@opengeni/db 4.3.2-canary.0 → 4.3.3-canary.0

package/dist/{chunk-UUPY6IGP.js → chunk-UK57QA2H.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-I4ITNMX2.js";
+} from "./chunk-GVZJ7XSR.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-UUPY6IGP.js.map
+//# sourceMappingURL=chunk-UK57QA2H.js.map

package/dist/connection-token-resolver.d.ts

@@ -60,6 +60,8 @@ export type ResolveConnectionCredentialResult = {
     connectionVersion?: number;
     /** Metadata-only owner attribution from the immediate pre-use fence. */
     connectionUseAttribution?: ConnectionUseAttribution;
+    /** Metadata-only equality key from current live authority; never credentials or authorization. */
+    operationAuthorityDigest?: string;
     /**
      * Revalidate the exact accepted attempt immediately before one target
      * provider request. Credential lookup/refresh is a separate audited

package/dist/database.d.ts

@@ -175,7 +175,7 @@ export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, f
  */
 export declare function withSessionActivityRlsContext<T>(db: Database, context: RlsContext & {
     workspaceId: string;
-}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none"): Promise<T>;
+}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none", organizationMembershipFence?: boolean): Promise<T>;
 export declare function withWorkspaceSessionActivityRls<T>(db: Database, workspaceId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
 /**
  * Run one of several ordered workspace activity scopes inside a caller-owned
@@ -191,7 +191,12 @@ export declare function withRestoredSessionActivityRlsContext<T>(db: Database, c
  * cannot express that provenance; keep the single trusted rebrand here.
  */
 export declare function withSessionActivitySavepoint<T>(db: SessionActivityDatabase, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
-export declare function retrySessionActivityRls<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
+export declare function retrySessionActivityRls<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions & {
+    /** Claim can inherit membership-fenced causal authority after locking the
+     * session. Acquire that fence before tenancy/control/session instead. An
+     * enclosing transaction must preserve this same lock prefix. */
+    organizationMembershipFence?: boolean;
+}, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
 export declare function retryWorkspacePersistence<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
 export declare function retryRlsPersistence<T>(db: Database, context: RlsContext, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
 /**

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-I4ITNMX2.js";
-import "./chunk-AI4NC6XW.js";
+} from "./chunk-GVZJ7XSR.js";
+import "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-UVBPOGA7.js";
-import "./chunk-I4ITNMX2.js";
-import "./chunk-AI4NC6XW.js";
+} from "./chunk-232VC2LW.js";
+import "./chunk-GVZJ7XSR.js";
+import "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/host-mcp-bindings.d.ts

@@ -70,4 +70,6 @@ export declare function inheritChildHostMcpTurnAuthorities(db: Database, input:
  * Missing/revoked authority denies; infrastructure failures propagate so the
  * broker reports refresh_failed rather than misclassifying an outage.
  * The historical function name is retained for existing internal consumers. */
-export declare function authorizeDirectHostMcpUse(db: Database, request: McpCredentialsRequest): Promise<boolean>;
+export declare function authorizeDirectHostMcpUse(db: Database, request: McpCredentialsRequest, 
+/** Internal metadata observer; called only after every live authorization fence succeeds. */
+onAuthorized?: (snapshot: HostMcpAcceptedAuthority) => void): Promise<boolean>;

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-XBXANJQS.js";
+} from "./chunk-M7PSMVFF.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -108,7 +108,7 @@ import {
   updateSessionCommandReceiptResult,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-F4BIHJ7J.js";
+} from "./chunk-EYF6MH6C.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   VideoGenerationCapacityError,
@@ -140,7 +140,7 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-PFBUHOI5.js";
+} from "./chunk-QLA3UQNX.js";
 import {
   ManagedAuthActorMutationInFlightError,
   ManagedAuthLoginSlotAlreadyExistsError,
@@ -163,7 +163,7 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-UUPY6IGP.js";
+} from "./chunk-UK57QA2H.js";
 import {
   migrate,
   runMigrations
@@ -190,7 +190,7 @@ import {
   inspectRuntimeDatabasePosture,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-YVYBAWBU.js";
+} from "./chunk-THJGMEK5.js";
 import {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
@@ -204,7 +204,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-DVSLOUEI.js";
+} from "./chunk-2ZMTQVTR.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -215,7 +215,7 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-UVBPOGA7.js";
+} from "./chunk-232VC2LW.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
@@ -251,7 +251,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-I4ITNMX2.js";
+} from "./chunk-GVZJ7XSR.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   LOSSLESS_JSON_STRING_PREFIX,
@@ -491,7 +491,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-AI4NC6XW.js";
+} from "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-execution-policy.ts
@@ -5241,7 +5241,13 @@ async function inheritChildHostMcpTurnAuthorities(db, input) {
     }
   });
 }
-async function authorizeDirectHostMcpUse(db, request) {
+async function authorizeDirectHostMcpUse(db, request, onAuthorized) {
+  const snapshot = await resolveDirectHostMcpUseAuthority(db, request);
+  if (!snapshot) return false;
+  onAuthorized?.(snapshot);
+  return true;
+}
+async function resolveDirectHostMcpUseAuthority(db, request) {
   if (!request.attemptId || !request.connectionRef.hostBinding) return false;
   const current = await getHostMcpLiveAttempt(
     db,
@@ -5321,7 +5327,7 @@ async function authorizeDirectHostMcpUse(db, request) {
       request.sessionId,
       request.attemptId
     );
-    return live !== null && live.id === request.turnId && live.executionGeneration === request.executionGeneration;
+    return live !== null && live.id === request.turnId && live.executionGeneration === request.executionGeneration && a;
   });
 }
 
@@ -82874,7 +82880,8 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
     {
       stage: "session_attempts.claim",
       eventTypes: ["session.turn.attempt_claimed"],
-      maxAttempts: 3
+      maxAttempts: 3,
+      organizationMembershipFence: true
     },
     async (scopedDb) => await withSessionActivitySavepoint(scopedDb, async (tx) => {
       const deliverPendingUpdates = async (accountId, turnId, turnGeneration, nextSequence, occurredAt, triggerEventId, expectedXaiAuthority, options = {}) => {