@opengeni/db 1.4.2 → 1.4.4

package/dist/interaction-schema.d.ts

@@ -3128,6 +3128,7 @@ export declare const computerSessions: import("drizzle-orm/pg-core").PgTableWith
                 screenCapture: boolean;
                 semanticActions: boolean;
                 pointerInput: boolean;
+                pointerClickContinuation?: boolean | undefined;
                 keyboardInput: boolean;
                 clipboard: boolean;
                 backgroundActions: boolean;
@@ -3153,6 +3154,7 @@ export declare const computerSessions: import("drizzle-orm/pg-core").PgTableWith
                 screenCapture: boolean;
                 semanticActions: boolean;
                 pointerInput: boolean;
+                pointerClickContinuation?: boolean | undefined;
                 keyboardInput: boolean;
                 clipboard: boolean;
                 backgroundActions: boolean;

package/dist/managed-auth-session-sets.js

@@ -20,8 +20,8 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-Y72DP3JF.js";
-import "./chunk-IT3EYY2C.js";
+} from "./chunk-A4LPJOKP.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/mcp-operations.js

@@ -1,6 +1,6 @@
 import {
   withRlsContext
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,

package/dist/organization-integration-policy.js

@@ -3,9 +3,9 @@ import {
   updateOrganizationIntegrationPolicy,
   withOrganizationIntegrationAcquisition,
   withOrganizationIntegrationPolicyFence
-} from "./chunk-A4J7EECR.js";
+} from "./chunk-7HP5NCRN.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-IT3EYY2C.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/retained-provider-commands.js

@@ -14,12 +14,12 @@ import {
   retainedProviderCommandPersistence,
   supervisedCommandProtocolReady,
   validateRouterOutputAdvance
-} from "./chunk-W75DRYG3.js";
-import "./chunk-K5MTNKJU.js";
-import "./chunk-JWBEE4CL.js";
-import "./chunk-TODVDGMO.js";
+} from "./chunk-DEMX4GWU.js";
+import "./chunk-WAFY2TCB.js";
+import "./chunk-SG5YDHSE.js";
+import "./chunk-NI3WPW2L.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-IT3EYY2C.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/session-background-commands.js

@@ -27,10 +27,10 @@ import {
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction,
   unobservableRetainedProcessOutcomeSql
-} from "./chunk-JWBEE4CL.js";
-import "./chunk-TODVDGMO.js";
+} from "./chunk-SG5YDHSE.js";
+import "./chunk-NI3WPW2L.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-IT3EYY2C.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/session-command-output.js

@@ -1,10 +1,10 @@
 import {
   appendSessionCommandOutput
-} from "./chunk-K5MTNKJU.js";
-import "./chunk-JWBEE4CL.js";
-import "./chunk-TODVDGMO.js";
+} from "./chunk-WAFY2TCB.js";
+import "./chunk-SG5YDHSE.js";
+import "./chunk-NI3WPW2L.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-IT3EYY2C.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/session-event-slices.js

@@ -1,8 +1,8 @@
 import {
   listSessionEventSlices,
   readSessionMessageSliceInScope
-} from "./chunk-B5C5SBSI.js";
-import "./chunk-IT3EYY2C.js";
+} from "./chunk-JYKUR5KT.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/session-mcp-credential-rotation.js

@@ -1,17 +1,17 @@
 import {
   connectionMetadataMatchesBinding
-} from "./chunk-OV5AUIBA.js";
+} from "./chunk-4SUZSKKW.js";
 import {
   lockSessionEventWriteRows,
   organizationApiKeyAllowsWorkspace
-} from "./chunk-JWBEE4CL.js";
-import "./chunk-TODVDGMO.js";
+} from "./chunk-SG5YDHSE.js";
+import "./chunk-NI3WPW2L.js";
 import "./chunk-4UJCXBR2.js";
 import {
   rawRows,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import {
   apiKeys,
   sessionCommandReceipts,

package/dist/session-tenancy.js

@@ -13,8 +13,8 @@ import {
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
   transitionSessionVisibility
-} from "./chunk-DKFEUGM4.js";
-import "./chunk-IT3EYY2C.js";
+} from "./chunk-57FM4RG4.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-TODVDGMO.js";
+} from "./chunk-NI3WPW2L.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-IT3EYY2C.js";
+import "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/dist/workspace-tool-defaults.js

@@ -1,11 +1,11 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-JWBEE4CL.js";
-import "./chunk-TODVDGMO.js";
+} from "./chunk-SG5YDHSE.js";
+import "./chunk-NI3WPW2L.js";
 import "./chunk-4UJCXBR2.js";
 import {
   withWorkspaceRls
-} from "./chunk-IT3EYY2C.js";
+} from "./chunk-45EMCVJC.js";
 import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -115,12 +115,12 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "1.4.2",
-    "@opengeni/codex": "1.4.2",
-    "@opengeni/config": "1.4.2",
-    "@opengeni/contracts": "1.4.2",
-    "@opengeni/network": "1.4.2",
-    "@opengeni/observability": "1.4.2",
+    "@opengeni/codemode": "1.4.4",
+    "@opengeni/codex": "1.4.4",
+    "@opengeni/config": "1.4.4",
+    "@opengeni/contracts": "1.4.4",
+    "@opengeni/network": "1.4.4",
+    "@opengeni/observability": "1.4.4",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/database.ts

@@ -864,17 +864,33 @@ export async function withSessionActivityRlsContext<T>(
   fn: (db: SessionActivityDatabase) => Promise<T>,
   transactionConfig?: PgTransactionConfig,
   fenceMode: "shared" | "none" = "shared",
-  organizationMembershipFence = false,
+  organizationMembershipFence: OrganizationMembershipFenceMode = false,
 ): Promise<T> {
   await assertSessionActivityGateEntry(db);
   return await withRlsContext(
     db,
     context,
     async (scopedDb) => {
-      if (organizationMembershipFence) {
-        // Claim can inherit membership-fenced authority after locking sessions.
-        // Acquire membership before even a shared tenancy fence: an exclusive
-        // tenancy/control waiter can otherwise complete the same lock cycle.
+      if (organizationMembershipFence === "shared") {
+        // A pure reader of membership truth (the turn claim) only needs to
+        // exclude membership/tenancy mutators, which hold this key
+        // exclusively. Readers must not serialize each other: an exclusive
+        // claim fence made every turn claim in one organization queue behind
+        // every other one. Same position as the exclusive mode below, so the
+        // membership -> tenancy -> control prefix order is unchanged. A
+        // caller using this mode must never request the exclusive lock on the
+        // same key later in the transaction (no in-place escalation).
+        await scopedDb.execute(sql`select pg_advisory_xact_lock_shared(
+          hashtextextended(${`organization-membership:${context.accountId}`}, 0))`);
+        if (fenceMode === "shared") {
+          await scopedDb.execute(sql`select pg_advisory_xact_lock_shared(
+            hashtextextended(${`session-tenancy:${context.workspaceId}`}, 0))`);
+        }
+      } else if (organizationMembershipFence) {
+        // Callers that reauthorize or mutate under the membership lifecycle
+        // lock take it exclusively. Acquire membership before even a shared
+        // tenancy fence: an exclusive tenancy/control waiter can otherwise
+        // complete the same lock cycle.
         await scopedDb.execute(sql`select pg_advisory_xact_lock(
           hashtextextended(${`organization-membership:${context.accountId}`}, 0))`);
         if (fenceMode === "shared") {
@@ -894,10 +910,17 @@ export async function withSessionActivityRlsContext<T>(
       return value;
     },
     transactionConfig,
-    organizationMembershipFence ? "none" : fenceMode,
+    organizationMembershipFence !== false ? "none" : fenceMode,
   );
 }
 
+/**
+ * `true`/`"exclusive"`: the callback reauthorizes or mutates under the
+ * organization-membership lifecycle lock. `"shared"`: the callback only reads
+ * membership-fenced authority and must never escalate to exclusive.
+ */
+export type OrganizationMembershipFenceMode = boolean | "exclusive" | "shared";
+
 /**
  * `organizationMembershipFence` is required when the callback takes the
  * organization-membership lifecycle lock (for example external-actor
@@ -981,14 +1004,21 @@ export async function retrySessionActivityRls<T>(
     /** Claim can inherit membership-fenced causal authority after locking the
      * session. Acquire that fence before tenancy/control/session instead. An
      * enclosing transaction must preserve this same lock prefix. */
-    organizationMembershipFence?: boolean;
+    organizationMembershipFence?: OrganizationMembershipFenceMode;
   },
   fn: (db: SessionActivityDatabase) => Promise<T>,
 ): Promise<T> {
   return await runIdempotentPersistenceTransaction(options, async () => {
     if (options.organizationMembershipFence) {
       const context = { ...(await rlsContextForWorkspace(db, workspaceId)), workspaceId };
-      return await withSessionActivityRlsContext(db, context, fn, undefined, "shared", true);
+      return await withSessionActivityRlsContext(
+        db,
+        context,
+        fn,
+        undefined,
+        "shared",
+        options.organizationMembershipFence,
+      );
     }
     return await withWorkspaceSessionActivityRls(db, workspaceId, fn);
   });

package/src/index.ts

@@ -72441,7 +72441,10 @@ export async function claimSessionWorkForAttempt(
       stage: "session_attempts.claim",
       eventTypes: ["session.turn.attempt_claimed"],
       maxAttempts: 3,
-      organizationMembershipFence: true,
+      // Claim reads membership-fenced authority; it never mutates membership.
+      // Shared keeps membership mutators fenced while concurrent claims in
+      // one organization stay parallel (exclusive serialized every claim).
+      organizationMembershipFence: "shared",
     },
     async (scopedDb) =>
       await withSessionActivitySavepoint(scopedDb, async (tx) => {