@opengeni/db 4.3.0-canary.0 → 4.3.2

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-YGRT6VZO.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-UUPY6IGP.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ManagedAuthActorMutationInFlightError,

package/dist/retained-provider-commands.js

@@ -1,9 +1,9 @@
 import {
   withRlsContext
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   sandboxRetainedProcesses
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/retained-provider-commands.ts

package/dist/schema.js

@@ -359,7 +359,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,

package/dist/session-background-commands.js

@@ -22,10 +22,10 @@ import {
   settleClaimedConnectedMachineBackgroundCommandWithMutation,
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction
-} from "./chunk-7JPLGBSA.js";
-import "./chunk-NCSPNCQK.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   COMMAND_OUTPUT_DEFAULT_BYTES,

package/dist/session-command-output.js

@@ -1,10 +1,10 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-7JPLGBSA.js";
-import "./chunk-NCSPNCQK.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
 import {
   withSessionActivityRlsContext
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   fromPostgresLosslessJson,
   sandboxRetainedProcesses,
@@ -12,7 +12,7 @@ import {
   sessionEvents,
   sessions,
   withLosslessContentWriteVersion
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-command-output.ts

package/dist/session-event-slices.js

@@ -1,13 +1,13 @@
 import {
   rawRows,
   withWorkspaceRls
-} from "./chunk-SGJDIF2D.js";
+} from "./chunk-I4ITNMX2.js";
 import {
   LOSSLESS_JSON_STRING_PREFIX,
   fromPostgresLosslessJson,
   sessionEvents,
   sessionTurns
-} from "./chunk-Y5XFVJJM.js";
+} from "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-event-slices.ts

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-ILKJKDII.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-XBXANJQS.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-NCSPNCQK.js";
-import "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-PFBUHOI5.js";
+import "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/workspace-tool-defaults.js

@@ -1,11 +1,11 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-7JPLGBSA.js";
-import "./chunk-NCSPNCQK.js";
+} from "./chunk-F4BIHJ7J.js";
+import "./chunk-PFBUHOI5.js";
 import {
   withWorkspaceRls
-} from "./chunk-SGJDIF2D.js";
-import "./chunk-Y5XFVJJM.js";
+} from "./chunk-I4ITNMX2.js";
+import "./chunk-AI4NC6XW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/workspace-tool-defaults.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "4.3.0-canary.0",
+  "version": "4.3.2",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -94,11 +94,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.5.4-canary.0",
-    "@opengeni/codex": "^0.2.22-canary.6",
-    "@opengeni/config": "^1.1.0-canary.0",
-    "@opengeni/contracts": "^3.0.0-canary.0",
-    "@opengeni/network": "^0.3.1-canary.6",
+    "@opengeni/codemode": "^0.5.5",
+    "@opengeni/codex": "^0.2.22",
+    "@opengeni/config": "^1.1.1",
+    "@opengeni/contracts": "^3.0.1",
+    "@opengeni/network": "^0.3.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/schema.ts

@@ -6646,10 +6646,11 @@ export const sessionTurns = pgTable(
       .$type<Record<string, unknown>>()
       .notNull()
       .default({ backfill: true }),
-    // Immutable human authority for exact-attempt governance. Human turns bind
-    // their own subject; trusted continuations/compactions may inherit the
-    // causal turn's value while retaining a service initiator. Null means the
-    // turn has no human preference authority.
+    // Bounded, immutable causal-human selector for named attempt-bound
+    // capabilities. Human turns bind their own subject; trusted continuations
+    // and compactions may inherit the causal turn's value while retaining a
+    // service initiator. It never authorizes by itself. Null means pure service
+    // work has no human-bound authority.
     initiatingHumanSubjectId: text("initiating_human_subject_id"),
     // Exact goal authority frozen when the logical turn is accepted. The
     // migration trigger fills this for old and rolling writers; claim only

package/src/workspace-artifacts.ts

@@ -538,7 +538,11 @@ async function assertAttemptAuthority(
       FOR NO KEY UPDATE OF session
     ), locked_turn AS MATERIALIZED (
       SELECT turn.id, turn.account_id, turn.workspace_id, turn.session_id,
-        turn.active_attempt_id, turn.execution_generation, turn.initiator_subject_id
+        turn.active_attempt_id, turn.execution_generation,
+        coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ) as initiating_human_subject_id
       FROM session_turns turn
       JOIN locked_session session
         ON session.id = turn.session_id
@@ -548,8 +552,10 @@ async function assertAttemptAuthority(
         AND turn.active_attempt_id = ${input.sourceAttemptId}::uuid
         AND turn.execution_generation = ${input.sourceExecutionGeneration}
         AND turn.status IN ('running', 'requires_action', 'recovering', 'waiting_capacity')
-        AND turn.initiator_kind = 'subject'
-        AND length(btrim(turn.initiator_subject_id)) BETWEEN 1 AND 1024
+        AND length(btrim(coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ))) BETWEEN 1 AND 1024
       FOR UPDATE OF turn
     ), locked_attempt AS MATERIALIZED (
       SELECT attempt.id, attempt.account_id, attempt.workspace_id,
@@ -578,7 +584,7 @@ async function assertAttemptAuthority(
   `)) as unknown as Array<{ id: string }>;
   if (!rows[0]) {
     throw new WorkspaceArtifactOperationError(
-      "Artifact mutation requires the exact active attempt and execution generation",
+      "Artifact mutation requires the exact active attempt, execution generation, and immutable human authority",
     );
   }
 }