@opengeni/db 3.2.2 → 3.3.0

package/dist/session-background-commands.js

@@ -28,13 +28,13 @@ import {
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction,
   unobservableRetainedProcessOutcomeSql
-} from "./chunk-V22DUH4C.js";
-import "./chunk-IF63BST7.js";
-import "./chunk-L3NT43Z5.js";
+} from "./chunk-HWEHZKHA.js";
+import "./chunk-Y4ERASEM.js";
+import "./chunk-7K5AVQUZ.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-6UU7OVUN.js";
+import "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 export {
   COMMAND_OUTPUT_DEFAULT_BYTES,

package/dist/session-command-output.js

@@ -1,13 +1,13 @@
 import {
   appendSessionCommandOutput,
   commandOutputClientEventIdPrefix
-} from "./chunk-V22DUH4C.js";
-import "./chunk-IF63BST7.js";
-import "./chunk-L3NT43Z5.js";
+} from "./chunk-HWEHZKHA.js";
+import "./chunk-Y4ERASEM.js";
+import "./chunk-7K5AVQUZ.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-6UU7OVUN.js";
+import "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 export {
   appendSessionCommandOutput,

package/dist/session-event-slices.js

@@ -1,10 +1,10 @@
 import {
   listSessionEventSlices,
   readSessionMessageSliceInScope
-} from "./chunk-4BAKPTPG.js";
-import "./chunk-6UU7OVUN.js";
+} from "./chunk-S74WULCK.js";
+import "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 export {
   listSessionEventSlices,

package/dist/session-mcp-credential-rotation.js

@@ -1,25 +1,25 @@
 import {
   connectionMetadataMatchesBinding
-} from "./chunk-VCJAYIPH.js";
+} from "./chunk-FX2PSMGH.js";
 import {
   lockSessionEventWriteRows,
   organizationApiKeyAllowsWorkspace
-} from "./chunk-V22DUH4C.js";
-import "./chunk-IF63BST7.js";
-import "./chunk-L3NT43Z5.js";
+} from "./chunk-HWEHZKHA.js";
+import "./chunk-Y4ERASEM.js";
+import "./chunk-7K5AVQUZ.js";
 import "./chunk-4UJCXBR2.js";
 import {
   rawRows,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-6UU7OVUN.js";
+} from "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
 import {
   apiKeys,
   sessionCommandReceipts,
   sessionMcpServers,
   sessions
-} from "./chunk-OXO32LTK.js";
+} from "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-mcp-credential-rotation.ts

package/dist/session-tenancy.js

@@ -19,14 +19,14 @@ import {
   sessionHasLiveAttempts,
   stopSessionWorkForVisibilityChange,
   transitionSessionVisibility
-} from "./chunk-K6NT66NP.js";
-import "./chunk-V22DUH4C.js";
-import "./chunk-IF63BST7.js";
-import "./chunk-L3NT43Z5.js";
+} from "./chunk-SDKFRIAN.js";
+import "./chunk-HWEHZKHA.js";
+import "./chunk-Y4ERASEM.js";
+import "./chunk-7K5AVQUZ.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-6UU7OVUN.js";
+import "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EMPTY_SESSION_VISIBILITY_WORK,

package/dist/site-publishing.d.ts

@@ -440,6 +440,17 @@ export declare function listActiveSiteRuntimeConversations(db: Database, scope:
         everyoneTools: boolean;
     };
 }): Promise<string[]>;
+/** Keyset-paged lifecycle inventory; no viewer transcript or age/count cutoff. */
+export declare function listSiteRuntimeCancellationCandidates(db: Database, scope: SitePublishingScope, input: {
+    siteId: string;
+    after?: string;
+    limit: number;
+    startedBefore: Date;
+    toolsNarrowedTo?: {
+        tools: readonly string[];
+        everyoneTools: boolean;
+    };
+}): Promise<string[]>;
 export type SiteRuntimeUsageSnapshot = {
     visitorDay: {
         conversations: number;

package/dist/{subscription-core-codex-4G4CCOJU.js → subscription-core-codex-HIAP7CY2.js}

@@ -19,8 +19,8 @@ import {
   subscriptionCoreReselectionPoints,
   subscriptionCoreTurnActor,
   touchSubscriptionCoreCodexBinding
-} from "./chunk-JYPBOJ2Y.js";
-import "./chunk-VBG4TW5C.js";
+} from "./chunk-AAOKWNHE.js";
+import "./chunk-ZZOEKHGU.js";
 import {
   SUBSCRIPTION_CORE_CODEX_ENTITLEMENT_COOLDOWN_MS,
   SUBSCRIPTION_CORE_CODEX_EXHAUSTED_FALLBACK_MS,
@@ -28,10 +28,10 @@ import {
   SUBSCRIPTION_CORE_CODEX_RATE_LIMIT_FALLBACK_MS,
   SubscriptionCoreCodexAccessLostError,
   SubscriptionCoreCodexLeaseLostError
-} from "./chunk-IF63BST7.js";
-import "./chunk-6UU7OVUN.js";
+} from "./chunk-Y4ERASEM.js";
+import "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SUBSCRIPTION_CORE_CODEX_ENTITLEMENT_COOLDOWN_MS,
@@ -61,4 +61,4 @@ export {
   subscriptionCoreTurnActor,
   touchSubscriptionCoreCodexBinding
 };
-//# sourceMappingURL=subscription-core-codex-4G4CCOJU.js.map
+//# sourceMappingURL=subscription-core-codex-HIAP7CY2.js.map

package/dist/{subscription-core-codex-compat-64ACIZVP.js → subscription-core-codex-compat-IBERN7DU.js}

@@ -12,17 +12,17 @@ import {
   setSubscriptionCoreCodexPrimary,
   setSubscriptionCoreCodexRotation,
   setSubscriptionCoreWorkspaceCodexSource
-} from "./chunk-YWHG45TK.js";
-import "./chunk-VBG4TW5C.js";
-import "./chunk-V22DUH4C.js";
+} from "./chunk-PNEJVKKV.js";
+import "./chunk-ZZOEKHGU.js";
+import "./chunk-HWEHZKHA.js";
 import {
   SubscriptionCoreCodexSourceRefusedError
-} from "./chunk-IF63BST7.js";
-import "./chunk-L3NT43Z5.js";
+} from "./chunk-Y4ERASEM.js";
+import "./chunk-7K5AVQUZ.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-6UU7OVUN.js";
+import "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SubscriptionCoreCodexSourceRefusedError,
@@ -40,4 +40,4 @@ export {
   setSubscriptionCoreCodexRotation,
   setSubscriptionCoreWorkspaceCodexSource
 };
-//# sourceMappingURL=subscription-core-codex-compat-64ACIZVP.js.map
+//# sourceMappingURL=subscription-core-codex-compat-IBERN7DU.js.map

package/dist/video-generation.js

@@ -28,11 +28,11 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-L3NT43Z5.js";
+} from "./chunk-7K5AVQUZ.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-6UU7OVUN.js";
+import "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/workspace-tool-defaults.js

@@ -1,14 +1,14 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-V22DUH4C.js";
-import "./chunk-IF63BST7.js";
-import "./chunk-L3NT43Z5.js";
+} from "./chunk-HWEHZKHA.js";
+import "./chunk-Y4ERASEM.js";
+import "./chunk-7K5AVQUZ.js";
 import "./chunk-4UJCXBR2.js";
 import {
   withWorkspaceRls
-} from "./chunk-6UU7OVUN.js";
+} from "./chunk-JTBJGSUZ.js";
 import "./chunk-SMCA7PNJ.js";
-import "./chunk-OXO32LTK.js";
+import "./chunk-CEJ3NQ3B.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/workspace-tool-defaults.ts

package/drizzle/0793_private_site_sessions.sql

@@ -0,0 +1,166 @@
+-- deployment-mode: maintenance
+-- maintenance-justification: old Site writers cannot supply the new immutable viewer audience or proof; drain them before activating the fail-closed native boundary.
+-- Freeze an independent viewer audience on native sessions. Published legacy
+-- mappings prove their audience; historical console provenance does not, and
+-- is deliberately not converted into an asserted private owner.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE sessions ADD COLUMN site_id uuid,
+  ADD COLUMN site_access_root_id uuid,
+  ADD COLUMN site_viewer_principal text,
+  ADD COLUMN site_owner_subject_id text;
+ALTER TABLE model_call_facts ADD COLUMN site_id uuid;
+
+-- Run the bounded source backfill under the same tenant scope as each row.
+-- Maintenance cutover: the migration owner must enumerate all tenants even
+-- when NOSUPERUSER/NOBYPASSRLS. These transaction-local DDL changes are restored
+-- before commit; runtime roles never receive a cross-tenant read lane.
+ALTER TABLE site_runtime_conversations NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE sessions NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE model_call_facts NO FORCE ROW LEVEL SECURITY;
+-- Table locks already exclude runtime writers; do not acquire a workspace
+-- advisory fence after those locks. Restore the exact trigger before commit.
+ALTER TABLE sessions DISABLE TRIGGER session_tenancy_workspace_fence;
+DO $backfill$
+DECLARE scope record;
+BEGIN
+  FOR scope IN SELECT DISTINCT account_id, workspace_id FROM site_runtime_conversations LOOP
+    PERFORM set_config('opengeni.account_id', scope.account_id::text, true);
+    PERFORM set_config('opengeni.workspace_id', scope.workspace_id::text, true);
+    WITH RECURSIVE bound AS (
+      SELECT s.id, s.id AS access_root, c.site_id, c.viewer_principal,
+        CASE WHEN c.viewer_principal LIKE 'user:%' THEN substr(c.viewer_principal,6) END AS owner
+      FROM sessions s JOIN site_runtime_conversations c
+        ON c.session_id=s.id AND c.account_id=s.account_id AND c.workspace_id=s.workspace_id
+      WHERE s.account_id=scope.account_id AND s.workspace_id=scope.workspace_id
+      UNION ALL
+      SELECT child.id, b.access_root,b.site_id,b.viewer_principal,b.owner
+      FROM sessions child JOIN bound b ON child.parent_session_id=b.id
+      WHERE child.account_id=scope.account_id AND child.workspace_id=scope.workspace_id
+    ) UPDATE sessions s SET site_id=b.site_id,site_access_root_id=b.access_root,
+      site_viewer_principal=b.viewer_principal,site_owner_subject_id=b.owner
+      FROM bound b WHERE s.id=b.id AND s.workspace_id=scope.workspace_id;
+    UPDATE model_call_facts f SET site_id=s.site_id FROM sessions s
+      WHERE f.account_id=scope.account_id AND f.workspace_id=scope.workspace_id
+        AND s.id=f.session_id AND s.workspace_id=f.workspace_id AND s.site_id IS NOT NULL;
+  END LOOP;
+END
+$backfill$;
+ALTER TABLE sessions ENABLE TRIGGER session_tenancy_workspace_fence;
+ALTER TABLE site_runtime_conversations FORCE ROW LEVEL SECURITY;
+ALTER TABLE sessions FORCE ROW LEVEL SECURITY;
+ALTER TABLE model_call_facts FORCE ROW LEVEL SECURITY;
+
+CREATE FUNCTION bind_session_site_audience() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $body$
+DECLARE parent sessions%ROWTYPE; conversation site_runtime_conversations%ROWTYPE;
+  origin jsonb; enabled boolean;
+BEGIN
+  IF TG_OP='UPDATE' THEN
+    IF OLD.site_access_root_id IS NOT NULL AND NEW.visibility IS DISTINCT FROM OLD.visibility THEN
+      RAISE EXCEPTION 'Site conversations keep their viewer audience; publish an output to share it' USING ERRCODE='42501';
+    END IF;
+    IF ROW(NEW.site_id,NEW.site_access_root_id,NEW.site_viewer_principal,NEW.site_owner_subject_id)
+      IS DISTINCT FROM ROW(OLD.site_id,OLD.site_access_root_id,OLD.site_viewer_principal,OLD.site_owner_subject_id)
+    THEN RAISE EXCEPTION 'Site session audience is immutable' USING ERRCODE='42501'; END IF;
+    RETURN NEW;
+  END IF;
+  IF NEW.site_id IS NOT NULL OR NEW.site_access_root_id IS NOT NULL
+    OR NEW.site_viewer_principal IS NOT NULL OR NEW.site_owner_subject_id IS NOT NULL
+  THEN RAISE EXCEPTION 'Site audience is derived by the server' USING ERRCODE='42501'; END IF;
+  IF NEW.parent_session_id IS NOT NULL THEN
+    SELECT * INTO parent FROM sessions WHERE id=NEW.parent_session_id
+      AND account_id=NEW.account_id AND workspace_id=NEW.workspace_id;
+    IF parent.site_access_root_id IS NOT NULL THEN
+      NEW.site_id:=parent.site_id; NEW.site_access_root_id:=parent.site_access_root_id;
+      NEW.site_viewer_principal:=parent.site_viewer_principal;
+      NEW.site_owner_subject_id:=parent.site_owner_subject_id;
+      RETURN NEW;
+    END IF;
+  END IF;
+  SELECT * INTO conversation FROM site_runtime_conversations
+    WHERE session_id=NEW.id AND account_id=NEW.account_id AND workspace_id=NEW.workspace_id;
+  IF FOUND THEN
+    NEW.site_id:=conversation.site_id; NEW.site_access_root_id:=NEW.id;
+    NEW.site_viewer_principal:=conversation.viewer_principal;
+    IF conversation.viewer_principal LIKE 'user:%' THEN
+      NEW.site_owner_subject_id:=substr(conversation.viewer_principal,6);
+    END IF;
+  ELSE
+    origin:=NEW.metadata->'_opengeniSiteOrigin';
+    IF jsonb_typeof(origin) IS DISTINCT FROM 'object' THEN RETURN NEW; END IF;
+    -- Native ownership must already have been derived by the authority fence.
+    -- Old console writers without private creation fail closed after migration.
+    IF NEW.owner_subject_id IS NULL OR
+      (NEW.parent_session_id IS NULL AND NEW.visibility<>'user_private') THEN
+      RAISE EXCEPTION 'Private Site sessions require verified viewer ownership' USING ERRCODE='42501';
+    END IF;
+    NEW.site_id:=nullif(origin->>'siteId','')::uuid;
+    NEW.site_access_root_id:=NEW.id; NEW.site_owner_subject_id:=NEW.owner_subject_id;
+  END IF;
+  IF current_setting('opengeni.site_session_audience_v1',true) IS DISTINCT FROM '1' THEN
+    RAISE EXCEPTION 'Site session writer upgrade required' USING ERRCODE='55000';
+  END IF;
+  -- Guest/service execution is not an exception to the organization's private
+  -- conversation policy. Native member creation already takes this lock first.
+  PERFORM pg_advisory_xact_lock(hashtextextended('organization-membership:'||NEW.account_id,0));
+  enabled:=organization_private_sessions_enabled(NEW.account_id);
+  IF NOT enabled AND NOT EXISTS(SELECT 1 FROM organization_memberships m
+    WHERE m.account_id=NEW.account_id AND m.status='active'
+      AND m.personal_workspace_id=NEW.workspace_id AND m.subject_id=NEW.site_owner_subject_id)
+  THEN RAISE EXCEPTION 'Private Site conversations are disabled by organization policy' USING ERRCODE='P0793'; END IF;
+  RETURN NEW;
+END
+$body$;
+-- Alphabetical trigger order: ownership is frozen before the Site audience.
+CREATE TRIGGER zz_sessions_site_audience BEFORE INSERT OR UPDATE ON sessions
+  FOR EACH ROW EXECUTE FUNCTION bind_session_site_audience();
+
+CREATE FUNCTION session_site_actor_visible(p_site uuid,p_access_root uuid,p_root uuid,p_viewer text,p_owner text)
+RETURNS boolean LANGUAGE sql STABLE SET search_path=pg_catalog AS $body$
+  SELECT p_access_root IS NULL
+    OR nullif(current_setting('opengeni.subject_id',true),'') IS NULL
+    OR p_owner=nullif(current_setting('opengeni.subject_id',true),'')
+    OR p_owner=nullif(current_setting('opengeni.initiating_human_subject_id',true),'')
+    OR (p_root::text=nullif(current_setting('opengeni.agent_root_session_id',true),'')
+      AND (p_access_root=p_root OR p_owner=nullif(current_setting('opengeni.initiating_human_subject_id',true),'')))
+    OR (current_setting('opengeni.subject_id',true)='site:'||p_site::text
+      AND p_site::text=current_setting('opengeni.site_id',true)
+      AND p_viewer=current_setting('opengeni.site_viewer_principal',true))
+$body$;
+-- No inventory-owner exception: privileged Insights transcript projections
+-- also see only the viewer's Site sessions. Their existing masked raw amount
+-- projections retain workspace totals without exposing private session data.
+CREATE POLICY site_viewer_isolation ON sessions AS RESTRICTIVE FOR ALL
+  USING (session_site_actor_visible(site_id,site_access_root_id,root_session_id,site_viewer_principal,site_owner_subject_id))
+  WITH CHECK (session_site_actor_visible(site_id,site_access_root_id,root_session_id,site_viewer_principal,site_owner_subject_id));
+CREATE INDEX sessions_site_viewer_idx ON sessions(workspace_id,site_id,site_viewer_principal)
+  WHERE site_access_root_id IS NOT NULL;
+
+CREATE FUNCTION stamp_model_call_site() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+BEGIN
+  IF TG_OP='INSERT' THEN
+    SELECT s.site_id INTO NEW.site_id FROM sessions s
+      WHERE s.account_id=NEW.account_id AND s.workspace_id=NEW.workspace_id AND s.id=NEW.session_id;
+  ELSIF NEW.site_id IS DISTINCT FROM OLD.site_id THEN
+    RAISE EXCEPTION 'Model call Site attribution is immutable' USING ERRCODE='42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER model_call_site_attribution BEFORE INSERT OR UPDATE ON model_call_facts
+  FOR EACH ROW EXECUTE FUNCTION stamp_model_call_site();
+CREATE INDEX model_call_facts_site_occurred_idx ON model_call_facts(workspace_id,site_id,occurred_at)
+  WHERE site_id IS NOT NULL;
+
+REVOKE ALL ON FUNCTION bind_session_site_audience() FROM PUBLIC;
+REVOKE ALL ON FUNCTION stamp_model_call_site() FROM PUBLIC;
+DO $pin$
+DECLARE data_schema text:=current_schema();
+BEGIN
+  EXECUTE format('ALTER FUNCTION %I.bind_session_site_audience() SET search_path=pg_catalog,%I,pg_temp',data_schema,data_schema);
+  EXECUTE format('ALTER FUNCTION %I.stamp_model_call_site() SET search_path=pg_catalog,%I,pg_temp',data_schema,data_schema);
+END
+$pin$;

package/drizzle/0794_site_ai_insights.sql

@@ -0,0 +1,175 @@
+-- deployment-mode: maintenance
+-- maintenance-justification: backfill exact model debit attribution during the private Site audience cutover before old writers or analytical readers can resume.
+-- Retain exact Site attribution on actual model debits, independently of fact
+-- delivery and session retention. No repricing or changes to charged amounts.
+SET LOCAL lock_timeout='5s';
+SET LOCAL statement_timeout='5min';
+ALTER TABLE credit_ledger_entries ADD COLUMN site_id uuid;
+
+ALTER TABLE sessions NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE credit_ledger_entries NO FORCE ROW LEVEL SECURITY;
+DO $backfill$
+DECLARE scope record;
+BEGIN
+  FOR scope IN SELECT DISTINCT account_id,workspace_id FROM sessions WHERE site_id IS NOT NULL LOOP
+    PERFORM set_config('opengeni.account_id',scope.account_id::text,true);
+    PERFORM set_config('opengeni.workspace_id',scope.workspace_id::text,true);
+    UPDATE credit_ledger_entries c SET site_id=s.site_id FROM sessions s
+      WHERE c.account_id=scope.account_id AND c.workspace_id=scope.workspace_id
+        AND c.type='model_usage_debit' AND c.source_type='model_response'
+        AND s.account_id=c.account_id AND s.workspace_id=c.workspace_id
+        AND s.id::text=c.metadata->>'sessionId' AND s.site_id IS NOT NULL;
+  END LOOP;
+END
+$backfill$;
+ALTER TABLE sessions FORCE ROW LEVEL SECURITY;
+ALTER TABLE credit_ledger_entries FORCE ROW LEVEL SECURITY;
+
+CREATE FUNCTION stamp_model_debit_site() RETURNS trigger
+LANGUAGE plpgsql SET search_path FROM CURRENT AS $body$
+BEGIN
+  IF TG_OP='INSERT' THEN
+    NEW.site_id:=NULL;
+    IF NEW.type='model_usage_debit' AND NEW.source_type='model_response' THEN
+      SELECT s.site_id INTO NEW.site_id FROM sessions s
+        WHERE s.account_id=NEW.account_id AND s.workspace_id=NEW.workspace_id
+          AND s.id::text=NEW.metadata->>'sessionId';
+    END IF;
+  ELSIF NEW.site_id IS DISTINCT FROM OLD.site_id THEN
+    RAISE EXCEPTION 'Model debit Site attribution is immutable' USING ERRCODE='42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+CREATE TRIGGER model_debit_site_attribution BEFORE INSERT OR UPDATE ON credit_ledger_entries
+  FOR EACH ROW EXECUTE FUNCTION stamp_model_debit_site();
+REVOKE ALL ON FUNCTION stamp_model_debit_site() FROM PUBLIC;
+CREATE INDEX credit_ledger_site_occurred_idx ON credit_ledger_entries(workspace_id,site_id,occurred_at)
+  WHERE site_id IS NOT NULL AND type='model_usage_debit' AND amount_micros<0;
+
+DO $reader$
+BEGIN
+  EXECUTE format($ddl$
+    CREATE FUNCTION opengeni_private.insights_site_usage(a uuid,w uuid,lo timestamptz,hi timestamptz,viewer text)
+    RETURNS TABLE(payload jsonb) LANGUAGE plpgsql VOLATILE SECURITY DEFINER
+    SET search_path=pg_catalog,%1$I,opengeni_private,pg_temp SET jit=off AS $fn$
+    DECLARE actor text:=nullif(current_setting('opengeni.subject_id',true),'');
+      human text:=nullif(current_setting('opengeni.initiating_human_subject_id',true),'');
+    BEGIN
+      IF a IS NULL OR w IS NULL OR a IS DISTINCT FROM nullif(current_setting('opengeni.account_id',true),'')::uuid
+        OR w IS DISTINCT FROM nullif(current_setting('opengeni.workspace_id',true),'')::uuid THEN
+        RAISE EXCEPTION 'Site Insights requires exact tenant scope' USING ERRCODE='42501'; END IF;
+      IF lo IS NULL OR hi IS NULL OR hi<lo OR hi-lo>interval '370 days' THEN
+        RAISE EXCEPTION 'Invalid Site Insights window' USING ERRCODE='22023'; END IF;
+      IF viewer IS NOT NULL AND viewer IS DISTINCT FROM actor AND viewer IS DISTINCT FROM human THEN
+        RAISE EXCEPTION 'Site Insights viewer differs from the verified actor' USING ERRCODE='42501'; END IF;
+      -- The existing owner+witness fact capability admits costs, not transcripts.
+      INSERT INTO opengeni_private.insights_fact_read_runtime_capabilities
+        (backend_pid,transaction_id,capability_kind,account_id,workspace_id,subject_id,initiating_human_subject_id)
+        VALUES(pg_backend_pid(),pg_current_xact_id(),'model_call_facts',a,w,actor,human);
+      BEGIN
+        RETURN QUERY WITH amounts AS MATERIALIZED (
+          SELECT f.site_id,1::bigint calls,CASE WHEN f.estimated_provider_cost_micros IS NULL THEN 0 ELSE 1 END::bigint priced,
+            0::bigint charged,coalesce(f.estimated_provider_cost_micros,0) equivalent,
+            CASE WHEN opengeni_private.insights_usage_payer(f.provider,f.billing_path)='subscription'
+              THEN coalesce(f.estimated_provider_cost_micros,0) ELSE 0 END subscription,
+            CASE WHEN opengeni_private.insights_usage_payer(f.provider,f.billing_path)='own_key'
+              THEN coalesce(f.estimated_provider_cost_micros,0) ELSE 0 END own_key
+          FROM %1$I.model_call_facts f WHERE f.account_id=a AND f.workspace_id=w
+            AND f.site_id IS NOT NULL AND f.occurred_at>=lo AND f.occurred_at<hi
+          UNION ALL
+          SELECT c.site_id,0,0,-c.amount_micros,0,0,0 FROM %1$I.credit_ledger_entries c
+            WHERE c.account_id=a AND c.workspace_id=w AND c.site_id IS NOT NULL
+              AND c.type='model_usage_debit' AND c.source_type='model_response' AND c.amount_micros<0
+              AND c.occurred_at>=lo AND c.occurred_at<hi
+        ), visible AS MATERIALIZED (
+          -- Match workspace-artifacts.visibleTo: its RLS is tenant-only.
+          -- Private/unavailable Sites share one bucket; never leak their ids.
+          SELECT site.id,site.title FROM %1$I.workspace_artifacts site
+            WHERE site.account_id=a AND site.workspace_id=w
+              AND (site.visibility='workspace_shared' OR site.owner_subject_id=viewer)
+        ), grouped AS (
+          SELECT v.id,coalesce(v.title,'Private or unavailable Sites') title,
+            CASE WHEN v.id IS NULL THEN 'restricted' ELSE 'site' END kind,
+            sum(calls)::bigint calls,sum(priced)::bigint priced,sum(charged)::bigint charged,
+            sum(equivalent)::bigint equivalent,sum(subscription)::bigint subscription,sum(own_key)::bigint own_key
+          FROM amounts x LEFT JOIN visible v ON v.id=x.site_id GROUP BY v.id,v.title
+        ), ranked AS (
+          SELECT *,row_number() OVER(ORDER BY charged DESC,equivalent DESC,id NULLS LAST) position FROM grouped
+        ), bounded AS (
+          SELECT id,title,kind,calls,priced,charged,equivalent,subscription,own_key FROM ranked WHERE position<=200
+          UNION ALL SELECT NULL,'Other Sites','other',sum(calls)::bigint,sum(priced)::bigint,sum(charged)::bigint,
+            sum(equivalent)::bigint,sum(subscription)::bigint,sum(own_key)::bigint FROM ranked WHERE position>200 HAVING count(*)>0
+        ) SELECT jsonb_build_object('siteId',id,'title',title,'kind',kind,'calls',calls,'pricedCalls',priced,
+          'chargedMicros',charged,'apiEquivalentMicros',equivalent,'subscriptionApiEquivalentMicros',subscription,
+          'ownKeyApiEquivalentMicros',own_key) FROM bounded ORDER BY charged DESC,equivalent DESC,id NULLS LAST;
+        DELETE FROM opengeni_private.insights_fact_read_runtime_capabilities WHERE backend_pid=pg_backend_pid()
+          AND transaction_id=pg_current_xact_id_if_assigned() AND capability_kind='model_call_facts';
+      EXCEPTION WHEN OTHERS THEN
+        DELETE FROM opengeni_private.insights_fact_read_runtime_capabilities WHERE backend_pid=pg_backend_pid()
+          AND transaction_id=pg_current_xact_id_if_assigned() AND capability_kind='model_call_facts';
+        RAISE;
+      END;
+    END
+    $fn$;
+  $ddl$,current_schema());
+  EXECUTE format('ALTER FUNCTION %I.stamp_model_debit_site() SET search_path=pg_catalog,%I,pg_temp',current_schema(),current_schema());
+END
+$reader$;
+
+REVOKE ALL ON FUNCTION opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text) FROM PUBLIC;
+DO $acl$
+DECLARE role_name text;
+BEGIN
+  FOR role_name IN SELECT r.rolname FROM jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) configured(value)
+    JOIN pg_roles r ON r.rolname=configured.value
+    WHERE has_table_privilege(r.rolname,format('%I.model_call_facts',current_schema()),'SELECT') LOOP
+    EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text) TO %I',role_name);
+  END LOOP;
+END
+$acl$;
+
+-- Analytical definers also run in installations whose migration owner bypasses
+-- RLS. Keep the independent Site audience explicit, without changing native
+-- private-session predicates or granting inventory access to Site transcripts.
+-- This invoker view adds only a filter; it never confers underlying table access.
+CREATE VIEW insights_audience_sessions WITH (security_invoker=true,security_barrier=true) AS
+  SELECT * FROM sessions WHERE session_site_actor_visible(
+    site_id,site_access_root_id,root_session_id,site_viewer_principal,site_owner_subject_id);
+REVOKE ALL ON insights_audience_sessions FROM PUBLIC;
+
+-- Existing migrations use source-anchored function replacement to preserve
+-- signatures, ACLs and accounting protocols. Change only the sessions relation
+-- in the complete, enumerated family of analytical readers; refuse source drift.
+DO $analytical_audience$
+DECLARE routine record; original text; updated text; changed int:=0;
+BEGIN
+  FOR routine IN SELECT p.oid,p.proname FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace
+    WHERE n.nspname='opengeni_private' AND p.proname IN (
+      'visible_workspace_insights_model_call_facts','visible_workspace_insights_usage_events',
+      'visible_workspace_insights_usage_projection','complete_workspace_insights_usage_projection',
+      'visible_workspace_insights_model_fact_rows','workspace_insights_amount_fact_rows',
+      'insights_scoped_usage_rows','insights_scoped_calls_rows') LOOP
+    original:=pg_get_functiondef(routine.oid);
+    updated:=regexp_replace(original,'\.sessions([[:space:]])','.insights_audience_sessions\1','g');
+    IF updated=original THEN
+      -- The short overloads delegate to their scoped sibling without a join.
+      IF routine.proname NOT IN('visible_workspace_insights_model_call_facts','visible_workspace_insights_usage_events') THEN
+        RAISE EXCEPTION 'Insights audience source contract changed: %',routine.proname; END IF;
+      CONTINUE;
+    END IF;
+    IF routine.proname='insights_scoped_usage_rows' THEN
+      -- A hidden Site is restricted, not a deleted conversation. This metadata
+      -- existence check cannot project identifiers and keeps totals complete.
+      updated:=replace(updated,'WHEN s.id IS NULL OR r.id IS NULL THEN ''deleted''',format(
+        'WHEN (s.id IS NULL OR r.id IS NULL) AND EXISTS(SELECT 1 FROM %I.model_call_facts sf
+          WHERE sf.account_id=a AND sf.workspace_id=w.id AND sf.session_id=f.session_id AND sf.site_id IS NOT NULL)
+          THEN ''restricted'' WHEN s.id IS NULL OR r.id IS NULL THEN ''deleted''',current_schema()));
+      IF position('sf.site_id IS NOT NULL' IN updated)=0 THEN RAISE EXCEPTION 'Insights classification source contract changed'; END IF;
+    END IF;
+    EXECUTE updated;
+    changed:=changed+1;
+  END LOOP;
+  IF changed<>9 THEN RAISE EXCEPTION 'Expected nine scoped analytical readers, updated %',changed; END IF;
+END
+$analytical_audience$;