@opengeni/db 4.3.2 → 4.3.3-canary.1

package/dist/{chunk-UUPY6IGP.js → chunk-UK57QA2H.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-I4ITNMX2.js";
+} from "./chunk-GVZJ7XSR.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-UUPY6IGP.js.map
+//# sourceMappingURL=chunk-UK57QA2H.js.map

package/dist/codex-selection-diagnostics.d.ts

@@ -0,0 +1,12 @@
+/** Observations about this session, never allocator inputs or failover policy. */
+export declare function codexSelectionDiagnostics(input: {
+    previousCredentialId: string | null;
+    credentialId: string;
+    reusedLease: boolean;
+    pinnedCredentialId: string | null;
+    pinSource?: "manual" | "policy" | null;
+}): {
+    transition: "assigned" | "switched" | "unchanged";
+    source: "allocator" | "manual_pin";
+    reason: "affinity_reused" | "assigned" | "lease_reused" | "switched";
+};

package/dist/connection-token-resolver.d.ts

@@ -60,6 +60,8 @@ export type ResolveConnectionCredentialResult = {
     connectionVersion?: number;
     /** Metadata-only owner attribution from the immediate pre-use fence. */
     connectionUseAttribution?: ConnectionUseAttribution;
+    /** Metadata-only equality key from current live authority; never credentials or authorization. */
+    operationAuthorityDigest?: string;
     /**
      * Revalidate the exact accepted attempt immediately before one target
      * provider request. Credential lookup/refresh is a separate audited

package/dist/database.d.ts

@@ -175,7 +175,7 @@ export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, f
  */
 export declare function withSessionActivityRlsContext<T>(db: Database, context: RlsContext & {
     workspaceId: string;
-}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none"): Promise<T>;
+}, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none", organizationMembershipFence?: boolean): Promise<T>;
 export declare function withWorkspaceSessionActivityRls<T>(db: Database, workspaceId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
 /**
  * Run one of several ordered workspace activity scopes inside a caller-owned
@@ -191,7 +191,12 @@ export declare function withRestoredSessionActivityRlsContext<T>(db: Database, c
  * cannot express that provenance; keep the single trusted rebrand here.
  */
 export declare function withSessionActivitySavepoint<T>(db: SessionActivityDatabase, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
-export declare function retrySessionActivityRls<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
+export declare function retrySessionActivityRls<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions & {
+    /** Claim can inherit membership-fenced causal authority after locking the
+     * session. Acquire that fence before tenancy/control/session instead. An
+     * enclosing transaction must preserve this same lock prefix. */
+    organizationMembershipFence?: boolean;
+}, fn: (db: SessionActivityDatabase) => Promise<T>): Promise<T>;
 export declare function retryWorkspacePersistence<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
 export declare function retryRlsPersistence<T>(db: Database, context: RlsContext, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
 /**

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-I4ITNMX2.js";
-import "./chunk-AI4NC6XW.js";
+} from "./chunk-GVZJ7XSR.js";
+import "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-UVBPOGA7.js";
-import "./chunk-I4ITNMX2.js";
-import "./chunk-AI4NC6XW.js";
+} from "./chunk-232VC2LW.js";
+import "./chunk-GVZJ7XSR.js";
+import "./chunk-6TKL3GQO.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/host-mcp-bindings.d.ts

@@ -70,4 +70,6 @@ export declare function inheritChildHostMcpTurnAuthorities(db: Database, input:
  * Missing/revoked authority denies; infrastructure failures propagate so the
  * broker reports refresh_failed rather than misclassifying an outage.
  * The historical function name is retained for existing internal consumers. */
-export declare function authorizeDirectHostMcpUse(db: Database, request: McpCredentialsRequest): Promise<boolean>;
+export declare function authorizeDirectHostMcpUse(db: Database, request: McpCredentialsRequest, 
+/** Internal metadata observer; called only after every live authorization fence succeeds. */
+onAuthorized?: (snapshot: HostMcpAcceptedAuthority) => void): Promise<boolean>;

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { codexSelectionDiagnostics } from "./codex-selection-diagnostics.js";
+export { codexSelectionDiagnostics } from "./codex-selection-diagnostics.js";
 import { type ModelConnectionAccess, type ModelConnectionTarget } from "./model-connection-access.js";
 export { assertModelConnectionAllowsTurn, modelAllowedByConnections, type ConnectionModelRestrictions, } from "./workspace-model-connection-access.js";
 export * from "./model-connection-access.js";
@@ -4884,6 +4886,27 @@ export declare function switchSessionCodexAccount(db: Database, input: {
 }>>;
 export declare function setSessionCodexPin(db: Database, workspaceId: string, sessionId: string, pinnedCredentialId: string | null, source?: CodexPinSource, options?: SetSessionCodexPinOptions): Promise<boolean>;
 /** Written by the worker at the turn boundary; drives the in-session indicator. */
+/** Commit observed assignment and its events together under the exact live attempt.
+ * Allocation still uses its frozen policy snapshot; this is observation only.
+ * Replays return the same receipt and never manufacture a second switch.
+ */
+export declare function recordSessionCodexSelectionForTurnAttempt(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    credentialId: string;
+    strategy: string;
+    reusedLease: boolean;
+    pinnedCredentialId: string | null;
+    pinSource: "manual" | "policy" | null;
+    eligibleCount: number;
+    connectedCount: number;
+}): Promise<{
+    events: SessionEvent[];
+    diagnostics: ReturnType<typeof codexSelectionDiagnostics>;
+}>;
 export declare function recordSessionActiveCodexCredential(db: Database, workspaceId: string, sessionId: string, credentialId: string): Promise<void>;
 /**
  * Disconnect ONE account. DELETE WHERE id = credentialId AND workspace_id. If it
@@ -5471,7 +5494,6 @@ export declare function reapExpiredSessionListSnapshots(db: Database, limit?: nu
  * lifecycle/title and authorization data.
  */
 export declare function listSessionsForSubject(db: Database, workspaceId: string, options: ListSessionsForSubjectOptions): Promise<SessionListResponse>;
-/** Read a session with the caller subject's personal pin projection. */
 export declare function getSessionForSubject(db: Database, workspaceId: string, sessionId: string, subjectId: string, relatedSessionAccess?: "target" | "root"): Promise<Session | null>;
 /**
  * Idempotently set a member's pin without mutating the session's lifecycle or
@@ -8112,6 +8134,13 @@ export type LegacyModalCheckpointAdoptionTarget = Omit<LegacyModalCheckpointSlot
  * an unreferenced candidate that GC might delete while the legacy slot still
  * depends on that provider object. */
 export declare function adoptLegacyModalCheckpointArtifact(db: Database, input: LegacyModalCheckpointAdoptionTarget): Promise<boolean>;
+/** Object-candidate outcome from the publication transaction, independent of
+ * lifecycle `wrote`. Absent for inline/provider receipts and pure CAS checks.
+ * `unused` is NOT a retirement receipt: only the owner of a fresh candidate with
+ * no other publication in flight may use it for immediate cleanup. Exceptions
+ * give no disposition (commit may have happened). Legacy/shared keys and evicted
+ * refs need durable no-reattachment evidence before deletion. */
+export type WorkspaceArchiveCandidateDisposition = "adopted" | "already_referenced" | "unused";
 export declare function persistDrainSnapshot(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -8142,6 +8171,7 @@ export declare function persistDrainSnapshot(db: Database, input: {
 })): Promise<{
     wrote: boolean;
     archiveRevision: string | null;
+    candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }>;
 /**
  * The ONE archive-fold write, shared by the drain seam (persistDrainSnapshot)
@@ -8213,6 +8243,7 @@ export declare function persistWarmSnapshot(db: Database, input: {
     throttled: boolean;
     superseded: boolean;
     archiveRevision: string | null;
+    candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }>;
 export declare function getMaterializedSandboxFileResources(db: Database, input: {
     accountId: string;