload = change.payload;
   const nextDefinition = {
-    image: payload.image === void 0 ? base.image : payload.image,
+    image: null,
     setupScript: payload.setupScript === void 0 ? base.setupScript : payload.setupScript,
     checks: Array.isArray(payload.checks) ? payload.checks : base.checks,
     credentialHooks: Array.isArray(payload.credentialHooks) ? payload.credentialHooks : base.credentialHooks,
@@ -5479,7 +5471,7 @@ async function createRigVersionForApi(deps, grant, rig, payload) {
     rig.workspaceId,
     rig.id,
     {
-      image: payload.image === void 0 ? base.image : payload.image,
+      image: null,
       setupScript: payload.setupScript === void 0 ? base.setupScript : payload.setupScript,
       checks: payload.checks ?? base.checks,
       credentialHooks: payload.credentialHooks ?? base.credentialHooks,
@@ -6931,7 +6923,7 @@ import {
   getConnectionMetadata as getConnectionMetadata4,
   getKnowledgeSourceForSyncAuthority,
   getNestedAgentDepthDeploymentPolicy,
-  getRig as getRig4,
+  getRig as getRig5,
   getScheduledTask,
   getScheduledTaskIncludingDeletedForUpdate,
   getScheduledTaskPersonalConnectionDelegations,
@@ -6981,9 +6973,9 @@ import {
   getAnySessionInGroup,
   getEnrollment as getEnrollment2,
   getChannel,
-  getRig as getRig3,
+  getRig as getRig4,
   getWorkspaceDefaultRigId,
-  listDistinctVariableSetIdsInGroup,
+  listDistinctVariableSetSelectionsInGroup,
   listDistinctRigVersionIdsInGroup,
   getSandbox as getSandbox3,
   getSession as getSession2,
@@ -7005,7 +6997,7 @@ import {
   requireSession as requireSession2,
   submitHumanPromptInTransaction,
   appendSessionEventsWithLockedSessionUpdate,
-  updateSessionTitle as updateSessionTitleRow,
+  updateSessionTitleWithEvent,
   withWorkspaceSubjectSessionActivityRls,
   QueueCommandConflictError,
   AgentCommandAuthorityError,
@@ -7020,7 +7012,6 @@ import {
   WorkspaceControlBusyError
 } from "@opengeni/db";
 import {
-  appendAndPublishEvents as appendAndPublishEvents2,
   publishDurableSessionEvents as publishDurableSessionEvents2,
   publishDurableWorkspaceControlEvent
 } from "@opengeni/events";
@@ -7244,6 +7235,7 @@ import {
 } from "@opengeni/contracts";
 import {
   forkSessionContent,
+  getRig as getRig3,
   getPrivateSessionCreatePolicy,
   getSessionEventForSubject,
   isRetryableDatabaseTransportFailure,
@@ -7251,6 +7243,7 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   SessionTenancyAccessError,
+  SessionTenancyInvalidRequestError,
   SessionTenancyNotActivatedError,
   transitionSessionVisibility
 } from "@opengeni/db";
@@ -7430,12 +7423,75 @@ async function forkManagedHumanSession(deps, authorization, workspaceId, sourceS
     destinationWorkspaceId: workspaceId,
     destinationVisibility: request.visibility === "private" ? "user_private" : "workspace_shared",
     workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
-    operationKey: request.idempotencyKey
+    operationKey: request.idempotencyKey,
+    ...request.rigId !== void 0 || request.variableSetIds !== void 0 ? {
+      runtimeRequest: {
+        rigId: request.rigId ?? null,
+        variableSetIds: request.variableSetIds ?? []
+      }
+    } : {}
   };
   const recoverAppliedReceipt = async () => await runTenancyMutation(async () => await replayAppliedSessionFork(deps.db, forkInput));
+  const runtimeSetupRequested = request.rigId !== void 0 || request.variableSetIds !== void 0;
+  let runtimeConfigurationPromise = null;
+  const resolveRuntimeConfiguration = async () => {
+    if (runtimeConfigurationPromise) return await runtimeConfigurationPromise;
+    runtimeConfigurationPromise = (async () => {
+      const variableSets = [];
+      for (const variableSetId of request.variableSetIds ?? []) {
+        variableSets.push(
+          await validateVariableSetAttachment(
+            { settings: deps.settings, db: deps.db },
+            authorization.grant,
+            workspaceId,
+            variableSetId
+          )
+        );
+      }
+      let rigVersionId = null;
+      if (request.rigId) {
+        requirePermission(authorization.grant, "rigs:use");
+        const rig = await getRig3(deps.db, authorization.grant, request.rigId);
+        if (!rig?.activeVersion) {
+          throw new SessionTenancyInvalidRequestError();
+        }
+        for (const defaultVariableSetId of new Set(rig.activeVersion.defaultVariableSetIds)) {
+          await validateVariableSetAttachment(
+            { settings: deps.settings, db: deps.db },
+            authorization.grant,
+            workspaceId,
+            defaultVariableSetId
+          );
+        }
+        rigVersionId = rig.activeVersion.id;
+      }
+      return {
+        variableSetIds: variableSets.map((variableSet) => variableSet.id),
+        rigId: request.rigId ?? null,
+        rigVersionId
+      };
+    })();
+    return await runtimeConfigurationPromise;
+  };
+  const publishRuntimeConfiguration = async (result2) => {
+    if (!result2.runtimeEventId || !result2.runtimeEventSequence) return;
+    await publishExactCommittedEvent(deps, {
+      workspaceId,
+      sessionId: result2.sessionId,
+      subjectId: authorization.grant.subjectId,
+      eventId: result2.runtimeEventId,
+      eventSequence: result2.runtimeEventSequence
+    });
+  };
   const applied = await recoverAppliedReceipt();
   if (applied) {
-    return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, applied);
+    const response2 = await projectAndPublishSessionFork(
+      deps,
+      authorization.grant.subjectId,
+      applied
+    );
+    await publishRuntimeConfiguration(applied);
+    return response2;
   }
   try {
     await requireSessionAuthorization(deps, authorization.grant, {
@@ -7446,12 +7502,26 @@ async function forkManagedHumanSession(deps, authorization, workspaceId, sourceS
   } catch (authorizationError) {
     const racedApplied = await recoverAppliedReceipt();
     if (racedApplied) {
-      return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, racedApplied);
+      const response2 = await projectAndPublishSessionFork(
+        deps,
+        authorization.grant.subjectId,
+        racedApplied
+      );
+      await publishRuntimeConfiguration(racedApplied);
+      return response2;
     }
     throw authorizationError;
   }
-  const result = await runTenancyMutation(async () => await forkSessionContent(deps.db, forkInput));
-  return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, result);
+  const runtimeConfiguration = runtimeSetupRequested ? await resolveRuntimeConfiguration() : null;
+  const result = await runTenancyMutation(
+    async () => await forkSessionContent(deps.db, {
+      ...forkInput,
+      ...runtimeConfiguration ? { runtimeConfiguration } : {}
+    })
+  );
+  const response = await projectAndPublishSessionFork(deps, authorization.grant.subjectId, result);
+  await publishRuntimeConfiguration(result);
+  return response;
 }
 
 // src/domain/sessions.ts
@@ -7819,7 +7889,8 @@ async function createAndStartSessionWithOutcome(input) {
       reasoningEffort: input.reasoningEffort,
       latencyMode: input.latencyMode ?? "standard",
       sandboxBackend: input.sandboxBackend,
-      variableSetId: input.variableSet?.id ?? null,
+      variableSetIds: input.variableSets?.map((variableSet) => variableSet.id) ?? [],
+      variableSetId: input.variableSets?.at(-1)?.id ?? null,
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       channelId: input.channelId ?? null,
@@ -7887,7 +7958,8 @@ async function createAndStartSessionWithOutcome(input) {
       reasoningEffort: input.reasoningEffort,
       latencyMode: input.latencyMode ?? "standard",
       sandboxBackend: input.sandboxBackend,
-      variableSetId: input.variableSet?.id ?? null,
+      variableSetIds: input.variableSets?.map((variableSet) => variableSet.id) ?? [],
+      variableSetId: input.variableSets?.at(-1)?.id ?? null,
       rigId: input.rigId ?? null,
       rigVersionId: input.rigVersionId ?? null,
       channelId: input.channelId ?? null,
@@ -7968,9 +8040,12 @@ async function finishStartSession(input, session) {
     turnExecutionPolicy: input.turnExecutionPolicy,
     createdEventPayload: {
       toolPolicy: input.toolPolicy,
-      ...input.variableSet ? {
-        variableSetId: input.variableSet.id,
-        variableSetName: input.variableSet.name
+      ...input.variableSets?.length ? {
+        variableSetIds: input.variableSets.map((variableSet) => variableSet.id),
+        variableSets: input.variableSets,
+        // Legacy highest-precedence aliases.
+        variableSetId: input.variableSets.at(-1).id,
+        variableSetName: input.variableSets.at(-1).name
       } : {},
       ...input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}
     },
@@ -8479,17 +8554,17 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
     });
   }
   await validateFileResources(db, grant.accountId, workspaceId, grant.subjectId, resources);
-  const variableSet = payload.variableSetId ? await validateVariableSetAttachment(
-    { settings, db },
-    grant,
-    workspaceId,
-    payload.variableSetId
-  ) : null;
+  const variableSets = [];
+  for (const variableSetId of payload.variableSetIds ?? []) {
+    variableSets.push(
+      await validateVariableSetAttachment({ settings, db }, grant, workspaceId, variableSetId)
+    );
+  }
   const requestedRigId = payload.rigId === void 0 ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;
   let frozenRigId = null;
   let frozenRigVersionId = null;
   if (requestedRigId) {
-    const rig = await getRig3(db, grant, requestedRigId);
+    const rig = await getRig4(db, grant, requestedRigId);
     if (!rig || !rig.activeVersion) {
       if (payload.rigId) {
         throw new HTTPException11(422, {
@@ -8547,7 +8622,10 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       ...payload.sandboxBackend ? { sandboxBackend: payload.sandboxBackend } : {},
       ...payload.targetSandboxId ? { targetSandboxId: payload.targetSandboxId } : {},
       ...payload.workingDir ? { workingDir: payload.workingDir } : {},
-      ...payload.variableSetId ? { variableSetId: payload.variableSetId } : {},
+      ...variableSets.length ? {
+        variableSetIds: variableSets.map((variableSet) => variableSet.id),
+        variableSetId: variableSets.at(-1).id
+      } : {},
       ...payload.rigId ? { rigId: payload.rigId } : {},
       ...payload.goal ? { goal: payload.goal } : {},
       ...payload.firstPartyMcpPermissions ? { firstPartyMcpPermissions: payload.firstPartyMcpPermissions } : {},
@@ -8640,8 +8718,8 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
   const sandboxChoice = payload.sandbox ?? (payload.targetSandboxId ? "new" : parentSessionId ? "shared" : "new");
   let sandboxGroupId = null;
   let inheritedBackend;
-  const requestedVariableSetId = payload.variableSetId ?? null;
-  const variableSetMatchesGroup = (memberVariableSetId) => memberVariableSetId === requestedVariableSetId;
+  const requestedVariableSetIds = variableSets.map((variableSet) => variableSet.id);
+  const variableSetsMatchGroup = (memberVariableSetIds) => stableJson4(memberVariableSetIds) === stableJson4(requestedVariableSetIds);
   const rigVersionMatchesGroup = (memberRigVersionId) => memberRigVersionId === frozenRigVersionId;
   if (sandboxChoice === "shared") {
     if (!parentSessionId) {
@@ -8654,7 +8732,7 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
     }
     const parent = parentSession;
     const parentBoxed = parent.sandboxBackend !== "none";
-    const variableSetMismatch = parentBoxed && !variableSetMatchesGroup(parent.variableSetId ?? null);
+    const variableSetMismatch = parentBoxed && !variableSetsMatchGroup(parent.variableSetIds);
     let rigMismatch = parentBoxed && !rigVersionMatchesGroup(parent.rigVersionId ?? null);
     if (parentBoxed && !rigMismatch) {
       const memberRigVersionIds = await listDistinctRigVersionIdsInGroup(
@@ -8684,13 +8762,13 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       });
     }
     if (member.sandboxBackend !== "none") {
-      const memberVariableSetIds = await listDistinctVariableSetIdsInGroup(
+      const memberVariableSetSelections = await listDistinctVariableSetSelectionsInGroup(
         db,
         workspaceId,
         sandboxChoice.groupId
       );
-      if (!memberVariableSetIds.every(
-        (memberVariableSetId) => variableSetMatchesGroup(memberVariableSetId)
+      if (!memberVariableSetSelections.every(
+        (memberVariableSetIds) => variableSetsMatchGroup(memberVariableSetIds)
       )) {
         throw new HTTPException11(422, {
           message: `sandbox group ${sandboxChoice.groupId} runs a different variableSet / different environment (the box variable set/environment is fixed at creation); create with the group's variableSet/environment or omit sandbox for an own box.`
@@ -8784,7 +8862,11 @@ async function createSessionForRequestWithOutcome(deps, grant, workspaceId, rawP
       ...creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {},
       ...creationInitiator.context ? { createdByContext: creationInitiator.context } : {},
       createdByActor: creationInitiator.actor ?? null,
-      variableSet: variableSet ? { id: variableSet.id, name: variableSet.name } : null,
+      variableSets: variableSets.map((variableSet) => ({
+        id: variableSet.id,
+        name: variableSet.name,
+        scope: variableSet.scope
+      })),
       // Frozen rig binding (M3): both null for a rig-less session (today's path).
       rigId: frozenRigId,
       rigVersionId: frozenRigVersionId,
@@ -9057,25 +9139,18 @@ async function updateSessionTitle(deps, grant, sessionId, title, source) {
     surface: "core"
   });
   const workspaceId = grant.workspaceId;
-  const result = await updateSessionTitleRow(db, {
+  const result = await updateSessionTitleWithEvent(db, {
     workspaceId,
     sessionId,
     title,
     source
   });
-  if (result.updated) {
-    await appendAndPublishEvents2(db, bus, workspaceId, sessionId, [
-      {
-        type: "session.title_set",
-        payload: {
-          title: result.title ?? title,
-          source
-        }
-      }
-    ]);
+  if (result.events.length > 0) {
+    await publishDurableSessionEvents2(bus, workspaceId, sessionId, result.events);
   }
   return {
-    ...result,
+    updated: result.updated,
+    title: result.title,
     relatedSessionAccess: authorization?.relatedSessionAccess ?? "root"
   };
 }
@@ -9614,7 +9689,7 @@ function scheduledTaskAuthorityUpdateForGrant(grant) {
   };
 }
 async function requireScheduledTaskRig(db, access, rigId) {
-  const rig = await getRig4(db, access, rigId);
+  const rig = await getRig5(db, access, rigId);
   if (!rig) {
     throw new HTTPException12(422, { message: `unknown rigId: ${rigId}` });
   }
@@ -10190,14 +10265,7 @@ import {
   WorkspaceInsightsSnapshot
 } from "@opengeni/contracts";
 import {
-  aggregateModelCallFacts,
-  aggregateModelCallFactsByDay,
-  aggregateModelCallFactsByHour,
-  aggregateModelContextContributions,
-  aggregateRootSessionDrivers,
-  aggregateScheduleFacts,
   aggregateSessionDepth,
-  aggregateWarmSecondsByGroup,
   countOnlineMachines,
   countScheduledTaskFires,
   countSessionsAttachedToGroups,
@@ -10205,16 +10273,33 @@ import {
   enumerateUtcHours,
   listFloorSessions,
   listLiveWarmLeases,
-  listModelCallFacets,
-  listRecentModelCalls,
   listScheduledTasks,
-  requireWorkspace as requireWorkspace5,
-  sumUsageQuantity as sumUsageQuantity2,
-  sumUsageQuantityByDay,
-  sumUsageQuantityByHour,
-  sumUsageQuantityInRange
+  readWorkspaceInsightsModelBundle,
+  readWorkspaceInsightsUsageBundle,
+  requireWorkspace as requireWorkspace5
 } from "@opengeni/db";
 var MACHINE_HEARTBEAT_FRESH_MS = 12e4;
+var WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES = 256;
+var WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES = 512;
+var WorkspaceInsightsFilterValidationError = class extends Error {
+  field;
+  maxUtf8Bytes;
+  constructor(field, maxUtf8Bytes) {
+    super(`${field} must be at most ${maxUtf8Bytes} UTF-8 bytes`);
+    this.name = "WorkspaceInsightsFilterValidationError";
+    this.field = field;
+    this.maxUtf8Bytes = maxUtf8Bytes;
+  }
+};
+function normalizeWorkspaceInsightsFilter(value, field) {
+  const normalized = value?.trim() || null;
+  if (normalized === null || normalized === "all") return null;
+  const maxUtf8Bytes = field === "provider" ? WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES : WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES;
+  if (new TextEncoder().encode(normalized).byteLength > maxUtf8Bytes) {
+    throw new WorkspaceInsightsFilterValidationError(field, maxUtf8Bytes);
+  }
+  return normalized;
+}
 function microsToUsd(micros) {
   return micros / 1e6;
 }
@@ -10321,157 +10406,67 @@ function billingPathOf(value) {
 function pricingSourceOf(value) {
   return value === "configured_list_price" || value === "gateway_reported" ? value : null;
 }
+function insightsSessionLabel(input) {
+  const title = input.title?.trim();
+  if (title) return title;
+  return `${(input.depth ?? 0) > 0 ? "Agent" : "Session"} ${input.id.slice(0, 8)}`;
+}
 async function getWorkspaceInsights(db, settings, input) {
+  const provider = normalizeWorkspaceInsightsFilter(input.provider, "provider");
+  const model = normalizeWorkspaceInsightsFilter(input.model, "model");
   await requireWorkspace5(db, input.workspaceId);
   const now = input.now ?? /* @__PURE__ */ new Date();
   const window = resolveRangeWindow(input.range, now);
-  const provider = input.provider?.trim() || null;
-  const model = input.model?.trim() || null;
   const modelFilterActive = Boolean(provider || model);
   const filter = { provider, model };
-  const aggregateFactsForSeries = input.range === "today" ? aggregateModelCallFactsByHour : aggregateModelCallFactsByDay;
-  const sumUsageForSeries = input.range === "today" ? sumUsageQuantityByHour : sumUsageQuantityByDay;
-  const [
-    workspaceCreditMicros,
-    priorWorkspaceCreditMicros,
-    warmSeconds,
-    priorWarmSeconds,
-    modelRows,
-    priorModelRows,
-    factDays,
-    warmDays,
-    costDays,
-    warmGroups,
-    liveWarm,
-    rootDrivers,
-    scheduleFacts,
-    tasks,
-    depth,
-    floorRows,
-    machinesOnline,
-    billableTokensUsed,
-    agentRunsUsed,
-    facets,
-    recentCalls,
-    promptContributions
-  ] = await Promise.all([
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.cost",
-      since: window.since,
-      until: window.until
-    }),
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.cost",
-      since: window.priorSince,
-      until: window.priorUntil
-    }),
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "sandbox.warm_seconds",
-      since: window.since,
-      until: window.until
-    }),
-    sumUsageQuantityInRange(db, {
-      workspaceId: input.workspaceId,
-      eventType: "sandbox.warm_seconds",
-      since: window.priorSince,
-      until: window.priorUntil
-    }),
-    aggregateModelCallFacts(db, {
+  const [modelBundle, usageBundle, liveWarm, tasks, depth, floorRows, machinesOnline] = await Promise.all([
+    readWorkspaceInsightsModelBundle(db, {
       workspaceId: input.workspaceId,
       since: window.since,
       until: window.until,
+      priorSince: window.priorSince,
+      priorUntil: window.priorUntil,
+      granularity: input.range === "today" ? "hour" : "day",
       ...filter
     }),
-    aggregateModelCallFacts(db, {
-      workspaceId: input.workspaceId,
-      since: window.priorSince,
-      until: window.priorUntil,
-      ...filter
-    }),
-    aggregateFactsForSeries(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter
-    }),
-    sumUsageForSeries(db, {
-      workspaceId: input.workspaceId,
-      eventType: "sandbox.warm_seconds",
-      since: window.since,
-      until: window.until
-    }),
-    sumUsageForSeries(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.cost",
-      since: window.since,
-      until: window.until
-    }),
-    aggregateWarmSecondsByGroup(db, {
+    readWorkspaceInsightsUsageBundle(db, {
       workspaceId: input.workspaceId,
       since: window.since,
       until: window.until,
-      limit: 24
+      priorSince: window.priorSince,
+      priorUntil: window.priorUntil,
+      monthSince: startOfUtcMonth2(now),
+      granularity: input.range === "today" ? "hour" : "day",
+      warmGroupLimit: 24
     }),
     listLiveWarmLeases(db, input.workspaceId),
-    aggregateRootSessionDrivers(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-      limit: 8
-    }),
-    aggregateScheduleFacts(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter
-    }),
     listScheduledTasks(db, input.workspaceId, 100),
     aggregateSessionDepth(db, input.workspaceId),
     listFloorSessions(db, input.workspaceId, 24),
-    settings.sandboxSelfhostedEnabled ? countOnlineMachines(db, input.workspaceId, MACHINE_HEARTBEAT_FRESH_MS, now) : Promise.resolve(0),
-    sumUsageQuantity2(db, {
-      workspaceId: input.workspaceId,
-      eventType: "model.tokens",
-      since: startOfUtcMonth2(now)
-    }),
-    sumUsageQuantity2(db, {
-      workspaceId: input.workspaceId,
-      eventType: "agent_run.created",
-      since: startOfUtcMonth2(now)
-    }),
-    listModelCallFacets(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until
-    }),
-    listRecentModelCalls(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter,
-      limit: 50
-    }),
-    aggregateModelContextContributions(db, {
-      workspaceId: input.workspaceId,
-      since: window.since,
-      until: window.until,
-      ...filter
-    })
+    settings.sandboxSelfhostedEnabled ? countOnlineMachines(db, input.workspaceId, MACHINE_HEARTBEAT_FRESH_MS, now) : Promise.resolve(0)
   ]);
-  const [priorRootDrivers, attached, fireCounts] = await Promise.all([
-    // Exact prior costs for the current top drivers — never a separate top-N page that
-    // drops roots and invents +$full as "new" spend.
-    aggregateRootSessionDrivers(db, {
-      workspaceId: input.workspaceId,
-      since: window.priorSince,
-      until: window.priorUntil,
-      ...filter,
-      rootSessionIds: rootDrivers.map((row) => row.rootSessionId)
-    }),
+  const {
+    modelRows,
+    priorModelRows,
+    factBuckets: factDays,
+    rootDrivers,
+    priorRootDrivers,
+    scheduleFacts,
+    facets,
+    recentCalls,
+    promptContributions
+  } = modelBundle;
+  const {
+    workspaceCreditMicros,
+    priorWorkspaceCreditMicros,
+    warmSeconds,
+    priorWarmSeconds,
+    buckets: usageBuckets,
+    warmGroups,
+    billableTokensUsed,
+    agentRunsUsed
+  } = usageBundle;
+  const [attached, fireCounts] = await Promise.all([
     countSessionsAttachedToGroups(
       db,
       input.workspaceId,
@@ -10546,13 +10541,13 @@ async function getWorkspaceInsights(db, settings, input) {
       cacheKnownCalls: 0,
       calls: 0
     };
-    const modelCostMicros = modelFilterActive ? facts.costMicros : costDays.get(bucket) ?? facts.costMicros;
+    const modelCostMicros = modelFilterActive ? facts.costMicros : usageBuckets.get(bucket)?.costMicros ?? facts.costMicros;
     return {
       label: input.range === "today" ? bucket.slice(11) : bucket.slice(5),
       modelCostUsd: microsToUsd(modelCostMicros),
       estimatedProviderUsd: microsToUsd(facts.estimatedProviderCostMicros),
       estimatedProviderCostKnownCalls: facts.estimatedProviderCostKnownCalls,
-      warmSeconds: warmDays.get(bucket) ?? 0,
+      warmSeconds: usageBuckets.get(bucket)?.warmSeconds ?? 0,
       inputTokens: facts.inputTokens,
       outputTokens: facts.outputTokens,
       cachedTokens: facts.cachedTokens,
@@ -10579,7 +10574,7 @@ async function getWorkspaceInsights(db, settings, input) {
     return {
       id: `root:${row.rootSessionId}`,
       groupBy: "root_session",
-      label: row.title?.trim() || row.rootSessionId.slice(0, 8),
+      label: insightsSessionLabel({ id: row.rootSessionId, title: row.title, depth: 0 }),
       creditUsd,
       estimatedProviderUsd: microsToUsd(row.estimatedProviderCostMicros),
       estimatedProviderCostKnownCalls: row.estimatedProviderCostKnownCalls,
@@ -10611,7 +10606,11 @@ async function getWorkspaceInsights(db, settings, input) {
     return row.model === model;
   }).map((row) => ({
     id: row.id,
-    title: row.title?.trim() || "Untitled session",
+    title: insightsSessionLabel({
+      id: row.id,
+      title: row.title,
+      depth: row.nestedAgentDepth
+    }),
     state: floorState(row),
     depth: row.nestedAgentDepth,
     model: row.model,
@@ -10644,7 +10643,11 @@ async function getWorkspaceInsights(db, settings, input) {
       occurredAt: row.occurredAt.toISOString(),
       recordedAt: row.recordedAt.toISOString(),
       sessionId: row.sessionId,
-      sessionTitle: row.sessionTitle?.trim() || "Untitled session",
+      sessionTitle: insightsSessionLabel({
+        id: row.sessionId,
+        title: row.sessionTitle,
+        depth: row.sessionDepth
+      }),
       turnId: row.turnId,
       provider: row.provider,
       providerApi: row.providerApi,
@@ -10701,7 +10704,11 @@ async function getWorkspaceInsights(db, settings, input) {
     sessionsTouched: depth.sessionsTouched,
     rootSessions: depth.rootSessions,
     deepestDepth: depth.deepestDepth,
-    deepestSessionTitle: depth.deepestSessionTitle || "",
+    deepestSessionTitle: depth.deepestSessionId ? insightsSessionLabel({
+      id: depth.deepestSessionId,
+      title: depth.deepestSessionTitle,
+      depth: depth.deepestDepth
+    }) : "",
     avgDepth: Math.round(depth.avgDepth * 10) / 10,
     warmIdleNow: liveWarm.filter((lease) => lease.turnHolders === 0).length,
     billableTokensUsed,
@@ -11640,6 +11647,7 @@ import {
   getWorkspaceInstructionPolicyBaseline,
   getWorkspaceKnowledgeChangeProposalSummary,
   getWorkspaceKnowledgeClaimInitiatingHuman,
+  materializeConfirmedRememberKnowledgeMemory,
   nestedPostgresSqlState as nestedPostgresSqlState3,
   rebaselineWorkspaceInstructionPolicyKnowledgeProposal
 } from "@opengeni/db";
@@ -11783,6 +11791,7 @@ function createRememberRouter(options) {
   const rebaselineProposal = options.rebaselineProposal ?? rebaselineWorkspaceInstructionPolicyKnowledgeProposal;
   const activateHumanConfirmed = options.activateHumanConfirmed ?? activateHumanConfirmedLearningDecision;
   const confirmKnowledgeClaim = options.confirmKnowledgeClaim ?? confirmRememberKnowledgeClaim;
+  const materializeKnowledgeMemory = options.materializeKnowledgeMemory ?? materializeConfirmedRememberKnowledgeMemory;
   const proposalSummary = options.proposalSummary ?? getWorkspaceKnowledgeChangeProposalSummary;
   const claimInitiatingHuman = options.claimInitiatingHuman ?? getWorkspaceKnowledgeClaimInitiatingHuman;
   const instructionPolicyBaseline = options.instructionPolicyBaseline ?? getWorkspaceInstructionPolicyBaseline;
@@ -11832,7 +11841,11 @@ function createRememberRouter(options) {
         scope: request.scope
       };
       if (route.decision === "blocked" || route.write === null) {
-        return RememberReceipt.parse({ ...base, status: "blocked", reason: "learning_policy_off" });
+        return RememberReceipt.parse({
+          ...base,
+          status: "blocked",
+          reason: "learning_policy_off"
+        });
       }
       if (route.write.knowledgeChangeProposalId === null) {
         return RememberReceipt.parse({
@@ -11888,19 +11901,27 @@ function createRememberRouter(options) {
         if (!initiatingHuman) {
           throw new RememberError("proposal_unavailable", "The remember claim is not available");
         }
-        const receipt2 = await confirmKnowledgeClaim(options.db, {
-          caller: {
-            workspaceId: attempt.workspaceId,
-            subjectId: initiatingHuman,
-            sessionId: attempt.sessionId,
-            turnId: attempt.turnId,
-            executionGeneration: attempt.executionGeneration
-          },
-          request: {
-            operationId: request.operationId,
-            claimId: request.claimId,
-            humanInputRequestId: request.humanInputRequestId
-          }
+        const { receipt: receipt2, materialization } = await options.db.transaction(async (tx) => {
+          const transaction = tx;
+          const activationReceipt = await confirmKnowledgeClaim(transaction, {
+            caller: {
+              workspaceId: attempt.workspaceId,
+              subjectId: initiatingHuman,
+              sessionId: attempt.sessionId,
+              turnId: attempt.turnId,
+              executionGeneration: attempt.executionGeneration
+            },
+            request: {
+              operationId: request.operationId,
+              claimId: request.claimId,
+              humanInputRequestId: request.humanInputRequestId
+            }
+          });
+          const materializedMemory = await materializeKnowledgeMemory(
+            transaction,
+            activationReceipt
+          );
+          return { receipt: activationReceipt, materialization: materializedMemory };
         });
         return RememberConfirmReceipt.parse({
           status: "activated",
@@ -11912,10 +11933,11 @@ function createRememberRouter(options) {
             destination: "knowledge",
             receiptId: receipt2.id,
             claimId: receipt2.claimId,
+            memoryId: materialization.memoryId,
             approvalReviewId: receipt2.approvalReviewId,
             effectiveAt: receipt2.createdAt,
             authorityKind: "human_confirmed",
-            undo: "knowledge_review"
+            undo: "memory_management"
           }
         });
       }
@@ -13063,7 +13085,8 @@ function organizationMembershipHttpStatus(sqlState) {
   if (sqlState === "22023" || sqlState === "23514") return 400;
   if (sqlState === "42501") return 403;
   if (sqlState === "P0002") return 404;
-  if (sqlState === "23505" || sqlState === "40001" || sqlState === "55000") return 409;
+  if (sqlState === "23505" || sqlState === "40001" || sqlState === "55000" || sqlState === "55P03")
+    return 409;
   return null;
 }
 
@@ -13075,7 +13098,7 @@ import {
 import {
   getNewSessionDraftInTransaction,
   getEnrollment as getEnrollment3,
-  getRig as getRig5,
+  getRig as getRig6,
   getSandbox as getSandbox4,
   getVariableSet as getVariableSet4,
   NewSessionDraftAccessError,
@@ -13142,17 +13165,30 @@ async function hydrateNewSessionDraft(deps, grant, workspaceId, row) {
     }
   }
   const options = { ...mapped.options };
-  if (options.variableSetId) {
-    if (!hasPermission(grant.permissions, "variable-sets:attach") || !hasPermission(grant.permissions, "variable-sets:use") || !await getVariableSet4(
-      deps.db,
-      { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
-      options.variableSetId
-    )) {
+  const variableSetIds = options.variableSetIds ?? [];
+  if (variableSetIds.length > 0) {
+    const selectionsAuthorized = hasPermission(grant.permissions, "variable-sets:attach") && hasPermission(grant.permissions, "variable-sets:use") && (await Promise.all(
+      variableSetIds.map(
+        (variableSetId) => getVariableSet4(
+          deps.db,
+          { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+          variableSetId
+        )
+      )
+    )).every(Boolean);
+    if (selectionsAuthorized) {
+      options.variableSetIds = variableSetIds;
+      options.variableSetId = variableSetIds[variableSetIds.length - 1];
+    } else {
+      delete options.variableSetIds;
       delete options.variableSetId;
     }
+  } else {
+    delete options.variableSetIds;
+    delete options.variableSetId;
   }
   if (options.rigId) {
-    const rig = await getRig5(deps.db, workspaceId, options.rigId);
+    const rig = await getRig6(deps.db, workspaceId, options.rigId);
     if (!rig?.activeVersion) delete options.rigId;
   }
   if (options.targetSandboxId) {
@@ -14195,7 +14231,10 @@ export {
   TranscriptionServiceError,
   VIDEO_GENERATION_ADAPTER_VERSION,
   VIDEO_GENERATION_MODEL_CATALOG,
+  WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES,
+  WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES,
   WebCryptoEditableArtifactLiveTokens,
+  WorkspaceInsightsFilterValidationError,
   acceptSessionUserMessage,
   acceptSessionUserMessageWithOutcome,
   accessGrantAuthorizationFromContext,
@@ -14344,6 +14383,7 @@ export {
   hashEditableArtifactCreateRequest,
   hashEditableArtifactImportRequest,
   inlinePackSkillInstall,
+  insightsSessionLabel,
   inspectEditableArtifactLiveWireEnvelope,
   isAcceptedMimeType,
   isAuthoritativeGitHubRepositorySelectionError,
@@ -14385,6 +14425,7 @@ export {
   normalizePrReviewPullRequestEvent,
   normalizeResources,
   normalizeVideoGenerationRequest,
+  normalizeWorkspaceInsightsFilter,
   officialMcpRegistryUrl,
   ogatxEditableArtifactMutationIntentCodec,
   openGeniSlackBotMetadata,