@opengeni/db 3.5.2-canary.0 → 3.7.3-canary.0

package/dist/schema.js

@@ -46,6 +46,7 @@ import {
   companyBrainContextSelectionReceipts,
   companyBrainTurnContextSnapshots,
   companyProfileActivationEvents,
+  companyProfileAgentAutomaticActivationReceipts,
   companyProfileAgentConfirmationReceipts,
   companyProfileAgentProposalReceipts,
   companyProfileHeads,
@@ -160,6 +161,9 @@ import {
   nestedAgentDepthConfiguration,
   networkRoutes,
   newSessionDrafts,
+  organizationCodexRotationSettings,
+  organizationCompanyProfileAgentPolicies,
+  organizationCompanyProfileAgentPolicyEvents,
   organizationInvitationBindingEvents,
   organizationMembershipInvitations,
   organizationMembershipLifecycleEvents,
@@ -224,6 +228,7 @@ import {
   sessionAttemptToolCatalogs,
   sessionBackgroundCommands,
   sessionCommandReceipts,
+  sessionEventCursors,
   sessionEvents,
   sessionGoalRevisions,
   sessionGoals,
@@ -249,6 +254,9 @@ import {
   sessionTurnStartupMilestones,
   sessionTurns,
   sessionVariableSetAttachments,
+  sessionWorkClaimRevisions,
+  sessionWorkClaimWriteCapabilities,
+  sessionWorkClaims,
   sessionWorkflowWakeOutbox,
   sessions,
   siteAuthConnections,
@@ -300,6 +308,7 @@ import {
   workspaceArtifactVersions,
   workspaceArtifacts,
   workspaceCaptures,
+  workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,
@@ -328,7 +337,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-6NYKC5DD.js";
+} from "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -378,6 +387,7 @@ export {
   companyBrainContextSelectionReceipts,
   companyBrainTurnContextSnapshots,
   companyProfileActivationEvents,
+  companyProfileAgentAutomaticActivationReceipts,
   companyProfileAgentConfirmationReceipts,
   companyProfileAgentProposalReceipts,
   companyProfileHeads,
@@ -492,6 +502,9 @@ export {
   nestedAgentDepthConfiguration,
   networkRoutes,
   newSessionDrafts,
+  organizationCodexRotationSettings,
+  organizationCompanyProfileAgentPolicies,
+  organizationCompanyProfileAgentPolicyEvents,
   organizationInvitationBindingEvents,
   organizationMembershipInvitations,
   organizationMembershipLifecycleEvents,
@@ -556,6 +569,7 @@ export {
   sessionAttemptToolCatalogs,
   sessionBackgroundCommands,
   sessionCommandReceipts,
+  sessionEventCursors,
   sessionEvents,
   sessionGoalRevisions,
   sessionGoals,
@@ -581,6 +595,9 @@ export {
   sessionTurnStartupMilestones,
   sessionTurns,
   sessionVariableSetAttachments,
+  sessionWorkClaimRevisions,
+  sessionWorkClaimWriteCapabilities,
+  sessionWorkClaims,
   sessionWorkflowWakeOutbox,
   sessions,
   siteAuthConnections,
@@ -632,6 +649,7 @@ export {
   workspaceArtifactVersions,
   workspaceArtifacts,
   workspaceCaptures,
+  workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,

package/dist/session-background-commands.js

@@ -12,9 +12,9 @@ import {
   settleClaimedConnectedMachineBackgroundCommand,
   settleConnectedMachineSessionBackgroundCommand,
   settleSessionBackgroundCommandForRetainedProcess
-} from "./chunk-FJHEWYV5.js";
-import "./chunk-X6T2P3L3.js";
-import "./chunk-6NYKC5DD.js";
+} from "./chunk-S3TDDCS2.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   backgroundCommandActivityForSessions,

package/dist/session-control.d.ts

@@ -60,6 +60,17 @@ export type EffectiveSessionControl = {
         commandCount: number;
     } | null;
 };
+/**
+ * The bounded control projection required by a locked activity-write fence.
+ * Settlement and background-command summaries are read-model concerns and must
+ * not extend the session-event critical section when admission only needs the
+ * effective run state and blocker scope.
+ */
+export type SessionWriteAdmissionControl = {
+    state: EffectiveControlState;
+    controlVersion: number;
+    primaryBlockerKind: EffectiveControlBlocker["kind"] | null;
+};
 export declare const SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS = 200;
 export declare const SESSION_DISCOVERY_CONTROL_TARGET_LIMIT = 100;
 /**
@@ -272,6 +283,13 @@ export type SessionEventWriteLockInput = {
     controlLock: WorkspaceControlLockMode | "already_locked" | "none";
     /** Used only when a staged caller already established the workspace prefix. */
     workspaceLock?: "key_share" | "already_locked";
+    /**
+     * Semantic writers retain FOR NO KEY UPDATE. Cursor-authoritative raw-only
+     * appends need only the FK-compatible identity hold; KEY SHARE is compatible
+     * with semantic NO KEY UPDATE and therefore removes the wide session row as
+     * their serialization mutex without inverting the rolling lock order.
+     */
+    sessionLock?: "no_key_update" | "key_share";
     sessionIds?: string[];
     turnIds?: string[];
     attemptIds?: string[];
@@ -280,6 +298,7 @@ export type SessionEventWriteLocks = {
     control: WorkspaceControlRow | null;
     workspace: typeof schema.workspaces.$inferSelect | null;
     sessions: Array<typeof schema.sessions.$inferSelect>;
+    cursors: Array<typeof schema.sessionEventCursors.$inferSelect>;
     turns: Array<typeof schema.sessionTurns.$inferSelect>;
     attempts: Array<typeof schema.sessionTurnAttempts.$inferSelect>;
 };
@@ -289,7 +308,8 @@ export type SessionEventWriteLocks = {
  *   workspace-control advisory lock + workspace_inference_controls row
  *     (when control-aware; see `lockWorkspaceInferenceControl`)
  *     -> actual workspaces row FOR KEY SHARE
- *     -> session rows FOR NO KEY UPDATE, UUID ordered
+ *     -> session rows FOR NO KEY UPDATE (semantic) or KEY SHARE (raw), UUID ordered
+ *     -> session event cursor rows FOR UPDATE, UUID ordered
  *     -> exact turn rows FOR UPDATE, UUID ordered
  *     -> exact attempt rows FOR UPDATE, UUID ordered
  *
@@ -304,10 +324,12 @@ export type SessionEventWriteLocks = {
  * `FOR UPDATE` lock serialized unrelated sessions and inverted the activity
  * path's session -> implicit workspace-FK edge.
  *
- * `FOR NO KEY UPDATE` is equally deliberate for sessions. Session primary and
- * composite identity keys are immutable, so writers need to exclude only concurrent
- * non-key mutation. Keeping FK `FOR KEY SHARE` checks compatible prevents the
- * activity finalizer's workspace counter from participating in a lock cycle.
+ * `FOR NO KEY UPDATE` is equally deliberate for semantic session writers.
+ * Cursor-authoritative raw-only writers use `FOR KEY SHARE`: it preserves the
+ * session identity against deletion while remaining compatible with semantic
+ * `FOR NO KEY UPDATE`. Keeping this rolling session-before-cursor order avoids
+ * an inversion with old binaries and quiescent cascade deletion; the compact
+ * cursor row, not the wide session row, is the raw ordering mutex.
  *
  * Complex lifecycle transactions may acquire allocator/control locks before
  * this helper and may discover exact turn IDs only after locking the session.
@@ -379,6 +401,19 @@ export declare function evaluateSessionControls(db: Database, workspaceId: strin
     /** Reuse a control row already locked before workspace/session/turn rows. */
     workspaceControl?: WorkspaceControlRow | undefined;
 }): Promise<Map<string, EffectiveSessionControl>>;
+/**
+ * Evaluate only the control facts needed to admit an already locked session
+ * write. The workspace-control row must be reused when the caller established
+ * the canonical prefix before session/turn/attempt locks.
+ *
+ * Deliberately omit settlementAttemptCounts and
+ * stoppingBackgroundCommandCounts: those recursive summaries do not affect
+ * effective pause state and their results are discarded by the write fence.
+ */
+export declare function evaluateSessionWriteAdmissionControl(db: Database, workspaceId: string, sessionId: string, options?: {
+    lock?: WorkspaceControlLockMode;
+    workspaceControl?: WorkspaceControlRow | undefined;
+}): Promise<SessionWriteAdmissionControl>;
 /**
  * Return one compact aggregate row per target for `sessions_list`.
  *

package/dist/session-queue-commands.d.ts

@@ -67,8 +67,10 @@ export type AgentInternalUpdateCommandResult = {
 };
 type SteerSupersessionResult = {
     interruptionCount: number;
+    steerTargetTurn: typeof schema.sessionTurns.$inferSelect | null;
     replacedTurn: typeof schema.sessionTurns.$inferSelect | null;
     liveCurrentTurnId: string | null;
+    deferredUntilCompaction: boolean;
     lastSequence: number;
 };
 /**

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-ORKVXHL2.js";
-import "./chunk-X6T2P3L3.js";
-import "./chunk-6NYKC5DD.js";
+} from "./chunk-5NNCGFQY.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/user-resource-authority.d.ts

@@ -71,6 +71,14 @@ export declare function issueSelfUserResourceGrant(db: Database, input: {
     expectedAuthorityEpoch?: number | null;
     workspaceSharedAcknowledged: boolean;
 }): Promise<UserResourceAuthorityGrant>;
+export declare function issueSelfLocalConnectionUseGrant(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authorityId: string;
+    context: "user_private" | "workspace_shared";
+    workspaceSharedAcknowledged: boolean;
+}): Promise<UserResourceAuthorityGrant>;
 export declare function revokeSelfUserResourceGrant(db: Database, input: {
     accountId: string;
     workspaceId: string;

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-Y44FKTYU.js";
-import "./chunk-X6T2P3L3.js";
-import "./chunk-6NYKC5DD.js";
+} from "./chunk-SZAWDXQC.js";
+import "./chunk-F6PBS6WE.js";
+import "./chunk-O56DM5GZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,