@opengeni/db 4.3.2 → 4.3.3-canary.0

package/dist/{chunk-UUPY6IGP.js → chunk-UK57QA2H.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-I4ITNMX2.js";
+} from "./chunk-GVZJ7XSR.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-UUPY6IGP.js.map
+//# sourceMappingURL=chunk-UK57QA2H.js.map

package/dist/connection-token-resolver.d.ts

@@ -60,6 +60,8 @@ export type ResolveConnectionCredentialResult = {
     connectionVersion?: number;
     /** Metadata-only owner attribution from the immediate pre-use fence. */
     connectionUseAttribution?: ConnectionUseAttribution;
+    /** Metadata-only equality key from current live authority; never credentials or authorization. */
+    operationAuthorityDigest?: string;
     /**
      * Revalidate the exact accepted attempt immediately before one target
      * provider request. Credential lookup/refresh is a separate audited

package/dist/database.d.ts

@@ -175,7 +175,7 @@ export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, f
  */
 export declare function withSessionActivityRlsContext<T>(db: Database, context: RlsContext & {
     workspaceId: string;
-}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none"): Promise<T>;
+}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none", organizationMembershipFence?: boolean): Promise<T>;
 export declare function withWorkspaceSessionActivityRls<T>(db: Database, workspaceId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
 /**
  * Run one of several ordered workspace activity scopes inside a caller-owned
@@ -191,7 +191,12 @@ export declare function withRestoredSessionActivityRlsContext<T>(db: Database, c
  * cannot express that provenance; keep the single trusted rebrand here.
  */
 export declare function withSessionActivitySavepoint<T>(db: SessionActivityDatabase, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
-export declare function retrySessionActivityRls<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
+export declare function retrySessionActivityRls<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions & {
+    /** Claim can inherit membership-fenced causal authority after locking the
+     * session. Acquire that fence before tenancy/control/session instead. An
+     * enclosing transaction must preserve this same lock prefix. */
+    organizationMembershipFence?: boolean;
+}, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
 export declare function retryWorkspacePersistence<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
 export declare function retryRlsPersistence<T>(db: Database, context: RlsContext, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
 /**

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-I4ITNMX2.js";
-import "./chunk-AI4NC6XW.js";
+} from "./chunk-GVZJ7XSR.js";
+import "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-UVBPOGA7.js";
-import "./chunk-I4ITNMX2.js";
-import "./chunk-AI4NC6XW.js";
+} from "./chunk-232VC2LW.js";
+import "./chunk-GVZJ7XSR.js";
+import "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/host-mcp-bindings.d.ts

@@ -70,4 +70,6 @@ export declare function inheritChildHostMcpTurnAuthorities(db: Database, input:
  * Missing/revoked authority denies; infrastructure failures propagate so the
  * broker reports refresh_failed rather than misclassifying an outage.
  * The historical function name is retained for existing internal consumers. */
-export declare function authorizeDirectHostMcpUse(db: Database, request: McpCredentialsRequest): Promise<boolean>;
+export declare function authorizeDirectHostMcpUse(db: Database, request: McpCredentialsRequest, 
+/** Internal metadata observer; called only after every live authorization fence succeeds. */
+onAuthorized?: (snapshot: HostMcpAcceptedAuthority) => void): Promise<boolean>;

package/dist/index.d.ts

@@ -8112,6 +8112,13 @@ export type LegacyModalCheckpointAdoptionTarget = Omit<LegacyModalCheckpointSlot
  * an unreferenced candidate that GC might delete while the legacy slot still
  * depends on that provider object. */
 export declare function adoptLegacyModalCheckpointArtifact(db: Database, input: LegacyModalCheckpointAdoptionTarget): Promise<boolean>;
+/** Object-candidate outcome from the publication transaction, independent of
+ * lifecycle `wrote`. Absent for inline/provider receipts and pure CAS checks.
+ * `unused` is NOT a retirement receipt: only the owner of a fresh candidate with
+ * no other publication in flight may use it for immediate cleanup. Exceptions
+ * give no disposition (commit may have happened). Legacy/shared keys and evicted
+ * refs need durable no-reattachment evidence before deletion. */
+export type WorkspaceArchiveCandidateDisposition = "adopted" | "already_referenced" | "unused";
 export declare function persistDrainSnapshot(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -8142,6 +8149,7 @@ export declare function persistDrainSnapshot(db: Database, input: {
 })): Promise<{
     wrote: boolean;
     archiveRevision: string | null;
+    candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }>;
 /**
  * The ONE archive-fold write, shared by the drain seam (persistDrainSnapshot)
@@ -8213,6 +8221,7 @@ export declare function persistWarmSnapshot(db: Database, input: {
     throttled: boolean;
     superseded: boolean;
     archiveRevision: string | null;
+    candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }>;
 export declare function getMaterializedSandboxFileResources(db: Database, input: {
     accountId: string;

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-XBXANJQS.js";
+} from "./chunk-M7PSMVFF.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -108,7 +108,7 @@ import {
   updateSessionCommandReceiptResult,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-F4BIHJ7J.js";
+} from "./chunk-EYF6MH6C.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   VideoGenerationCapacityError,
@@ -140,7 +140,7 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-PFBUHOI5.js";
+} from "./chunk-QLA3UQNX.js";
 import {
   ManagedAuthActorMutationInFlightError,
   ManagedAuthLoginSlotAlreadyExistsError,
@@ -163,7 +163,7 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-UUPY6IGP.js";
+} from "./chunk-UK57QA2H.js";
 import {
   migrate,
   runMigrations
@@ -190,7 +190,7 @@ import {
   inspectRuntimeDatabasePosture,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-YVYBAWBU.js";
+} from "./chunk-THJGMEK5.js";
 import {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
@@ -204,7 +204,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-DVSLOUEI.js";
+} from "./chunk-2ZMTQVTR.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -215,7 +215,7 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-UVBPOGA7.js";
+} from "./chunk-232VC2LW.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
@@ -251,7 +251,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-I4ITNMX2.js";
+} from "./chunk-GVZJ7XSR.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   LOSSLESS_JSON_STRING_PREFIX,
@@ -491,7 +491,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-AI4NC6XW.js";
+} from "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-execution-policy.ts
@@ -5241,7 +5241,13 @@ async function inheritChildHostMcpTurnAuthorities(db, input) {
     }
   });
 }
-async function authorizeDirectHostMcpUse(db, request) {
+async function authorizeDirectHostMcpUse(db, request, onAuthorized) {
+  const snapshot = await resolveDirectHostMcpUseAuthority(db, request);
+  if (!snapshot) return false;
+  onAuthorized?.(snapshot);
+  return true;
+}
+async function resolveDirectHostMcpUseAuthority(db, request) {
   if (!request.attemptId || !request.connectionRef.hostBinding) return false;
   const current = await getHostMcpLiveAttempt(
     db,
@@ -5321,7 +5327,7 @@ async function authorizeDirectHostMcpUse(db, request) {
       request.sessionId,
       request.attemptId
     );
-    return live !== null && live.id === request.turnId && live.executionGeneration === request.executionGeneration;
+    return live !== null && live.id === request.turnId && live.executionGeneration === request.executionGeneration && a;
   });
 }
 
@@ -9207,6 +9213,7 @@ import {
   SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,
   parseWorkspaceArchiveDescriptor,
   parseWorkspaceArchiveObjectRef,
+  validateWorkspaceArchiveObjectRef,
   workspaceArchivePayloadPresent,
   omitInlineWorkspaceArchiveWhenObjectRefPresent,
   stableJson as stableJson16,
@@ -76187,7 +76194,17 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
   );
 }
 function publishedWorkspaceArchiveFields(input) {
-  const ref = parseWorkspaceArchiveObjectRef(input.workspaceArchiveRef) ?? void 0;
+  const ref = input.workspaceArchiveRef == null ? void 0 : validateWorkspaceArchiveObjectRef(input.workspaceArchiveRef, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    sandboxGroupId: input.sandboxGroupId,
+    descriptor: input.workspaceArchiveMeta
+  }) ?? void 0;
+  if (input.workspaceArchiveRef != null && !ref) {
+    throw new Error(
+      "Invalid workspace archive object ref: publication scope or descriptor mismatch"
+    );
+  }
   const inline = typeof input.workspaceArchive === "string" && input.workspaceArchive.length > 0 ? input.workspaceArchive : void 0;
   if (!ref && !inline) {
     throw new Error("workspace archive publication requires inline bytes or an object ref");
@@ -76204,11 +76221,24 @@ function publishedWorkspaceArchiveFields(input) {
   }
   return { workspaceArchive: inline };
 }
+function workspaceArchiveCandidateFields(candidate, lockedResumeState) {
+  if (!candidate) return {};
+  const sessionState = lockedResumeState?.sessionState;
+  const referenced = [
+    sessionState?.workspaceArchiveRef,
+    sessionState?.workspaceArchivePrevRef
+  ].some((value) => {
+    const ref = parseWorkspaceArchiveObjectRef(value);
+    return ref?.key === candidate.key && ref.backend === candidate.backend;
+  });
+  return { candidateDisposition: referenced ? "already_referenced" : "unused" };
+}
 async function persistDrainSnapshot(db, input) {
   const workspaceArchiveMeta = input.workspaceArchive === null ? null : parseArchiveRevision(input.workspaceArchiveMeta);
   if (input.workspaceArchive !== null && !workspaceArchiveMeta) {
     throw new Error("Invalid verified workspace archive descriptor");
   }
+  const published = input.workspaceArchive === null ? null : publishedWorkspaceArchiveFields(input);
   if (workspaceArchiveMeta?.version === 2 && (workspaceArchiveMeta.provider === "modal_snapshot_filesystem" || workspaceArchiveMeta.provider === "modal_snapshot_directory") && !input.checkpointArtifactId) {
     throw new Error("Modal native checkpoint publication requires a registered artifact");
   }
@@ -76246,10 +76276,15 @@ async function persistDrainSnapshot(db, input) {
         for update
       `);
       const row = guard[0];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published?.workspaceArchiveRef,
+        row?.resume_state
+      );
       if (!row) {
         return {
           wrote: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const sourceLeaseMatches = input.expectedLeaseId === void 0 || row.id === input.expectedLeaseId;
@@ -76259,7 +76294,7 @@ async function persistDrainSnapshot(db, input) {
       const lateReceipt = recovery.lateArchiveCapture;
       const coldLatePublication = input.workspaceArchive !== null && input.expectedLeaseId !== void 0 && input.providerRequestId !== void 0 && row.id === input.expectedLeaseId && row.liveness === "cold" && Number(row.refcount) === 0 && Number(row.lease_epoch) === input.expectedEpoch + 1 && row.instance_id === null && Number(row.workspace_generation) === input.expectedWorkspaceGeneration && row.archive_capture_id === null && recovery.provider.status === "missing" && recovery.provider.instanceId === input.expectedInstanceId && recovery.restore.rematerializationId === null && (recovery.restore.status === "unrecoverable" || recovery.restore.status === "degraded" || recovery.restore.status === "pending") && lateReceipt?.sourceLeaseId === input.expectedLeaseId && lateReceipt.sourceLeaseEpoch === input.expectedEpoch && lateReceipt.sourceInstanceId === input.expectedInstanceId && lateReceipt.sourceWorkspaceGeneration === input.expectedWorkspaceGeneration && lateReceipt.providerRequestId === input.providerRequestId && !row.unsettled_mutation;
       if (!activePublication && !coldLatePublication) {
-        return { wrote: false, archiveRevision: null };
+        return { wrote: false, archiveRevision: null, ...candidateFields };
       }
       const priorArchive = row.prior_archive ?? null;
       const priorArchivePrev = row.prior_archive_prev ?? null;
@@ -76271,7 +76306,7 @@ async function persistDrainSnapshot(db, input) {
           archiveRevision: null
         };
       }
-      const published = publishedWorkspaceArchiveFields(input);
+      if (!published) throw new Error("Missing workspace archive publication fields");
       const priorMeta = parseArchiveRevision(priorSessionState?.workspaceArchiveMeta);
       if (activePublication && row.archive_capture_published_at !== null) {
         if (priorArchive === null && priorRef === null || priorMeta === null) {
@@ -76291,7 +76326,7 @@ async function persistDrainSnapshot(db, input) {
               )
           `);
         }
-        return { wrote: true, archiveRevision: priorMeta.revision };
+        return { wrote: true, archiveRevision: priorMeta.revision, ...candidateFields };
       }
       const rotation = rotateWorkspaceArchives({
         resumeState: row.resume_state,
@@ -76345,12 +76380,14 @@ async function persistDrainSnapshot(db, input) {
       if (!folded) {
         return {
           wrote: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       return {
         wrote: true,
-        archiveRevision: workspaceArchiveMeta?.revision ?? null
+        archiveRevision: workspaceArchiveMeta?.revision ?? null,
+        ...published.workspaceArchiveRef ? { candidateDisposition: "adopted" } : {}
       };
     }
   );
@@ -76627,12 +76664,27 @@ async function persistWarmSnapshot(db, input) {
         )
       ).limit(1) : [];
       const attemptMayPersistWorkspace = attempt !== void 0 && (attempt.state === "claimed" || attempt.state === "running" ? attempt.outcome === null : attempt.state === "closed" && (attempt.outcome === "completed" || attempt.outcome === "failed" || attempt.outcome === "requires_action"));
+      const candidateLease = published.workspaceArchiveRef ? await scopedDb.execute(sql81`
+            select jsonb_build_object('sessionState', jsonb_build_object(
+              'workspaceArchiveRef', resume_state #> '{sessionState,workspaceArchiveRef}',
+              'workspaceArchivePrevRef', resume_state #> '{sessionState,workspaceArchivePrevRef}'
+            )) as resume_state
+            from sandbox_leases
+            where workspace_id = ${input.workspaceId}
+              and sandbox_group_id = ${input.sandboxGroupId}
+            for update
+          `) : [];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published.workspaceArchiveRef,
+        candidateLease[0]?.resume_state
+      );
       if (!attempt || attempt.accountId !== input.accountId || attempt.sandboxGroupId !== input.sandboxGroupId || interruption || !attemptMayPersistWorkspace) {
         return {
           wrote: false,
           throttled: false,
           superseded: true,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const guard = await scopedDb.execute(sql81`
@@ -76680,7 +76732,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const priorArchive = guard[0].prior_archive ?? null;
@@ -76693,7 +76746,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: true,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       if (input.minIntervalMs > 0 && Number.isFinite(priorAtMs) && capturedAtMs - priorAtMs < input.minIntervalMs) {
@@ -76701,7 +76755,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: true,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const rotation = rotateWorkspaceArchives({
@@ -76722,7 +76777,8 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       const livenessGuard = rowLiveness;
@@ -76752,14 +76808,16 @@ async function persistWarmSnapshot(db, input) {
           wrote: false,
           throttled: false,
           superseded: false,
-          archiveRevision: null
+          archiveRevision: null,
+          ...candidateFields
         };
       }
       return {
         wrote: true,
         throttled: false,
         superseded: false,
-        archiveRevision: workspaceArchiveMeta.revision
+        archiveRevision: workspaceArchiveMeta.revision,
+        ...published.workspaceArchiveRef ? { candidateDisposition: "adopted" } : {}
       };
     }
   );
@@ -82822,7 +82880,8 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
     {
       stage: "session_attempts.claim",
       eventTypes: ["session.turn.attempt_claimed"],
-      maxAttempts: 3
+      maxAttempts: 3,
+      organizationMembershipFence: true
     },
     async (scopedDb) => await withSessionActivitySavepoint(scopedDb, async (tx) => {
       const deliverPendingUpdates = async (accountId, turnId, turnGeneration, nextSequence, occurredAt, triggerEventId, expectedXaiAuthority, options = {}) => {