@opengeni/db 4.3.0-canary.0 → 4.3.2-canary.0

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-YGRT6VZO.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-UUPY6IGP.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ManagedAuthActorMutationInFlightError,

package/dist/retained-provider-commands.js

@@ -1,9 +1,9 @@
 import {
   withRlsContext
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   sandboxRetainedProcesses
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/retained-provider-commands.ts

package/dist/schema.js

@@ -359,7 +359,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,

package/dist/session-background-commands.js

@@ -22,10 +22,10 @@ import {
   settleClaimedConnectedMachineBackgroundCommandWithMutation,
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction
-} from "./chunk-7JPLGBSA.js";
-import "./chunk-NCSPNCQK.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   COMMAND_OUTPUT_DEFAULT_BYTES,

package/dist/session-command-output.js

@@ -1,10 +1,10 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-7JPLGBSA.js";
-import "./chunk-NCSPNCQK.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
 import {
   withSessionActivityRlsContext
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   fromPostgresLosslessJson,
   sandboxRetainedProcesses,
@@ -12,7 +12,7 @@ import {
   sessionEvents,
   sessions,
   withLosslessContentWriteVersion
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-command-output.ts

package/dist/session-event-slices.js

@@ -1,13 +1,13 @@
 import {
   rawRows,
   withWorkspaceRls
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   LOSSLESS_JSON_STRING_PREFIX,
   fromPostgresLosslessJson,
   sessionEvents,
   sessionTurns
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-event-slices.ts

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-ILKJKDII.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-XBXANJQS.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-NCSPNCQK.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-PFBUHOI5.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/workspace-tool-defaults.js

@@ -1,11 +1,11 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-7JPLGBSA.js";
-import "./chunk-NCSPNCQK.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
 import {
   withWorkspaceRls
-} from "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/workspace-tool-defaults.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "4.3.0-canary.0",
+  "version": "4.3.2-canary.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -94,11 +94,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.5.4-canary.0",
-    "@opengeni/codex": "^0.2.22-canary.6",
-    "@opengeni/config": "^1.1.0-canary.0",
-    "@opengeni/contracts": "^3.0.0-canary.0",
-    "@opengeni/network": "^0.3.1-canary.6",
+    "@opengeni/codemode": "^0.5.5-canary.0",
+    "@opengeni/codex": "^0.2.22-canary.7",
+    "@opengeni/config": "^1.1.1-canary.0",
+    "@opengeni/contracts": "^3.0.1-canary.0",
+    "@opengeni/network": "^0.3.1-canary.7",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/index.ts

@@ -272,6 +272,7 @@ import {
   SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,
   parseWorkspaceArchiveDescriptor,
   parseWorkspaceArchiveObjectRef,
+  validateWorkspaceArchiveObjectRef,
   workspaceArchivePayloadPresent,
   omitInlineWorkspaceArchiveWhenObjectRefPresent,
   type WorkspaceArchiveObjectRef,
@@ -53448,13 +53449,30 @@ export async function adoptLegacyModalCheckpointArtifact(
 }
 
 function publishedWorkspaceArchiveFields(input: {
+  accountId: string;
+  workspaceId: string;
+  sandboxGroupId: string;
+  workspaceArchiveMeta: SandboxArchiveRevision;
   workspaceArchive?: string | null;
   workspaceArchiveRef?: WorkspaceArchiveObjectRef | null;
 }): {
   workspaceArchive?: string;
   workspaceArchiveRef?: WorkspaceArchiveObjectRef;
 } {
-  const ref = parseWorkspaceArchiveObjectRef(input.workspaceArchiveRef) ?? undefined;
+  const ref =
+    input.workspaceArchiveRef == null
+      ? undefined
+      : (validateWorkspaceArchiveObjectRef(input.workspaceArchiveRef, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sandboxGroupId: input.sandboxGroupId,
+          descriptor: input.workspaceArchiveMeta,
+        }) ?? undefined);
+  if (input.workspaceArchiveRef != null && !ref) {
+    throw new Error(
+      "Invalid workspace archive object ref: publication scope or descriptor mismatch",
+    );
+  }
   const inline =
     typeof input.workspaceArchive === "string" && input.workspaceArchive.length > 0
       ? input.workspaceArchive
@@ -53475,6 +53493,30 @@ function publishedWorkspaceArchiveFields(input: {
   return { workspaceArchive: inline };
 }
 
+/** Object-candidate outcome from the publication transaction, independent of
+ * lifecycle `wrote`. Absent for inline/provider receipts and pure CAS checks.
+ * `unused` is NOT a retirement receipt: only the owner of a fresh candidate with
+ * no other publication in flight may use it for immediate cleanup. Exceptions
+ * give no disposition (commit may have happened). Legacy/shared keys and evicted
+ * refs need durable no-reattachment evidence before deletion. */
+export type WorkspaceArchiveCandidateDisposition = "adopted" | "already_referenced" | "unused";
+
+function workspaceArchiveCandidateFields(
+  candidate: WorkspaceArchiveObjectRef | undefined,
+  lockedResumeState: Record<string, unknown> | null | undefined,
+): { candidateDisposition?: WorkspaceArchiveCandidateDisposition } {
+  if (!candidate) return {};
+  const sessionState = lockedResumeState?.sessionState as Record<string, unknown> | undefined;
+  const referenced = [
+    sessionState?.workspaceArchiveRef,
+    sessionState?.workspaceArchivePrevRef,
+  ].some((value) => {
+    const ref = parseWorkspaceArchiveObjectRef(value);
+    return ref?.key === candidate.key && ref.backend === candidate.backend;
+  });
+  return { candidateDisposition: referenced ? "already_referenced" : "unused" };
+}
+
 export async function persistDrainSnapshot(
   db: Database,
   input: {
@@ -53511,12 +53553,14 @@ export async function persistDrainSnapshot(
 ): Promise<{
   wrote: boolean;
   archiveRevision: string | null;
+  candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }> {
   const workspaceArchiveMeta =
     input.workspaceArchive === null ? null : parseArchiveRevision(input.workspaceArchiveMeta);
   if (input.workspaceArchive !== null && !workspaceArchiveMeta) {
     throw new Error("Invalid verified workspace archive descriptor");
   }
+  const published = input.workspaceArchive === null ? null : publishedWorkspaceArchiveFields(input);
   if (
     workspaceArchiveMeta?.version === 2 &&
     (workspaceArchiveMeta.provider === "modal_snapshot_filesystem" ||
@@ -53575,10 +53619,15 @@ export async function persistDrainSnapshot(
         for update
       `);
       const row = guard[0];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published?.workspaceArchiveRef,
+        row?.resume_state,
+      );
       if (!row) {
         return {
           wrote: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const sourceLeaseMatches =
@@ -53624,7 +53673,7 @@ export async function persistDrainSnapshot(
         lateReceipt.providerRequestId === input.providerRequestId &&
         !row.unsettled_mutation;
       if (!activePublication && !coldLatePublication) {
-        return { wrote: false, archiveRevision: null };
+        return { wrote: false, archiveRevision: null, ...candidateFields };
       }
       const priorArchive = row.prior_archive ?? null;
       const priorArchivePrev = row.prior_archive_prev ?? null;
@@ -53642,7 +53691,7 @@ export async function persistDrainSnapshot(
           archiveRevision: null,
         };
       }
-      const published = publishedWorkspaceArchiveFields(input);
+      if (!published) throw new Error("Missing workspace archive publication fields");
       const priorMeta = parseArchiveRevision(priorSessionState?.workspaceArchiveMeta);
       if (activePublication && row.archive_capture_published_at !== null) {
         // A predecessor and its successor may receive the same provider result.
@@ -53668,7 +53717,7 @@ export async function persistDrainSnapshot(
               )
           `);
         }
-        return { wrote: true, archiveRevision: priorMeta.revision };
+        return { wrote: true, archiveRevision: priorMeta.revision, ...candidateFields };
       }
       const rotation = rotateWorkspaceArchives({
         resumeState: row.resume_state,
@@ -53729,11 +53778,13 @@ export async function persistDrainSnapshot(
         return {
           wrote: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       return {
         wrote: true,
         archiveRevision: workspaceArchiveMeta?.revision ?? null,
+        ...(published.workspaceArchiveRef ? { candidateDisposition: "adopted" as const } : {}),
       };
     },
   );
@@ -54132,6 +54183,7 @@ export async function persistWarmSnapshot(
   throttled: boolean;
   superseded: boolean;
   archiveRevision: string | null;
+  candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }> {
   const capturedAtMs = input.capturedAtMs ?? Date.now();
   const workspaceArchiveMeta = parseArchiveRevision(input.workspaceArchiveMeta);
@@ -54201,6 +54253,26 @@ export async function persistWarmSnapshot(
             (attempt.outcome === "completed" ||
               attempt.outcome === "failed" ||
               attempt.outcome === "requires_action"));
+      // Even a replay rejected by the attempt/epoch/capture guards may name
+      // a committed current or previous object. Inspect those slots under the
+      // same lease lock as publication, after the canonical workspace lock.
+      // This conveys no retirement or no-future-reattachment authority.
+      const candidateLease = published.workspaceArchiveRef
+        ? await scopedDb.execute<{ resume_state: Record<string, unknown> | null }>(sql`
+            select jsonb_build_object('sessionState', jsonb_build_object(
+              'workspaceArchiveRef', resume_state #> '{sessionState,workspaceArchiveRef}',
+              'workspaceArchivePrevRef', resume_state #> '{sessionState,workspaceArchivePrevRef}'
+            )) as resume_state
+            from sandbox_leases
+            where workspace_id = ${input.workspaceId}
+              and sandbox_group_id = ${input.sandboxGroupId}
+            for update
+          `)
+        : [];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published.workspaceArchiveRef,
+        candidateLease[0]?.resume_state,
+      );
       if (
         !attempt ||
         attempt.accountId !== input.accountId ||
@@ -54213,6 +54285,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: true,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const guard = await scopedDb.execute<{
@@ -54270,6 +54343,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const priorArchive = guard[0]!.prior_archive ?? null;
@@ -54290,6 +54364,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: true,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       if (
@@ -54302,6 +54377,7 @@ export async function persistWarmSnapshot(
           throttled: true,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const rotation = rotateWorkspaceArchives({
@@ -54323,6 +54399,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const livenessGuard: "warm" | "draining" = rowLiveness;
@@ -54355,6 +54432,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       return {
@@ -54362,6 +54440,7 @@ export async function persistWarmSnapshot(
         throttled: false,
         superseded: false,
         archiveRevision: workspaceArchiveMeta.revision,
+        ...(published.workspaceArchiveRef ? { candidateDisposition: "adopted" as const } : {}),
       };
     },
   );

package/src/schema.ts

@@ -6646,10 +6646,11 @@ export const sessionTurns = pgTable(
       .$type<Record<string, unknown>>()
       .notNull()
       .default({ backfill: true }),
-    // Immutable human authority for exact-attempt governance. Human turns bind
-    // their own subject; trusted continuations/compactions may inherit the
-    // causal turn's value while retaining a service initiator. Null means the
-    // turn has no human preference authority.
+    // Bounded, immutable causal-human selector for named attempt-bound
+    // capabilities. Human turns bind their own subject; trusted continuations
+    // and compactions may inherit the causal turn's value while retaining a
+    // service initiator. It never authorizes by itself. Null means pure service
+    // work has no human-bound authority.
     initiatingHumanSubjectId: text("initiating_human_subject_id"),
     // Exact goal authority frozen when the logical turn is accepted. The
     // migration trigger fills this for old and rolling writers; claim only

package/src/workspace-artifacts.ts

@@ -538,7 +538,11 @@ async function assertAttemptAuthority(
       FOR NO KEY UPDATE OF session
     ), locked_turn AS MATERIALIZED (
       SELECT turn.id, turn.account_id, turn.workspace_id, turn.session_id,
-        turn.active_attempt_id, turn.execution_generation, turn.initiator_subject_id
+        turn.active_attempt_id, turn.execution_generation,
+        coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ) as initiating_human_subject_id
       FROM session_turns turn
       JOIN locked_session session
         ON session.id = turn.session_id
@@ -548,8 +552,10 @@ async function assertAttemptAuthority(
         AND turn.active_attempt_id = ${input.sourceAttemptId}::uuid
         AND turn.execution_generation = ${input.sourceExecutionGeneration}
         AND turn.status IN ('running', 'requires_action', 'recovering', 'waiting_capacity')
-        AND turn.initiator_kind = 'subject'
-        AND length(btrim(turn.initiator_subject_id)) BETWEEN 1 AND 1024
+        AND length(btrim(coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ))) BETWEEN 1 AND 1024
       FOR UPDATE OF turn
     ), locked_attempt AS MATERIALIZED (
       SELECT attempt.id, attempt.account_id, attempt.workspace_id,
@@ -578,7 +584,7 @@ async function assertAttemptAuthority(
   `)) as unknown as Array<{ id: string }>;
   if (!rows[0]) {
     throw new WorkspaceArtifactOperationError(
-      "Artifact mutation requires the exact active attempt and execution generation",
+      "Artifact mutation requires the exact active attempt, execution generation, and immutable human authority",
     );
   }
 }