@opengeni/db 1.0.1 → 3.1.0-canary.0

package/dist/session-control.d.ts

@@ -55,6 +55,10 @@ export type EffectiveSessionControl = {
         interruptionPendingCount: number;
         quiescencePendingCount: number;
     } | null;
+    backgroundCommandSettlement: {
+        state: "stopping";
+        commandCount: number;
+    } | null;
 };
 export declare const SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS = 200;
 export declare const SESSION_DISCOVERY_CONTROL_TARGET_LIMIT = 100;
@@ -90,6 +94,10 @@ export declare function serializeEffectiveSessionControl(control: EffectiveSessi
         interruptionPendingCount: number;
         quiescencePendingCount: number;
     } | null;
+    backgroundCommandSettlement: {
+        state: "stopping";
+        commandCount: number;
+    } | null;
     primaryBlocker: (Omit<EffectiveControlBlocker, "changedAt"> & {
         changedAt: string | null;
     }) | null;
@@ -142,7 +150,118 @@ export declare function assertAgentCommandAuthorityInTransaction(db: Database, i
     action: "pause" | "resume" | "steer" | "message" | "goal";
 }): Promise<void>;
 export declare function canonicalSessionCommandHash(value: unknown): string;
-export declare function lockWorkspaceInferenceControl(db: Database, workspaceId: string, mode: WorkspaceControlLockMode): Promise<WorkspaceControlRow>;
+/**
+ * Default bounded control-prefix wait for request-scoped API mutations (Send,
+ * Steer, queued Steer, Pause/Resume/Cancel, workspace Pause/Resume, realtime
+ * sync). The bound is one budget across every lock step of the admission
+ * (advisory lock, row lock, and the savepoint escalation of a paused branch),
+ * not a per-statement timeout. A request that cannot enter the workspace
+ * control prefix within the budget fails with the typed, retryable
+ * `WorkspaceControlBusyError` before any write instead of holding a pooled
+ * connection and a snapshot for as long as the HTTP client (or ingress) keeps
+ * the socket open. Worker settlement, claims, and event appends never pass a
+ * bound: a legitimate wait there must not become a failed settlement.
+ * The deployment value is `OPENGENI_WORKSPACE_CONTROL_LOCK_TIMEOUT_MS`, parsed
+ * and validated once at boot by `@opengeni/config`
+ * (`settings.workspaceControlLockTimeoutMs`) and handed to this module through
+ * `configureWorkspaceControlRequestLockTimeoutMs` when the API app is built.
+ * This module never reads `process.env` per request.
+ */
+export declare const WORKSPACE_CONTROL_REQUEST_LOCK_TIMEOUT_MS = 20000;
+/**
+ * Install the validated request-scoped budget for this process. The value is
+ * process-global and last-writer-wins: the API calls this exactly once from
+ * its settings at app composition (`createApp`), and every later
+ * `workspaceControlRequestLockTimeoutMs()` read observes that value. Workers
+ * never call it because they never pass a bound. A non-positive or
+ * non-integer value is a programming error here (the config layer already
+ * rejected it at boot).
+ */
+export declare function configureWorkspaceControlRequestLockTimeoutMs(lockTimeoutMs: number): void;
+/** The request-scoped budget in milliseconds currently configured for this process. */
+export declare function workspaceControlRequestLockTimeoutMs(): number;
+export declare class WorkspaceControlBusyError extends Error {
+    readonly workspaceId: string;
+    readonly lockTimeoutMs: number;
+    readonly code = "WORKSPACE_CONTROL_BUSY";
+    constructor(workspaceId: string, lockTimeoutMs: number);
+}
+/**
+ * One wall-clock budget shared by every lock step of one control-prefix
+ * acquisition. Each step sets `lock_timeout` to the remaining budget, so the
+ * total wait never exceeds the requested bound even when the advisory lock,
+ * the row lock, and a savepoint escalation each wait in turn.
+ */
+export type WorkspaceControlLockBudget = {
+    readonly totalMs: number;
+    readonly deadlineAt: number;
+};
+export declare function workspaceControlLockBudget(lockTimeoutMs: number): WorkspaceControlLockBudget;
+export type WorkspaceControlLockOptions = {
+    /**
+     * Bound the whole prefix acquisition in milliseconds. Omit for
+     * worker/lifecycle writers. The previous `lock_timeout` is restored once the
+     * prefix is held.
+     */
+    lockTimeoutMs?: number;
+    /** Share an already running budget (used by the admission helper). */
+    budget?: WorkspaceControlLockBudget;
+};
+/**
+ * Lock the mandatory workspace inference-control row.
+ *
+ * `share` and `update` first take a transaction-scoped advisory lock on
+ * `hashtextextended('workspace-control:<workspace id>', 0)` in the matching
+ * mode and only then the row lock. The advisory lock is what makes the prefix
+ * fair: PostgreSQL row locks let a new FOR SHARE requester join a share-locked
+ * tuple without queueing behind an already waiting FOR UPDATE, so under
+ * continuous share traffic (claims, settlement, appends across many sessions)
+ * a genuine control mutation can starve indefinitely. Heavyweight locks have a
+ * FIFO wait queue: a shared request conflicts with a waiting exclusive request
+ * and queues behind it, so a mutator waits only for the holders that preceded
+ * it, and sharers keep flowing between mutations. The row lock is retained
+ * unchanged for FK/consistency semantics and for SQL-function writers that
+ * lock the row directly (session-create triggers and capability functions).
+ *
+ * Invariant: a transaction that locks this row through any other path (a
+ * SECURITY DEFINER function, a trigger, raw SQL) must already hold the prefix
+ * through this helper or must never call this helper afterwards for the same
+ * workspace. Requesting the advisory lock after holding the row lock can
+ * deadlock against a mutator that holds the advisory lock and waits for the
+ * row. Every current SQL-function locker either runs in its own transaction or
+ * runs after this helper in the same transaction.
+ */
+export declare function lockWorkspaceInferenceControl(db: Database, workspaceId: string, mode: WorkspaceControlLockMode, options?: WorkspaceControlLockOptions): Promise<WorkspaceControlRow>;
+export type WorkspaceControlAdmissionLock = {
+    control: WorkspaceControlRow;
+    mode: "share" | "update";
+};
+/**
+ * Lock the workspace control prefix for an admission. Callers that may resume
+ * a paused branch request escalation; inert queue admission stays shared.
+ *
+ * The common case (the target branch is active) holds only `FOR SHARE`. That
+ * still excludes every control mutation (Pause/Resume/Cancel, workspace
+ * control, auto-resume all take `FOR UPDATE`), so the effective state observed
+ * here cannot change for the rest of the transaction, while other Sends,
+ * Steers, claims, and event appends on the workspace proceed concurrently.
+ *
+ * When the branch is paused the admission must advance the workspace control
+ * revision, so it needs `FOR UPDATE`. Upgrading in place would deadlock as soon
+ * as two sharers decide to upgrade together (each waits for the other's share
+ * lock), so the shared prefix is taken inside a savepoint and rolled back
+ * before the exclusive prefix is requested: PostgreSQL releases row locks and
+ * transaction-level advisory locks acquired inside a rolled-back savepoint, so
+ * the exclusive request queues normally behind other holders.
+ *
+ * Callers that already hold the prefix exclusively (for example a realtime
+ * sync that admitted a delegation) simply observe their own stronger lock.
+ */
+export declare function lockWorkspaceInferenceControlForAdmission(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    resumePausedBranch: boolean;
+} & WorkspaceControlLockOptions): Promise<WorkspaceControlAdmissionLock>;
 export type SessionEventWriteLockInput = {
     workspaceId: string;
     /**
@@ -167,12 +286,19 @@ export type SessionEventWriteLocks = {
 /**
  * Establish the one canonical lock prefix for every `session_events` writer:
  *
- *   workspace_inference_controls (when control-aware)
+ *   workspace-control advisory lock + workspace_inference_controls row
+ *     (when control-aware; see `lockWorkspaceInferenceControl`)
  *     -> actual workspaces row FOR KEY SHARE
  *     -> session rows FOR NO KEY UPDATE, UUID ordered
  *     -> exact turn rows FOR UPDATE, UUID ordered
  *     -> exact attempt rows FOR UPDATE, UUID ordered
  *
+ * Control-aware writers that do not mutate the control row take it `share`;
+ * only genuine control mutations (Pause/Resume/Cancel, workspace control,
+ * auto-resume, settings narrowing, quiescent tree deletion) take `update`.
+ * Prompt admission declares whether it may resume a paused branch through
+ * `lockWorkspaceInferenceControlForAdmission`.
+ *
  * `FOR KEY SHARE` is deliberate. Event inserts need the workspace key to remain
  * stable for their FK, but they do not mutate the workspace. The old generic
  * `FOR UPDATE` lock serialized unrelated sessions and inverted the activity
@@ -187,6 +313,11 @@ export type SessionEventWriteLocks = {
  * this helper and may discover exact turn IDs only after locking the session.
  * They use the explicit `already_locked` stages, while retaining the same
  * monotonic table order. New event writers should prefer one complete call.
+ *
+ * Retained-screenshot prepare is not an event writer, but its INSERT still
+ * KEY SHAREs the turn and attempt through FKs. It must take this same prefix
+ * first: PostgreSQL fires those FK checks in catalog name/OID order, which can
+ * be attempt-then-turn and otherwise deadlocks against this helper.
  */
 export declare function lockSessionEventWriteRows(db: Database, input: SessionEventWriteLockInput): Promise<SessionEventWriteLocks>;
 export declare function registerSessionTurnAttemptClaim(db: Database, input: {
@@ -203,6 +334,7 @@ export declare function registerSessionTurnAttemptClaim(db: Database, input: {
     authorityEpoch: number;
     authorityVisibility: "user_private" | "workspace_shared";
     authorityOwnerOrganizationMembershipId: string | null;
+    personalResourceProtocolVersion: number;
     mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy>;
     connectorActionPolicies: schema.ConnectorActionPolicySnapshotEntry[];
 }): Promise<typeof schema.sessionTurnAttempts.$inferSelect>;
@@ -314,6 +446,7 @@ export type SessionControlMutationResult = {
     sessionControlEventId: string;
     workspaceControlEventId: string;
     interruptionCount: number;
+    backgroundCommandCount: number;
     wakeCount: number;
     cancelledSessionCount: number;
     cancelledTurnCount: number;
@@ -321,8 +454,16 @@ export type SessionControlMutationResult = {
         sessionId: string;
         eventIds: string[];
     }>;
+    workflowWake: SessionControlWorkflowWake | null;
     replay: boolean;
 };
+export type SessionControlWorkflowWake = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    temporalWorkflowId: string;
+    wakeRevision: number;
+};
 export declare function mutateSessionControlInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
     workspaceId: string;
@@ -332,13 +473,22 @@ export declare function mutateSessionControlInTransaction(db: SessionActivityDat
     action: "pause" | "resume" | "cancel";
     reason?: string | null;
     expectedControlEtag?: string | null;
+    /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
+    controlLockTimeoutMs?: number;
 }): Promise<SessionControlMutationResult>;
 export declare function autoResumeSessionBranchInTransaction(db: SessionActivityDatabase, input: {
     workspaceId: string;
     sessionId: string;
     actor: string;
-    reason: "human_send" | "human_steer" | "service_send" | "service_steer" | "agent_steer";
+    reason: "human_steer" | "service_steer" | "agent_steer";
     observedControlEtag?: string | null;
+    /**
+     * The admission prefix the caller already holds. A `share` admission
+     * proves the branch was active under a lock that excludes every control
+     * mutation, so it never needs to resume; only an `update` admission may
+     * advance the workspace revision here.
+     */
+    admission?: WorkspaceControlAdmissionLock;
 }): Promise<{
     revision: number;
     control: EffectiveSessionControl;
@@ -351,6 +501,7 @@ export type WorkspaceControlMutationResult = {
     workspaceControlEventId: string;
     workspaceState: EffectiveControlState;
     interruptionCount: number;
+    backgroundCommandCount: number;
     wakeCount: number;
     replay: boolean;
 };
@@ -362,4 +513,6 @@ export declare function mutateWorkspaceControlInTransaction(db: Database, input:
     action: "pause" | "resume";
     reason?: string | null;
     expectedRevision?: number | null;
+    /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
+    controlLockTimeoutMs?: number;
 }): Promise<WorkspaceControlMutationResult>;

package/dist/session-goal-pacing.d.ts

@@ -0,0 +1,68 @@
+import type { Database } from "./database.js";
+import * as schema from "./schema.js";
+/** Column reset shared by every goal head mutation that retires a `goal_wait` hold. */
+export declare const SESSION_GOAL_HOLD_CLEARED: {
+    readonly continuationHoldTurnId: null;
+    readonly continuationHoldUntil: null;
+    readonly continuationHoldReason: null;
+    readonly continuationHoldSetAt: null;
+};
+/** The pause reason written when a per-goal or deployment continuation ceiling is reached. */
+export declare const SESSION_GOAL_CAP_PAUSED_REASON = "max_auto_continuations";
+/**
+ * Column reset applied when a goal re-arms: a fresh continuation epoch starts
+ * with zero consecutive no-input continuations and no pointer to a
+ * pre-pause continuation turn.
+ */
+export declare const SESSION_GOAL_CONTINUATION_EPOCH_RESET: {
+    readonly autoContinuations: 0;
+    readonly noProgressStreak: 0;
+    readonly lastContinuationTurnId: null;
+    readonly versionAtLastContinuation: null;
+};
+export type SessionGoalAutoResumeCause = {
+    /** The system-update kind that arrived, or `human_prompt` for a Send/Steer. */
+    kind: string;
+    updateId?: string;
+    turnId?: string;
+};
+export type SessionGoalAutoResumedByExternalInput = {
+    goal: typeof schema.sessionGoals.$inferSelect;
+    /** `goal.resumed` payload the caller appends at its next session sequence. */
+    payload: {
+        goalId: string;
+        text: string;
+        successCriteria?: string;
+        version: number;
+        objectiveRevision: number;
+        mutationPolicy: string;
+        actor: "system";
+        reason: "external_input";
+        cause: SessionGoalAutoResumeCause;
+    };
+};
+/**
+ * Resume a goal that the continuation ceiling paused, because new external
+ * input arrived. The ceiling (`max_auto_continuations`) is pacing for
+ * consecutive no-input continuations, never user intent: a `user_pause`,
+ * `api`, `agent`, or `limits` pause is deliberately left alone and is never
+ * resumed here. Every producer of external input calls this: child results,
+ * scheduled occurrences, and media results (`addSessionSystemUpdate*`), Agent
+ * messages (`sendAgentMessageInTransaction`), Agent Steer
+ * (`steerAgentSessionInTransaction`), and human/API Send/Steer
+ * (`submitHumanPromptInTransaction`).
+ *
+ * Lock contract: the caller already holds the canonical event-write prefix
+ * and the session row (`FOR NO KEY UPDATE`); this helper then takes the goal
+ * row `FOR UPDATE`, the same order every goal tool uses. It mutates only the
+ * goal head and returns the `goal.resumed` payload; the caller must append
+ * that event at its next session sequence inside the SAME transaction so the
+ * goal mutation and its timeline fact remain one session-sequenced commit.
+ * Returns null when the session has no goal or its pause is not the ceiling.
+ */
+export declare function autoResumeGoalPausedByCapInTransaction(tx: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    cause: SessionGoalAutoResumeCause;
+    now: Date;
+}): Promise<SessionGoalAutoResumedByExternalInput | null>;

package/dist/session-queue-commands.d.ts

@@ -1,8 +1,8 @@
-import { ResourceRef, type McpPersonalConnectionDelegation, type DraftTimelineAnnotation, type LatencyMode, type ReasoningEffort, type SessionEvent, type SessionTurn, type TurnExecutionPolicyV1, type TimelineAnnotation } from "@opengeni/contracts";
-import type { Database, SessionActivityDatabase } from "./database.js";
+import { ResourceRef, type McpPersonalConnectionDelegation, type DraftTimelineAnnotation, type LatencyMode, type ReasoningEffort, type SessionEvent, type SessionPromptRouting, type SessionTurn, type TurnExecutionPolicyV1, type TimelineAnnotation, type PersonalResourceAttachmentIntent } from "@opengeni/contracts";
+import { type Database, type SessionActivityDatabase } from "./database.js";
 import { type SessionCommandActor, type SessionCommandReceiptRow } from "./session-control.js";
 import * as schema from "./schema.js";
-export type QueueCommandConflictCode = "QUEUE_VERSION_CHANGED" | "QUEUE_PROMPT_STARTED" | "QUEUE_ANCHOR_CHANGED" | "PROMPT_CHANGED" | "DRAFT_CHANGED" | "DRAFT_NOT_EMPTY" | "EDIT_SOURCE_CHANGED";
+export type QueueCommandConflictCode = "QUEUE_VERSION_CHANGED" | "QUEUE_PROMPT_STARTED" | "QUEUE_ANCHOR_CHANGED" | "PROMPT_CHANGED" | "DRAFT_CHANGED" | "DRAFT_NOT_EMPTY" | "EDIT_SOURCE_CHANGED" | "ONCE_ATTACHMENT_IMMUTABLE";
 export declare class QueueCommandConflictError extends Error {
     readonly code: QueueCommandConflictCode;
     readonly current: {
@@ -32,13 +32,18 @@ export type EditQueueCommandResult = QueueCommandResult & {
 export type SteerQueueCommandResult = QueueCommandResult & {
     interruptionCount: number;
     workspaceControlEventId: string | null;
+    workflowId: string;
+    wakeRevision: number;
 };
 export type SubmitHumanPromptResult = {
     receipt: SessionCommandReceiptRow;
+    routing: SessionPromptRouting;
     queueVersion: number;
     accepted: SessionEvent;
     events: SessionEvent[];
     turn: SessionTurn;
+    /** Current actor/session composer after an exact draft-bound submission. */
+    draft: ComposerDraftRow | null;
     /** Backward-compatible row identities for lower-level callers. */
     acceptedEventId: string;
     eventIds: string[];
@@ -98,7 +103,12 @@ export declare function saveComposerDraftInTransaction(db: Database, input: {
     resources: ResourceRef[];
     model: string;
     reasoningEffort: ReasoningEffort;
-    latencyMode?: LatencyMode;
+    latencyMode: LatencyMode;
+    /**
+     * Bound the workspace control prefix wait (request-scoped API callers pass
+     * `workspaceControlRequestLockTimeoutMs()`); omit for lifecycle callers.
+     */
+    controlLockTimeoutMs?: number;
 }): Promise<ComposerDraftRow>;
 export declare function moveQueuedTurnInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
@@ -109,6 +119,11 @@ export declare function moveQueuedTurnInTransaction(db: SessionActivityDatabase,
     expectedQueueVersion: number;
     actor: SessionCommandActor;
     operationKey: string;
+    /**
+     * Bound the workspace control prefix wait (request-scoped API callers pass
+     * `workspaceControlRequestLockTimeoutMs()`); omit for lifecycle callers.
+     */
+    controlLockTimeoutMs?: number;
 }): Promise<QueueCommandResult>;
 export declare function deleteSessionQueueItemInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
@@ -119,6 +134,11 @@ export declare function deleteSessionQueueItemInTransaction(db: SessionActivityD
     actor: SessionCommandActor;
     operationKey: string;
     reason?: string | null;
+    /**
+     * Bound the workspace control prefix wait (request-scoped API callers pass
+     * `workspaceControlRequestLockTimeoutMs()`); omit for lifecycle callers.
+     */
+    controlLockTimeoutMs?: number;
 }): Promise<QueueCommandResult>;
 export declare function editQueuedTurnInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
@@ -131,6 +151,11 @@ export declare function editQueuedTurnInTransaction(db: SessionActivityDatabase,
     replaceDraft: boolean;
     actor: SessionCommandActor;
     operationKey: string;
+    /**
+     * Bound the workspace control prefix wait (request-scoped API callers pass
+     * `workspaceControlRequestLockTimeoutMs()`); omit for lifecycle callers.
+     */
+    controlLockTimeoutMs?: number;
 }): Promise<EditQueueCommandResult>;
 export declare function steerQueuedTurnInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
@@ -141,6 +166,8 @@ export declare function steerQueuedTurnInTransaction(db: SessionActivityDatabase
     controlEtag?: string | null;
     actor: SessionCommandActor;
     operationKey: string;
+    /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
+    controlLockTimeoutMs?: number;
 }): Promise<SteerQueueCommandResult>;
 export declare function submitHumanPromptInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
@@ -175,10 +202,13 @@ export declare function submitHumanPromptInTransaction(db: SessionActivityDataba
     /** Record the admitted run's durable usage fact in this transaction. */
     recordAgentRunUsage?: boolean;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    personalResourceAttachment?: PersonalResourceAttachmentIntent;
     mcpCredentialUpdates?: Array<{
         id: string;
         headersEncrypted: Record<string, string>;
     }>;
+    /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
+    controlLockTimeoutMs?: number;
 }): Promise<SubmitHumanPromptResult>;
 export declare function sendAgentMessageInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
@@ -189,6 +219,11 @@ export declare function sendAgentMessageInTransaction(db: SessionActivityDatabas
     }>;
     operationKey: string;
     text: string;
+    /**
+     * Bound the workspace control prefix wait (request-scoped API callers pass
+     * `workspaceControlRequestLockTimeoutMs()`); omit for lifecycle callers.
+     */
+    controlLockTimeoutMs?: number;
 }): Promise<AgentInternalUpdateCommandResult>;
 export declare function steerAgentSessionInTransaction(db: SessionActivityDatabase, input: {
     accountId: string;
@@ -199,5 +234,7 @@ export declare function steerAgentSessionInTransaction(db: SessionActivityDataba
     }>;
     operationKey: string;
     instruction: string;
+    /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
+    controlLockTimeoutMs?: number;
 }): Promise<AgentInternalUpdateCommandResult>;
 export {};

package/dist/session-realtime-ledger.d.ts

@@ -105,6 +105,8 @@ export type SessionRealtimeInboundEntryInput = {
     modelContext?: string | undefined;
 };
 export type SyncSessionRealtimeLedgerInput = AssertSessionRealtimeOwnerInput & {
+    /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
+    controlLockTimeoutMs?: number;
     connectionId: string;
     connectionEpoch: number;
     entries?: SessionRealtimeInboundEntryInput[] | undefined;

package/dist/session-tenancy.d.ts

@@ -1,5 +1,31 @@
+import { type SessionTenancyBlocker } from "@opengeni/contracts";
 import { type Database } from "./database.js";
+export declare class SessionTenancyConflictError extends Error {
+    readonly reason: "not_quiescent" | "authority_epoch" | "operation_reuse";
+    readonly blocker: SessionTenancyBlocker | null;
+    readonly name = "SessionTenancyConflictError";
+    constructor(reason: "not_quiescent" | "authority_epoch" | "operation_reuse", blocker?: SessionTenancyBlocker | null, options?: ErrorOptions);
+}
+export declare class SessionTenancyNotActivatedError extends Error {
+    readonly name = "SessionTenancyNotActivatedError";
+    constructor(options?: ErrorOptions);
+}
+export declare class SessionTenancyAccessError extends Error {
+    readonly name = "SessionTenancyAccessError";
+    constructor(options?: ErrorOptions);
+}
+export declare class SessionTenancyInvalidRequestError extends Error {
+    readonly name = "SessionTenancyInvalidRequestError";
+    constructor(options?: ErrorOptions);
+}
+/** Extract only the fixed quiescence DETAIL vocabulary, never arbitrary driver detail. */
+export declare function nestedSessionTenancyBlocker(error: unknown): SessionTenancyBlocker | null;
 export type SessionTenancyVisibility = "user_private" | "workspace_shared";
+export type PrivateSessionCreatePolicy = {
+    personalWorkspace: boolean;
+    platformAvailable: boolean;
+    organizationEnabled: boolean;
+};
 export type TransitionSessionVisibilityInput = {
     workspaceId: string;
     sessionId: string;
@@ -10,6 +36,8 @@ export type TransitionSessionVisibilityInput = {
 };
 export type TransitionSessionVisibilityResult = {
     operationId: string;
+    eventId: string | null;
+    eventSequence: number | null;
     visibility: SessionTenancyVisibility;
     authorityEpoch: number;
     ownerOrganizationMembershipId: string | null;
@@ -27,10 +55,13 @@ export type ForkSessionContentInput = {
     actorSubjectId: string;
     destinationWorkspaceId: string;
     destinationVisibility: SessionTenancyVisibility;
+    workspaceSharedAcknowledged: boolean;
     operationKey: string;
 };
 export type ForkSessionContentResult = {
     operationId: string;
+    eventId: string;
+    eventSequence: number;
     sessionId: string;
     workspaceId: string;
     visibility: SessionTenancyVisibility;
@@ -38,7 +69,46 @@ export type ForkSessionContentResult = {
     copiedHistoryItemCount: number;
     replay: boolean;
 };
+export declare function sessionTenancyProductActivated(db: Database, workspaceId: string): Promise<boolean>;
+export declare function getPrivateSessionCreatePolicy(db: Database, input: {
+    workspaceId: string;
+    actorSubjectId: string;
+}): Promise<PrivateSessionCreatePolicy>;
+/** Open the exact transaction-local trigger capability used by atomic private create. */
+export declare function openPrivateSessionCreateCapability(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    actorSubjectId: string;
+}): Promise<{
+    capabilityId: string;
+    ownerMembershipId: string;
+}>;
+/** Open the exact transaction-local capability for one private child insert. */
+export declare function openPrivateChildSessionCreateCapability(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    parentSessionId: string;
+    actorTurnId: string;
+    actorAttemptId: string;
+    actorExecutionGeneration: number;
+}): Promise<{
+    capabilityId: string;
+    ownerMembershipId: string;
+    ownerSubjectId: string;
+}>;
+export declare function closePrivateSessionCreateCapability(db: Database, capabilityId: string): Promise<void>;
 export declare function canonicalSessionVisibilityTransitionHash(input: Pick<TransitionSessionVisibilityInput, "sessionId" | "targetVisibility" | "expectedAuthorityEpoch">): string;
-export declare function canonicalSessionForkHash(input: Pick<ForkSessionContentInput, "sourceSessionId" | "destinationWorkspaceId" | "destinationVisibility">): string;
+export declare function canonicalSessionForkHash(input: Pick<ForkSessionContentInput, "sourceSessionId" | "destinationWorkspaceId" | "destinationVisibility" | "workspaceSharedAcknowledged">): string;
 export declare function transitionSessionVisibility(db: Database, input: TransitionSessionVisibilityInput): Promise<TransitionSessionVisibilityResult>;
 export declare function forkSessionContent(db: Database, input: ForkSessionContentInput): Promise<ForkSessionContentResult>;
+/**
+ * Recover one exact committed fork before mutable source-session authorization.
+ *
+ * The database capability requires the authenticated actor's active workspace
+ * authority and matches the complete actor/workspace/source/key/request-hash
+ * tuple. A fresh key returns null; changed intent raises the ordinary tenancy
+ * idempotency conflict. This is receipt recovery, not session discovery.
+ */
+export declare function replayAppliedSessionFork(db: Database, input: ForkSessionContentInput): Promise<ForkSessionContentResult | null>;

package/dist/session-tenancy.js

@@ -1,16 +1,38 @@
 import {
+  SessionTenancyAccessError,
+  SessionTenancyConflictError,
+  SessionTenancyInvalidRequestError,
+  SessionTenancyNotActivatedError,
   canonicalSessionForkHash,
   canonicalSessionVisibilityTransitionHash,
+  closePrivateSessionCreateCapability,
   forkSessionContent,
+  getPrivateSessionCreatePolicy,
+  nestedSessionTenancyBlocker,
+  openPrivateChildSessionCreateCapability,
+  openPrivateSessionCreateCapability,
+  replayAppliedSessionFork,
+  sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-WD5ROSLL.js";
-import "./chunk-ZWREYEWA.js";
-import "./chunk-6ZYKCRFO.js";
+} from "./chunk-TIKF3KTI.js";
+import "./chunk-SCPUJS53.js";
+import "./chunk-PR2WMLOQ.js";
 import "./chunk-PZ5AY32C.js";
 export {
+  SessionTenancyAccessError,
+  SessionTenancyConflictError,
+  SessionTenancyInvalidRequestError,
+  SessionTenancyNotActivatedError,
   canonicalSessionForkHash,
   canonicalSessionVisibilityTransitionHash,
+  closePrivateSessionCreateCapability,
   forkSessionContent,
+  getPrivateSessionCreatePolicy,
+  nestedSessionTenancyBlocker,
+  openPrivateChildSessionCreateCapability,
+  openPrivateSessionCreateCapability,
+  replayAppliedSessionFork,
+  sessionTenancyProductActivated,
   transitionSessionVisibility
 };
 //# sourceMappingURL=session-tenancy.js.map

package/dist/session-tool-call-settlement.d.ts

@@ -18,12 +18,17 @@ export type ClosePendingSessionToolCallsInput = {
     reason: string;
     sequence: number;
     now: Date;
+    turnAssociation?: "current" | null;
+    preserveInterruptionRows?: boolean;
 };
 /**
- * Close every unresolved raw tool call for a logical turn while its owning
- * session/turn locks are held. Durable results win; otherwise the model gets an
- * explicit interrupted/outcome-unknown result for protocols that can represent
- * one. Repeated settlement is an exact no-op after ledger deletion.
+ * Close raw tool calls for a logical turn while its owning session/turn locks
+ * are held. Recoverable transitions preserve interruption rows because those
+ * rows are the exact open-suffix resume authority for a replacement attempt;
+ * ordinary in-flight rows still receive durable outcome-unknown settlement.
+ * Terminal and superseding transitions close every row. Durable results win;
+ * repeated settlement is an exact no-op after the selected ledger rows are
+ * deleted.
  */
 export declare function closePendingSessionToolCallsInTransaction(tx: Database, input: ClosePendingSessionToolCallsInput): Promise<{
     sequence: number;

package/dist/slack-routing-personal-workspace.d.ts

@@ -0,0 +1,23 @@
+import { type Database } from "./database.js";
+/**
+ * The subject's own personal workspace in one organization, or null.
+ *
+ * Only an `active` membership counts, and only that membership's own
+ * `personalWorkspaceId` pointer is read - never a default workspace, a
+ * `created_by`, or current access.
+ *
+ * Non-`user:` subjects (API keys, delegated service principals, configured and
+ * local principals) can never own an organization membership, so they
+ * short-circuit rather than tripping `list_self_organization_memberships`'
+ * `42501` guard.
+ *
+ * ORACLE, NOT AN AUTHORIZATION. This answers "which workspace is this named
+ * subject's own" for whatever subject it is handed; it does not establish that
+ * the caller IS that subject. Pass only a subject authenticated out of band -
+ * for Slack, one named by a durable `slack_bot_user_links` row. Never pass a
+ * subject taken from a request payload.
+ */
+export declare function namedSubjectPersonalWorkspaceId(db: Database, input: {
+    accountId: string;
+    subjectId: string;
+}): Promise<string | null>;