@opengeni/db 1.0.2 → 1.1.0

package/dist/{chunk-UEQQ2WWU.js → chunk-Z5HJXH3X.js}

@@ -2,10 +2,9 @@ import {
   nestedPostgresSqlState,
   rawRows,
   rlsContextForWorkspace,
-  withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-56MYWKQV.js";
+} from "./chunk-SKYRM7R7.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -28,7 +27,7 @@ var SessionTenancyConflictError = class extends Error {
 var SessionTenancyNotActivatedError = class extends Error {
   name = "SessionTenancyNotActivatedError";
   constructor(options) {
-    super("Session tenancy product surface is not activated for this organization", options);
+    super("Only-me chats are not enabled for this organization", options);
   }
 };
 var SessionTenancyAccessError = class extends Error {
@@ -65,19 +64,6 @@ function nestedSessionTenancyBlocker(error) {
   }
   return null;
 }
-async function sessionTenancyProductActivated(db, workspaceId) {
-  const { accountId } = await rlsContextForWorkspace(db, workspaceId);
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await rawRows(
-      scopedDb,
-      sql`select session_tenancy_product_activated(
-        ${accountId}::uuid,
-        ${SESSION_TENANCY_ACTIVATION_VERSION}
-      ) as activated`
-    );
-    return rows[0]?.activated === true;
-  });
-}
 async function getPrivateSessionCreatePolicy(db, input) {
   const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
   return await withWorkspaceSubjectRls(
@@ -159,11 +145,6 @@ async function openPrivateChildSessionCreateCapability(db, input) {
 async function closePrivateSessionCreateCapability(db, capabilityId) {
   await db.execute(sql`select close_private_session_create_capability(${capabilityId}::uuid)`);
 }
-async function assertSessionTenancyProductActivated(db, workspaceId) {
-  if (!await sessionTenancyProductActivated(db, workspaceId)) {
-    throw new SessionTenancyNotActivatedError();
-  }
-}
 function mapSessionTenancyPersistenceError(error, options) {
   const state = nestedPostgresSqlState(error);
   if (state === "55P03") {
@@ -251,7 +232,6 @@ async function transitionSessionVisibility(db, input) {
   if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
   const requestHash = canonicalSessionVisibilityTransitionHash(input);
   const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
-  await assertSessionTenancyProductActivated(db, input.workspaceId);
   try {
     return await withWorkspaceSubjectSessionActivityRls(
       db,
@@ -313,7 +293,6 @@ async function forkSessionContent(db, input) {
     throw new Error("Resolved session fork runtime configuration does not match its request");
   }
   const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
-  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
   const requestHash = canonicalSessionForkHash(input);
   try {
     return await withWorkspaceSubjectRls(
@@ -408,7 +387,6 @@ async function replayAppliedSessionFork(db, input) {
     throw new Error("The first session fork contract is same-workspace only");
   }
   const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
-  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
   const requestHash = canonicalSessionForkHash(input);
   try {
     return await withWorkspaceSubjectRls(
@@ -491,7 +469,6 @@ export {
   SessionTenancyAccessError,
   SessionTenancyInvalidRequestError,
   nestedSessionTenancyBlocker,
-  sessionTenancyProductActivated,
   getPrivateSessionCreatePolicy,
   openPrivateSessionCreateCapability,
   openPrivateChildSessionCreateCapability,
@@ -502,4 +479,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-UEQQ2WWU.js.map
+//# sourceMappingURL=chunk-Z5HJXH3X.js.map

package/dist/chunk-Z5HJXH3X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session-tenancy.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { sql } from \"drizzle-orm\";\nimport {\n  SessionTenancyBlocker as SessionTenancyBlockerSchema,\n  type SessionTenancyBlocker,\n} from \"@opengeni/contracts\";\nimport {\n  rawRows,\n  type Database,\n  rlsContextForWorkspace,\n  withWorkspaceSubjectRls,\n  withWorkspaceSubjectSessionActivityRls,\n} from \"./database\";\nimport { nestedPostgresSqlState } from \"./persistence-errors\";\n\n// Frozen SQL protocol argument: every organization is activated at version 1\n// since migration 0611, but the lifecycle routines still require it explicitly.\nconst SESSION_TENANCY_ACTIVATION_VERSION = 1;\n\nexport class SessionTenancyConflictError extends Error {\n  readonly name = \"SessionTenancyConflictError\";\n  constructor(\n    readonly reason: \"not_quiescent\" | \"authority_epoch\" | \"operation_reuse\",\n    readonly blocker: SessionTenancyBlocker | null = null,\n    options?: ErrorOptions,\n  ) {\n    super(\n      reason === \"not_quiescent\"\n        ? \"Session must be fully quiescent before its tenancy can change\"\n        : reason === \"authority_epoch\"\n          ? \"Session authority changed before the operation committed\"\n          : \"Session tenancy operation key was reused with different input\",\n      options,\n    );\n  }\n}\n\n/**\n * The organization's owner/admin Only-me setting does not permit a new private\n * session (or private transition) in this shared workspace. Activation itself is\n * universal since migration 0611; the name and the SESSION_TENANCY_NOT_ACTIVATED\n * wire code are kept for client compatibility.\n */\nexport class SessionTenancyNotActivatedError extends Error {\n  readonly name = \"SessionTenancyNotActivatedError\";\n  constructor(options?: ErrorOptions) {\n    super(\"Only-me chats are not enabled for this organization\", options);\n  }\n}\n\nexport class SessionTenancyAccessError extends Error {\n  readonly name = \"SessionTenancyAccessError\";\n  constructor(options?: ErrorOptions) {\n    super(\"Session tenancy target is unavailable\", options);\n  }\n}\n\nexport class SessionTenancyInvalidRequestError extends Error {\n  readonly name = \"SessionTenancyInvalidRequestError\";\n  constructor(options?: ErrorOptions) {\n    super(\"Session tenancy request is invalid\", options);\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\n/** Extract only the fixed quiescence DETAIL vocabulary, never arbitrary driver detail. */\nexport function nestedSessionTenancyBlocker(error: unknown): SessionTenancyBlocker | null {\n  const queue: unknown[] = [error];\n  const seen = new Set<unknown>();\n  while (queue.length > 0 && seen.size < 64) {\n    const current = queue.shift();\n    if (!isRecord(current) || seen.has(current)) continue;\n    seen.add(current);\n    for (const key of [\"detail\", \"detailMessage\"] as const) {\n      const parsed = SessionTenancyBlockerSchema.safeParse(current[key]);\n      if (parsed.success) return parsed.data;\n    }\n    for (const key of [\"cause\", \"original\", \"driverError\", \"error\", \"errors\"] as const) {\n      const nested = current[key];\n      if (Array.isArray(nested)) queue.push(...nested);\n      else if (nested !== undefined) queue.push(nested);\n    }\n  }\n  return null;\n}\n\nexport type SessionTenancyVisibility = \"user_private\" | \"workspace_shared\";\n\nexport type PrivateSessionCreatePolicy = {\n  personalWorkspace: boolean;\n  platformAvailable: boolean;\n  organizationEnabled: boolean;\n};\n\nexport type TransitionSessionVisibilityInput = {\n  workspaceId: string;\n  sessionId: string;\n  actorSubjectId: string;\n  targetVisibility: SessionTenancyVisibility;\n  expectedAuthorityEpoch: number;\n  operationKey: string;\n  beforeCommit?: (tx: Database) => Promise<void>;\n};\n\nexport type TransitionSessionVisibilityResult = {\n  operationId: string;\n  eventId: string | null;\n  eventSequence: number | null;\n  visibility: SessionTenancyVisibility;\n  authorityEpoch: number;\n  ownerOrganizationMembershipId: string | null;\n  changed: boolean;\n  replay: boolean;\n  interruptedAttemptCount: number;\n  cancelledTurnCount: number;\n  cancelledUpdateCount: number;\n  pausedGoalCount: number;\n  revokedGrantCount: number;\n};\n\nexport type ForkSessionContentInput = {\n  sourceEventId?: string;\n  sourceWorkspaceId: string;\n  sourceSessionId: string;\n  actorSubjectId: string;\n  destinationWorkspaceId: string;\n  destinationVisibility: SessionTenancyVisibility;\n  workspaceSharedAcknowledged: boolean;\n  operationKey: string;\n  runtimeRequest?: ForkSessionRuntimeRequest;\n  runtimeConfiguration?: ForkSessionRuntimeConfiguration;\n  beforeCommit?: (tx: Database) => Promise<void>;\n};\n\nexport type ForkSessionRuntimeRequest = {\n  variableSetIds: string[];\n  rigId: string | null;\n};\n\nexport type ForkSessionRuntimeConfiguration = ForkSessionRuntimeRequest & {\n  rigVersionId: string | null;\n};\n\nexport type ForkSessionContentResult = {\n  operationId: string;\n  eventId: string;\n  eventSequence: number;\n  sessionId: string;\n  workspaceId: string;\n  visibility: SessionTenancyVisibility;\n  authorityEpoch: number;\n  copiedHistoryItemCount: number;\n  replay: boolean;\n  runtimeEventId: string | null;\n  runtimeEventSequence: number | null;\n};\n\nexport async function getPrivateSessionCreatePolicy(\n  db: Database,\n  input: { workspaceId: string; actorSubjectId: string },\n): Promise<PrivateSessionCreatePolicy> {\n  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);\n  return await withWorkspaceSubjectRls(\n    db,\n    input.workspaceId,\n    input.actorSubjectId,\n    async (scopedDb) => {\n      const rows = await rawRows<{\n        personalWorkspace: boolean;\n        platformAvailable: boolean;\n        organizationEnabled: boolean;\n      }>(\n        scopedDb,\n        sql`select\n          personal_workspace as \"personalWorkspace\",\n          platform_available as \"platformAvailable\",\n          organization_enabled as \"organizationEnabled\"\n        from get_private_session_create_policy(\n          ${accountId}::uuid,\n          ${input.workspaceId}::uuid,\n          ${input.actorSubjectId}\n        )`,\n      );\n      const policy = rows[0];\n      if (!policy) throw new SessionTenancyAccessError();\n      return policy;\n    },\n  );\n}\n\n/** Open the exact transaction-local trigger capability used by atomic private create. */\nexport async function openPrivateSessionCreateCapability(\n  db: Database,\n  input: { accountId: string; workspaceId: string; sessionId: string; actorSubjectId: string },\n): Promise<{ capabilityId: string; ownerMembershipId: string }> {\n  let rows: Array<{ capabilityId: string; ownerMembershipId: string }>;\n  try {\n    rows = await rawRows<{ capabilityId: string; ownerMembershipId: string }>(\n      db,\n      sql`select\n        capability_id as \"capabilityId\",\n        owner_membership_id as \"ownerMembershipId\"\n      from open_private_session_create_capability(\n        ${input.accountId}::uuid,\n        ${input.workspaceId}::uuid,\n        ${input.sessionId}::uuid,\n        ${input.actorSubjectId}\n      )`,\n    );\n  } catch (error) {\n    // The definer raises 55000 only when the organization owner/admin setting\n    // does not permit a new private session in this shared workspace; every\n    // authority failure remains 42501 and propagates unchanged.\n    if (nestedPostgresSqlState(error) === \"55000\") {\n      throw new SessionTenancyNotActivatedError({ cause: error });\n    }\n    throw error;\n  }\n  const capabilityId = rows[0]?.capabilityId;\n  const ownerMembershipId = rows[0]?.ownerMembershipId;\n  if (!capabilityId || !ownerMembershipId) {\n    throw new Error(\"Private session create capability was not returned\");\n  }\n  return { capabilityId, ownerMembershipId };\n}\n\n/** Open the exact transaction-local capability for one private child insert. */\nexport async function openPrivateChildSessionCreateCapability(\n  db: Database,\n  input: {\n    accountId: string;\n    workspaceId: string;\n    sessionId: string;\n    parentSessionId: string;\n    actorTurnId: string;\n    actorAttemptId: string;\n    actorExecutionGeneration: number;\n  },\n): Promise<{ capabilityId: string; ownerMembershipId: string; ownerSubjectId: string }> {\n  const rows = await rawRows<{\n    capabilityId: string;\n    ownerMembershipId: string;\n    ownerSubjectId: string;\n  }>(\n    db,\n    sql`select\n      capability_id as \"capabilityId\",\n      owner_membership_id as \"ownerMembershipId\",\n      owner_subject_id as \"ownerSubjectId\"\n    from open_private_child_session_create_capability(\n      ${input.accountId}::uuid,\n      ${input.workspaceId}::uuid,\n      ${input.sessionId}::uuid,\n      ${input.parentSessionId}::uuid,\n      ${input.actorTurnId}::uuid,\n      ${input.actorAttemptId}::uuid,\n      ${input.actorExecutionGeneration}::integer\n    )`,\n  );\n  const capabilityId = rows[0]?.capabilityId;\n  const ownerMembershipId = rows[0]?.ownerMembershipId;\n  const ownerSubjectId = rows[0]?.ownerSubjectId;\n  if (!capabilityId || !ownerMembershipId || !ownerSubjectId) {\n    throw new Error(\"Private child session create capability was not returned\");\n  }\n  return { capabilityId, ownerMembershipId, ownerSubjectId };\n}\n\nexport async function closePrivateSessionCreateCapability(\n  db: Database,\n  capabilityId: string,\n): Promise<void> {\n  await db.execute(sql`select close_private_session_create_capability(${capabilityId}::uuid)`);\n}\n\nfunction mapSessionTenancyPersistenceError(\n  error: unknown,\n  options: { authorityEpochConflict: boolean },\n): never {\n  const state = nestedPostgresSqlState(error);\n  if (state === \"55P03\") {\n    throw new SessionTenancyConflictError(\"not_quiescent\", nestedSessionTenancyBlocker(error), {\n      cause: error,\n    });\n  }\n  if (state === \"40001\" && options.authorityEpochConflict) {\n    throw new SessionTenancyConflictError(\"authority_epoch\", null, { cause: error });\n  }\n  if (state === \"23505\") {\n    throw new SessionTenancyConflictError(\"operation_reuse\", null, { cause: error });\n  }\n  if (state === \"55000\") {\n    throw new SessionTenancyNotActivatedError({ cause: error });\n  }\n  if (state === \"42501\" || state === \"P0002\") {\n    throw new SessionTenancyAccessError({ cause: error });\n  }\n  if (state === \"22023\") {\n    throw new SessionTenancyInvalidRequestError({ cause: error });\n  }\n  throw error;\n}\n\nexport function canonicalSessionVisibilityTransitionHash(\n  input: Pick<\n    TransitionSessionVisibilityInput,\n    \"sessionId\" | \"targetVisibility\" | \"expectedAuthorityEpoch\"\n  >,\n): string {\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify({\n        version: 1,\n        sessionId: input.sessionId,\n        targetVisibility: input.targetVisibility,\n        expectedAuthorityEpoch: input.expectedAuthorityEpoch,\n      }),\n    )\n    .digest(\"hex\");\n}\n\nexport function canonicalSessionForkHash(\n  input: Pick<\n    ForkSessionContentInput,\n    | \"sourceSessionId\"\n    | \"destinationWorkspaceId\"\n    | \"destinationVisibility\"\n    | \"workspaceSharedAcknowledged\"\n    | \"runtimeRequest\"\n    | \"sourceEventId\"\n  >,\n): string {\n  if (input.sourceEventId) {\n    return createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          version: 4,\n          sourceSessionId: input.sourceSessionId,\n          destinationWorkspaceId: input.destinationWorkspaceId,\n          destinationVisibility: input.destinationVisibility,\n          workspaceSharedAcknowledged: input.workspaceSharedAcknowledged,\n          sourceEventId: input.sourceEventId,\n        }),\n      )\n      .digest(\"hex\");\n  }\n  if (input.runtimeRequest) {\n    return createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          version: 3,\n          sourceSessionId: input.sourceSessionId,\n          destinationWorkspaceId: input.destinationWorkspaceId,\n          destinationVisibility: input.destinationVisibility,\n          workspaceSharedAcknowledged: input.workspaceSharedAcknowledged,\n          runtime: input.runtimeRequest,\n        }),\n      )\n      .digest(\"hex\");\n  }\n  const legacyCompatiblePrivateRequest =\n    input.destinationVisibility === \"user_private\" && !input.workspaceSharedAcknowledged;\n  return createHash(\"sha256\")\n    .update(\n      JSON.stringify(\n        legacyCompatiblePrivateRequest\n          ? {\n              version: 1,\n              sourceSessionId: input.sourceSessionId,\n              destinationWorkspaceId: input.destinationWorkspaceId,\n              destinationVisibility: input.destinationVisibility,\n            }\n          : {\n              version: 2,\n              sourceSessionId: input.sourceSessionId,\n              destinationWorkspaceId: input.destinationWorkspaceId,\n              destinationVisibility: input.destinationVisibility,\n              workspaceSharedAcknowledged: input.workspaceSharedAcknowledged,\n            },\n      ),\n    )\n    .digest(\"hex\");\n}\n\nfunction canonicalForkRuntimeConfigurationDigest(input: ForkSessionRuntimeRequest): string {\n  return createHash(\"sha256\")\n    .update(JSON.stringify({ version: 1, ...input }))\n    .digest(\"hex\");\n}\n\nexport async function transitionSessionVisibility(\n  db: Database,\n  input: TransitionSessionVisibilityInput,\n): Promise<TransitionSessionVisibilityResult> {\n  if (!Number.isSafeInteger(input.expectedAuthorityEpoch) || input.expectedAuthorityEpoch < 1) {\n    throw new Error(\"expectedAuthorityEpoch must be a positive safe integer\");\n  }\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  const requestHash = canonicalSessionVisibilityTransitionHash(input);\n  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);\n  try {\n    return await withWorkspaceSubjectSessionActivityRls(\n      db,\n      input.workspaceId,\n      input.actorSubjectId,\n      async (scopedDb) => {\n        const rows = await rawRows<{\n          operationId: string;\n          eventId: string | null;\n          eventSequence: number | null;\n          visibility: SessionTenancyVisibility;\n          authorityEpoch: number;\n          ownerOrganizationMembershipId: string | null;\n          changed: boolean;\n          replay: boolean;\n          interruptedAttemptCount: number;\n          cancelledTurnCount: number;\n          cancelledUpdateCount: number;\n          pausedGoalCount: number;\n          revokedGrantCount: number;\n        }>(\n          scopedDb,\n          sql`select\n          operation_id as \"operationId\",\n          event_id as \"eventId\",\n          event_sequence as \"eventSequence\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          owner_organization_membership_id as \"ownerOrganizationMembershipId\",\n          changed,\n          replay,\n          interrupted_attempt_count as \"interruptedAttemptCount\",\n          cancelled_turn_count as \"cancelledTurnCount\",\n          cancelled_update_count as \"cancelledUpdateCount\",\n          paused_goal_count as \"pausedGoalCount\",\n          revoked_grant_count as \"revokedGrantCount\"\n        from transition_session_visibility(\n          ${accountId}::uuid,\n          ${input.workspaceId}::uuid,\n          ${input.sessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.targetVisibility},\n          ${input.expectedAuthorityEpoch},\n          ${input.operationKey},\n          ${requestHash},\n          ${SESSION_TENANCY_ACTIVATION_VERSION}\n        )`,\n        );\n        const result = rows[0];\n        if (!result) throw new Error(\"Session visibility transition returned no result\");\n        await input.beforeCommit?.(scopedDb);\n        return result;\n      },\n      undefined,\n      \"none\",\n    );\n  } catch (error) {\n    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: true });\n  }\n}\n\nexport async function forkSessionContent(\n  db: Database,\n  input: ForkSessionContentInput,\n): Promise<ForkSessionContentResult> {\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  if (input.destinationWorkspaceId !== input.sourceWorkspaceId) {\n    throw new Error(\"The first session fork contract is same-workspace only\");\n  }\n  if (input.sourceEventId && input.runtimeRequest) {\n    throw new Error(\"Message forks cannot replace runtime setup\");\n  }\n  if (Boolean(input.runtimeRequest) !== Boolean(input.runtimeConfiguration)) {\n    throw new Error(\"A fresh session fork runtime request requires its resolved configuration\");\n  }\n  if (\n    input.runtimeRequest &&\n    (input.runtimeRequest.rigId !== input.runtimeConfiguration?.rigId ||\n      JSON.stringify(input.runtimeRequest.variableSetIds) !==\n        JSON.stringify(input.runtimeConfiguration?.variableSetIds))\n  ) {\n    throw new Error(\"Resolved session fork runtime configuration does not match its request\");\n  }\n  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);\n  const requestHash = canonicalSessionForkHash(input);\n  try {\n    return await withWorkspaceSubjectRls(\n      db,\n      input.sourceWorkspaceId,\n      input.actorSubjectId,\n      async (scopedDb) => {\n        if (input.runtimeRequest && input.runtimeConfiguration) {\n          const runtimeDigest = canonicalForkRuntimeConfigurationDigest(input.runtimeRequest);\n          const rows = await rawRows<ForkSessionContentResult>(\n            scopedDb,\n            sql`select\n            operation_id as \"operationId\",\n            event_id as \"eventId\",\n            event_sequence as \"eventSequence\",\n            session_id as \"sessionId\",\n            workspace_id as \"workspaceId\",\n            visibility,\n            authority_epoch as \"authorityEpoch\",\n            copied_history_item_count as \"copiedHistoryItemCount\",\n            replay,\n            runtime_event_id as \"runtimeEventId\",\n            runtime_event_sequence as \"runtimeEventSequence\"\n          from fork_session_content_with_runtime(\n            ${accountId}::uuid,\n            ${input.sourceWorkspaceId}::uuid,\n            ${input.sourceSessionId}::uuid,\n            ${input.actorSubjectId},\n            ${input.destinationWorkspaceId}::uuid,\n            ${input.destinationVisibility},\n            ${input.workspaceSharedAcknowledged},\n            ${input.operationKey},\n            ${requestHash},\n            ${SESSION_TENANCY_ACTIVATION_VERSION},\n            ${JSON.stringify(input.runtimeConfiguration.variableSetIds)}::jsonb,\n            ${input.runtimeConfiguration.rigId}::uuid,\n            ${input.runtimeConfiguration.rigVersionId}::uuid,\n            ${runtimeDigest}\n          )`,\n          );\n          const result = rows[0];\n          if (!result) throw new Error(\"Session fork returned no result\");\n          await input.beforeCommit?.(scopedDb);\n          return result;\n        }\n        const rows = await rawRows<ForkSessionContentResult>(\n          scopedDb,\n          sql`select\n          operation_id as \"operationId\",\n          event_id as \"eventId\",\n          event_sequence as \"eventSequence\",\n          session_id as \"sessionId\",\n          workspace_id as \"workspaceId\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          copied_history_item_count as \"copiedHistoryItemCount\",\n          replay,\n          null::uuid as \"runtimeEventId\",\n          null::integer as \"runtimeEventSequence\"\n        from fork_session_content(\n          ${accountId}::uuid,\n          ${input.sourceWorkspaceId}::uuid,\n          ${input.sourceSessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.destinationWorkspaceId}::uuid,\n          ${input.destinationVisibility},\n          ${input.workspaceSharedAcknowledged},\n          ${input.operationKey},\n          ${requestHash},\n          ${SESSION_TENANCY_ACTIVATION_VERSION}\n          ${input.sourceEventId ? sql`, ${input.sourceEventId}::uuid` : sql``}\n        )`,\n        );\n        const result = rows[0];\n        if (!result) throw new Error(\"Session fork returned no result\");\n        await input.beforeCommit?.(scopedDb);\n        return result;\n      },\n      undefined,\n      \"none\",\n    );\n  } catch (error) {\n    // A private destination inside a shared workspace carries the same\n    // organization owner/admin product decision the create path enforces\n    // (migration 0323), and the fork routine raises the same 55000. Surface it\n    // as the not-activated product state rather than an opaque database error.\n    if (nestedPostgresSqlState(error) === \"55000\") {\n      throw new SessionTenancyNotActivatedError({ cause: error });\n    }\n    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: false });\n  }\n}\n\n/**\n * Recover one exact committed fork before mutable source-session authorization.\n *\n * The database capability requires the authenticated actor's active workspace\n * authority and matches the complete actor/workspace/source/key/request-hash\n * tuple. A fresh key returns null; changed intent raises the ordinary tenancy\n * idempotency conflict. This is receipt recovery, not session discovery.\n */\nexport async function replayAppliedSessionFork(\n  db: Database,\n  input: ForkSessionContentInput,\n): Promise<ForkSessionContentResult | null> {\n  if (!input.operationKey.trim()) throw new Error(\"operationKey must not be empty\");\n  if (input.destinationWorkspaceId !== input.sourceWorkspaceId) {\n    throw new Error(\"The first session fork contract is same-workspace only\");\n  }\n  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);\n  const requestHash = canonicalSessionForkHash(input);\n  try {\n    return await withWorkspaceSubjectRls(\n      db,\n      input.sourceWorkspaceId,\n      input.actorSubjectId,\n      async (scopedDb) => {\n        if (input.runtimeRequest) {\n          const runtimeDigest = canonicalForkRuntimeConfigurationDigest(input.runtimeRequest);\n          const rows = await rawRows<ForkSessionContentResult>(\n            scopedDb,\n            sql`select\n            operation_id as \"operationId\",\n            event_id as \"eventId\",\n            event_sequence as \"eventSequence\",\n            session_id as \"sessionId\",\n            workspace_id as \"workspaceId\",\n            visibility,\n            authority_epoch as \"authorityEpoch\",\n            copied_history_item_count as \"copiedHistoryItemCount\",\n            replay,\n            runtime_event_id as \"runtimeEventId\",\n            runtime_event_sequence as \"runtimeEventSequence\"\n          from replay_applied_session_fork_with_runtime(\n            ${accountId}::uuid,\n            ${input.sourceWorkspaceId}::uuid,\n            ${input.sourceSessionId}::uuid,\n            ${input.actorSubjectId},\n            ${input.destinationWorkspaceId}::uuid,\n            ${input.destinationVisibility},\n            ${input.workspaceSharedAcknowledged},\n            ${input.operationKey},\n            ${requestHash},\n            ${SESSION_TENANCY_ACTIVATION_VERSION},\n            ${runtimeDigest}\n          )`,\n          );\n          await input.beforeCommit?.(scopedDb);\n          return rows[0] ?? null;\n        }\n        const rows = await rawRows<ForkSessionContentResult>(\n          scopedDb,\n          sql`select\n          operation_id as \"operationId\",\n          event_id as \"eventId\",\n          event_sequence as \"eventSequence\",\n          session_id as \"sessionId\",\n          workspace_id as \"workspaceId\",\n          visibility,\n          authority_epoch as \"authorityEpoch\",\n          copied_history_item_count as \"copiedHistoryItemCount\",\n          replay,\n          null::uuid as \"runtimeEventId\",\n          null::integer as \"runtimeEventSequence\"\n        from replay_applied_session_fork(\n          ${accountId}::uuid,\n          ${input.sourceWorkspaceId}::uuid,\n          ${input.sourceSessionId}::uuid,\n          ${input.actorSubjectId},\n          ${input.destinationWorkspaceId}::uuid,\n          ${input.destinationVisibility},\n          ${input.workspaceSharedAcknowledged},\n          ${input.operationKey},\n          ${requestHash},\n          ${SESSION_TENANCY_ACTIVATION_VERSION}\n        )`,\n        );\n        await input.beforeCommit?.(scopedDb);\n        return rows[0] ?? null;\n      },\n    );\n  } catch (error) {\n    mapSessionTenancyPersistenceError(error, { authorityEpochConflict: false });\n  }\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,WAAW;AACpB;AAAA,EACE,yBAAyB;AAAA,OAEpB;AAYP,IAAM,qCAAqC;AAEpC,IAAM,8BAAN,cAA0C,MAAM;AAAA,EAErD,YACW,QACA,UAAwC,MACjD,SACA;AACA;AAAA,MACE,WAAW,kBACP,kEACA,WAAW,oBACT,6DACA;AAAA,MACN;AAAA,IACF;AAXS;AACA;AAAA,EAWX;AAAA,EAdS,OAAO;AAelB;AAQO,IAAM,kCAAN,cAA8C,MAAM;AAAA,EAChD,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,uDAAuD,OAAO;AAAA,EACtE;AACF;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,yCAAyC,OAAO;AAAA,EACxD;AACF;AAEO,IAAM,oCAAN,cAAgD,MAAM;AAAA,EAClD,OAAO;AAAA,EAChB,YAAY,SAAwB;AAClC,UAAM,sCAAsC,OAAO;AAAA,EACrD;AACF;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAGO,SAAS,4BAA4B,OAA8C;AACxF,QAAM,QAAmB,CAAC,KAAK;AAC/B,QAAM,OAAO,oBAAI,IAAa;AAC9B,SAAO,MAAM,SAAS,KAAK,KAAK,OAAO,IAAI;AACzC,UAAM,UAAU,MAAM,MAAM;AAC5B,QAAI,CAAC,SAAS,OAAO,KAAK,KAAK,IAAI,OAAO,EAAG;AAC7C,SAAK,IAAI,OAAO;AAChB,eAAW,OAAO,CAAC,UAAU,eAAe,GAAY;AACtD,YAAM,SAAS,4BAA4B,UAAU,QAAQ,GAAG,CAAC;AACjE,UAAI,OAAO,QAAS,QAAO,OAAO;AAAA,IACpC;AACA,eAAW,OAAO,CAAC,SAAS,YAAY,eAAe,SAAS,QAAQ,GAAY;AAClF,YAAM,SAAS,QAAQ,GAAG;AAC1B,UAAI,MAAM,QAAQ,MAAM,EAAG,OAAM,KAAK,GAAG,MAAM;AAAA,eACtC,WAAW,OAAW,OAAM,KAAK,MAAM;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AACT;AAyEA,eAAsB,8BACpB,IACA,OACqC;AACrC,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,WAAW;AACxE,SAAO,MAAM;AAAA,IACX;AAAA,IACA,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAO,aAAa;AAClB,YAAM,OAAO,MAAM;AAAA,QAKjB;AAAA,QACA;AAAA;AAAA;AAAA;AAAA;AAAA,YAKI,SAAS;AAAA,YACT,MAAM,WAAW;AAAA,YACjB,MAAM,cAAc;AAAA;AAAA,MAE1B;AACA,YAAM,SAAS,KAAK,CAAC;AACrB,UAAI,CAAC,OAAQ,OAAM,IAAI,0BAA0B;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAGA,eAAsB,mCACpB,IACA,OAC8D;AAC9D,MAAI;AACJ,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,UAII,MAAM,SAAS;AAAA,UACf,MAAM,WAAW;AAAA,UACjB,MAAM,SAAS;AAAA,UACf,MAAM,cAAc;AAAA;AAAA,IAE1B;AAAA,EACF,SAAS,OAAO;AAId,QAAI,uBAAuB,KAAK,MAAM,SAAS;AAC7C,YAAM,IAAI,gCAAgC,EAAE,OAAO,MAAM,CAAC;AAAA,IAC5D;AACA,UAAM;AAAA,EACR;AACA,QAAM,eAAe,KAAK,CAAC,GAAG;AAC9B,QAAM,oBAAoB,KAAK,CAAC,GAAG;AACnC,MAAI,CAAC,gBAAgB,CAAC,mBAAmB;AACvC,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO,EAAE,cAAc,kBAAkB;AAC3C;AAGA,eAAsB,wCACpB,IACA,OASsF;AACtF,QAAM,OAAO,MAAM;AAAA,IAKjB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKI,MAAM,SAAS;AAAA,QACf,MAAM,WAAW;AAAA,QACjB,MAAM,SAAS;AAAA,QACf,MAAM,eAAe;AAAA,QACrB,MAAM,WAAW;AAAA,QACjB,MAAM,cAAc;AAAA,QACpB,MAAM,wBAAwB;AAAA;AAAA,EAEpC;AACA,QAAM,eAAe,KAAK,CAAC,GAAG;AAC9B,QAAM,oBAAoB,KAAK,CAAC,GAAG;AACnC,QAAM,iBAAiB,KAAK,CAAC,GAAG;AAChC,MAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,gBAAgB;AAC1D,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO,EAAE,cAAc,mBAAmB,eAAe;AAC3D;AAEA,eAAsB,oCACpB,IACA,cACe;AACf,QAAM,GAAG,QAAQ,qDAAqD,YAAY,SAAS;AAC7F;AAEA,SAAS,kCACP,OACA,SACO;AACP,QAAM,QAAQ,uBAAuB,KAAK;AAC1C,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,4BAA4B,iBAAiB,4BAA4B,KAAK,GAAG;AAAA,MACzF,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,UAAU,WAAW,QAAQ,wBAAwB;AACvD,UAAM,IAAI,4BAA4B,mBAAmB,MAAM,EAAE,OAAO,MAAM,CAAC;AAAA,EACjF;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,4BAA4B,mBAAmB,MAAM,EAAE,OAAO,MAAM,CAAC;AAAA,EACjF;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,gCAAgC,EAAE,OAAO,MAAM,CAAC;AAAA,EAC5D;AACA,MAAI,UAAU,WAAW,UAAU,SAAS;AAC1C,UAAM,IAAI,0BAA0B,EAAE,OAAO,MAAM,CAAC;AAAA,EACtD;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI,kCAAkC,EAAE,OAAO,MAAM,CAAC;AAAA,EAC9D;AACA,QAAM;AACR;AAEO,SAAS,yCACd,OAIQ;AACR,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,KAAK,UAAU;AAAA,MACb,SAAS;AAAA,MACT,WAAW,MAAM;AAAA,MACjB,kBAAkB,MAAM;AAAA,MACxB,wBAAwB,MAAM;AAAA,IAChC,CAAC;AAAA,EACH,EACC,OAAO,KAAK;AACjB;AAEO,SAAS,yBACd,OASQ;AACR,MAAI,MAAM,eAAe;AACvB,WAAO,WAAW,QAAQ,EACvB;AAAA,MACC,KAAK,UAAU;AAAA,QACb,SAAS;AAAA,QACT,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,MAAM;AAAA,QAC9B,uBAAuB,MAAM;AAAA,QAC7B,6BAA6B,MAAM;AAAA,QACnC,eAAe,MAAM;AAAA,MACvB,CAAC;AAAA,IACH,EACC,OAAO,KAAK;AAAA,EACjB;AACA,MAAI,MAAM,gBAAgB;AACxB,WAAO,WAAW,QAAQ,EACvB;AAAA,MACC,KAAK,UAAU;AAAA,QACb,SAAS;AAAA,QACT,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,MAAM;AAAA,QAC9B,uBAAuB,MAAM;AAAA,QAC7B,6BAA6B,MAAM;AAAA,QACnC,SAAS,MAAM;AAAA,MACjB,CAAC;AAAA,IACH,EACC,OAAO,KAAK;AAAA,EACjB;AACA,QAAM,iCACJ,MAAM,0BAA0B,kBAAkB,CAAC,MAAM;AAC3D,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,KAAK;AAAA,MACH,iCACI;AAAA,QACE,SAAS;AAAA,QACT,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,MAAM;AAAA,QAC9B,uBAAuB,MAAM;AAAA,MAC/B,IACA;AAAA,QACE,SAAS;AAAA,QACT,iBAAiB,MAAM;AAAA,QACvB,wBAAwB,MAAM;AAAA,QAC9B,uBAAuB,MAAM;AAAA,QAC7B,6BAA6B,MAAM;AAAA,MACrC;AAAA,IACN;AAAA,EACF,EACC,OAAO,KAAK;AACjB;AAEA,SAAS,wCAAwC,OAA0C;AACzF,SAAO,WAAW,QAAQ,EACvB,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG,GAAG,MAAM,CAAC,CAAC,EAC/C,OAAO,KAAK;AACjB;AAEA,eAAsB,4BACpB,IACA,OAC4C;AAC5C,MAAI,CAAC,OAAO,cAAc,MAAM,sBAAsB,KAAK,MAAM,yBAAyB,GAAG;AAC3F,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,QAAM,cAAc,yCAAyC,KAAK;AAClE,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,WAAW;AACxE,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,aAAa;AAClB,cAAM,OAAO,MAAM;AAAA,UAejB;AAAA,UACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAeE,SAAS;AAAA,YACT,MAAM,WAAW;AAAA,YACjB,MAAM,SAAS;AAAA,YACf,MAAM,cAAc;AAAA,YACpB,MAAM,gBAAgB;AAAA,YACtB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA,YACX,kCAAkC;AAAA;AAAA,QAEtC;AACA,cAAM,SAAS,KAAK,CAAC;AACrB,YAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,kDAAkD;AAC/E,cAAM,MAAM,eAAe,QAAQ;AACnC,eAAO;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,sCAAkC,OAAO,EAAE,wBAAwB,KAAK,CAAC;AAAA,EAC3E;AACF;AAEA,eAAsB,mBACpB,IACA,OACmC;AACnC,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,MAAI,MAAM,2BAA2B,MAAM,mBAAmB;AAC5D,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,MAAM,iBAAiB,MAAM,gBAAgB;AAC/C,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,MAAI,QAAQ,MAAM,cAAc,MAAM,QAAQ,MAAM,oBAAoB,GAAG;AACzE,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AACA,MACE,MAAM,mBACL,MAAM,eAAe,UAAU,MAAM,sBAAsB,SAC1D,KAAK,UAAU,MAAM,eAAe,cAAc,MAChD,KAAK,UAAU,MAAM,sBAAsB,cAAc,IAC7D;AACA,UAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,iBAAiB;AAC9E,QAAM,cAAc,yBAAyB,KAAK;AAClD,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,aAAa;AAClB,YAAI,MAAM,kBAAkB,MAAM,sBAAsB;AACtD,gBAAM,gBAAgB,wCAAwC,MAAM,cAAc;AAClF,gBAAMA,QAAO,MAAM;AAAA,YACjB;AAAA,YACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAaE,SAAS;AAAA,cACT,MAAM,iBAAiB;AAAA,cACvB,MAAM,eAAe;AAAA,cACrB,MAAM,cAAc;AAAA,cACpB,MAAM,sBAAsB;AAAA,cAC5B,MAAM,qBAAqB;AAAA,cAC3B,MAAM,2BAA2B;AAAA,cACjC,MAAM,YAAY;AAAA,cAClB,WAAW;AAAA,cACX,kCAAkC;AAAA,cAClC,KAAK,UAAU,MAAM,qBAAqB,cAAc,CAAC;AAAA,cACzD,MAAM,qBAAqB,KAAK;AAAA,cAChC,MAAM,qBAAqB,YAAY;AAAA,cACvC,aAAa;AAAA;AAAA,UAEjB;AACA,gBAAMC,UAASD,MAAK,CAAC;AACrB,cAAI,CAACC,QAAQ,OAAM,IAAI,MAAM,iCAAiC;AAC9D,gBAAM,MAAM,eAAe,QAAQ;AACnC,iBAAOA;AAAA,QACT;AACA,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAaE,SAAS;AAAA,YACT,MAAM,iBAAiB;AAAA,YACvB,MAAM,eAAe;AAAA,YACrB,MAAM,cAAc;AAAA,YACpB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,qBAAqB;AAAA,YAC3B,MAAM,2BAA2B;AAAA,YACjC,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA,YACX,kCAAkC;AAAA,YAClC,MAAM,gBAAgB,QAAQ,MAAM,aAAa,WAAW,KAAK;AAAA;AAAA,QAErE;AACA,cAAM,SAAS,KAAK,CAAC;AACrB,YAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,iCAAiC;AAC9D,cAAM,MAAM,eAAe,QAAQ;AACnC,eAAO;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AAKd,QAAI,uBAAuB,KAAK,MAAM,SAAS;AAC7C,YAAM,IAAI,gCAAgC,EAAE,OAAO,MAAM,CAAC;AAAA,IAC5D;AACA,sCAAkC,OAAO,EAAE,wBAAwB,MAAM,CAAC;AAAA,EAC5E;AACF;AAUA,eAAsB,yBACpB,IACA,OAC0C;AAC1C,MAAI,CAAC,MAAM,aAAa,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AAChF,MAAI,MAAM,2BAA2B,MAAM,mBAAmB;AAC5D,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,uBAAuB,IAAI,MAAM,iBAAiB;AAC9E,QAAM,cAAc,yBAAyB,KAAK;AAClD,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO,aAAa;AAClB,YAAI,MAAM,gBAAgB;AACxB,gBAAM,gBAAgB,wCAAwC,MAAM,cAAc;AAClF,gBAAMD,QAAO,MAAM;AAAA,YACjB;AAAA,YACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAaE,SAAS;AAAA,cACT,MAAM,iBAAiB;AAAA,cACvB,MAAM,eAAe;AAAA,cACrB,MAAM,cAAc;AAAA,cACpB,MAAM,sBAAsB;AAAA,cAC5B,MAAM,qBAAqB;AAAA,cAC3B,MAAM,2BAA2B;AAAA,cACjC,MAAM,YAAY;AAAA,cAClB,WAAW;AAAA,cACX,kCAAkC;AAAA,cAClC,aAAa;AAAA;AAAA,UAEjB;AACA,gBAAM,MAAM,eAAe,QAAQ;AACnC,iBAAOA,MAAK,CAAC,KAAK;AAAA,QACpB;AACA,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAaE,SAAS;AAAA,YACT,MAAM,iBAAiB;AAAA,YACvB,MAAM,eAAe;AAAA,YACrB,MAAM,cAAc;AAAA,YACpB,MAAM,sBAAsB;AAAA,YAC5B,MAAM,qBAAqB;AAAA,YAC3B,MAAM,2BAA2B;AAAA,YACjC,MAAM,YAAY;AAAA,YAClB,WAAW;AAAA,YACX,kCAAkC;AAAA;AAAA,QAEtC;AACA,cAAM,MAAM,eAAe,QAAQ;AACnC,eAAO,KAAK,CAAC,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,sCAAkC,OAAO,EAAE,wBAAwB,MAAM,CAAC;AAAA,EAC5E;AACF;","names":["rows","result"]}

package/dist/connect-attempts.js

@@ -7,9 +7,9 @@ import {
   getConnectAttempt,
   getConnectBeginReplay,
   listPendingConnectAttempts
-} from "./chunk-OQZOGCLG.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-BLUQG54M.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/editable-artifacts.js

@@ -10,9 +10,9 @@ import {
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor
-} from "./chunk-Y77PVZZD.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-BZV5ZDRY.js";
+import "./chunk-SKYRM7R7.js";
+import "./chunk-VOB6TXSJ.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { SubscriptionAccountChangedError } from "./subscription-account-conflict.js";
+import type { GoalAdmissionPausedReason } from "@opengeni/contracts";
 export declare const getScheduledTaskClaudeProviderAccountAuthoritySnapshot: (db: Database, workspaceId: string, taskId: string) => Promise<{
     version: 1;
     scope: "organization";
@@ -3306,7 +3307,7 @@ export declare function recordScheduledTaskAdmissionFailure(db: Database, input:
     diagnostic: ConnectionAccountSelectionDiagnostic;
 }): Promise<ScheduledTaskRun>;
 /** Reasons a scheduled occurrence is refused before accepting execution. */
-export type ScheduledTaskAdmissionRefusalReason = "scheduled_authority_unavailable" | "machine_target_unavailable" | "machine_enrollment_inactive" | "variable_set_unavailable" | "rig_version_unavailable" | "insufficient_credits" | "allowance_exhausted" | "monthly_model_cost_limit" | "monthly_agent_run_limit";
+export type ScheduledTaskAdmissionRefusalReason = "scheduled_authority_unavailable" | "machine_target_unavailable" | "machine_enrollment_inactive" | "variable_set_unavailable" | "rig_version_unavailable" | "scheduled_model_unavailable" | "insufficient_credits" | "allowance_exhausted" | "monthly_model_cost_limit" | "monthly_agent_run_limit";
 /**
  * Record a refused occurrence as an immutable run receipt under its producer
  * identity (migration 0539). A transient refusal is `skipped`, a terminal one
@@ -10400,6 +10401,11 @@ export declare function updateSessionTitleWithEvent(db: Database, input: {
     title: string | null;
     events: SessionEvent[];
 }>;
+/** Read-only admission at a locked paused-to-active transition. */
+export type SessionGoalResumeValidation = (tx: Database, session: Pick<Session, "accountId" | "workspaceId" | "model" | "codexCompactionMode" | "latencyMode">, causalTurn: {
+    id: string;
+    initiatingHumanSubjectId: string | null;
+} | null) => Promise<void>;
 /**
  * Status transition helper. Idempotent: requesting the current status returns
  * `changed: false` so callers can skip emitting a duplicate event. `completed`
@@ -10417,6 +10423,8 @@ export declare function setSessionGoalStatus(db: Database, workspaceId: string,
     commandActor?: Extract<SessionCommandActor, {
         type: "agent_attempt";
     }>;
+    /** Runs under the canonical control/session/goal locks, before a paused goal changes. */
+    beforeResume?: SessionGoalResumeValidation;
 }): Promise<{
     goal: SessionGoal;
     changed: boolean;
@@ -10445,6 +10453,7 @@ export declare function setSessionGoalStatusWithEvent(db: Database, workspaceId:
     commandActor?: Extract<SessionCommandActor, {
         type: "agent_attempt";
     }>;
+    beforeResume?: SessionGoalResumeValidation;
     event: SetSessionGoalStatusEvent;
 }): Promise<{
     goal: SessionGoal;
@@ -10459,7 +10468,7 @@ export type GoalContinuationDecision = {
     decision: "queue";
 } | {
     decision: "paused";
-    reason: "max_auto_continuations" | "limits" | "allowance";
+    reason: "max_auto_continuations" | "limits" | GoalAdmissionPausedReason;
     goal: SessionGoal;
 } | {
     decision: "continue";
@@ -10479,7 +10488,7 @@ export declare function evaluateGoalContinuation(db: Database, input: {
     sessionId: string;
     defaultMaxAutoContinuations?: number | null;
     budgetBlocked?: string | null;
-    budgetPausedReason?: "limits" | "allowance" | undefined;
+    budgetPausedReason?: "limits" | GoalAdmissionPausedReason | undefined;
 }): Promise<GoalContinuationDecision>;
 export declare const GOAL_IDLE_BACKOFF_WAKE_REASON = "goal_idle_backoff";
 /**
@@ -10526,7 +10535,7 @@ export declare function materializeGoalContinuation(db: Database, input: {
     workflowId: string;
     defaultMaxAutoContinuations?: number | null;
     budgetBlocked?: string | null;
-    budgetPausedReason?: "limits" | "allowance" | undefined;
+    budgetPausedReason?: "limits" | GoalAdmissionPausedReason | undefined;
     /** Trusted worker admission, evaluated under the same session/goal locks
      * as lineage materialization. Never substitutes a mutable latest human. */
     admission?: (tx: Database, causalTurn: {
@@ -10534,7 +10543,7 @@ export declare function materializeGoalContinuation(db: Database, input: {
         initiatingHumanSubjectId: string | null;
     } | null) => Promise<{
         budgetBlocked: string | null;
-        budgetPausedReason?: "limits" | "allowance";
+        budgetPausedReason?: "limits" | GoalAdmissionPausedReason;
     }>;
     idleBackoff?: GoalIdleBackoffPolicy | null;
     policy: {

package/dist/index.js

@@ -8,14 +8,15 @@ import {
   normalizeBearerScheme,
   normalizedCredentialHeaders,
   refreshOAuthConnectionCredential
-} from "./chunk-7POTLB24.js";
+} from "./chunk-M2YGXCCQ.js";
 import {
   retainedProviderCommandPersistence
-} from "./chunk-OMHBVHX7.js";
+} from "./chunk-ODKYBA3C.js";
 import {
   readSessionMessageSliceInScope
-} from "./chunk-NLSG7GGA.js";
+} from "./chunk-KJVOBLFC.js";
 import {
+  ARTIFACT_PIN_RUNTIME_ROUTINES,
   CLAUDE_SUBSCRIPTION_CAPABILITY_ROUTINES,
   FORCE_RLS_TABLES,
   NON_RLS_RUNTIME_TABLES,
@@ -45,7 +46,7 @@ import {
   isRetryableRuntimeDatabaseStartupError,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-N5QCKHYL.js";
+} from "./chunk-T5NHDEZW.js";
 import {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
@@ -59,7 +60,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-KEDWSSNP.js";
+} from "./chunk-7Z7ALFRE.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -72,7 +73,7 @@ import {
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor
-} from "./chunk-Y77PVZZD.js";
+} from "./chunk-BZV5ZDRY.js";
 import {
   SessionTenancyAccessError,
   SessionTenancyConflictError,
@@ -87,10 +88,9 @@ import {
   openPrivateChildSessionCreateCapability,
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
-  sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-UEQQ2WWU.js";
-import "./chunk-F3YMVRF4.js";
+} from "./chunk-Z5HJXH3X.js";
+import "./chunk-GLA5YCQS.js";
 import {
   ConnectAttemptConflictError,
   ConnectAttemptNotFoundError,
@@ -100,11 +100,11 @@ import {
   getConnectAttempt,
   getConnectBeginReplay,
   listPendingConnectAttempts
-} from "./chunk-OQZOGCLG.js";
+} from "./chunk-BLUQG54M.js";
 import {
   withOrganizationIntegrationAcquisition,
   withOrganizationIntegrationPolicyFence
-} from "./chunk-PQGTWFRF.js";
+} from "./chunk-M3SWH4MU.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -254,7 +254,7 @@ import {
   validateOrganizationApiKeyWorkspaceScope,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-7S53WLPI.js";
+} from "./chunk-EKXCF3FH.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   CreditDebitAttribution,
@@ -304,7 +304,7 @@ import {
   validateMemberAllowanceRule,
   validateWorkspaceAllowanceConfig,
   withCreditDebitAttribution
-} from "./chunk-MACELCXG.js";
+} from "./chunk-CIGHXFPD.js";
 import {
   external_exports
 } from "./chunk-4UJCXBR2.js";
@@ -330,7 +330,7 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-KH3TYDGY.js";
+} from "./chunk-J4WFOVBV.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
@@ -369,7 +369,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-56MYWKQV.js";
+} from "./chunk-SKYRM7R7.js";
 import {
   agentRunStates,
   apiKeys,
@@ -618,7 +618,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-LDTQGYD2.js";
+} from "./chunk-VOB6TXSJ.js";
 import {
   decryptEnvironmentValue,
   encryptEnvironmentValue,
@@ -4855,6 +4855,13 @@ async function scanSessionMessages(db, workspaceId, request, filters, authorityI
 
 // src/artifact-catalog.ts
 import { sql as sql17 } from "drizzle-orm";
+async function updateArtifactPin(db, scope, input) {
+  await withRlsContext(db, scope, async (tx) => {
+    await tx.execute(sql17`select opengeni_private.update_artifact_pin(
+      ${scope.accountId}::uuid, ${scope.workspaceId}::uuid,
+      ${input.kind}::text, ${input.artifactId}::text, ${input.pinned}::boolean)`);
+  });
+}
 async function recordSandboxFilePublication(db, input) {
   await withRlsContext(db, input, async (tx) => {
     await tx.execute(
@@ -4903,26 +4910,30 @@ async function listArtifactCatalogCandidates(db, scope, input) {
     branches.push(sql17`
     SELECT p.file_id::text AS id, p.kind, p.title, 'active'::text AS status,
       p.published_at AS created_at, p.published_at AS updated_at, p.source_session_id, NULL::text AS version_id, 'sandbox_file'::text AS origin
-    FROM opengeni_private.list_sandbox_file_publications(${scope.accountId}::uuid, ${scope.workspaceId}::uuid,
+    FROM opengeni_private.list_sandbox_file_publications_pinned(${scope.accountId}::uuid, ${scope.workspaceId}::uuid,
       ${JSON.stringify({ sourceSessionId: source, q: query.q, kinds: publishedKinds, sort: query.sort, snapshotAt: input.snapshotAt, after: input.after, limit: input.limit })}::jsonb) p`);
   if (!branches.length) return [];
   const sort = query.sort === "title" ? sql17`lower(title)` : query.sort === "newest" ? sql17`to_char(created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US')` : sql17`to_char(updated_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US')`;
   const descending = query.sort !== "title";
   const position = input.after;
-  const keyset = !position ? sql17`true` : sql17`(
+  const secondaryKeyset = !position ? sql17`true` : sql17`(
     sort_key COLLATE "C" ${descending ? sql17`<` : sql17`>`} ${position.key} COLLATE "C"
     OR (sort_key = ${position.key} AND (kind COLLATE "C", id COLLATE "C") > (${position.kind}, ${position.id})))`;
+  const keyset = !position ? sql17`true` : sql17`(pinned < ${position.pinned ?? false}::boolean OR
+        (pinned = ${position.pinned ?? false}::boolean AND ${secondaryKeyset}))`;
   return withRlsContext(
     db,
     scope,
     async (tx) => {
       const result = await tx.execute(sql17`
       WITH candidates AS (${sql17.join(branches, sql17` UNION ALL `)}),
-      ordered AS (SELECT *, ${sort} AS sort_key FROM candidates
+      ordered AS (SELECT candidates.*, ${sort} AS sort_key, (pins.artifact_id IS NOT NULL) AS pinned
+        FROM candidates LEFT JOIN opengeni_private.list_artifact_pins(${scope.accountId}::uuid, ${scope.workspaceId}::uuid) pins
+          ON pins.kind = candidates.kind AND pins.artifact_id = candidates.id
         WHERE status = ${query.status} AND created_at <= ${input.snapshotAt}::timestamptz
           ${query.q ? sql17`AND strpos(lower(title), lower(${query.q})) > 0` : sql17``})
       SELECT * FROM ordered WHERE ${keyset}
-      ORDER BY sort_key COLLATE "C" ${descending ? sql17`DESC` : sql17`ASC`}, kind COLLATE "C", id COLLATE "C"
+      ORDER BY pinned DESC, sort_key COLLATE "C" ${descending ? sql17`DESC` : sql17`ASC`}, kind COLLATE "C", id COLLATE "C"
       LIMIT ${input.limit}`);
       return Array.isArray(result) ? result : result.rows;
     },
@@ -69399,10 +69410,6 @@ async function readSessionListForSubject(db, workspaceId, options, summary) {
         }))) {
           throw new SessionListAccessError();
         }
-        const tenancyActivated = await sessionTenancyProductActivated(
-          tx,
-          workspaceId
-        );
         const archiveMode = options.archiveStatus ?? (options.archivedOnly ? "archived" : "active");
         const sortBy = options.sortBy ?? (archiveMode === "archived" ? "archivedAt" : "updatedAt");
         if (options.archivedOnly && archiveMode !== "archived") {
@@ -69718,7 +69725,7 @@ async function readSessionListForSubject(db, workspaceId, options, summary) {
                     ...mapSessionArchive(row.pin),
                     ...row.pin?.archived && exactArchiveTimestamps.has(session.id) ? { archivedAt: exactArchiveTimestamps.get(session.id) } : {}
                   },
-                  { subjectId: options.subjectId, activated: tenancyActivated }
+                  { subjectId: options.subjectId }
                 ),
                 ...sortBy === "updatedAt" && exactOrdinaryTimestamps.has(session.id) ? { updatedAt: exactOrdinaryTimestamps.get(session.id) } : {},
                 ...sortBy === "createdAt" && exactOrdinaryTimestamps.has(session.id) ? { createdAt: exactOrdinaryTimestamps.get(session.id) } : {},
@@ -69899,7 +69906,6 @@ async function getSessionForSubject(db, workspaceId, sessionId, subjectId, relat
     const mcpServers = await sessionMcpServerMetadataForSessions(scopedDb, workspaceId, [
       sessionId
     ]);
-    const tenancyActivated = await sessionTenancyProductActivated(scopedDb, workspaceId);
     const failureDiagnostics = await sessionFailureDiagnostics(scopedDb, workspaceId, session);
     return projectSessionForRelatedAccess(
       {
@@ -69911,7 +69917,7 @@ async function getSessionForSubject(db, workspaceId, sessionId, subjectId, relat
           mapSessionAttention(session, row.pin),
           mapSessionArchive(row.pin),
           void 0,
-          { subjectId, activated: tenancyActivated }
+          { subjectId }
         ),
         failureDiagnostics
       },
@@ -73987,6 +73993,13 @@ async function applyContextCompaction(db, input) {
           )
         );
         const supersededFrom = Math.floor(Number(maxPosition)) + 1;
+        if (providerRecoveryCountFromTurnMetadata(fence.turn.metadata) > 0) {
+          await tx.update(sessionTurns).set({
+            metadata: metadataWithoutProviderRecoveryCount(fence.turn.metadata),
+            version: fence.turn.version + 1,
+            updatedAt: /* @__PURE__ */ new Date()
+          }).where(eq74(sessionTurns.id, input.turnId));
+        }
         await tx.update(sessionHistoryItems).set({ active: false }).where(
           and73(
             eq74(sessionHistoryItems.workspaceId, input.workspaceId),
@@ -88364,6 +88377,40 @@ async function setSessionGoalStatus(db, workspaceId, sessionId, input) {
     if (existing.status === "completed") {
       throw new Error("session goal is completed; set a new goal to continue");
     }
+    if (input.status === "active" && input.beforeResume) {
+      const [effectiveSession] = await withEffectiveSessionPolicy(scopedDb, workspaceId, [session]);
+      const causalTurnFilter = session.activeTurnId ? or12(
+        eq74(sessionTurns.id, session.activeTurnId),
+        sql108`${sessionTurns.finishedAt} is not null`
+      ) : sql108`${sessionTurns.finishedAt} is not null`;
+      const [causalTurn] = await scopedDb.select({
+        id: sessionTurns.id,
+        initiatingHumanSubjectId: sessionTurns.initiatingHumanSubjectId
+      }).from(sessionTurns).where(
+        and73(
+          eq74(sessionTurns.workspaceId, workspaceId),
+          eq74(sessionTurns.sessionId, sessionId),
+          causalTurnFilter
+        )
+      ).orderBy(
+        ...session.activeTurnId ? [desc27(sql108`${sessionTurns.id} = ${session.activeTurnId}`)] : [],
+        desc27(sessionTurns.finishedAt),
+        desc27(sessionTurns.position),
+        desc27(sessionTurns.createdAt),
+        desc27(sessionTurns.id)
+      ).limit(1);
+      await input.beforeResume(
+        scopedDb,
+        {
+          accountId: session.accountId,
+          workspaceId,
+          model: effectiveSession.model,
+          latencyMode: effectiveSession.latencyMode,
+          codexCompactionMode: session.codexCompactionMode
+        },
+        causalTurn ?? null
+      );
+    }
     if (input.status === "completed") {
       await verifyGoalReportDeliveries(scopedDb, {
         accountId: session.accountId,
@@ -88441,6 +88488,7 @@ async function setSessionGoalStatusWithEvent(db, workspaceId, sessionId, input)
         ...input.reportDeliveries !== void 0 ? { reportDeliveries: input.reportDeliveries } : {},
         ...input.reportArtifactActor ? { reportArtifactActor: input.reportArtifactActor } : {},
         ...input.commandActor ? { commandActor: input.commandActor } : {},
+        ...input.beforeResume ? { beforeResume: input.beforeResume } : {},
         ...input.evidence !== void 0 ? { evidence: input.evidence } : {},
         ...input.rationale !== void 0 ? { rationale: input.rationale } : {},
         ...input.pausedReason !== void 0 ? { pausedReason: input.pausedReason } : {}
@@ -95535,6 +95583,8 @@ function providerRecoveryCountFromTurnMetadata(metadata) {
 function metadataWithoutProviderRecoveryCount(metadata) {
   const next = { ...metadata ?? {} };
   delete next.providerRecoveryCount;
+  delete next.providerRecoveryStartedAt;
+  delete next.providerRecoveryReason;
   return next;
 }
 function hasCompletedCurrentModelRequest(events, requireMeaningfulOutput = false) {
@@ -97216,7 +97266,11 @@ async function requestSessionTurnRecovery(db, workspaceId, input) {
               providerRecoveryCount: SANDBOX_SETUP_RECOVERY_LIMIT
             }
           } : {},
-          ...input.providerRecoveryCount !== void 0 ? { providerRecoveryCount: input.providerRecoveryCount } : {}
+          ...input.providerRecoveryCount !== void 0 ? {
+            providerRecoveryCount: input.providerRecoveryCount,
+            providerRecoveryStartedAt: providerRecoveryCountFromTurnMetadata(turn.metadata) > 0 && typeof turn.metadata?.providerRecoveryStartedAt === "string" ? turn.metadata.providerRecoveryStartedAt : now.toISOString(),
+            providerRecoveryReason: input.reason
+          } : {}
         },
         updatedAt: now
       }).where(
@@ -100854,7 +100908,7 @@ function mapSession(row, effectiveControl, mcpServers = [], pin = mapSessionPin(
     toolPolicyVersion: Number(row.toolPolicyVersion),
     mcpApprovalPolicies: row.mcpApprovalPolicies,
     metadata: row.metadata,
-    ...tenancyViewer?.activated ? { tenancy: mapSessionTenancy(row, tenancyViewer.subjectId) } : {},
+    ...tenancyViewer ? { tenancy: mapSessionTenancy(row, tenancyViewer.subjectId) } : {},
     createdBy: initiatorFromStorage(
       row.createdByKind,
       row.createdBySubjectId,
@@ -101865,6 +101919,7 @@ export {
   APPROVAL_RUN_STATE_MAX_JSON_BYTES,
   APPROVAL_RUN_STATE_MAX_JSON_NODES,
   APPROVAL_RUN_STATE_MAX_JSON_PROPERTIES,
+  ARTIFACT_PIN_RUNTIME_ROUTINES,
   ATTACHED_BROWSER_SESSION_CAPABILITIES,
   ActiveSessionHistoryLimitExceededError,
   AgentCommandAuthorityError,
@@ -103851,7 +103906,6 @@ export {
   sessionRequiresActionSinceForSessions,
   sessionSubject,
   sessionSystemUpdateOutboxKindPayload,
-  sessionTenancyProductActivated,
   sessionTreeStatsForSessions,
   sessionTurnFinalReplyFacts,
   sessionTurnHasFinalReplyNudge,
@@ -103973,6 +104027,7 @@ export {
   uninstallApiIntegration,
   uninstallPluginPackage,
   uninstallPortableSkill,
+  updateArtifactPin,
   updateAutomationSource,
   updateAutomationTrigger,
   updateBrowserIdentity,