@opengeni/db 4.3.0-canary.0 → 4.3.2-canary.0

package/dist/{chunk-IHADTE7C.js → chunk-DVSLOUEI.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -309,4 +309,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-IHADTE7C.js.map
+//# sourceMappingURL=chunk-DVSLOUEI.js.map

package/dist/{chunk-7JPLGBSA.js → chunk-F4BIHJ7J.js}

@@ -1,6 +1,6 @@
 import {
   cancelUnacceptedVideoGenerationsForToolCallsInTransaction
-} from "./chunk-NCSPNCQK.js";
+} from "./chunk-PFBUHOI5.js";
 import {
   nestedPostgresSqlState,
   rawRows,
@@ -10,7 +10,7 @@ import {
   withSessionActivityRlsContext,
   withWorkspaceRls,
   withWorkspaceSubjectRls
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   auditEvents,
@@ -37,7 +37,7 @@ import {
   workspaceControlEvents,
   workspaceInferenceControls,
   workspaces
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 
 // src/session-background-commands.ts
 import { SessionCommandFailure } from "@opengeni/contracts";
@@ -4769,4 +4769,4 @@ export {
   setWorkspacePauseTimerInTransaction,
   fireWorkspacePauseTimerInTransaction
 };
-//# sourceMappingURL=chunk-7JPLGBSA.js.map
+//# sourceMappingURL=chunk-F4BIHJ7J.js.map

package/dist/{chunk-SGJDIF2D.js → chunk-I4ITNMX2.js}

@@ -4,7 +4,7 @@ import {
   sessions,
   workspaceSessionActivityRevisions,
   workspaces
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 
 // src/persistence-errors.ts
 var SQLSTATE_KEYS = ["sqlState", "sqlstate", "code"];
@@ -755,4 +755,4 @@ export {
   withAccountRls,
   dbBindingFor
 };
-//# sourceMappingURL=chunk-SGJDIF2D.js.map
+//# sourceMappingURL=chunk-I4ITNMX2.js.map

package/dist/{chunk-NCSPNCQK.js → chunk-PFBUHOI5.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 
 // src/video-generation.ts
 import {
@@ -992,4 +992,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-NCSPNCQK.js.map
+//# sourceMappingURL=chunk-PFBUHOI5.js.map

package/dist/{chunk-YGRT6VZO.js → chunk-UUPY6IGP.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-YGRT6VZO.js.map
+//# sourceMappingURL=chunk-UUPY6IGP.js.map

package/dist/{chunk-YGBOVXC7.js → chunk-UVBPOGA7.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3540,4 +3540,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-YGBOVXC7.js.map
+//# sourceMappingURL=chunk-UVBPOGA7.js.map

package/dist/{chunk-ILKJKDII.js → chunk-XBXANJQS.js}

@@ -5,7 +5,7 @@ import {
   withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -502,4 +502,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-ILKJKDII.js.map
+//# sourceMappingURL=chunk-XBXANJQS.js.map

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-YGBOVXC7.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-UVBPOGA7.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/index.d.ts

@@ -8112,6 +8112,13 @@ export type LegacyModalCheckpointAdoptionTarget = Omit<LegacyModalCheckpointSlot
  * an unreferenced candidate that GC might delete while the legacy slot still
  * depends on that provider object. */
 export declare function adoptLegacyModalCheckpointArtifact(db: Database, input: LegacyModalCheckpointAdoptionTarget): Promise<boolean>;
+/** Object-candidate outcome from the publication transaction, independent of
+ * lifecycle `wrote`. Absent for inline/provider receipts and pure CAS checks.
+ * `unused` is NOT a retirement receipt: only the owner of a fresh candidate with
+ * no other publication in flight may use it for immediate cleanup. Exceptions
+ * give no disposition (commit may have happened). Legacy/shared keys and evicted
+ * refs need durable no-reattachment evidence before deletion. */
+export type WorkspaceArchiveCandidateDisposition = "adopted" | "already_referenced" | "unused";
 export declare function persistDrainSnapshot(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -8142,6 +8149,7 @@ export declare function persistDrainSnapshot(db: Database, input: {
 })): Promise<{
     wrote: boolean;
     archiveRevision: string | null;
+    candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }>;
 /**
  * The ONE archive-fold write, shared by the drain seam (persistDrainSnapshot)
@@ -8213,6 +8221,7 @@ export declare function persistWarmSnapshot(db: Database, input: {
     throttled: boolean;
     superseded: boolean;
     archiveRevision: string | null;
+    candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }>;
 export declare function getMaterializedSandboxFileResources(db: Database, input: {
     accountId: string;

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-ILKJKDII.js";
+} from "./chunk-XBXANJQS.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -108,7 +108,7 @@ import {
   updateSessionCommandReceiptResult,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-7JPLGBSA.js";
+} from "./chunk-F4BIHJ7J.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   VideoGenerationCapacityError,
@@ -140,7 +140,7 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-NCSPNCQK.js";
+} from "./chunk-PFBUHOI5.js";
 import {
   ManagedAuthActorMutationInFlightError,
   ManagedAuthLoginSlotAlreadyExistsError,
@@ -163,7 +163,7 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-YGRT6VZO.js";
+} from "./chunk-UUPY6IGP.js";
 import {
   migrate,
   runMigrations
@@ -204,7 +204,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-IHADTE7C.js";
+} from "./chunk-DVSLOUEI.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -215,7 +215,7 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-YGBOVXC7.js";
+} from "./chunk-UVBPOGA7.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
@@ -251,7 +251,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   LOSSLESS_JSON_STRING_PREFIX,
@@ -491,7 +491,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-execution-policy.ts
@@ -9207,6 +9207,7 @@ import {
   SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,
   parseWorkspaceArchiveDescriptor,
   parseWorkspaceArchiveObjectRef,
+  validateWorkspaceArchiveObjectRef,
   workspaceArchivePayloadPresent,
   omitInlineWorkspaceArchiveWhenObjectRefPresent,
   stableJson as stableJson16,
@@ -35290,7 +35291,11 @@ async function assertAttemptAuthority(scopedDb, input) {
       FOR NO KEY UPDATE OF session
     ), locked_turn AS MATERIALIZED (
       SELECT turn.id, turn.account_id, turn.workspace_id, turn.session_id,
-        turn.active_attempt_id, turn.execution_generation, turn.initiator_subject_id
+        turn.active_attempt_id, turn.execution_generation,
+        coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ) as initiating_human_subject_id
       FROM session_turns turn
       JOIN locked_session session
         ON session.id = turn.session_id
@@ -35300,8 +35305,10 @@ async function assertAttemptAuthority(scopedDb, input) {
         AND turn.active_attempt_id = ${input.sourceAttemptId}::uuid
         AND turn.execution_generation = ${input.sourceExecutionGeneration}
         AND turn.status IN ('running', 'requires_action', 'recovering', 'waiting_capacity')
-        AND turn.initiator_kind = 'subject'
-        AND length(btrim(turn.initiator_subject_id)) BETWEEN 1 AND 1024
+        AND length(btrim(coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ))) BETWEEN 1 AND 1024
       FOR UPDATE OF turn
     ), locked_attempt AS MATERIALIZED (
       SELECT attempt.id, attempt.account_id, attempt.workspace_id,
@@ -35330,7 +35337,7 @@ async function assertAttemptAuthority(scopedDb, input) {
   `);
   if (!rows[0]) {
     throw new WorkspaceArtifactOperationError(
-      "Artifact mutation requires the exact active attempt and execution generation"
+      "Artifact mutation requires the exact active attempt, execution generation, and immutable human authority"
     );
   }
 }
@@ -76181,7 +76188,17 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
   );
 }
 function publishedWorkspaceArchiveFields(input) {
-  const ref = parseWorkspaceArchiveObjectRef(input.workspaceArchiveRef) ?? void 0;
+  const ref = input.workspaceArchiveRef == null ? void 0 : validateWorkspaceArchiveObjectRef(input.workspaceArchiveRef, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    sandboxGroupId: input.sandboxGroupId,
+    descriptor: input.workspaceArchiveMeta
+  }) ?? void 0;
+  if (input.workspaceArchiveRef != null && !ref) {
+    throw new Error(
+      "Invalid workspace archive object ref: publication scope or descriptor mismatch"
+    );
+  }
   const inline = typeof input.workspaceArchive === "string" && input.workspaceArchive.length > 0 ? input.workspaceArchive : void 0;
   if (!ref && !inline) {
     throw new Error("workspace archive publication requires inline bytes or an object ref");
@@ -76198,11 +76215,24 @@ function publishedWorkspaceArchiveFields(input) {
   }
   return { workspaceArchive: inline };
 }
+function workspaceArchiveCandidateFields(candidate, lockedResumeState) {
+  if (!candidate) return {};
+  const sessionState = lockedResumeState?.sessionState;
+  const referenced = [
+    sessionState?.workspaceArchiveRef,
+    sessionState?.workspaceArchivePrevRef
+  ].some((value) => {
+    const ref = parseWorkspaceArchiveObjectRef(value);
+    return ref?.key === candidate.key && ref.backend === candidate.backend;
+  });
+  return { candidateDisposition: referenced ? "already_referenced" : "unused" };
+}
 async function persistDrainSnapshot(db, input) {
   const workspaceArchiveMeta = input.workspaceArchive === null ? null : parseArchiveRevision(input.workspaceArchiveMeta);
   if (input.workspaceArchive !== null && !workspaceArchiveMeta) {
     throw new Error("Invalid verified workspace archive descriptor");
   }
+  const published = input.workspaceArchive === null ? null : publishedWorkspaceArchiveFields(input);
   if (workspaceArchiveMeta?.version === 2 && (workspaceArchiveMeta.provider === "modal_snapshot_filesystem" || workspaceArchiveMeta.provider === "modal_snapshot_directory") && !input.checkpointArtifactId) {
     throw new Error("Modal native checkpoint publication requires a registered artifact");
   }
@@ -76240,10 +76270,15 @@ async function persistDrainSnapshot(db, input) {
         for update
       `);
       const row = guard[0];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published?.workspaceArchiveRef,
+        row?.resume_state
+      );
       if (!row) {
         return {
           wrote: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const sourceLeaseMatches = input.expectedLeaseId === void 0 || row.id === input.expectedLeaseId;
@@ -76253,7 +76288,7 @@ async function persistDrainSnapshot(db, input) {
       const lateReceipt = recovery.lateArchiveCapture;
       const coldLatePublication = input.workspaceArchive !== null && input.expectedLeaseId !== void 0 && input.providerRequestId !== void 0 && row.id === input.expectedLeaseId && row.liveness === "cold" && Number(row.refcount) === 0 && Number(row.lease_epoch) === input.expectedEpoch + 1 && row.instance_id === null && Number(row.workspace_generation) === input.expectedWorkspaceGeneration && row.archive_capture_id === null && recovery.provider.status === "missing" && recovery.provider.instanceId === input.expectedInstanceId && recovery.restore.rematerializationId === null && (recovery.restore.status === "unrecoverable" || recovery.restore.status === "degraded" || recovery.restore.status === "pending") && lateReceipt?.sourceLeaseId === input.expectedLeaseId && lateReceipt.sourceLeaseEpoch === input.expectedEpoch && lateReceipt.sourceInstanceId === input.expectedInstanceId && lateReceipt.sourceWorkspaceGeneration === input.expectedWorkspaceGeneration && lateReceipt.providerRequestId === input.providerRequestId && !row.unsettled_mutation;
       if (!activePublication && !coldLatePublication) {
-        return { wrote: false, archiveRevision: null };
+        return { wrote: false, archiveRevision: null, ...candidateFields };
       }
       const priorArchive = row.prior_archive ?? null;
       const priorArchivePrev = row.prior_archive_prev ?? null;
@@ -76265,7 +76300,7 @@ async function persistDrainSnapshot(db, input) {
           archiveRevision: null
         };
       }
-      const published = publishedWorkspaceArchiveFields(input);
+      if (!published) throw new Error("Missing workspace archive publication fields");
       const priorMeta = parseArchiveRevision(priorSessionState?.workspaceArchiveMeta);
       if (activePublication && row.archive_capture_published_at !== null) {
         if (priorArchive === null && priorRef === null || priorMeta === null) {
@@ -76285,7 +76320,7 @@ async function persistDrainSnapshot(db, input) {
               )
           `);
         }
-        return { wrote: true, archiveRevision: priorMeta.revision };
+        return { wrote: true, archiveRevision: priorMeta.revision, ...candidateFields };
       }
       const rotation = rotateWorkspaceArchives({
         resumeState: row.resume_state,
@@ -76339,12 +76374,14 @@ async function persistDrainSnapshot(db, input) {
       if (!folded) {
         return {
           wrote: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       return {
         wrote: true,
-        archiveRevision: workspaceArchiveMeta?.revision ?? null
+        archiveRevision: workspaceArchiveMeta?.revision ?? null,
+        ...published.workspaceArchiveRef ? { candidateDisposition: "adopted" } : {}
       };
     }
   );
@@ -76621,12 +76658,27 @@ async function persistWarmSnapshot(db, input) {
         )
       ).limit(1) : [];
       const attemptMayPersistWorkspace = attempt !== void 0 && (attempt.state === "claimed" || attempt.state === "running" ? attempt.outcome === null : attempt.state === "closed" && (attempt.outcome === "completed" || attempt.outcome === "failed" || attempt.outcome === "requires_action"));
+      const candidateLease = published.workspaceArchiveRef ? await scopedDb.execute(sql81`
+            select jsonb_build_object('sessionState', jsonb_build_object(
+              'workspaceArchiveRef', resume_state #> '{sessionState,workspaceArchiveRef}',
+              'workspaceArchivePrevRef', resume_state #> '{sessionState,workspaceArchivePrevRef}'
+            )) as resume_state
+            from sandbox_leases
+            where workspace_id = ${input.workspaceId}
+              and sandbox_group_id = ${input.sandboxGroupId}
+            for update
+          `) : [];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published.workspaceArchiveRef,
+        candidateLease[0]?.resume_state
+      );
       if (!attempt || attempt.accountId !== input.accountId || attempt.sandboxGroupId !== input.sandboxGroupId || interruption || !attemptMayPersistWorkspace) {
         return {
           wrote: false,
           throttled: false,
           superseded: true,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const guard = await scopedDb.execute(sql81`
@@ -76674,7 +76726,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const priorArchive = guard[0].prior_archive ?? null;
@@ -76687,7 +76740,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: true,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       if (input.minIntervalMs > 0 && Number.isFinite(priorAtMs) && capturedAtMs - priorAtMs < input.minIntervalMs) {
@@ -76695,7 +76749,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: true,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const rotation = rotateWorkspaceArchives({
@@ -76716,7 +76771,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const livenessGuard = rowLiveness;
@@ -76746,14 +76802,16 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       return {
         wrote: true,
         throttled: false,
         superseded: false,
-        archiveRevision: workspaceArchiveMeta.revision
+        archiveRevision: workspaceArchiveMeta.revision,
+        ...published.workspaceArchiveRef ? { candidateDisposition: "adopted" } : {}
       };
     }
   );