@opengeni/db 4.0.0-canary.1 → 4.0.0-canary.2

package/dist/{chunk-I6YPQMAL.js → chunk-VU2IK37Y.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-ZQ32COTC.js";
+} from "./chunk-XIYAXH47.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-I6YPQMAL.js.map
+//# sourceMappingURL=chunk-VU2IK37Y.js.map

package/dist/{chunk-ZQ32COTC.js → chunk-XIYAXH47.js}

@@ -4,7 +4,7 @@ import {
   sessions,
   workspaceSessionActivityRevisions,
   workspaces
-} from "./chunk-XAKQCOF3.js";
+} from "./chunk-PWJJKCTF.js";
 
 // src/persistence-errors.ts
 var SQLSTATE_KEYS = ["sqlState", "sqlstate", "code"];
@@ -755,4 +755,4 @@ export {
   withAccountRls,
   dbBindingFor
 };
-//# sourceMappingURL=chunk-ZQ32COTC.js.map
+//# sourceMappingURL=chunk-XIYAXH47.js.map

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-ZQ32COTC.js";
-import "./chunk-XAKQCOF3.js";
+} from "./chunk-XIYAXH47.js";
+import "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-YVDQDD33.js";
-import "./chunk-ZQ32COTC.js";
-import "./chunk-XAKQCOF3.js";
+} from "./chunk-L2QFSPFP.js";
+import "./chunk-XIYAXH47.js";
+import "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/index.d.ts

@@ -9516,6 +9516,11 @@ export type FailSessionWorkBeforeAttemptClaimInput = {
     workflowId: string;
     trigger: SessionWorkTrigger;
     error: string;
+    /** Already-classified admission facts from the failed worker activity. */
+    admissionFailure?: {
+        disposition: "retryable" | "permanent";
+        code: "db_deadlock" | "db_serialization_failure" | "db_failure" | "claim_invariant";
+    };
 };
 export type FailSessionWorkBeforeAttemptClaimResult = {
     action: "failed";
@@ -9581,6 +9586,7 @@ export declare function settleSessionIdleWithParentOutbox(db: Database, workspac
     action: "settled";
     changed: boolean;
     episodeKey: string;
+    notifyParent: boolean;
     events: SessionEvent[];
 } | {
     action: "stale";

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-2HGYCAXN.js";
+} from "./chunk-B5Y3TCSP.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -85,7 +85,7 @@ import {
   updateSessionCommandReceiptResult,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-FVZINOBB.js";
+} from "./chunk-DUB3LUVM.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   VideoGenerationCapacityError,
@@ -117,7 +117,7 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-A5RFBEZR.js";
+} from "./chunk-CQF6G4IF.js";
 import {
   ManagedAuthActorMutationInFlightError,
   ManagedAuthLoginSlotAlreadyExistsError,
@@ -140,7 +140,7 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-I6YPQMAL.js";
+} from "./chunk-VU2IK37Y.js";
 import {
   migrate,
   runMigrations
@@ -181,7 +181,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-47LKLIIK.js";
+} from "./chunk-NPKBYGAK.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -192,7 +192,7 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-YVDQDD33.js";
+} from "./chunk-L2QFSPFP.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
@@ -228,7 +228,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-ZQ32COTC.js";
+} from "./chunk-XIYAXH47.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   LOSSLESS_JSON_STRING_PREFIX,
@@ -466,7 +466,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-XAKQCOF3.js";
+} from "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/index.ts
@@ -64938,7 +64938,10 @@ async function adoptManagedSessionBackgroundCommand(db, input) {
         sessionId: input.sessionId,
         commandId: input.processId,
         retainedProcessId: input.processId,
-        command: input.command
+        command: input.command,
+        turnId: input.turnId,
+        attemptId: input.attemptId,
+        executionGeneration: input.executionGeneration
       });
     })
   );
@@ -79219,7 +79222,7 @@ function systemUpdateExecutionAuthorityKey(update) {
 }
 function systemUpdateCausalHumanTurnId(update) {
   const lineage = update.lineage && typeof update.lineage === "object" && !Array.isArray(update.lineage) ? update.lineage : null;
-  const value = isChildLifecycleSystemUpdateKind(update.kind) ? lineage?.parentTurnId : update.kind === "goal_continuation" ? lineage?.causalTurnId : null;
+  const value = isChildLifecycleSystemUpdateKind(update.kind) ? lineage?.parentTurnId : update.kind === "goal_continuation" || update.kind === "background_command_result" || update.kind === "session_wait_timeout" ? lineage?.causalTurnId : null;
   if (typeof value !== "string" || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/iu.test(value)) {
     return null;
   }
@@ -79240,7 +79243,7 @@ function agentSteerCausalActor(update) {
 function systemUpdateCausalExecutionKey(update) {
   const targetTurnId = systemUpdateCausalHumanTurnId(update);
   if (targetTurnId) return `target-turn:${targetTurnId}`;
-  if (isChildLifecycleSystemUpdateKind(update.kind) || update.kind === "goal_continuation") {
+  if (isChildLifecycleSystemUpdateKind(update.kind) || update.kind === "goal_continuation" || update.kind === "background_command_result" || update.kind === "session_wait_timeout") {
     return `${update.kind}-update:${update.id}`;
   }
   if (update.kind !== "agent_steer_instruction") return null;
@@ -82390,6 +82393,10 @@ async function settleSessionInputWaitInActivity(db, input) {
     }
     const deadlineAt = expected.inputWaitUntil.toISOString();
     const reason = expected.inputWaitReason;
+    const causalAuthority = await sameSessionCausalAuthorityTx(db, {
+      ...input,
+      turnId: input.waitTurnId
+    });
     try {
       const result = await addSessionSystemUpdateWithSourceMutation(
         db,
@@ -82398,6 +82405,9 @@ async function settleSessionInputWaitInActivity(db, input) {
           workspaceId: input.workspaceId,
           sessionId: input.sessionId,
           kind: "session_wait_timeout",
+          personalConnectionDelegations: causalAuthority?.personalConnectionDelegations ?? [],
+          xaiProviderAccountAuthoritySnapshot: causalAuthority?.xaiProviderAccountAuthoritySnapshot ?? WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V13,
+          lineage: causalAuthority?.lineage ?? {},
           classification: "info",
           sourceId: input.waitTurnId,
           dedupeKey: `session-input-wait-timeout:${input.waitTurnId}`,
@@ -82830,6 +82840,8 @@ async function failSessionWorkBeforeAttemptClaim(db, workspaceId, input) {
           payload: {
             status: "failed",
             code: "pre_claim_failure",
+            error: input.error,
+            ...input.admissionFailure ? { admissionFailure: input.admissionFailure } : {},
             ...!turn ? { failedSystemUpdateIds } : {}
           },
           turnId: turn?.id ?? null,
@@ -83074,6 +83086,8 @@ async function recoverSessionWorkFailedBeforeAttemptClaim(db, workspaceId, input
       const failedUpdates = await tx.select({
         id: sessionSystemUpdates.id,
         kind: sessionSystemUpdates.kind,
+        sourceId: sessionSystemUpdates.sourceId,
+        dedupeKey: sessionSystemUpdates.dedupeKey,
         lineage: sessionSystemUpdates.lineage,
         deliveredTurnId: sessionSystemUpdates.deliveredTurnId,
         deliveredHistoryItemId: sessionSystemUpdates.deliveredHistoryItemId,
@@ -83152,12 +83166,53 @@ async function recoverSessionWorkFailedBeforeAttemptClaim(db, workspaceId, input
         }
       }
       const causalTurnIds = /* @__PURE__ */ new Set();
+      const repairedAuthorities = /* @__PURE__ */ new Map();
       for (const update of failedUpdates) {
-        const causalTurnId = systemUpdateCausalHumanTurnId(update);
+        let causalTurnId = systemUpdateCausalHumanTurnId(update);
         const lineage = update.lineage && typeof update.lineage === "object" && !Array.isArray(update.lineage) ? update.lineage : null;
-        if (!isChildLifecycleSystemUpdateKind(update.kind) || !causalTurnId || lineage?.parentSessionId !== input.sessionId || update.deliveredTurnId !== null || update.deliveredHistoryItemId !== null || update.deliveredAt !== null) {
+        if (update.deliveredTurnId !== null || update.deliveredHistoryItemId !== null || update.deliveredAt !== null)
           return { action: "stale", event: null };
-        }
+        if (isChildLifecycleSystemUpdateKind(update.kind)) {
+          if (!causalTurnId || lineage?.parentSessionId !== input.sessionId) {
+            return { action: "stale", event: null };
+          }
+        } else if (update.kind === "background_command_result") {
+          if (!update.sourceId || !UUID_PATTERN2.test(update.sourceId) || update.dedupeKey !== `background-command-result:${update.sourceId}`) {
+            return { action: "stale", event: null };
+          }
+          const authority = await backgroundCommandCausalAuthorityTx(tx, {
+            accountId: session.accountId,
+            workspaceId,
+            sessionId: input.sessionId,
+            commandId: update.sourceId
+          });
+          if (!authority) return { action: "stale", event: null };
+          repairedAuthorities.set(update.id, authority);
+          causalTurnId = authority.lineage.causalTurnId;
+        } else if (update.kind === "session_wait_timeout") {
+          if (!update.sourceId || !UUID_PATTERN2.test(update.sourceId) || update.dedupeKey !== `session-input-wait-timeout:${update.sourceId}`) {
+            return { action: "stale", event: null };
+          }
+          const [timeoutProof] = await tx.execute(sql68`
+              select id from session_events
+              where workspace_id = ${workspaceId} and session_id = ${input.sessionId}
+                and type = 'session.wait.finished'
+                and payload ->> 'waitTurnId' = ${update.sourceId}
+                and payload ->> 'outcome' = 'timeout'
+                and sequence < ${input.expectedFailureEventSequence}
+              limit 1`);
+          if (!timeoutProof) return { action: "stale", event: null };
+          const authority = await sameSessionCausalAuthorityTx(tx, {
+            accountId: session.accountId,
+            workspaceId,
+            sessionId: input.sessionId,
+            turnId: update.sourceId
+          });
+          if (!authority) return { action: "stale", event: null };
+          repairedAuthorities.set(update.id, authority);
+          causalTurnId = authority.lineage.causalTurnId;
+        } else return { action: "stale", event: null };
+        if (!causalTurnId) return { action: "stale", event: null };
         causalTurnIds.add(causalTurnId);
       }
       const causalTurns = await tx.select({
@@ -83176,6 +83231,22 @@ async function recoverSessionWorkFailedBeforeAttemptClaim(db, workspaceId, input
       )) {
         return { action: "stale", event: null };
       }
+      for (const update of failedUpdates) {
+        const authority = repairedAuthorities.get(update.id);
+        if (!authority) continue;
+        await tx.update(sessionSystemUpdates).set({
+          personalConnectionDelegations: authority.personalConnectionDelegations,
+          xaiProviderAccountAuthoritySnapshot: authority.xaiProviderAccountAuthoritySnapshot,
+          lineage: { ...update.lineage, ...authority.lineage }
+        }).where(
+          and52(
+            eq53(sessionSystemUpdates.id, update.id),
+            eq53(sessionSystemUpdates.workspaceId, workspaceId),
+            eq53(sessionSystemUpdates.sessionId, input.sessionId),
+            eq53(sessionSystemUpdates.state, "failed")
+          )
+        );
+      }
       const restored = await tx.update(sessionSystemUpdates).set({ state: "pending" }).where(
         and52(
           eq53(sessionSystemUpdates.workspaceId, workspaceId),
@@ -83386,11 +83457,20 @@ async function settleSessionIdleWithParentOutbox(db, workspaceId, sessionId) {
         );
       }
       const episodeKey = String(Number(episodeSequence));
-      if (!session.parentSessionId) {
+      const waitState = await sessionInputWaitStateTx(tx, workspaceId, sessionId, session);
+      const [goal] = await tx.select({ status: sessionGoals.status }).from(sessionGoals).where(
+        and52(
+          eq53(sessionGoals.workspaceId, workspaceId),
+          eq53(sessionGoals.sessionId, sessionId)
+        )
+      ).limit(1);
+      const ongoingWork = waitState.disposition === "held" || waitState.disposition === "timeout" || goal?.status === "active";
+      if (!session.parentSessionId || ongoingWork) {
         return {
           action: "settled",
           changed: events.length > 0,
           episodeKey,
+          notifyParent: false,
           events
         };
       }
@@ -83410,6 +83490,7 @@ async function settleSessionIdleWithParentOutbox(db, workspaceId, sessionId) {
         action: "settled",
         changed: events.length > 0,
         episodeKey,
+        notifyParent: true,
         events
       };
     });
@@ -86781,6 +86862,90 @@ async function addSessionSystemUpdateWithSourceMutation(db, input, mutateSource,
     })
   );
 }
+async function sameSessionCausalAuthorityTx(tx, input) {
+  const [turn] = await tx.select().from(sessionTurns).where(
+    and52(
+      eq53(sessionTurns.accountId, input.accountId),
+      eq53(sessionTurns.workspaceId, input.workspaceId),
+      eq53(sessionTurns.sessionId, input.sessionId),
+      eq53(sessionTurns.id, input.turnId)
+    )
+  ).limit(1);
+  if (!turn) return null;
+  const personalConnectionDelegations = personalConnectionDelegationsForSameSessionSuccessor(
+    parsedPersonalConnectionDelegations(
+      turn.personalConnectionDelegations,
+      `session_turns:${turn.id}`
+    ),
+    input.sessionId
+  );
+  const xaiProviderAccountAuthoritySnapshot = XaiProviderAccountAuthoritySnapshotV13.parse(
+    turn.xaiProviderAccountAuthoritySnapshot
+  );
+  const human = turn.initiatingHumanSubjectId ?? (turn.initiatorKind === "subject" ? turn.initiatorSubjectId : null);
+  if (!human && (personalConnectionDelegations.some((d) => d.userDelegation) || xaiProviderAccountAuthoritySnapshot.scope === "user")) {
+    throw new SessionControlInvariantError("Causal turn lost its personal execution authority");
+  }
+  return {
+    personalConnectionDelegations,
+    xaiProviderAccountAuthoritySnapshot,
+    lineage: {
+      causalTurnId: turn.id,
+      ...human && personalConnectionDelegations.some((d) => d.userDelegation) ? { connectionAuthoritySubjectId: human } : {},
+      ...human && xaiProviderAccountAuthoritySnapshot.scope === "user" ? { xaiAuthoritySubjectId: human } : {}
+    }
+  };
+}
+async function backgroundCommandCausalAuthorityTx(tx, input) {
+  const [command] = await tx.select().from(sessionBackgroundCommands).where(
+    and52(
+      eq53(sessionBackgroundCommands.accountId, input.accountId),
+      eq53(sessionBackgroundCommands.workspaceId, input.workspaceId),
+      eq53(sessionBackgroundCommands.sessionId, input.sessionId),
+      eq53(sessionBackgroundCommands.id, input.commandId)
+    )
+  ).limit(1);
+  if (!command || !["exited", "lost"].includes(command.state) || !command.settledAt) return null;
+  let turnId = command.launchTurnId;
+  let attemptId = command.launchAttemptId;
+  let generation = command.launchExecutionGeneration;
+  if (!turnId && command.provider === "managed" && command.retainedProcessId) {
+    const [process2] = await tx.select().from(sandboxRetainedProcesses).where(
+      and52(
+        eq53(sandboxRetainedProcesses.id, command.retainedProcessId),
+        eq53(sandboxRetainedProcesses.accountId, input.accountId),
+        eq53(sandboxRetainedProcesses.workspaceId, input.workspaceId),
+        eq53(sandboxRetainedProcesses.sessionId, input.sessionId)
+      )
+    ).limit(1);
+    if (process2?.ownerActorKind === "turn" && process2.ownerActorId === process2.ownerAttemptId) {
+      turnId = process2.ownerTurnId;
+      attemptId = process2.ownerAttemptId;
+      generation = process2.ownerExecutionGeneration;
+    }
+  }
+  if (!turnId || !attemptId || !generation) return null;
+  const [attempt] = await tx.select({ id: sessionTurnAttempts.id }).from(sessionTurnAttempts).where(
+    and52(
+      eq53(sessionTurnAttempts.id, attemptId),
+      eq53(sessionTurnAttempts.accountId, input.accountId),
+      eq53(sessionTurnAttempts.workspaceId, input.workspaceId),
+      eq53(sessionTurnAttempts.sessionId, input.sessionId),
+      eq53(sessionTurnAttempts.turnId, turnId),
+      eq53(sessionTurnAttempts.executionGeneration, generation)
+    )
+  ).limit(1);
+  if (!attempt) return null;
+  const authority = await sameSessionCausalAuthorityTx(tx, { ...input, turnId });
+  return authority ? {
+    ...authority,
+    lineage: {
+      ...authority.lineage,
+      causalAttemptId: attemptId,
+      causalExecutionGeneration: generation
+    }
+  } : null;
+}
 function backgroundCommandTerminalMutation(input) {
   let controlActive = false;
   const events = [];
@@ -86868,6 +87033,10 @@ function backgroundCommandTerminalMutation(input) {
         ...command.failure ? { failure: command.failure } : {},
         outputLocator
       };
+      const causalAuthority = await backgroundCommandCausalAuthorityTx(tx, {
+        ...input,
+        commandId: command.id
+      });
       const [insertedUpdate] = await tx.insert(sessionSystemUpdates).values(
         withLosslessContentWriteVersion(
           withLosslessContentWriteVersion(
@@ -86881,7 +87050,13 @@ function backgroundCommandTerminalMutation(input) {
               dedupeKey: `background-command-result:${command.id}`,
               summary,
               payload,
-              lineage: { commandId: command.id, provider: command.provider },
+              personalConnectionDelegations: causalAuthority?.personalConnectionDelegations ?? [],
+              xaiProviderAccountAuthoritySnapshot: causalAuthority?.xaiProviderAccountAuthoritySnapshot ?? WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V13,
+              lineage: {
+                commandId: command.id,
+                provider: command.provider,
+                ...causalAuthority?.lineage
+              },
               state: "pending"
             },
             "summary",