@opengeni/db 0.27.11 → 0.28.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.27.11",
+  "version": "0.28.1",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -51,8 +51,8 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.11",
-    "@opengeni/config": "^0.10.14",
-    "@opengeni/contracts": "^0.38.3",
+    "@opengeni/config": "^0.11.0",
+    "@opengeni/contracts": "^0.39.0",
     "@opengeni/network": "^0.2.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"

package/src/index.ts

@@ -21967,7 +21967,6 @@ export async function applyContextCompaction(
     expectedAttemptId: string;
     replacementItems: Array<Record<string, unknown>>;
     summaryItem: Record<string, unknown>;
-    replacementInputTokens: number;
     clearRequestedCompaction?: boolean;
     eventPayload?: Record<string, unknown>;
   },
@@ -22056,7 +22055,10 @@ export async function applyContextCompaction(
         await tx
           .update(schema.sessions)
           .set({
-            lastInputTokens: Math.max(0, Math.floor(input.replacementInputTokens)),
+            // The active model input changed without an ordinary provider call.
+            // Keep this field provider-only and let the first successful
+            // post-compaction response install the next authoritative count.
+            lastInputTokens: null,
             ...(input.clearRequestedCompaction ? { compactRequested: false } : {}),
             ...(insertedEvents.length > 0
               ? {
@@ -22279,8 +22281,9 @@ export async function nextSessionHistoryPosition(
 }
 
 /**
- * Record the actual input-token count of the most recent turn's final model
- * call, for the next turn's pre-read compaction trigger.
+ * Replace the input-token count for the most recent authoritative terminal
+ * response. Null means that response supplied no usable final-call count, so
+ * the next turn must not reuse an older response's value for compaction.
  */
 export async function setSessionLastInputTokensForTurnAttempt(
   db: Database,
@@ -22290,7 +22293,7 @@ export async function setSessionLastInputTokensForTurnAttempt(
     turnId: string;
     expectedExecutionGeneration: number;
     expectedAttemptId: string;
-    lastInputTokens: number;
+    lastInputTokens: number | null;
   },
 ): Promise<boolean> {
   return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
@@ -22348,8 +22351,8 @@ export class SessionContextBusyError extends Error {
  *      reserved for an approval that paused mid-turn, and the API forbids a
  *      clear while such an approval or active turn exists.
  *
- * Also resets last_input_tokens to 0 so the next turn's compaction trigger
- * starts fresh against the now-short context.
+ * Also clears last_input_tokens because no provider has observed the new
+ * context yet.
  *
  * Idempotent: a re-run supersedes the (now sole, already-marker) active row,
  * inserts another marker at the next position. The post-condition (one active
@@ -22441,7 +22444,7 @@ export async function clearSessionContext(
 
         await tx
           .update(schema.sessions)
-          .set({ lastInputTokens: 0, updatedAt: new Date() })
+          .set({ lastInputTokens: null, updatedAt: new Date() })
           .where(
             and(
               eq(schema.sessions.workspaceId, input.workspaceId),
@@ -29167,67 +29170,87 @@ async function verifyWorkspaceMutationSettlementForAuthority(
   },
 ): Promise<void> {
   const operation = normalizeWorkspaceMutationOperation(input.operation);
-  const settlement: SandboxWorkspaceMutationSettlementResult = await withRlsContext(
-    db,
+  const settleOnce = async (): Promise<SandboxWorkspaceMutationSettlementResult> =>
+    await withRlsContext(
+      db,
+      {
+        accountId: authorityInput.accountId,
+        workspaceId: authorityInput.workspaceId,
+      },
+      async (scopedDb) =>
+        await scopedDb.transaction(async (txRaw) => {
+          const tx = txRaw as unknown as Database;
+          // Admission and settlement must take the same canonical ownership
+          // prefix before either touches the lease. The former order
+          // (admission row -> authority -> lease) deadlocked a completed
+          // parallel exec settlement against retained-process promotion
+          // (admission row -> lease -> authority). PostgreSQL then rolled
+          // back the losing admission settlement and permanently blocked
+          // checkpoint capture.
+          //
+          // Preserve physical-settlement semantics when mutable authority
+          // is stale: retain the typed fence, settle the exact immutable
+          // admission below, commit, and only then reject its output.
+          let authority: LockedWorkspaceMutationAuthority | null = null;
+          let authorityFailure: SandboxWorkspaceMutationSettlementResult | null = null;
+          try {
+            authority = await lockWorkspaceMutationAuthorityTx(tx, authorityInput);
+          } catch (error) {
+            const failure = workspaceMutationAuthorityFailure(error);
+            if (!failure) throw error;
+            authorityFailure = failure;
+          }
+
+          const actorKind = authorityInput.kind;
+          const actorId =
+            authorityInput.kind === "turn"
+              ? authorityInput.attemptId
+              : authorityInput.kind === "direct"
+                ? authorityInput.requestId
+                : authorityInput.processId;
+          const admission = await selectExactAdmissionForUpdate(tx, {
+            accountId: authorityInput.accountId,
+            workspaceId: authorityInput.workspaceId,
+            admissionId: input.admission.id,
+            actorKind,
+            actorId,
+            sessionId: authorityInput.sessionId,
+            admittedWorkspaceGeneration: input.admission.workspaceGeneration,
+            operation,
+          });
+          if (
+            !admission ||
+            !admissionMatchesSnapshot(admission, input.admission) ||
+            !admissionSnapshotMatchesAuthorityInput(input.admission, authorityInput) ||
+            admission.provider_outcome === "retained" ||
+            (admission.provider_outcome && admission.provider_outcome !== input.outcome)
+          ) {
+            return {
+              failure: "admission_fenced" as const,
+              detail: "Workspace mutation settlement did not match its exact durable admission",
+            };
+          }
+          if (!admission.settled_at) {
+            await tx.execute(sql`
+              update sandbox_workspace_mutation_admissions set
+                provider_outcome = ${input.outcome}, settled_at = now()
+              where id = ${input.admission.id} and settled_at is null
+            `);
+          }
+          if (input.outcome === "rejected") return { failure: null };
+          if (authorityFailure) return authorityFailure;
+          if (!authority) {
+            throw new Error("Workspace mutation settlement lost its locked authority");
+          }
+          return await verifyResolvedAdmissionAuthority(tx, authority, admission);
+        }),
+    );
+  const settlement = await runIdempotentPersistenceTransaction(
     {
-      accountId: authorityInput.accountId,
-      workspaceId: authorityInput.workspaceId,
+      stage: "sandbox_workspace_mutation_settlement",
+      maxAttempts: 5,
     },
-    async (scopedDb) =>
-      await scopedDb.transaction(async (txRaw) => {
-        const tx = txRaw as unknown as Database;
-        const actorKind = authorityInput.kind;
-        const actorId =
-          authorityInput.kind === "turn"
-            ? authorityInput.attemptId
-            : authorityInput.kind === "direct"
-              ? authorityInput.requestId
-              : authorityInput.processId;
-        const admission = await selectExactAdmissionForUpdate(tx, {
-          accountId: authorityInput.accountId,
-          workspaceId: authorityInput.workspaceId,
-          admissionId: input.admission.id,
-          actorKind,
-          actorId,
-          sessionId: authorityInput.sessionId,
-          admittedWorkspaceGeneration: input.admission.workspaceGeneration,
-          operation,
-        });
-        if (
-          !admission ||
-          !admissionMatchesSnapshot(admission, input.admission) ||
-          !admissionSnapshotMatchesAuthorityInput(input.admission, authorityInput) ||
-          admission.provider_outcome === "retained" ||
-          (admission.provider_outcome && admission.provider_outcome !== input.outcome)
-        ) {
-          return {
-            failure: "admission_fenced" as const,
-            detail: "Workspace mutation settlement did not match its exact durable admission",
-          };
-        }
-        if (!admission.settled_at) {
-          await tx.execute(sql`
-            update sandbox_workspace_mutation_admissions set
-              provider_outcome = ${input.outcome}, settled_at = now()
-            where id = ${input.admission.id} and settled_at is null
-          `);
-        }
-        if (input.outcome === "rejected") return { failure: null };
-        // The provider has already returned. Lock and settle its immutable
-        // admission before consulting mutable turn/route/process authority, so
-        // a stale-authority rejection cannot roll the physical settlement back
-        // and strand archive capture. Only authority-fence errors are converted
-        // to a post-commit rejection; database failures still abort normally.
-        let authority: LockedWorkspaceMutationAuthority;
-        try {
-          authority = await lockWorkspaceMutationAuthorityTx(tx, authorityInput);
-        } catch (error) {
-          const failure = workspaceMutationAuthorityFailure(error);
-          if (failure) return failure;
-          throw error;
-        }
-        return await verifyResolvedAdmissionAuthority(tx, authority, admission);
-      }),
+    settleOnce,
   );
   if (settlement.failure !== null) {
     throw new SandboxWorkspaceMutationFencedError(settlement.failure, settlement.detail);
@@ -29426,6 +29449,19 @@ export async function retainWorkspaceMutationProcess(
     async (scopedDb) =>
       await scopedDb.transaction(async (txRaw) => {
         const tx = txRaw as unknown as Database;
+        // Use the same ownership prefix as mutation admission and settlement.
+        // A stale authority still cannot strand a provider process: remember
+        // the fence, durably promote the exact process, then reject its output
+        // after this transaction commits.
+        let authority: LockedWorkspaceMutationAuthority | null = null;
+        let authorityFailure: SandboxWorkspaceMutationSettlementResult | null = null;
+        try {
+          authority = await lockWorkspaceMutationAuthorityTx(tx, authorityInput);
+        } catch (error) {
+          const failure = workspaceMutationAuthorityFailure(error);
+          if (!failure) throw error;
+          authorityFailure = failure;
+        }
         const actorKind = authorityInput.kind;
         const actorId =
           authorityInput.kind === "turn" ? authorityInput.attemptId : authorityInput.requestId;
@@ -29586,16 +29622,13 @@ export async function retainWorkspaceMutationProcess(
         }
 
         // A yielded provider process is already a physical outcome. Persist its
-        // exact route and non-TTL holder before consulting mutable authority, so
-        // a route/turn race cannot leave an untracked process or open parent
-        // admission. Report staleness only after this transaction commits.
-        let authority: LockedWorkspaceMutationAuthority;
-        try {
-          authority = await lockWorkspaceMutationAuthorityTx(tx, authorityInput);
-        } catch (error) {
-          const failure = workspaceMutationAuthorityFailure(error);
-          if (failure) return { process: mapRetainedProcess(process!), failure };
-          throw error;
+        // exact route and non-TTL holder even when the earlier authority check
+        // found a stale route/turn, then report staleness after commit.
+        if (authorityFailure) {
+          return { process: mapRetainedProcess(process!), failure: authorityFailure };
+        }
+        if (!authority) {
+          throw new Error("Retained process promotion lost its locked authority");
         }
         const identity = await verifyResolvedAdmissionAuthority(tx, authority, admission);
         return { process: mapRetainedProcess(process!), failure: identity };
@@ -39494,8 +39527,10 @@ export async function peekSessionWork(
         attemptId: interruption.attemptId,
       };
     }
-    if (effectiveControl.state !== "active") return { kind: "idle" };
-
+    // Physical quiescence finishes an already-accepted interruption; it is not
+    // new session work. Reconcile the missing receipt even while control stays
+    // paused, otherwise the pause itself can strand this session and every
+    // ancestor behind a permanent `settlement: stopping` projection.
     const awaitingQuiescence = await nextSessionAttemptAwaitingQuiescence(
       scopedDb,
       workspaceId,
@@ -39508,6 +39543,8 @@ export async function peekSessionWork(
       };
     }
 
+    if (effectiveControl.state !== "active") return { kind: "idle" };
+
     const [capacityWait] = await scopedDb
       .select()
       .from(schema.codexCapacityWaiters)
@@ -45137,3 +45174,4 @@ export {
 } from "./connection-token-resolver";
 
 export * from "./workspace-artifacts";
+export * from "./transcription-recordings";

package/src/runtime-posture.ts

@@ -118,6 +118,10 @@ export const FORCE_RLS_TABLES = [
   "slack_interactions",
   "social_connections",
   "social_posts",
+  "transcription_recording_chunks",
+  "transcription_recording_objects",
+  "transcription_recording_segments",
+  "transcription_recordings",
   "usage_events",
   "workspace_artifact_events",
   "workspace_artifact_versions",
@@ -248,6 +252,10 @@ export const RUNTIME_FULL_DML_TABLES = [
   "social_connections",
   "social_posts",
   "stripe_webhook_events",
+  "transcription_recording_chunks",
+  "transcription_recording_objects",
+  "transcription_recording_segments",
+  "transcription_recordings",
   "usage_events",
   "workspace_artifacts",
   "workspace_captures",

package/src/schema.ts

@@ -1499,10 +1499,9 @@ export const sessions = pgTable(
     nestedAgentDepthPolicySessionId: uuid("nested_agent_depth_policy_session_id"),
     temporalWorkflowId: text("temporal_workflow_id"),
     activeTurnId: uuid("active_turn_id"),
-    // Actual input tokens reported for the last model call of the most recent
-    // turn. The pre-turn portable compaction trigger reads this as its budget
-    // signal (char/4 estimate is the same-turn fallback). Null until a turn with
-    // usage has completed.
+    // Actual input tokens reported for the latest authoritative ordinary model
+    // call. Compaction/context clearing invalidates it to null; local history
+    // estimates must never be stored here.
     lastInputTokens: integer("last_input_tokens"),
     // Operator /compact request flag. The API sets
     // it true; the worker honors it BEFORE the next turn's model call by forcing
@@ -6037,3 +6036,4 @@ export * from "./workspace-instruction-policies-schema";
 export * from "./preference-registry-schema";
 export * from "./memory-governance-schema";
 export * from "./scoped-knowledge-schema";
+export * from "./transcription-recordings-schema";

package/src/transcription-recordings-schema.ts

@@ -0,0 +1,250 @@
+import { sql } from "drizzle-orm";
+import {
+  boolean,
+  check,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+
+export const transcriptionRecordingStateValues = [
+  "uploading",
+  "segmenting",
+  "ready",
+  "transcribing",
+  "complete",
+  "failed",
+  "discarded",
+] as const;
+
+export const transcriptionRecordingChunkStateValues = ["uploading", "complete"] as const;
+export const transcriptionRecordingObjectKindValues = ["chunk", "segment"] as const;
+
+export const transcriptionRecordingSegmentStateValues = [
+  "preparing",
+  "pending",
+  "transcribing",
+  "complete",
+  "failed",
+] as const;
+
+export const transcriptionRecordings = pgTable(
+  "transcription_recordings",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    mimeType: text("mime_type").notNull(),
+    state: text("state", { enum: transcriptionRecordingStateValues })
+      .notNull()
+      .default("uploading"),
+    nextChunkNumber: integer("next_chunk_number").notNull().default(0),
+    chunkCount: integer("chunk_count").notNull().default(0),
+    totalBytes: integer("total_bytes").notNull().default(0),
+    totalDurationMilliseconds: integer("total_duration_milliseconds").notNull().default(0),
+    segmentCount: integer("segment_count").notNull().default(0),
+    completedSegmentCount: integer("completed_segment_count").notNull().default(0),
+    transcriptText: text("transcript_text"),
+    languages: jsonb("languages").$type<string[]>().notNull().default([]),
+    errorCode: text("error_code"),
+    retryable: boolean("retryable").notNull().default(false),
+    providerId: text("provider_id"),
+    processingGeneration: integer("processing_generation").notNull().default(0),
+    processingOwner: uuid("processing_owner"),
+    processingStartedAt: timestamp("processing_started_at", { withTimezone: true }),
+    objectsCleanedAt: timestamp("objects_cleaned_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  },
+  (table) => ({
+    exactAuthority: uniqueIndex("transcription_recordings_exact_authority_uq").on(
+      table.accountId,
+      table.workspaceId,
+      table.subjectId,
+      table.id,
+    ),
+    subjectCreated: index("transcription_recordings_subject_created_idx").on(
+      table.workspaceId,
+      table.subjectId,
+      table.createdAt,
+    ),
+    expiry: index("transcription_recordings_expiry_idx").on(table.expiresAt, table.id),
+    valuesValid: check(
+      "transcription_recordings_values_check",
+      sql`${table.nextChunkNumber} >= 0
+        and ${table.chunkCount} >= 0
+        and ${table.totalBytes} >= 0
+        and ${table.totalDurationMilliseconds} >= 0
+        and ${table.segmentCount} >= 0
+        and ${table.completedSegmentCount} >= 0
+        and ${table.completedSegmentCount} <= ${table.segmentCount}
+        and octet_length(${table.subjectId}) between 1 and 1024
+        and octet_length(${table.mimeType}) between 1 and 128
+        and (
+          ${table.providerId} is null
+          or octet_length(${table.providerId}) between 1 and 128
+        )`,
+    ),
+    processingValid: check(
+      "transcription_recordings_processing_check",
+      sql`(
+          ${table.processingOwner} is null
+          and ${table.processingStartedAt} is null
+        ) or (
+          ${table.processingOwner} is not null
+          and ${table.processingStartedAt} is not null
+        )`,
+    ),
+  }),
+);
+
+export const transcriptionRecordingObjects = pgTable(
+  "transcription_recording_objects",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    recordingId: uuid("recording_id").notNull(),
+    objectKey: text("object_key").primaryKey(),
+    kind: text("kind", { enum: transcriptionRecordingObjectKindValues }).notNull(),
+    cleanupAfter: timestamp("cleanup_after", { withTimezone: true }).notNull(),
+    cleanupClaimId: uuid("cleanup_claim_id"),
+    cleanupClaimedAt: timestamp("cleanup_claimed_at", { withTimezone: true }),
+    cleanedAt: timestamp("cleaned_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    dueCleanup: index("transcription_recording_objects_due_cleanup_idx")
+      .on(table.cleanupAfter, table.objectKey)
+      .where(sql`${table.cleanedAt} is null`),
+    claimRecovery: index("transcription_recording_objects_claim_recovery_idx")
+      .on(table.cleanupClaimedAt, table.objectKey)
+      .where(sql`${table.cleanedAt} is null and ${table.cleanupClaimId} is not null`),
+    valuesValid: check(
+      "transcription_recording_objects_values_check",
+      sql`octet_length(${table.objectKey}) between 1 and 1024
+        and (
+          (${table.cleanupClaimId} is null and ${table.cleanupClaimedAt} is null)
+          or (${table.cleanupClaimId} is not null and ${table.cleanupClaimedAt} is not null)
+        )
+        and (
+          ${table.cleanedAt} is null
+          or (${table.cleanupClaimId} is null and ${table.cleanupClaimedAt} is null)
+        )`,
+    ),
+  }),
+);
+
+export const transcriptionRecordingChunks = pgTable(
+  "transcription_recording_chunks",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    recordingId: uuid("recording_id").notNull(),
+    chunkNumber: integer("chunk_number").notNull(),
+    state: text("state", { enum: transcriptionRecordingChunkStateValues })
+      .notNull()
+      .default("uploading"),
+    byteLength: integer("byte_length").notNull(),
+    sha256: text("sha256").notNull(),
+    startMilliseconds: integer("start_milliseconds").notNull(),
+    durationMilliseconds: integer("duration_milliseconds").notNull(),
+    objectKey: text("object_key").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+  },
+  (table) => ({
+    pk: primaryKey({
+      name: "transcription_recording_chunks_pk",
+      columns: [table.recordingId, table.chunkNumber],
+    }),
+    recordingOrder: index("transcription_recording_chunks_order_idx").on(
+      table.workspaceId,
+      table.recordingId,
+      table.chunkNumber,
+    ),
+    objectKey: uniqueIndex("transcription_recording_chunks_object_key_uq").on(table.objectKey),
+    valuesValid: check(
+      "transcription_recording_chunks_values_check",
+      sql`${table.chunkNumber} >= 0
+        and ${table.byteLength} > 0
+        and ${table.startMilliseconds} >= 0
+        and ${table.durationMilliseconds} >= 0
+        and ${table.sha256} ~ '^[0-9a-f]{64}$'
+        and octet_length(${table.objectKey}) between 1 and 1024
+        and (
+          (${table.state} = 'uploading' and ${table.completedAt} is null)
+          or (${table.state} = 'complete' and ${table.completedAt} is not null)
+        )`,
+    ),
+  }),
+);
+
+export const transcriptionRecordingSegments = pgTable(
+  "transcription_recording_segments",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    recordingId: uuid("recording_id").notNull(),
+    segmentNumber: integer("segment_number").notNull(),
+    generation: integer("generation").notNull(),
+    state: text("state", { enum: transcriptionRecordingSegmentStateValues })
+      .notNull()
+      .default("preparing"),
+    byteLength: integer("byte_length").notNull(),
+    sha256: text("sha256").notNull(),
+    startMilliseconds: integer("start_milliseconds").notNull(),
+    durationMilliseconds: integer("duration_milliseconds").notNull(),
+    objectKey: text("object_key").notNull(),
+    attemptId: uuid("attempt_id"),
+    attemptStartedAt: timestamp("attempt_started_at", { withTimezone: true }),
+    attemptDeadlineAt: timestamp("attempt_deadline_at", { withTimezone: true }),
+    transcriptText: text("transcript_text"),
+    languages: jsonb("languages").$type<string[]>().notNull().default([]),
+    providerId: text("provider_id"),
+    errorCode: text("error_code"),
+    retryable: boolean("retryable").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({
+      name: "transcription_recording_segments_pk",
+      columns: [table.recordingId, table.segmentNumber],
+    }),
+    recordingOrder: index("transcription_recording_segments_order_idx").on(
+      table.workspaceId,
+      table.recordingId,
+      table.segmentNumber,
+    ),
+    objectKey: uniqueIndex("transcription_recording_segments_object_key_uq").on(table.objectKey),
+    valuesValid: check(
+      "transcription_recording_segments_values_check",
+      sql`${table.segmentNumber} >= 0
+        and ${table.generation} > 0
+        and ${table.byteLength} > 0
+        and ${table.startMilliseconds} >= 0
+        and ${table.durationMilliseconds} > 0
+        and ${table.sha256} ~ '^[0-9a-f]{64}$'
+        and octet_length(${table.objectKey}) between 1 and 1024
+        and (
+          (${table.attemptId} is null
+            and ${table.attemptStartedAt} is null
+            and ${table.attemptDeadlineAt} is null)
+          or (${table.attemptId} is not null
+            and ${table.attemptStartedAt} is not null
+            and ${table.attemptDeadlineAt} is not null)
+        )`,
+    ),
+  }),
+);