@opengeni/db 1.0.1 → 3.2.0-canary.0

package/dist/{chunk-CUPM3FGB.js → chunk-2PRS4J5Q.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-ZWREYEWA.js";
+} from "./chunk-AZHW7R5V.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-6ZYKCRFO.js";
+} from "./chunk-KRLPEMLH.js";
 
 // src/video-generation.ts
 import {
@@ -992,4 +992,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-CUPM3FGB.js.map
+//# sourceMappingURL=chunk-2PRS4J5Q.js.map

package/dist/chunk-6HMM2R5T.js

@@ -0,0 +1,390 @@
+import {
+  nestedPostgresSqlState,
+  rawRows,
+  rlsContextForWorkspace,
+  withWorkspaceRls,
+  withWorkspaceSubjectRls,
+  withWorkspaceSubjectSessionActivityRls
+} from "./chunk-AZHW7R5V.js";
+
+// src/session-tenancy.ts
+import { createHash } from "crypto";
+import { sql } from "drizzle-orm";
+import {
+  SessionTenancyBlocker as SessionTenancyBlockerSchema
+} from "@opengeni/contracts";
+var SESSION_TENANCY_ACTIVATION_VERSION = 1;
+var SessionTenancyConflictError = class extends Error {
+  constructor(reason, blocker = null, options) {
+    super(
+      reason === "not_quiescent" ? "Session must be fully quiescent before its tenancy can change" : reason === "authority_epoch" ? "Session authority changed before the operation committed" : "Session tenancy operation key was reused with different input",
+      options
+    );
+    this.reason = reason;
+    this.blocker = blocker;
+  }
+  name = "SessionTenancyConflictError";
+};
+var SessionTenancyNotActivatedError = class extends Error {
+  name = "SessionTenancyNotActivatedError";
+  constructor(options) {
+    super("Session tenancy product surface is not activated for this organization", options);
+  }
+};
+var SessionTenancyAccessError = class extends Error {
+  name = "SessionTenancyAccessError";
+  constructor(options) {
+    super("Session tenancy target is unavailable", options);
+  }
+};
+var SessionTenancyInvalidRequestError = class extends Error {
+  name = "SessionTenancyInvalidRequestError";
+  constructor(options) {
+    super("Session tenancy request is invalid", options);
+  }
+};
+function isRecord(value) {
+  return Boolean(value && typeof value === "object");
+}
+function nestedSessionTenancyBlocker(error) {
+  const queue = [error];
+  const seen = /* @__PURE__ */ new Set();
+  while (queue.length > 0 && seen.size < 64) {
+    const current = queue.shift();
+    if (!isRecord(current) || seen.has(current)) continue;
+    seen.add(current);
+    for (const key of ["detail", "detailMessage"]) {
+      const parsed = SessionTenancyBlockerSchema.safeParse(current[key]);
+      if (parsed.success) return parsed.data;
+    }
+    for (const key of ["cause", "original", "driverError", "error", "errors"]) {
+      const nested = current[key];
+      if (Array.isArray(nested)) queue.push(...nested);
+      else if (nested !== void 0) queue.push(nested);
+    }
+  }
+  return null;
+}
+async function sessionTenancyProductActivated(db, workspaceId) {
+  const { accountId } = await rlsContextForWorkspace(db, workspaceId);
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const rows = await rawRows(
+      scopedDb,
+      sql`select session_tenancy_product_activated(
+        ${accountId}::uuid,
+        ${SESSION_TENANCY_ACTIVATION_VERSION}
+      ) as activated`
+    );
+    return rows[0]?.activated === true;
+  });
+}
+async function getPrivateSessionCreatePolicy(db, input) {
+  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
+  return await withWorkspaceSubjectRls(
+    db,
+    input.workspaceId,
+    input.actorSubjectId,
+    async (scopedDb) => {
+      const rows = await rawRows(
+        scopedDb,
+        sql`select
+          personal_workspace as "personalWorkspace",
+          platform_available as "platformAvailable",
+          organization_enabled as "organizationEnabled"
+        from get_private_session_create_policy(
+          ${accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.actorSubjectId}
+        )`
+      );
+      const policy = rows[0];
+      if (!policy) throw new SessionTenancyAccessError();
+      return policy;
+    }
+  );
+}
+async function openPrivateSessionCreateCapability(db, input) {
+  let rows;
+  try {
+    rows = await rawRows(
+      db,
+      sql`select
+        capability_id as "capabilityId",
+        owner_membership_id as "ownerMembershipId"
+      from open_private_session_create_capability(
+        ${input.accountId}::uuid,
+        ${input.workspaceId}::uuid,
+        ${input.sessionId}::uuid,
+        ${input.actorSubjectId}
+      )`
+    );
+  } catch (error) {
+    if (nestedPostgresSqlState(error) === "55000") {
+      throw new SessionTenancyNotActivatedError({ cause: error });
+    }
+    throw error;
+  }
+  const capabilityId = rows[0]?.capabilityId;
+  const ownerMembershipId = rows[0]?.ownerMembershipId;
+  if (!capabilityId || !ownerMembershipId) {
+    throw new Error("Private session create capability was not returned");
+  }
+  return { capabilityId, ownerMembershipId };
+}
+async function openPrivateChildSessionCreateCapability(db, input) {
+  const rows = await rawRows(
+    db,
+    sql`select
+      capability_id as "capabilityId",
+      owner_membership_id as "ownerMembershipId",
+      owner_subject_id as "ownerSubjectId"
+    from open_private_child_session_create_capability(
+      ${input.accountId}::uuid,
+      ${input.workspaceId}::uuid,
+      ${input.sessionId}::uuid,
+      ${input.parentSessionId}::uuid,
+      ${input.actorTurnId}::uuid,
+      ${input.actorAttemptId}::uuid,
+      ${input.actorExecutionGeneration}::integer
+    )`
+  );
+  const capabilityId = rows[0]?.capabilityId;
+  const ownerMembershipId = rows[0]?.ownerMembershipId;
+  const ownerSubjectId = rows[0]?.ownerSubjectId;
+  if (!capabilityId || !ownerMembershipId || !ownerSubjectId) {
+    throw new Error("Private child session create capability was not returned");
+  }
+  return { capabilityId, ownerMembershipId, ownerSubjectId };
+}
+async function closePrivateSessionCreateCapability(db, capabilityId) {
+  await db.execute(sql`select close_private_session_create_capability(${capabilityId}::uuid)`);
+}
+async function assertSessionTenancyProductActivated(db, workspaceId) {
+  if (!await sessionTenancyProductActivated(db, workspaceId)) {
+    throw new SessionTenancyNotActivatedError();
+  }
+}
+function mapSessionTenancyPersistenceError(error, options) {
+  const state = nestedPostgresSqlState(error);
+  if (state === "55P03") {
+    throw new SessionTenancyConflictError("not_quiescent", nestedSessionTenancyBlocker(error), {
+      cause: error
+    });
+  }
+  if (state === "40001" && options.authorityEpochConflict) {
+    throw new SessionTenancyConflictError("authority_epoch", null, { cause: error });
+  }
+  if (state === "23505") {
+    throw new SessionTenancyConflictError("operation_reuse", null, { cause: error });
+  }
+  if (state === "55000") {
+    throw new SessionTenancyNotActivatedError({ cause: error });
+  }
+  if (state === "42501" || state === "P0002") {
+    throw new SessionTenancyAccessError({ cause: error });
+  }
+  if (state === "22023") {
+    throw new SessionTenancyInvalidRequestError({ cause: error });
+  }
+  throw error;
+}
+function canonicalSessionVisibilityTransitionHash(input) {
+  return createHash("sha256").update(
+    JSON.stringify({
+      version: 1,
+      sessionId: input.sessionId,
+      targetVisibility: input.targetVisibility,
+      expectedAuthorityEpoch: input.expectedAuthorityEpoch
+    })
+  ).digest("hex");
+}
+function canonicalSessionForkHash(input) {
+  const legacyCompatiblePrivateRequest = input.destinationVisibility === "user_private" && !input.workspaceSharedAcknowledged;
+  return createHash("sha256").update(
+    JSON.stringify(
+      legacyCompatiblePrivateRequest ? {
+        version: 1,
+        sourceSessionId: input.sourceSessionId,
+        destinationWorkspaceId: input.destinationWorkspaceId,
+        destinationVisibility: input.destinationVisibility
+      } : {
+        version: 2,
+        sourceSessionId: input.sourceSessionId,
+        destinationWorkspaceId: input.destinationWorkspaceId,
+        destinationVisibility: input.destinationVisibility,
+        workspaceSharedAcknowledged: input.workspaceSharedAcknowledged
+      }
+    )
+  ).digest("hex");
+}
+async function transitionSessionVisibility(db, input) {
+  if (!Number.isSafeInteger(input.expectedAuthorityEpoch) || input.expectedAuthorityEpoch < 1) {
+    throw new Error("expectedAuthorityEpoch must be a positive safe integer");
+  }
+  if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
+  const requestHash = canonicalSessionVisibilityTransitionHash(input);
+  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
+  await assertSessionTenancyProductActivated(db, input.workspaceId);
+  try {
+    return await withWorkspaceSubjectSessionActivityRls(
+      db,
+      input.workspaceId,
+      input.actorSubjectId,
+      async (scopedDb) => {
+        const rows = await rawRows(
+          scopedDb,
+          sql`select
+          operation_id as "operationId",
+          event_id as "eventId",
+          event_sequence as "eventSequence",
+          visibility,
+          authority_epoch as "authorityEpoch",
+          owner_organization_membership_id as "ownerOrganizationMembershipId",
+          changed,
+          replay,
+          interrupted_attempt_count as "interruptedAttemptCount",
+          cancelled_turn_count as "cancelledTurnCount",
+          cancelled_update_count as "cancelledUpdateCount",
+          paused_goal_count as "pausedGoalCount",
+          revoked_grant_count as "revokedGrantCount"
+        from transition_session_visibility(
+          ${accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.sessionId}::uuid,
+          ${input.actorSubjectId},
+          ${input.targetVisibility},
+          ${input.expectedAuthorityEpoch},
+          ${input.operationKey},
+          ${requestHash},
+          ${SESSION_TENANCY_ACTIVATION_VERSION}
+        )`
+        );
+        const result = rows[0];
+        if (!result) throw new Error("Session visibility transition returned no result");
+        return result;
+      },
+      void 0,
+      "none"
+    );
+  } catch (error) {
+    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: true });
+  }
+}
+async function forkSessionContent(db, input) {
+  if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
+  if (input.destinationWorkspaceId !== input.sourceWorkspaceId) {
+    throw new Error("The first session fork contract is same-workspace only");
+  }
+  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
+  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
+  const requestHash = canonicalSessionForkHash(input);
+  try {
+    return await withWorkspaceSubjectRls(
+      db,
+      input.sourceWorkspaceId,
+      input.actorSubjectId,
+      async (scopedDb) => {
+        const rows = await rawRows(
+          scopedDb,
+          sql`select
+          operation_id as "operationId",
+          event_id as "eventId",
+          event_sequence as "eventSequence",
+          session_id as "sessionId",
+          workspace_id as "workspaceId",
+          visibility,
+          authority_epoch as "authorityEpoch",
+          copied_history_item_count as "copiedHistoryItemCount",
+          replay
+        from fork_session_content(
+          ${accountId}::uuid,
+          ${input.sourceWorkspaceId}::uuid,
+          ${input.sourceSessionId}::uuid,
+          ${input.actorSubjectId},
+          ${input.destinationWorkspaceId}::uuid,
+          ${input.destinationVisibility},
+          ${input.workspaceSharedAcknowledged},
+          ${input.operationKey},
+          ${requestHash},
+          ${SESSION_TENANCY_ACTIVATION_VERSION}
+        )`
+        );
+        const result = rows[0];
+        if (!result) throw new Error("Session fork returned no result");
+        return result;
+      },
+      void 0,
+      "none"
+    );
+  } catch (error) {
+    if (nestedPostgresSqlState(error) === "55000") {
+      throw new SessionTenancyNotActivatedError({ cause: error });
+    }
+    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: false });
+  }
+}
+async function replayAppliedSessionFork(db, input) {
+  if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
+  if (input.destinationWorkspaceId !== input.sourceWorkspaceId) {
+    throw new Error("The first session fork contract is same-workspace only");
+  }
+  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
+  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
+  const requestHash = canonicalSessionForkHash(input);
+  try {
+    return await withWorkspaceSubjectRls(
+      db,
+      input.sourceWorkspaceId,
+      input.actorSubjectId,
+      async (scopedDb) => {
+        const rows = await rawRows(
+          scopedDb,
+          sql`select
+          operation_id as "operationId",
+          event_id as "eventId",
+          event_sequence as "eventSequence",
+          session_id as "sessionId",
+          workspace_id as "workspaceId",
+          visibility,
+          authority_epoch as "authorityEpoch",
+          copied_history_item_count as "copiedHistoryItemCount",
+          replay
+        from replay_applied_session_fork(
+          ${accountId}::uuid,
+          ${input.sourceWorkspaceId}::uuid,
+          ${input.sourceSessionId}::uuid,
+          ${input.actorSubjectId},
+          ${input.destinationWorkspaceId}::uuid,
+          ${input.destinationVisibility},
+          ${input.workspaceSharedAcknowledged},
+          ${input.operationKey},
+          ${requestHash},
+          ${SESSION_TENANCY_ACTIVATION_VERSION}
+        )`
+        );
+        return rows[0] ?? null;
+      }
+    );
+  } catch (error) {
+    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: false });
+  }
+}
+
+export {
+  SessionTenancyConflictError,
+  SessionTenancyNotActivatedError,
+  SessionTenancyAccessError,
+  SessionTenancyInvalidRequestError,
+  nestedSessionTenancyBlocker,
+  sessionTenancyProductActivated,
+  getPrivateSessionCreatePolicy,
+  openPrivateSessionCreateCapability,
+  openPrivateChildSessionCreateCapability,
+  closePrivateSessionCreateCapability,
+  canonicalSessionVisibilityTransitionHash,
+  canonicalSessionForkHash,
+  transitionSessionVisibility,
+  forkSessionContent,
+  replayAppliedSessionFork
+};
+//# sourceMappingURL=chunk-6HMM2R5T.js.map

package/dist/chunk-6HMM2R5T.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session-tenancy.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { sql } from \"drizzle-orm\";\nimport {\n  SessionTenancyBlocker as SessionTenancyBlockerSchema,\n  type SessionTenancyBlocker,\n} from \"@opengeni/contracts\";\nimport {\n  rawRows,\n  type Database,\n  rlsContextForWorkspace,\n  withWorkspaceRls,\n  withWorkspaceSubjectRls,\n  withWorkspaceSubjectSessionActivityRls,\n} from \"./database\";\nimport { nestedPostgresSqlState } from \"./persistence-errors\";\n\nconst SESSION_TENANCY_ACTIVATION_VERSION = 1;\n\nexport class SessionTenancyConflictError extends Error {\n  readonly name = \"SessionTenancyConflictError\";\n  constructor(\n    readonly reason: \"not_quiescent\" | \"authority_epoch\" | \"operation_reuse\",\n    readonly blocker: SessionTenancyBlocker | null = null,\n    options?: ErrorOptions,\n  ) {\n    super(\n      reason === \"not_quiescent\"\n        ? \"Session must be fully quiescent before its tenancy can change\"\n        : reason === \"authority_epoch\"\n          ? \"Session authority changed before the operation committed\"\n          : \"Session tenancy operation key was reused with different input\",\n      options,\n    );\n  }\n}\n\nexport class SessionTenancyNotActivatedError extends Error {\n  readonly name = \"SessionTenancyNotActivatedError\";\n  constructor(options?: ErrorOptions) {\n    super(\"Session tenancy product surface is not activated for this organization\", options);\n  }\n}\n\nexport class SessionTenancyAccessError extends Error {\n  readonly name = \"SessionTenancyAccessError\";\n  constructor(options?: ErrorOptions) {\n    super(\"Session tenancy target is unavailable\", options);\n  }\n}\n\nexport class SessionTenancyInvalidRequestError extends Error {\n  readonly name = \"SessionTenancyInvalidRequestError\";\n  constructor(options?: ErrorOptions) {\n    super(\"Session tenancy request is invalid\", options);\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\n/** Extract only the fixed quiescence DETAIL vocabulary, never arbitrary driver detail. */\nexport function nestedSessionTenancyBlocker(error: unknown): SessionTenancyBlocker | null {\n  const queue: unknown[] = [error];\n  const seen = new Set<unknown>();\n  while (queue.length > 0 && seen.size < 64) {\n    const current = queue.shift();\n    if (!isRecord(current) || seen.has(current)) continue;\n    seen.add(current);\n    for (const key of [\"detail\", \"detailMessage\"] as const) {\n      const parsed = SessionTenancyBlockerSchema.safeParse(current[key]);\n      if (parsed.success) return parsed.data;\n    }\n    for (const key of [\"cause\", \"original\", \"driverError\", \"error\", \"errors\"] as const) {\n      const nested = current[key];\n      if (Array.isArray(nested)) queue.push(...nested);\n      else if (nested !== undefined) queue.push(nested);\n    }\n  }\n  return null;\n}\n\nexport type SessionTenancyVisibility = \"user_private\" | \"workspace_shared\";\n\nexport type PrivateSessionCreatePolicy = {\n  personalWorkspace: boolean;\n  platformAvailable: boolean;\n  organizationEnabled: boolean;\n};\n\nexport type TransitionSessionVisibilityInput = {\n  workspaceId: string;\n  sessionId: string;\n  actorSubjectId: string;\n  targetVisibility: SessionTenancyVisibility;\n  expectedAuthorityEpoch: number;\n  operationKey: string;\n};\n\nexport type TransitionSessionVisibilityResult = {\n  operationId: string;\n  eventId: string | null;\n  eventSequence: number | null;\n  visibility: SessionTenancyVisibility;\n  authorityEpoch: number;\n  ownerOrganizationMembershipId: string | null;\n  changed: boolean;\n  replay: boolean;\n  interruptedAttemptCount: number;\n  cancelledTurnCount: number;\n  cancelledUpdateCount: number;\n  pausedGoalCount: number;\n  revokedGrantCount: number;\n};\n\nexport type ForkSessionContentInput = {\n  sourceWorkspaceId: string;\n  sourceSessionId: string;\n  actorSubjectId: string;\n  destinationWorkspaceId: string;\n  destinationVisibility: SessionTenancyVisibility;\n  workspaceSharedAcknowledged: boolean;\n  operationKey: string;\n};\n\nexport type ForkSessionContentResult = {\n  operationId: string;\n  eventId: string;\n  eventSequence: number;\n  sessionId: string;\n  workspaceId: string;\n  visibility: SessionTenancyVisibility;\n  authorityEpoch: number;\n  copiedHistoryItemCount: number;\n  replay: boolean;\n};\n\nexport async function sessionTenancyProductActivated(\n  db: Database,\n  workspaceId: string,\n): Promise<boolean> {\n  const { accountId } = await rlsContextForWorkspace(db, workspaceId);\n  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {\n    const rows = await rawRows<{ activated: boolean }>(\n      scopedDb,\n      sql`select session_tenancy_product_activated(\n        ${accountId}::uuid,\n        ${SESSION_TENANCY_ACTIVATION_VERSION}\n      ) as activated`,\n    );\n    return rows[0]?.activated === true;\n  });\n}\n\nexport async function getPrivateSessionCreatePolicy(\n  db: Database,\n  input: { workspaceId: string; actorSubjectId: string },\n): Promise<PrivateSessionCreatePolicy> {\n  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);\n  return await withWorkspaceSubjectRls(\n    db,\n    input.workspaceId,\n    input.actorSubjectId,\n    async (scopedDb) => {\n      const rows = await rawRows<{\n        personalWorkspace: boolean;\n        platformAvailable: boolean;\n        organizationEnabled: boolean;\n      }>(\n        scopedDb,\n        sql`select\n          personal_workspace as \"personalWorkspace\",\n          platform_available as \"platformAvailable\",\n          organization_enabled as \"organizationEnabled\"\n        from get_private_session_create_policy(\n          ${accountId}::uuid,\n          ${input.workspaceId}::uuid,\n          ${input.actorSubjectId}\n        )`,\n      );\n      const policy = rows[0];\n      if (!policy) throw new SessionTenancyAccessError();\n      return policy;\n    },\n  );\n}\n\n/** Open the exact transaction-local trigger capability used by atomic private create. */\nexport async function openPrivateSessionCreateCapability(\n  db: Database,\n  input: { accountId: string; workspaceId: string; sessionId: string; actorSubjectId: string },\n): Promise<{ capabilityId: string; ownerMembershipId: string }> {\n  let rows: Array<{ capabilityId: string; ownerMembershipId: string }>;\n  try {\n    rows = await rawRows<{ capabilityId: string; ownerMembershipId: string }>(\n      db,\n      sql`select\n        capability_id as \"capabilityId\",\n        owner_membership_id as \"ownerMembershipId\"\n      from open_private_session_create_capability(\n        ${input.accountId}::uuid,\n        ${input.workspaceId}::uuid,\n        ${input.sessionId}::uuid,\n        ${input.actorSubjectId}\n      )`,\n    );\n  } catch (error) {\n    // The definer raises 55000 only when the organization owner/admin setting\n    // does not permit a new private session in this shared workspace; every\n    // authority failure remains 42501 and propagates unchanged.\n    if (nestedPostgresSqlState(error) === \"55000\") {\n      throw new SessionTenancyNotActivatedError({ cause: error });\n    }\n    throw error;\n  }\n  const capabilityId = rows[0]?.capabilityId;\n  const ownerMembershipId = rows[0]?.ownerMembershipId;\n  if (!capabilityId || !ownerMembershipId) {\n    throw new Error(\"Private session create capability was not returned\");\n  }\n  return { capabilityId, ownerMembershipId };\n}\n\n/** Open the exact transaction-local capability for one private child insert. */\nexport async function openPrivateChildSessionCreateCapability(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    parentSessionId: string;\n    actorTurnId: string;\n    actorAttemptId: string;\n    actorExecutionGeneration: number;\n  },\n): Promise<{ capabilityId: string; ownerMembershipId: string; ownerSubjectId: string }> {\n  const rows = await rawRows<{\n    capabilityId: string;\n    ownerMembershipId: string;\n    ownerSubjectId: string;\n  }>(\n    db,\n    sql`select\n      capability_id as \"capabilityId\",\n      owner_membership_id as \"ownerMembershipId\",\n      owner_subject_id as \"ownerSubjectId\"\n    from open_private_child_session_create_capability(\n      ${input.accountId}::uuid,\n      ${input.workspaceId}::uuid,\n      ${input.sessionId}::uuid,\n      ${input.parentSessionId}::uuid,\n      ${input.actorTurnId}::uuid,\n      ${input.actorAttemptId}::uuid,\n      ${input.actorExecutionGeneration}::integer\n    )`,\n  );\n  const capabilityId = rows[0]?.capabilityId;\n  const ownerMembershipId = rows[0]?.ownerMembershipId;\n  const ownerSubjectId = rows[0]?.ownerSubjectId;\n  if (!capabilityId || !ownerMembershipId || !ownerSubjectId) {\n    throw new Error(\"Private child session create capability was not returned\");\n  }\n  return { capabilityId, ownerMembershipId, ownerSubjectId };\n}\n\nexport async function closePrivateSessionCreateCapability(\n  db: Database,\n  capabilityId: string,\n): Promise<void> {\n  await db.execute(sql`select close_private_session_create_capability(${capabilityId}::uuid)`);\n}\n\nasync function assertSessionTenancyProductActivated(\n  db: Database,\n  workspaceId: string,\n): Promise<void> {\n  if (!(await sessionTenancyProductActivated(db, workspaceId))) {\n    throw new SessionTenancyNotActivatedError();\n  }\n}\n\nfunction mapSessionTenancyPersistenceError(\n  error: unknown,\n  options: { authorityEpochConflict: boolean },\n): never {\n  const state = nestedPostgresSqlState(error);\n  if (state === \"55P03\") {\n    throw new SessionTenancyConflictError(\"not_quiescent\", nestedSessionTenancyBlocker(error), {\n      cause: error,\n    });\n  }\n  if (state === \"40001\" && options.authorityEpochConflict) {\n    throw new SessionTenancyConflictError(\"authority_epoch\", null, { cause: error });\n  }\n  if (state === \"23505\") {\n    throw new SessionTenancyConflictError(\"operation_reuse\", null, { cause: error });\n  }\n  if (state === \"55000\") {\n    throw new SessionTenancyNotActivatedError({ cause: error });\n  }\n  if (state === \"42501\" || state === \"P0002\") {\n    throw new SessionTenancyAccessError({ cause: error });\n  }\n  if (state === \"22023\") {\n    throw new SessionTenancyInvalidRequestError({ cause: error });\n  }\n  throw error;\n}\n\nexport function canonicalSessionVisibilityTransitionHash(\n  input: Pick<\n    TransitionSessionVisibilityInput,\n    \"sessionId\" | \"targetVisibility\" | \"expectedAuthorityEpoch\"\n  >,\n): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        sessionId: input.sessionId,\n        targetVisibility: input.targetVisibility,\n        expectedAuthorityEpoch: input.expectedAuthorityEpoch,\n      }),\n    )\n    .digest(\"hex\");\n}\n\nexport function canonicalSessionForkHash(\n  input: Pick<\n    ForkSessionContentInput,\n    | \"sourceSessionId\"\n    | \"destinationWorkspaceId\"\n    | \"destinationVisibility\"\n    | \"workspaceSharedAcknowledged\"\n  >,\n): string {\n  const legacyCompatiblePrivateRequest =\n    input.destinationVisibility === \"user_private\" && !input.workspaceSharedAcknowledged;\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify(\n        legacyCompatiblePrivateRequest\n          ? {\n              version: 1,\n              sourceSessionId: input.sourceSessionId,\n              destinationWorkspaceId: input.destinationWorkspaceId,\n              destinationVisibility: input.destinationVisibility,\n            }\n          : {\n              version: 2,\n              sourceSessionId: input.sourceSessionId,\n              destinationWorkspaceId: input.destinationWorkspaceId,\n              destinationVisibility: input.destinationVisibility,\n              workspaceSharedAcknowledged: input.workspaceSharedAcknowledged,\n            },\n      ),\n    )\n    .digest(\"hex\");\n}\n\nexport async function transitionSessionVisibility(\n  db: Database,\n  input: TransitionSessionVisibilityInput,\n): Promise<TransitionSessionVisibilityResult> {\n  if (!Number.isSafeInteger(input.expectedAuthorityEpoch) || input.expectedAuthorityEpoch < 1) {\n    throw new Error(\"expectedAuthorityEpoch must be a positive safe integer\");\n  }\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  const requestHash = canonicalSessionVisibilityTransitionHash(input);\n  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);\n  await assertSessionTenancyProductActivated(db, input.workspaceId);\n  try {\n    return await withWorkspaceSubjectSessionActivityRls(\n      db,\n      input.workspaceId,\n      input.actorSubjectId,\n      async (scopedDb) => {\n        const rows = await rawRows<{\n          operationId: string;\n          eventId: string | null;\n          eventSequence: number | null;\n          visibility: SessionTenancyVisibility;\n          authorityEpoch: number;\n          ownerOrganizationMembershipId: string | null;\n          changed: boolean;\n          replay: boolean;\n          interruptedAttemptCount: number;\n          cancelledTurnCount: number;\n          cancelledUpdateCount: number;\n          pausedGoalCount: number;\n          revokedGrantCount: number;\n        }>(\n          scopedDb,\n          sql`select\n          operation_id as \"operationId\",\n          event_id as \"eventId\",\n          event_sequence as \"eventSequence\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          owner_organization_membership_id as \"ownerOrganizationMembershipId\",\n          changed,\n          replay,\n          interrupted_attempt_count as \"interruptedAttemptCount\",\n          cancelled_turn_count as \"cancelledTurnCount\",\n          cancelled_update_count as \"cancelledUpdateCount\",\n          paused_goal_count as \"pausedGoalCount\",\n          revoked_grant_count as \"revokedGrantCount\"\n        from transition_session_visibility(\n          ${accountId}::uuid,\n          ${input.workspaceId}::uuid,\n          ${input.sessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.targetVisibility},\n          ${input.expectedAuthorityEpoch},\n          ${input.operationKey},\n          ${requestHash},\n          ${SESSION_TENANCY_ACTIVATION_VERSION}\n        )`,\n        );\n        const result = rows[0];\n        if (!result) throw new Error(\"Session visibility transition returned no result\");\n        return result;\n      },\n      undefined,\n      \"none\",\n    );\n  } catch (error) {\n    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: true });\n  }\n}\n\nexport async function forkSessionContent(\n  db: Database,\n  input: ForkSessionContentInput,\n): Promise<ForkSessionContentResult> {\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  if (input.destinationWorkspaceId !== input.sourceWorkspaceId) {\n    throw new Error(\"The first session fork contract is same-workspace only\");\n  }\n  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);\n  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);\n  const requestHash = canonicalSessionForkHash(input);\n  try {\n    return await withWorkspaceSubjectRls(\n      db,\n      input.sourceWorkspaceId,\n      input.actorSubjectId,\n      async (scopedDb) => {\n        const rows = await rawRows<ForkSessionContentResult>(\n          scopedDb,\n          sql`select\n          operation_id as \"operationId\",\n          event_id as \"eventId\",\n          event_sequence as \"eventSequence\",\n          session_id as \"sessionId\",\n          workspace_id as \"workspaceId\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          copied_history_item_count as \"copiedHistoryItemCount\",\n          replay\n        from fork_session_content(\n          ${accountId}::uuid,\n          ${input.sourceWorkspaceId}::uuid,\n          ${input.sourceSessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.destinationWorkspaceId}::uuid,\n          ${input.destinationVisibility},\n          ${input.workspaceSharedAcknowledged},\n          ${input.operationKey},\n          ${requestHash},\n          ${SESSION_TENANCY_ACTIVATION_VERSION}\n        )`,\n        );\n        const result = rows[0];\n        if (!result) throw new Error(\"Session fork returned no result\");\n        return result;\n      },\n      undefined,\n      \"none\",\n    );\n  } catch (error) {\n    // A private destination inside a shared workspace carries the same\n    // organization owner/admin product decision the create path enforces\n    // (migration 0323), and the fork routine raises the same 55000. Surface it\n    // as the not-activated product state rather than an opaque database error.\n    if (nestedPostgresSqlState(error) === \"55000\") {\n      throw new SessionTenancyNotActivatedError({ cause: error });\n    }\n    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: false });\n  }\n}\n\n/**\n * Recover one exact committed fork before mutable source-session authorization.\n *\n * The database capability requires the authenticated actor's active workspace\n * authority and matches the complete actor/workspace/source/key/request-hash\n * tuple. A fresh key returns null; changed intent raises the ordinary tenancy\n * idempotency conflict. This is receipt recovery, not session discovery.\n */\nexport async function replayAppliedSessionFork(\n  db: Database,\n  input: ForkSessionContentInput,\n): Promise<ForkSessionContentResult | null> {\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  if (input.destinationWorkspaceId !== input.sourceWorkspaceId) {\n    throw new Error(\"The first session fork contract is same-workspace only\");\n  }\n  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);\n  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);\n  const requestHash = canonicalSessionForkHash(input);\n  try {\n    return await withWorkspaceSubjectRls(\n      db,\n      input.sourceWorkspaceId,\n      input.actorSubjectId,\n      async (scopedDb) => {\n        const rows = await rawRows<ForkSessionContentResult>(\n          scopedDb,\n          sql`select\n          operation_id as \"operationId\",\n          event_id as \"eventId\",\n          event_sequence as \"eventSequence\",\n          session_id as \"sessionId\",\n          workspace_id as \"workspaceId\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          copied_history_item_count as \"copiedHistoryItemCount\",\n          replay\n        from replay_applied_session_fork(\n          ${accountId}::uuid,\n          ${input.sourceWorkspaceId}::uuid,\n          ${input.sourceSessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.destinationWorkspaceId}::uuid,\n          ${input.destinationVisibility},\n          ${input.workspaceSharedAcknowledged},\n          ${input.operationKey},\n          ${requestHash},\n          ${SESSION_TENANCY_ACTIVATION_VERSION}\n        )`,\n        );\n        return rows[0] ?? null;\n      },\n    );\n  } catch (error) {\n    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: false });\n  }\n}\n"],"mappings":";;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,WAAW;AACpB;AAAA,EACE,yBAAyB;AAAA,OAEpB;AAWP,IAAM,qCAAqC;AAEpC,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YACW,QACA,UAAwC,MACjD,SACA;AACA;AAAA,MACE,WAAW,kBACP,kEACA,WAAW,oBACT,6DACA;AAAA,MACN;AAAA,IACF;AAXS;AACA;AAAA,EAWX;AAAA,EAdS,OAAO;AAelB;AAEO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EAChD,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,0EAA0E,OAAO;AAAA,EACzF;AACF;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,yCAAyC,OAAO;AAAA,EACxD;AACF;AAEO,IAAM,oCAAN,cAAgD,MAAM;AAAA,EAClD,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,sCAAsC,OAAO;AAAA,EACrD;AACF;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAGO,SAAS,4BAA4B,OAA8C;AACxF,QAAM,QAAmB,CAAC,KAAK;AAC/B,QAAM,OAAO,oBAAI,IAAa;AAC9B,SAAO,MAAM,SAAS,KAAK,KAAK,OAAO,IAAI;AACzC,UAAM,UAAU,MAAM,MAAM;AAC5B,QAAI,CAAC,SAAS,OAAO,KAAK,KAAK,IAAI,OAAO,EAAG;AAC7C,SAAK,IAAI,OAAO;AAChB,eAAW,OAAO,CAAC,UAAU,eAAe,GAAY;AACtD,YAAM,SAAS,4BAA4B,UAAU,QAAQ,GAAG,CAAC;AACjE,UAAI,OAAO,QAAS,QAAO,OAAO;AAAA,IACpC;AACA,eAAW,OAAO,CAAC,SAAS,YAAY,eAAe,SAAS,QAAQ,GAAY;AAClF,YAAM,SAAS,QAAQ,GAAG;AAC1B,UAAI,MAAM,QAAQ,MAAM,EAAG,OAAM,KAAK,GAAG,MAAM;AAAA,eACtC,WAAW,OAAW,OAAM,KAAK,MAAM;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AACT;AAyDA,eAAsB,+BACpB,IACA,aACkB;AAClB,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,WAAW;AAClE,SAAO,MAAM,iBAAiB,IAAI,aAAa,OAAO,aAAa;AACjE,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,UACI,SAAS;AAAA,UACT,kCAAkC;AAAA;AAAA,IAExC;AACA,WAAO,KAAK,CAAC,GAAG,cAAc;AAAA,EAChC,CAAC;AACH;AAEA,eAAsB,8BACpB,IACA,OACqC;AACrC,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,WAAW;AACxE,SAAO,MAAM;AAAA,IACX;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,aAAa;AAClB,YAAM,OAAO,MAAM;AAAA,QAKjB;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA,YAKI,SAAS;AAAA,YACT,MAAM,WAAW;AAAA,YACjB,MAAM,cAAc;AAAA;AAAA,MAE1B;AACA,YAAM,SAAS,KAAK,CAAC;AACrB,UAAI,CAAC,OAAQ,OAAM,IAAI,0BAA0B;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAGA,eAAsB,mCACpB,IACA,OAC8D;AAC9D,MAAI;AACJ,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,UAII,MAAM,SAAS;AAAA,UACf,MAAM,WAAW;AAAA,UACjB,MAAM,SAAS;AAAA,UACf,MAAM,cAAc;AAAA;AAAA,IAE1B;AAAA,EACF,SAAS,OAAO;AAId,QAAI,uBAAuB,KAAK,MAAM,SAAS;AAC7C,YAAM,IAAI,gCAAgC,EAAE,OAAO,MAAM,CAAC;AAAA,IAC5D;AACA,UAAM;AAAA,EACR;AACA,QAAM,eAAe,KAAK,CAAC,GAAG;AAC9B,QAAM,oBAAoB,KAAK,CAAC,GAAG;AACnC,MAAI,CAAC,gBAAgB,CAAC,mBAAmB;AACvC,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO,EAAE,cAAc,kBAAkB;AAC3C;AAGA,eAAsB,wCACpB,IACA,OASsF;AACtF,QAAM,OAAO,MAAM;AAAA,IAKjB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKI,MAAM,SAAS;AAAA,QACf,MAAM,WAAW;AAAA,QACjB,MAAM,SAAS;AAAA,QACf,MAAM,eAAe;AAAA,QACrB,MAAM,WAAW;AAAA,QACjB,MAAM,cAAc;AAAA,QACpB,MAAM,wBAAwB;AAAA;AAAA,EAEpC;AACA,QAAM,eAAe,KAAK,CAAC,GAAG;AAC9B,QAAM,oBAAoB,KAAK,CAAC,GAAG;AACnC,QAAM,iBAAiB,KAAK,CAAC,GAAG;AAChC,MAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,gBAAgB;AAC1D,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,EAAE,cAAc,mBAAmB,eAAe;AAC3D;AAEA,eAAsB,oCACpB,IACA,cACe;AACf,QAAM,GAAG,QAAQ,qDAAqD,YAAY,SAAS;AAC7F;AAEA,eAAe,qCACb,IACA,aACe;AACf,MAAI,CAAE,MAAM,+BAA+B,IAAI,WAAW,GAAI;AAC5D,UAAM,IAAI,gCAAgC;AAAA,EAC5C;AACF;AAEA,SAAS,kCACP,OACA,SACO;AACP,QAAM,QAAQ,uBAAuB,KAAK;AAC1C,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,4BAA4B,iBAAiB,4BAA4B,KAAK,GAAG;AAAA,MACzF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,UAAU,WAAW,QAAQ,wBAAwB;AACvD,UAAM,IAAI,4BAA4B,mBAAmB,MAAM,EAAE,OAAO,MAAM,CAAC;AAAA,EACjF;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,4BAA4B,mBAAmB,MAAM,EAAE,OAAO,MAAM,CAAC;AAAA,EACjF;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,gCAAgC,EAAE,OAAO,MAAM,CAAC;AAAA,EAC5D;AACA,MAAI,UAAU,WAAW,UAAU,SAAS;AAC1C,UAAM,IAAI,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAAA,EACtD;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,kCAAkC,EAAE,OAAO,MAAM,CAAC;AAAA,EAC9D;AACA,QAAM;AACR;AAEO,SAAS,yCACd,OAIQ;AACR,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,WAAW,MAAM;AAAA,MACjB,kBAAkB,MAAM;AAAA,MACxB,wBAAwB,MAAM;AAAA,IAChC,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACjB;AAEO,SAAS,yBACd,OAOQ;AACR,QAAM,iCACJ,MAAM,0BAA0B,kBAAkB,CAAC,MAAM;AAC3D,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,KAAK;AAAA,MACH,iCACI;AAAA,QACE,SAAS;AAAA,QACT,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,MAAM;AAAA,QAC9B,uBAAuB,MAAM;AAAA,MAC/B,IACA;AAAA,QACE,SAAS;AAAA,QACT,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,MAAM;AAAA,QAC9B,uBAAuB,MAAM;AAAA,QAC7B,6BAA6B,MAAM;AAAA,MACrC;AAAA,IACN;AAAA,EACF,EACC,OAAO,KAAK;AACjB;AAEA,eAAsB,4BACpB,IACA,OAC4C;AAC5C,MAAI,CAAC,OAAO,cAAc,MAAM,sBAAsB,KAAK,MAAM,yBAAyB,GAAG;AAC3F,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,QAAM,cAAc,yCAAyC,KAAK;AAClE,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,WAAW;AACxE,QAAM,qCAAqC,IAAI,MAAM,WAAW;AAChE,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,aAAa;AAClB,cAAM,OAAO,MAAM;AAAA,UAejB;AAAA,UACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAeE,SAAS;AAAA,YACT,MAAM,WAAW;AAAA,YACjB,MAAM,SAAS;AAAA,YACf,MAAM,cAAc;AAAA,YACpB,MAAM,gBAAgB;AAAA,YACtB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA,YACX,kCAAkC;AAAA;AAAA,QAEtC;AACA,cAAM,SAAS,KAAK,CAAC;AACrB,YAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,kDAAkD;AAC/E,eAAO;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,sCAAkC,OAAO,EAAE,wBAAwB,KAAK,CAAC;AAAA,EAC3E;AACF;AAEA,eAAsB,mBACpB,IACA,OACmC;AACnC,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,MAAI,MAAM,2BAA2B,MAAM,mBAAmB;AAC5D,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,iBAAiB;AAC9E,QAAM,qCAAqC,IAAI,MAAM,iBAAiB;AACtE,QAAM,cAAc,yBAAyB,KAAK;AAClD,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,aAAa;AAClB,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAWE,SAAS;AAAA,YACT,MAAM,iBAAiB;AAAA,YACvB,MAAM,eAAe;AAAA,YACrB,MAAM,cAAc;AAAA,YACpB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,qBAAqB;AAAA,YAC3B,MAAM,2BAA2B;AAAA,YACjC,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA,YACX,kCAAkC;AAAA;AAAA,QAEtC;AACA,cAAM,SAAS,KAAK,CAAC;AACrB,YAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iCAAiC;AAC9D,eAAO;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AAKd,QAAI,uBAAuB,KAAK,MAAM,SAAS;AAC7C,YAAM,IAAI,gCAAgC,EAAE,OAAO,MAAM,CAAC;AAAA,IAC5D;AACA,sCAAkC,OAAO,EAAE,wBAAwB,MAAM,CAAC;AAAA,EAC5E;AACF;AAUA,eAAsB,yBACpB,IACA,OAC0C;AAC1C,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,MAAI,MAAM,2BAA2B,MAAM,mBAAmB;AAC5D,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,iBAAiB;AAC9E,QAAM,qCAAqC,IAAI,MAAM,iBAAiB;AACtE,QAAM,cAAc,yBAAyB,KAAK;AAClD,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,aAAa;AAClB,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAWE,SAAS;AAAA,YACT,MAAM,iBAAiB;AAAA,YACvB,MAAM,eAAe;AAAA,YACrB,MAAM,cAAc;AAAA,YACpB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,qBAAqB;AAAA,YAC3B,MAAM,2BAA2B;AAAA,YACjC,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA,YACX,kCAAkC;AAAA;AAAA,QAEtC;AACA,eAAO,KAAK,CAAC,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,sCAAkC,OAAO,EAAE,wBAAwB,MAAM,CAAC;AAAA,EAC5E;AACF;","names":[]}

package/dist/{chunk-ZWREYEWA.js → chunk-AZHW7R5V.js}

@@ -4,7 +4,7 @@ import {
   sessions,
   workspaceSessionActivityRevisions,
   workspaces
-} from "./chunk-6ZYKCRFO.js";
+} from "./chunk-KRLPEMLH.js";
 
 // src/persistence-errors.ts
 var SQLSTATE_KEYS = ["sqlState", "sqlstate", "code"];
@@ -331,7 +331,8 @@ function createDb(databaseUrl, options = {}) {
   const db = drizzle(client, { schema: schema_exports });
   dbBindings.set(db, {
     rlsStrategy: options.rlsStrategy ?? "force",
-    ...options.userLookup ? { userLookup: options.userLookup } : {}
+    ...options.userLookup ? { userLookup: options.userLookup } : {},
+    ...options.userProfileLookup ? { userProfileLookup: options.userProfileLookup } : {}
   });
   return {
     db,
@@ -343,7 +344,8 @@ function createDb(databaseUrl, options = {}) {
 function registerDbBinding(db, binding) {
   dbBindings.set(db, {
     rlsStrategy: binding.rlsStrategy ?? "force",
-    ...binding.userLookup ? { userLookup: binding.userLookup } : {}
+    ...binding.userLookup ? { userLookup: binding.userLookup } : {},
+    ...binding.userProfileLookup ? { userProfileLookup: binding.userProfileLookup } : {}
   });
 }
 async function setRlsContext(db, context) {
@@ -407,12 +409,17 @@ async function restoreRlsContextSettings(db, settings) {
     throw new Error("RLS context could not be restored after a nested scope");
   }
 }
-async function withRlsContext(db, context, fn, transactionConfig) {
+async function withRlsContext(db, context, fn, transactionConfig, sessionTenancyFence = "shared") {
   const restoreParentScope = isTransactionHandle(db);
   return await db.transaction(async (tx) => {
     const scoped = tx;
     const parentScope = restoreParentScope ? await readRlsContextSettings(scoped) : null;
     await setRlsContext(scoped, context);
+    if (context.workspaceId && sessionTenancyFence === "shared") {
+      await scoped.execute(
+        sql`select pg_advisory_xact_lock_shared(hashtextextended(${`session-tenancy:${context.workspaceId}`}, 0))`
+      );
+    }
     await assertRlsContextApplied(scoped, context);
     const value = await fn(scoped);
     if (parentScope) await restoreRlsContextSettings(scoped, parentScope);
@@ -573,8 +580,11 @@ async function finalizeSessionActivityGate(db, workspaceId) {
   await db.execute(
     sql`set constraints sessions_activity_insert_commit_guard, sessions_activity_update_commit_guard immediate`
   );
+  await db.execute(
+    sql`set constraints sessions_activity_insert_commit_guard, sessions_activity_update_commit_guard deferred`
+  );
 }
-async function withSessionActivityRlsContext(db, context, fn, transactionConfig) {
+async function withSessionActivityRlsContext(db, context, fn, transactionConfig, fenceMode = "shared") {
   await assertSessionActivityGateEntry(db);
   return await withRlsContext(
     db,
@@ -588,7 +598,8 @@ async function withSessionActivityRlsContext(db, context, fn, transactionConfig)
       }
       return value;
     },
-    transactionConfig
+    transactionConfig,
+    fenceMode
   );
 }
 async function withWorkspaceSessionActivityRls(db, workspaceId, fn, transactionConfig) {
@@ -599,6 +610,37 @@ async function withWorkspaceSessionActivityRls(db, workspaceId, fn, transactionC
     transactionConfig
   );
 }
+async function withRestoredSessionActivityRlsContext(db, context, fn) {
+  if (!isTransactionHandle(db)) {
+    throw new Error("Sequential workspace activity scopes require a caller-owned transaction");
+  }
+  const [prior] = await rawRows(
+    db,
+    sql`select
+      coalesce(current_setting('opengeni.session_activity_gate_state', true), '') as state,
+      coalesce(
+        current_setting('opengeni.session_activity_gate_workspace_id', true), ''
+      ) as workspace_id`
+  );
+  try {
+    return await withRlsContext(db, context, async (scopedDb) => {
+      const gate = await beginSessionActivityGate(scopedDb, context.workspaceId);
+      if (!gate.owner) {
+        throw new Error("Sequential workspace activity scope unexpectedly reused an open gate");
+      }
+      const value = await fn(gate.db);
+      await assertRlsContextApplied(gate.db, context);
+      await finalizeSessionActivityGate(gate.db, context.workspaceId);
+      return value;
+    });
+  } finally {
+    await db.execute(sql`select
+      set_config('opengeni.session_activity_gate_state', ${prior?.state ?? ""}, true),
+      set_config(
+        'opengeni.session_activity_gate_workspace_id', ${prior?.workspace_id ?? ""}, true
+      )`);
+  }
+}
 async function withSessionActivitySavepoint(db, fn) {
   return await db.transaction(async (tx) => await fn(tx));
 }
@@ -617,7 +659,7 @@ async function retryRlsPersistence(db, context, options, fn) {
     return await withRlsContext(db, context, fn);
   });
 }
-async function withWorkspaceSubjectRls(db, workspaceId, subjectId, fn, transactionConfig) {
+async function withWorkspaceSubjectRls(db, workspaceId, subjectId, fn, transactionConfig, sessionTenancyFence = "shared") {
   if (!subjectId.trim()) {
     throw new Error("withWorkspaceSubjectRls: a non-empty subjectId is required");
   }
@@ -629,10 +671,11 @@ async function withWorkspaceSubjectRls(db, workspaceId, subjectId, fn, transacti
       await setSubjectRlsContext(scopedDb, subjectId);
       return await fn(scopedDb);
     },
-    transactionConfig
+    transactionConfig,
+    sessionTenancyFence
   );
 }
-async function withWorkspaceSubjectSessionActivityRls(db, workspaceId, subjectId, fn, transactionConfig) {
+async function withWorkspaceSubjectSessionActivityRls(db, workspaceId, subjectId, fn, transactionConfig, fenceMode = "shared") {
   if (!subjectId.trim()) {
     throw new Error("withWorkspaceSubjectSessionActivityRls: a non-empty subjectId is required");
   }
@@ -644,7 +687,8 @@ async function withWorkspaceSubjectSessionActivityRls(db, workspaceId, subjectId
       await setSubjectRlsContext(scopedDb, subjectId);
       return await fn(scopedDb);
     },
-    transactionConfig
+    transactionConfig,
+    fenceMode
   );
 }
 async function setSubjectRlsContext(db, subjectId) {
@@ -697,6 +741,7 @@ export {
   withWorkspaceRls,
   withSessionActivityRlsContext,
   withWorkspaceSessionActivityRls,
+  withRestoredSessionActivityRlsContext,
   withSessionActivitySavepoint,
   retrySessionActivityRls,
   retryWorkspacePersistence,
@@ -708,4 +753,4 @@ export {
   withAccountRls,
   dbBindingFor
 };
-//# sourceMappingURL=chunk-ZWREYEWA.js.map
+//# sourceMappingURL=chunk-AZHW7R5V.js.map