@opengeni/db 3.7.4 → 4.0.0-canary.0

package/dist/schema.js

@@ -62,6 +62,7 @@ import {
   connectorActionPolicies,
   connectorActionRequests,
   creditLedgerEntries,
+  deploymentModelCatalog,
   deviceEnrollmentRequests,
   deviceEnrollmentStatusValues,
   documentBases,
@@ -154,6 +155,11 @@ import {
   managedAuthLoginTransactions,
   managedAuthSessionSetOperations,
   managedAuthSessionSets,
+  mcpOauthAccessTokens,
+  mcpOauthAuthorizationCodes,
+  mcpOauthAuthorizationRequests,
+  mcpOauthClients,
+  mcpOauthRefreshTokens,
   memorySlackPublicationConfigurations,
   memorySlackPublicationReceipts,
   memorySlackPublications,
@@ -169,6 +175,9 @@ import {
   organizationMembershipLifecycleEvents,
   organizationMembershipOperationReceipts,
   organizationMemberships,
+  organizationModelProviderConnectionOperations,
+  organizationModelProviderConnections,
+  organizationModelProviderCustomModels,
   organizationPrivateSessionSettingEvents,
   organizationPrivateSessionSettings,
   organizationProfileEvents,
@@ -225,6 +234,7 @@ import {
   scheduledTasks,
   sessionAttemptCodemodeCalls,
   sessionAttemptInterruptions,
+  sessionAttemptModelContextSnapshots,
   sessionAttemptToolCatalogs,
   sessionBackgroundCommands,
   sessionCommandReceipts,
@@ -289,6 +299,7 @@ import {
   taskNoteWriteCapabilities,
   taskNotes,
   temporalScheduleCleanupOutbox,
+  toolGatewayApprovalCapabilities,
   transcriptionRecordingChunkStateValues,
   transcriptionRecordingChunks,
   transcriptionRecordingObjectKindValues,
@@ -310,6 +321,7 @@ import {
   workspaceCaptures,
   workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
+  workspaceGatewayCustomModels,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,
   workspaceInstructionPolicyDeactivationEvents,
@@ -337,7 +349,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-O56DM5GZ.js";
+} from "./chunk-QM6YOWHZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -403,6 +415,7 @@ export {
   connectorActionPolicies,
   connectorActionRequests,
   creditLedgerEntries,
+  deploymentModelCatalog,
   deviceEnrollmentRequests,
   deviceEnrollmentStatusValues,
   documentBases,
@@ -495,6 +508,11 @@ export {
   managedAuthLoginTransactions,
   managedAuthSessionSetOperations,
   managedAuthSessionSets,
+  mcpOauthAccessTokens,
+  mcpOauthAuthorizationCodes,
+  mcpOauthAuthorizationRequests,
+  mcpOauthClients,
+  mcpOauthRefreshTokens,
   memorySlackPublicationConfigurations,
   memorySlackPublicationReceipts,
   memorySlackPublications,
@@ -510,6 +528,9 @@ export {
   organizationMembershipLifecycleEvents,
   organizationMembershipOperationReceipts,
   organizationMemberships,
+  organizationModelProviderConnectionOperations,
+  organizationModelProviderConnections,
+  organizationModelProviderCustomModels,
   organizationPrivateSessionSettingEvents,
   organizationPrivateSessionSettings,
   organizationProfileEvents,
@@ -566,6 +587,7 @@ export {
   scheduledTasks,
   sessionAttemptCodemodeCalls,
   sessionAttemptInterruptions,
+  sessionAttemptModelContextSnapshots,
   sessionAttemptToolCatalogs,
   sessionBackgroundCommands,
   sessionCommandReceipts,
@@ -630,6 +652,7 @@ export {
   taskNoteWriteCapabilities,
   taskNotes,
   temporalScheduleCleanupOutbox,
+  toolGatewayApprovalCapabilities,
   transcriptionRecordingChunkStateValues,
   transcriptionRecordingChunks,
   transcriptionRecordingObjectKindValues,
@@ -651,6 +674,7 @@ export {
   workspaceCaptures,
   workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
+  workspaceGatewayCustomModels,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,
   workspaceInstructionPolicyDeactivationEvents,

package/dist/session-background-commands.d.ts

@@ -1,11 +1,17 @@
 import type { SessionBackgroundCommand, SessionBackgroundCommandActivity } from "@opengeni/contracts";
-import type { Database } from "./database.js";
+import type { Database, SessionActivityDatabase } from "./database.js";
 export type ConnectedMachineBackgroundCommandProof = {
     outcome: "exited" | "lost";
     exitCode: number | null;
     reason: string;
     observedAt: Date;
 };
+export declare const SESSION_BACKGROUND_COMMAND_REASON_MAX_BYTES = 512;
+export declare function boundedSessionBackgroundCommandReason(value: string, label: string): string;
+export type SessionBackgroundCommandTerminalMutation = {
+    prepare: (tx: SessionActivityDatabase) => Promise<void>;
+    commit: (tx: SessionActivityDatabase, command: SessionBackgroundCommand) => Promise<void>;
+};
 export type ConnectedMachineBackgroundCommandClaim = {
     commandId: string;
     accountId: string;
@@ -71,9 +77,9 @@ export declare function deferConnectedMachineBackgroundCommandReconciliation(db:
     retryAfterMs: number;
 }): Promise<boolean>;
 /** Settle only from the proof already checkpointed under this exact claim. */
-export declare function settleClaimedConnectedMachineBackgroundCommand(db: Database, input: {
+export declare function settleClaimedConnectedMachineBackgroundCommandWithMutation(db: Database, input: {
     claim: ConnectedMachineBackgroundCommandClaim;
-}): Promise<boolean>;
+}, mutateTerminal: SessionBackgroundCommandTerminalMutation): Promise<boolean>;
 export declare function requestSessionBackgroundCommandCancellation(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -101,7 +107,7 @@ export declare function requestWorkspaceBackgroundCommandCancellationsInTransact
     workspaceId: string;
     subjectId: string;
 }): Promise<number>;
-export declare function settleSessionBackgroundCommandForRetainedProcess(db: Database, input: {
+export declare function settleSessionBackgroundCommandForRetainedProcessInTransaction(tx: SessionActivityDatabase, input: {
     accountId: string;
     workspaceId: string;
     sessionId: string;
@@ -109,8 +115,8 @@ export declare function settleSessionBackgroundCommandForRetainedProcess(db: Dat
     outcome: "exited" | "lost";
     exitCode: number | null;
     reason: string;
-}): Promise<SessionBackgroundCommand | null>;
-export declare function settleConnectedMachineSessionBackgroundCommand(db: Database, input: {
+}, mutateTerminal: SessionBackgroundCommandTerminalMutation): Promise<SessionBackgroundCommand | null>;
+export declare function settleConnectedMachineSessionBackgroundCommandWithMutation(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sessionId: string;
@@ -122,4 +128,10 @@ export declare function settleConnectedMachineSessionBackgroundCommand(db: Datab
     outcome: "exited" | "lost";
     exitCode: number | null;
     reason: string;
+}, mutateTerminal: SessionBackgroundCommandTerminalMutation): Promise<SessionBackgroundCommand | null>;
+export declare function getSessionBackgroundCommand(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    commandId: string;
 }): Promise<SessionBackgroundCommand | null>;

package/dist/session-background-commands.js

@@ -1,7 +1,10 @@
 import {
+  SESSION_BACKGROUND_COMMAND_REASON_MAX_BYTES,
   backgroundCommandActivityForSessions,
+  boundedSessionBackgroundCommandReason,
   claimConnectedMachineSessionBackgroundCommands,
   deferConnectedMachineBackgroundCommandReconciliation,
+  getSessionBackgroundCommand,
   insertConnectedMachineSessionBackgroundCommandInTransaction,
   insertManagedSessionBackgroundCommandInTransaction,
   listSessionBackgroundCommands,
@@ -9,17 +12,20 @@ import {
   requestSessionBackgroundCommandCancellation,
   requestSessionBackgroundCommandCancellationsInTransaction,
   requestWorkspaceBackgroundCommandCancellationsInTransaction,
-  settleClaimedConnectedMachineBackgroundCommand,
-  settleConnectedMachineSessionBackgroundCommand,
-  settleSessionBackgroundCommandForRetainedProcess
-} from "./chunk-S3TDDCS2.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+  settleClaimedConnectedMachineBackgroundCommandWithMutation,
+  settleConnectedMachineSessionBackgroundCommandWithMutation,
+  settleSessionBackgroundCommandForRetainedProcessInTransaction
+} from "./chunk-N5VXJ4I2.js";
+import "./chunk-UFAMOUWL.js";
+import "./chunk-QM6YOWHZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
+  SESSION_BACKGROUND_COMMAND_REASON_MAX_BYTES,
   backgroundCommandActivityForSessions,
+  boundedSessionBackgroundCommandReason,
   claimConnectedMachineSessionBackgroundCommands,
   deferConnectedMachineBackgroundCommandReconciliation,
+  getSessionBackgroundCommand,
   insertConnectedMachineSessionBackgroundCommandInTransaction,
   insertManagedSessionBackgroundCommandInTransaction,
   listSessionBackgroundCommands,
@@ -27,8 +33,8 @@ export {
   requestSessionBackgroundCommandCancellation,
   requestSessionBackgroundCommandCancellationsInTransaction,
   requestWorkspaceBackgroundCommandCancellationsInTransaction,
-  settleClaimedConnectedMachineBackgroundCommand,
-  settleConnectedMachineSessionBackgroundCommand,
-  settleSessionBackgroundCommandForRetainedProcess
+  settleClaimedConnectedMachineBackgroundCommandWithMutation,
+  settleConnectedMachineSessionBackgroundCommandWithMutation,
+  settleSessionBackgroundCommandForRetainedProcessInTransaction
 };
 //# sourceMappingURL=session-background-commands.js.map

package/dist/session-control.d.ts

@@ -158,7 +158,7 @@ export declare function assertAgentCommandAuthorityInTransaction(db: Database, i
         type: "agent_attempt";
     }>;
     targetSessionId: string;
-    action: "pause" | "resume" | "steer" | "message" | "goal";
+    action: "pause" | "resume" | "steer" | "message" | "goal" | "wait";
 }): Promise<void>;
 export declare function canonicalSessionCommandHash(value: unknown): string;
 /**
@@ -429,6 +429,40 @@ export declare function evaluateSessionControl(db: Database, workspaceId: string
     lock?: WorkspaceControlLockMode;
     workspaceControl?: WorkspaceControlRow | undefined;
 }): Promise<EffectiveSessionControl>;
+export type SessionPromptCommandAction = "prompt.send" | "prompt.steer";
+/**
+ * Prompt operation keys are actor-scoped across target sessions and across the
+ * Send/Steer action pair. The advisory lock closes the gap left by the legacy
+ * action/target-specific unique index without changing old receipt identities.
+ */
+export declare function reserveSessionPromptCommandReceipt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    actor: SessionCommandActor;
+    action: SessionPromptCommandAction;
+    targetSessionId: string;
+    operationKey: string;
+    canonicalRequestHash: string;
+    boundaryRequestHash: string;
+}): Promise<{
+    receipt: SessionCommandReceiptRow;
+    replay: boolean;
+}>;
+/** Serialize one actor-scoped prompt operation before replay or reservation. */
+export declare function lockSessionPromptCommandOperation(db: Database, input: {
+    workspaceId: string;
+    actor: SessionCommandActor;
+    operationKey: string;
+}): Promise<void>;
+/** Return only a fully committed exact prompt receipt with the new boundary fingerprint. */
+export declare function getCompletedSessionPromptCommandReceipt(db: Database, input: {
+    workspaceId: string;
+    actor: SessionCommandActor;
+    action: SessionPromptCommandAction;
+    targetSessionId: string;
+    operationKey: string;
+    boundaryRequestHash: string;
+}): Promise<SessionCommandReceiptRow | null>;
 export declare function reserveSessionCommandReceipt(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -438,7 +472,8 @@ export declare function reserveSessionCommandReceipt(db: Database, input: {
     targetTurnId: string | null;
     operationKey: string;
     canonicalRequestHash: string;
-    identityScope?: "actor" | "goal_operation";
+    identityScope?: "actor" | "target_operation";
+    initialResult?: Record<string, unknown>;
 }): Promise<{
     receipt: SessionCommandReceiptRow;
     replay: boolean;

package/dist/session-goal-pacing.d.ts

@@ -1,11 +1,8 @@
 import type { Database } from "./database.js";
 import * as schema from "./schema.js";
-/** Column reset shared by every goal head mutation that retires a `goal_wait` hold. */
-export declare const SESSION_GOAL_HOLD_CLEARED: {
-    readonly continuationHoldTurnId: null;
-    readonly continuationHoldUntil: null;
-    readonly continuationHoldReason: null;
-    readonly continuationHoldSetAt: null;
+/** Clear a terminal unchanged-input continuation fence after newer goal truth. */
+export declare const SESSION_GOAL_SUPPRESSION_CLEARED: {
+    readonly continuationSuppressedTurnId: null;
 };
 /** The pause reason written when a per-goal or deployment continuation ceiling is reached. */
 export declare const SESSION_GOAL_CAP_PAUSED_REASON = "max_auto_continuations";

package/dist/session-queue-commands.d.ts

@@ -53,6 +53,18 @@ export type SubmitHumanPromptResult = {
     workspaceControlEventId: string | null;
     replay: boolean;
 };
+export declare function replaySubmittedHumanPromptFromBoundaryReceipt(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    actor: SessionCommandActor;
+    operationKey: string;
+    delivery: "send" | "steer";
+    boundaryRequestHash: string;
+    expectedDraftRevision?: number | null;
+    /** Wait for an overlapping same-key transaction before checking committed replay truth. */
+    serializeOperation?: boolean;
+}): Promise<SubmitHumanPromptResult | null>;
 export type AgentInternalUpdateCommandResult = {
     receipt: SessionCommandReceiptRow;
     updateId: string;
@@ -179,6 +191,8 @@ export declare function submitHumanPromptInTransaction(db: SessionActivityDataba
     subjectLabel?: string;
     actor: SessionCommandActor;
     operationKey: string;
+    /** Stable parsed boundary-request identity used before mutable enrichment. */
+    boundaryRequestHash?: string;
     delivery: "send" | "steer";
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
@@ -213,6 +227,9 @@ export declare function submitHumanPromptInTransaction(db: SessionActivityDataba
         id: string;
         headersEncrypted: Record<string, string>;
     }>;
+    /** Trusted database-only admission seam. It runs only after a completed
+     * operation replay has been ruled out; throwing rolls the prompt back. */
+    beforeFreshPromptCommit?: (tx: Database) => Promise<void>;
     /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
     controlLockTimeoutMs?: number;
 }): Promise<SubmitHumanPromptResult>;

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-5NNCGFQY.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-P6NSEG2S.js";
+import "./chunk-UFAMOUWL.js";
+import "./chunk-QM6YOWHZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/tool-gateway-approvals.d.ts

@@ -0,0 +1,31 @@
+import type { ToolGatewayIdentity } from "@opengeni/contracts";
+import type { Database } from "./database.js";
+export declare class ToolGatewayApprovalRateLimitError extends Error {
+    readonly name = "ToolGatewayApprovalRateLimitError";
+}
+export declare class ToolGatewayApprovalOperationStartedError extends Error {
+    readonly name = "ToolGatewayApprovalOperationStartedError";
+}
+export declare function issueToolGatewayApproval(db: Database, input: {
+    tokenHash: string;
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    operationId: string;
+    catalogDigest: string;
+    identity: ToolGatewayIdentity;
+    argumentsDigest: string;
+    approvalAuthorityDigest: string;
+    expiresAt: Date;
+}): Promise<void>;
+export declare function consumeToolGatewayApproval(db: Database, input: {
+    tokenHash: string;
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    operationId: string;
+    catalogDigest: string;
+    identity: ToolGatewayIdentity;
+    argumentsDigest: string;
+    approvalAuthorityDigest: string;
+}): Promise<boolean>;

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-SZAWDXQC.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-CJROYHSC.js";
+import "./chunk-UFAMOUWL.js";
+import "./chunk-QM6YOWHZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/workspace-artifacts.d.ts

@@ -1,6 +1,6 @@
-import type { WorkspaceArtifact, WorkspaceArtifactDetailResponse, WorkspaceArtifactMutationResponse, WorkspaceArtifactVersion } from "@opengeni/contracts";
+import { type ToolGatewayIdentity, type WorkspaceArtifact, type WorkspaceArtifactDetailResponse, type WorkspaceArtifactMutationResponse, type WorkspaceArtifactVersion } from "@opengeni/contracts";
 import type { Database } from "./database.js";
-type ArtifactMutationToolName = "artifacts_create" | "artifacts_publish" | "artifacts_rollback";
+type ArtifactMutationToolName = "artifacts_create" | "artifacts_publish" | "artifacts_rollback" | "artifacts_archive" | "artifacts_restore";
 export declare class WorkspaceArtifactNotFoundError extends Error {
     readonly name = "WorkspaceArtifactNotFoundError";
 }
@@ -15,6 +15,7 @@ export declare class WorkspaceArtifactOperationError extends Error {
 export declare function listWorkspaceArtifacts(db: Database, workspaceId: string, options?: {
     limit?: number;
     cursor?: string;
+    status?: "active" | "archived";
 }): Promise<{
     artifacts: WorkspaceArtifact[];
     nextCursor: string | null;
@@ -25,6 +26,7 @@ export declare function getWorkspaceArtifactContentRef(db: Database, workspaceId
     artifactId: string;
     version: WorkspaceArtifactVersion;
     contentKey: string;
+    sourceKey: string | null;
 }>;
 type PublishMetadata = {
     accountId: string;
@@ -32,6 +34,10 @@ type PublishMetadata = {
     contentKey: string;
     contentSha256: string;
     sizeBytes: number;
+    sourceKey: string;
+    sourceSha256: string;
+    sourceSizeBytes: number;
+    requestedTools?: ToolGatewayIdentity[];
     operationKey: string;
     actorSubjectId: string;
     sourceSessionId: string | null;
@@ -40,12 +46,14 @@ type PublishMetadata = {
     sourceExecutionGeneration: number | null;
     sourceToolName: ArtifactMutationToolName | null;
     persistContent: () => Promise<void>;
+    discardContent: () => Promise<void>;
 };
 export declare function createWorkspaceArtifact(db: Database, input: PublishMetadata & {
     artifactId: string;
     slug: string;
     title: string;
     description: string | null;
+    requestedSlug?: string | null;
 }): Promise<WorkspaceArtifactMutationResponse>;
 export declare function publishWorkspaceArtifactVersion(db: Database, input: PublishMetadata & {
     artifactId: string;
@@ -53,10 +61,16 @@ export declare function publishWorkspaceArtifactVersion(db: Database, input: Pub
     title?: string;
     description?: string | null;
 }): Promise<WorkspaceArtifactMutationResponse>;
-export declare function rollbackWorkspaceArtifact(db: Database, input: Omit<PublishMetadata, "contentKey" | "contentSha256" | "sizeBytes" | "persistContent"> & {
+export declare function rollbackWorkspaceArtifact(db: Database, input: Omit<PublishMetadata, "contentKey" | "contentSha256" | "sizeBytes" | "sourceKey" | "sourceSha256" | "sourceSizeBytes" | "requestedTools" | "persistContent" | "discardContent"> & {
     artifactId: string;
     versionId: string;
     expectedCurrentVersionId: string;
     reason: string;
 }): Promise<WorkspaceArtifactMutationResponse>;
+export declare function setWorkspaceArtifactStatus(db: Database, input: Omit<PublishMetadata, "contentKey" | "contentSha256" | "sizeBytes" | "sourceKey" | "sourceSha256" | "sourceSizeBytes" | "requestedTools" | "persistContent" | "discardContent"> & {
+    artifactId: string;
+    status: "active" | "archived";
+    expectedCurrentVersionId: string;
+    reason: string;
+}): Promise<WorkspaceArtifactMutationResponse>;
 export {};

package/dist/xai-subscription.d.ts

@@ -97,6 +97,14 @@ export declare function listXaiSubscriptionAccountsMetadata(db: Database, input:
 export declare function workspaceXaiSubscriptionActive(db: Database, settings: {
     readonly supergrokSubscriptionEnabled: boolean;
 }, workspaceId: string, subjectId: string): Promise<boolean>;
+/** Metadata-only readiness for the exact provider-account authority frozen on a turn. */
+export declare function workspaceXaiSubscriptionActiveForAuthority(db: Database, settings: {
+    readonly supergrokSubscriptionEnabled: boolean;
+}, input: {
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}): Promise<boolean>;
 export declare function getXaiSubscriptionAccountMetadata(db: Database, input: {
     workspaceId: string;
     subjectId: string;

package/drizzle/0387_bound_host_export_session_payloads.sql

@@ -0,0 +1,165 @@
+-- deployment-mode: rolling
+-- Host export is an optional bounded projection. Canonical session_events keeps
+-- the complete lossless payload; an oversized projection must never roll back
+-- the source event or a later lifecycle transaction that closes pending work.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.enqueue_host_session_event_export()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_enabled boolean;
+      v_initiator jsonb;
+      v_context jsonb := '{}'::jsonb;
+      v_origin text;
+      v_source_payload_bytes integer;
+      v_export_payload jsonb;
+      v_export_payload_codec_version smallint;
+      v_payload_bytes integer;
+    BEGIN
+      IF NEW.type IN (
+        'agent.message.delta', 'agent.reasoning.delta',
+        'sandbox.command.output.delta', 'terminal.pty.output.delta'
+      ) THEN
+        RETURN NEW;
+      END IF;
+
+      SELECT c.session_events_enabled INTO v_enabled
+      FROM %1$I.host_export_config c WHERE c.id = 1
+      FOR SHARE;
+      IF coalesce(v_enabled, false) = false THEN
+        RETURN NEW;
+      END IF;
+
+      IF NEW.turn_id IS NOT NULL THEN
+        SELECT
+          CASE WHEN octet_length(t.initiator_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', t.initiator_kind,
+              'subjectId', t.initiator_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+                THEN left(t.initiator_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+              THEN left(t.initiator_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'backfill') = 'boolean'
+              THEN t.initiator_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(t.initiator_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          t.source
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.session_turns t
+        WHERE t.workspace_id = NEW.workspace_id AND t.id = NEW.turn_id;
+      ELSIF NEW.type = 'session.created' THEN
+        SELECT
+          CASE WHEN octet_length(s.created_by_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', s.created_by_kind,
+              'subjectId', s.created_by_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+                THEN left(s.created_by_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+              THEN left(s.created_by_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'backfill') = 'boolean'
+              THEN s.created_by_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(s.created_by_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          NULL
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.sessions s
+        WHERE s.workspace_id = NEW.workspace_id AND s.id = NEW.session_id;
+      END IF;
+
+      v_source_payload_bytes := octet_length(NEW.payload::text);
+      v_export_payload := NEW.payload;
+      v_export_payload_codec_version := NEW.payload_codec_version;
+      IF v_source_payload_bytes > 65536 THEN
+        v_export_payload := jsonb_build_object(
+          '_hostExport', jsonb_build_object(
+            'payloadMode', 'summary',
+            'payloadTruncated', true,
+            'originalBytes', v_source_payload_bytes,
+            'sourceEventId', NEW.id,
+            'fullPayload', 'retained in canonical session event'
+          ),
+          'preview', '[host-export payload omitted at bounded projection boundary]'
+        );
+        -- The projection is literal PostgreSQL JSON, not an application-codec
+        -- envelope. Preserve codec truth only when the original payload is kept.
+        v_export_payload_codec_version := NULL;
+      END IF;
+
+      v_payload_bytes := octet_length(v_export_payload::text)
+        + octet_length(NEW.type)
+        + coalesce(octet_length(NEW.client_event_id), 0)
+        + coalesce(octet_length(NEW.turn_association), 0)
+        + coalesce(octet_length(NEW.duplicate_reason), 0)
+        + octet_length(coalesce(v_initiator, 'null'::jsonb)::text)
+        + octet_length(v_context::text)
+        + 768;
+      INSERT INTO %1$I.host_export_outbox (
+        export_kind, source_id, account_id, workspace_id, session_id,
+        turn_id, turn_generation, turn_attempt_id, session_sequence,
+        client_event_id, turn_association, duplicate_of_event_id, duplicate_reason,
+        event_type, idempotency_key, initiator, initiator_context, origin,
+        payload, payload_codec_version, envelope_bytes, occurred_at,
+        source_recorded_at, enqueued_at
+      ) VALUES (
+        'session_event', NEW.id, NEW.account_id, NEW.workspace_id, NEW.session_id,
+        NEW.turn_id, NEW.turn_generation, NEW.turn_attempt_id, NEW.sequence,
+        NEW.client_event_id, NEW.turn_association, NEW.duplicate_of_event_id,
+        NEW.duplicate_reason,
+        NEW.type, 'session_event:' || NEW.id::text, v_initiator,
+        coalesce(v_context, '{}'::jsonb), v_origin, v_export_payload,
+        v_export_payload_codec_version, greatest(1, v_payload_bytes), NEW.occurred_at,
+        NEW.created_at, clock_timestamp()
+      )
+      ON CONFLICT (export_kind, source_id) DO NOTHING;
+      RETURN NEW;
+    END $function$;
+  $create$, target_schema);
+END
+$migration$;
+
+COMMENT ON COLUMN host_export_outbox.payload IS
+  'Immutable bounded host projection. Canonical session_events retains the complete payload; oversized host projections carry an explicit content-free truncation receipt.';
+COMMENT ON COLUMN host_export_outbox.payload_codec_version IS
+  'Codec truth for the stored host projection. NULL means literal SQL JSON, including oversized-payload projections; 1 means the original application-coded payload was retained exactly.';