@opengeni/db 1.4.2 → 1.4.4

package/dist/{chunk-TODVDGMO.js → chunk-NI3WPW2L.js}

@@ -7,7 +7,7 @@ import {
   withAccountRls,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import {
   connections,
   creditDebitAllocations,
@@ -1430,4 +1430,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-TODVDGMO.js.map
+//# sourceMappingURL=chunk-NI3WPW2L.js.map

package/dist/{chunk-OKCBARX6.js → chunk-PUOQEL6A.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3592,4 +3592,4 @@ export {
   PostgresEditableArtifactLiveReadStore,
   transactionallyAuthorizeEditableArtifactActor
 };
-//# sourceMappingURL=chunk-OKCBARX6.js.map
+//# sourceMappingURL=chunk-PUOQEL6A.js.map

package/dist/{chunk-JWBEE4CL.js → chunk-SG5YDHSE.js}

@@ -1,6 +1,6 @@
 import {
   cancelUnacceptedVideoGenerationsForToolCallsInTransaction
-} from "./chunk-TODVDGMO.js";
+} from "./chunk-NI3WPW2L.js";
 import {
   external_exports
 } from "./chunk-4UJCXBR2.js";
@@ -14,7 +14,7 @@ import {
   withSessionActivityRlsContext,
   withWorkspaceRls,
   withWorkspaceSubjectRls
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import {
   auditEvents,
   codexCapacityWaiters,
@@ -6449,4 +6449,4 @@ export {
   setWorkspacePauseTimerInTransaction,
   fireWorkspacePauseTimerInTransaction
 };
-//# sourceMappingURL=chunk-JWBEE4CL.js.map
+//# sourceMappingURL=chunk-SG5YDHSE.js.map

package/dist/{chunk-K5MTNKJU.js → chunk-WAFY2TCB.js}

@@ -1,9 +1,9 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-JWBEE4CL.js";
+} from "./chunk-SG5YDHSE.js";
 import {
   withSessionActivityRlsContext
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import {
   sandboxRetainedProcesses,
   sessionBackgroundCommands,
@@ -140,4 +140,4 @@ async function appendSessionCommandOutput(db, input) {
 export {
   appendSessionCommandOutput
 };
-//# sourceMappingURL=chunk-K5MTNKJU.js.map
+//# sourceMappingURL=chunk-WAFY2TCB.js.map

package/dist/connect-attempts.js

@@ -7,8 +7,8 @@ import {
   getConnectAttempt,
   getConnectBeginReplay,
   listPendingConnectAttempts
-} from "./chunk-HUKBIZGH.js";
-import "./chunk-IT3EYY2C.js";
+} from "./chunk-LGXWM3UJ.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/database.d.ts

@@ -191,7 +191,13 @@ export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, f
  */
 export declare function withSessionActivityRlsContext<T>(db: Database, context: RlsContext & {
     workspaceId: string;
-}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none", organizationMembershipFence?: boolean): Promise<T>;
+}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none", organizationMembershipFence?: OrganizationMembershipFenceMode): Promise<T>;
+/**
+ * `true`/`"exclusive"`: the callback reauthorizes or mutates under the
+ * organization-membership lifecycle lock. `"shared"`: the callback only reads
+ * membership-fenced authority and must never escalate to exclusive.
+ */
+export type OrganizationMembershipFenceMode = boolean | "exclusive" | "shared";
 /**
  * `organizationMembershipFence` is required when the callback takes the
  * organization-membership lifecycle lock (for example external-actor
@@ -217,7 +223,7 @@ export declare function retrySessionActivityRls<T>(db: Database, workspaceId: st
     /** Claim can inherit membership-fenced causal authority after locking the
      * session. Acquire that fence before tenancy/control/session instead. An
      * enclosing transaction must preserve this same lock prefix. */
-    organizationMembershipFence?: boolean;
+    organizationMembershipFence?: OrganizationMembershipFenceMode;
 }, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
 export declare function retryWorkspacePersistence<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
 export declare function retryRlsPersistence<T>(db: Database, context: RlsContext, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;

package/dist/editable-artifact-durable-export.js

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/editable-artifacts.js

@@ -10,8 +10,8 @@ import {
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor
-} from "./chunk-OKCBARX6.js";
-import "./chunk-IT3EYY2C.js";
+} from "./chunk-PUOQEL6A.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/index.js

@@ -8,13 +8,13 @@ import {
   normalizeBearerScheme,
   normalizedCredentialHeaders,
   refreshOAuthConnectionCredential
-} from "./chunk-OV5AUIBA.js";
+} from "./chunk-4SUZSKKW.js";
 import {
   retainedProviderCommandPersistence
-} from "./chunk-W75DRYG3.js";
+} from "./chunk-DEMX4GWU.js";
 import {
   readSessionMessageSliceInScope
-} from "./chunk-B5C5SBSI.js";
+} from "./chunk-JYKUR5KT.js";
 import {
   ARTIFACT_PIN_RUNTIME_ROUTINES,
   CLAUDE_SUBSCRIPTION_CAPABILITY_ROUTINES,
@@ -60,7 +60,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-NZ2SP55O.js";
+} from "./chunk-ISNA4KUA.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -73,7 +73,7 @@ import {
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor
-} from "./chunk-OKCBARX6.js";
+} from "./chunk-PUOQEL6A.js";
 import {
   SessionTenancyAccessError,
   SessionTenancyConflictError,
@@ -89,8 +89,8 @@ import {
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
   transitionSessionVisibility
-} from "./chunk-DKFEUGM4.js";
-import "./chunk-K5MTNKJU.js";
+} from "./chunk-57FM4RG4.js";
+import "./chunk-WAFY2TCB.js";
 import {
   ConnectAttemptConflictError,
   ConnectAttemptNotFoundError,
@@ -100,11 +100,11 @@ import {
   getConnectAttempt,
   getConnectBeginReplay,
   listPendingConnectAttempts
-} from "./chunk-HUKBIZGH.js";
+} from "./chunk-LGXWM3UJ.js";
 import {
   withOrganizationIntegrationAcquisition,
   withOrganizationIntegrationPolicyFence
-} from "./chunk-A4J7EECR.js";
+} from "./chunk-7HP5NCRN.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -255,7 +255,7 @@ import {
   validateOrganizationApiKeyWorkspaceScope,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-JWBEE4CL.js";
+} from "./chunk-SG5YDHSE.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   CreditDebitAttribution,
@@ -311,7 +311,7 @@ import {
   validateMemberAllowanceRule,
   validateWorkspaceAllowanceConfig,
   withCreditDebitAttribution
-} from "./chunk-TODVDGMO.js";
+} from "./chunk-NI3WPW2L.js";
 import {
   external_exports
 } from "./chunk-4UJCXBR2.js";
@@ -337,7 +337,7 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-Y72DP3JF.js";
+} from "./chunk-A4LPJOKP.js";
 import {
   DatabaseTransactionError,
   DatabaseUnavailableError,
@@ -380,7 +380,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import {
   agentRunStates,
   apiKeys,
@@ -92483,7 +92483,10 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
       stage: "session_attempts.claim",
       eventTypes: ["session.turn.attempt_claimed"],
       maxAttempts: 3,
-      organizationMembershipFence: true
+      // Claim reads membership-fenced authority; it never mutates membership.
+      // Shared keeps membership mutators fenced while concurrent claims in
+      // one organization stay parallel (exclusive serialized every claim).
+      organizationMembershipFence: "shared"
     },
     async (scopedDb) => await withSessionActivitySavepoint(scopedDb, async (tx) => {
       const deliverPendingUpdates = async (accountId, turnId, turnGeneration, nextSequence, occurredAt, triggerEventId, options = {}) => {