@opengeni/db 5.0.1 → 6.0.0

package/dist/schema.js

@@ -189,6 +189,8 @@ import {
   organizationCodexRotationSettings,
   organizationCompanyProfileAgentPolicies,
   organizationCompanyProfileAgentPolicyEvents,
+  organizationIntegrationPolicies,
+  organizationIntegrationPolicyOperations,
   organizationInvitationBindingEvents,
   organizationMembershipInvitations,
   organizationMembershipLifecycleEvents,
@@ -217,8 +219,6 @@ import {
   organizationUserRetentionObjectDeletionReceipts,
   organizationUserRetentionObjectObligations,
   organizationUserRetentionPolicies,
-  packInstallationComponents,
-  packInstallations,
   personalGitHubRepositorySelectionHeads,
   personalGitHubRepositorySelectionOperations,
   personalGitHubRepositorySelections,
@@ -360,7 +360,6 @@ import {
   workspaceLearningPolicySnapshots,
   workspaceMemberships,
   workspaceModelPolicies,
-  workspacePacks,
   workspaceScreenshotQuotas,
   workspaceSessionActivityRevisions,
   workspaceVariableSetVariables,
@@ -373,7 +372,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-F73UKJY6.js";
+} from "./chunk-MN5PZMEK.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -567,6 +566,8 @@ export {
   organizationCodexRotationSettings,
   organizationCompanyProfileAgentPolicies,
   organizationCompanyProfileAgentPolicyEvents,
+  organizationIntegrationPolicies,
+  organizationIntegrationPolicyOperations,
   organizationInvitationBindingEvents,
   organizationMembershipInvitations,
   organizationMembershipLifecycleEvents,
@@ -595,8 +596,6 @@ export {
   organizationUserRetentionObjectDeletionReceipts,
   organizationUserRetentionObjectObligations,
   organizationUserRetentionPolicies,
-  packInstallationComponents,
-  packInstallations,
   personalGitHubRepositorySelectionHeads,
   personalGitHubRepositorySelectionOperations,
   personalGitHubRepositorySelections,
@@ -738,7 +737,6 @@ export {
   workspaceLearningPolicySnapshots,
   workspaceMemberships,
   workspaceModelPolicies,
-  workspacePacks,
   workspaceScreenshotQuotas,
   workspaceSessionActivityRevisions,
   workspaceVariableSetVariables,

package/dist/session-admission-block.d.ts

@@ -0,0 +1,32 @@
+import { SessionAdmissionBlock } from "@opengeni/contracts";
+import { z } from "zod";
+export type SessionAdmissionFence = {
+    lastSequence: number;
+    controlVersion: number;
+};
+export declare const StoredSessionAdmissionBlock: z.ZodObject<{
+    reason: z.ZodEnum<{
+        database_claim_rejected: "database_claim_rejected";
+        initiator_membership_required: "initiator_membership_required";
+        personal_resource_grant_required: "personal_resource_grant_required";
+    }>;
+    sqlState: z.ZodNullable<z.ZodString>;
+    retryPolicy: z.ZodLiteral<"explicit_recheck">;
+    blockedAt: z.ZodString;
+    attemptId: z.ZodString;
+    fence: z.ZodObject<{
+        lastSequence: z.ZodNumber;
+        controlVersion: z.ZodNumber;
+    }, z.core.$strict>;
+    previousStatus: z.ZodEnum<{
+        idle: "idle";
+        queued: "queued";
+        recovering: "recovering";
+        requires_action: "requires_action";
+        running: "running";
+        waiting_capacity: "waiting_capacity";
+    }>;
+}, z.core.$strict>;
+export type StoredSessionAdmissionBlock = z.infer<typeof StoredSessionAdmissionBlock>;
+/** Never expose internal attempt/fence identities through the public projection. */
+export declare function projectSessionAdmissionBlock(value: StoredSessionAdmissionBlock | null | undefined): SessionAdmissionBlock | null;

package/dist/session-attempt-writers.d.ts

@@ -0,0 +1,4 @@
+import { type SQL } from "drizzle-orm";
+/** Physical writers retain ownership after logical settlement. A durably
+ * adopted background command owns its lifetime independently of the turn. */
+export declare function sessionAttemptPendingWritersSql(attempt: SQL): SQL;

package/dist/session-background-commands.js

@@ -22,10 +22,11 @@ import {
   settleClaimedConnectedMachineBackgroundCommandWithMutation,
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction
-} from "./chunk-6T2GGYWE.js";
-import "./chunk-ERKVSPDX.js";
-import "./chunk-DPONPYJD.js";
-import "./chunk-F73UKJY6.js";
+} from "./chunk-GABXCG3N.js";
+import "./chunk-LVY33EWL.js";
+import "./chunk-4UJCXBR2.js";
+import "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-command-output.js

@@ -1,131 +1,13 @@
 import {
-  lockSessionEventWriteRows
-} from "./chunk-6T2GGYWE.js";
-import "./chunk-ERKVSPDX.js";
-import {
-  withSessionActivityRlsContext
-} from "./chunk-DPONPYJD.js";
-import {
-  sandboxRetainedProcesses,
-  sessionBackgroundCommands,
-  sessionEvents,
-  sessions
-} from "./chunk-F73UKJY6.js";
-import {
-  fromPostgresLosslessJson,
-  withLosslessContentWriteVersion
-} from "./chunk-S2TZ3F4L.js";
+  appendSessionCommandOutput
+} from "./chunk-PJI4MUZ7.js";
+import "./chunk-GABXCG3N.js";
+import "./chunk-LVY33EWL.js";
+import "./chunk-4UJCXBR2.js";
+import "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
+import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
-
-// src/session-command-output.ts
-import { and, eq } from "drizzle-orm";
-async function appendSessionCommandOutput(db, input) {
-  if (!input.chunkId || input.chunkId.length > 200)
-    throw new Error("Invalid command output chunk ID");
-  if (!input.chunk) return [];
-  return await withSessionActivityRlsContext(db, input, async (tx) => {
-    const events = [];
-    const locks = await lockSessionEventWriteRows(tx, {
-      workspaceId: input.workspaceId,
-      controlLock: "share",
-      sessionIds: [input.sessionId]
-    });
-    const session = locks.sessions[0];
-    if (!session || session.accountId !== input.accountId)
-      throw new Error("Command output session not found");
-    const [command] = await tx.select({ id: sessionBackgroundCommands.id }).from(sessionBackgroundCommands).where(
-      and(
-        eq(sessionBackgroundCommands.accountId, input.accountId),
-        eq(sessionBackgroundCommands.workspaceId, input.workspaceId),
-        eq(sessionBackgroundCommands.sessionId, input.sessionId),
-        eq(sessionBackgroundCommands.id, input.commandId)
-      )
-    ).limit(1);
-    if (!command) {
-      const [process] = await tx.select({ id: sandboxRetainedProcesses.id }).from(sandboxRetainedProcesses).where(
-        and(
-          eq(sandboxRetainedProcesses.accountId, input.accountId),
-          eq(sandboxRetainedProcesses.workspaceId, input.workspaceId),
-          eq(sandboxRetainedProcesses.sessionId, input.sessionId),
-          eq(sandboxRetainedProcesses.id, input.commandId)
-        )
-      ).limit(1);
-      if (!process) throw new Error("Command output has no retained command identity");
-    }
-    let sequence = session.lastSequence;
-    let part = 0;
-    for (let offset = 0; offset < input.chunk.length; ) {
-      let end = Math.min(offset + 16384, input.chunk.length);
-      if (end < input.chunk.length && /[\uD800-\uDBFF]/u.test(input.chunk[end - 1])) end -= 1;
-      const clientEventId = `command-output:${input.commandId}:${input.chunkId}:${input.stream}:${part++}`;
-      const chunk = input.chunk.slice(offset, end);
-      offset = end;
-      const [existing] = await tx.select({
-        payload: sessionEvents.payload,
-        version: sessionEvents.payloadCodecVersion
-      }).from(sessionEvents).where(
-        and(
-          eq(sessionEvents.workspaceId, input.workspaceId),
-          eq(sessionEvents.sessionId, input.sessionId),
-          eq(sessionEvents.clientEventId, clientEventId)
-        )
-      ).limit(1);
-      if (existing) {
-        const payload = fromPostgresLosslessJson(existing.payload, existing.version);
-        if (payload.chunk !== chunk || payload.commandId !== input.commandId || payload.stream !== input.stream) {
-          throw new Error("Command output retry changed the captured chunk");
-        }
-        continue;
-      }
-      const [inserted] = await tx.insert(sessionEvents).values(
-        withLosslessContentWriteVersion(
-          {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            sessionId: input.sessionId,
-            sequence: ++sequence,
-            type: "sandbox.command.output.delta",
-            clientEventId,
-            payload: {
-              commandId: input.commandId,
-              stream: input.stream,
-              streamFidelity: input.streamFidelity ?? "separate",
-              chunk
-            }
-          },
-          "payload",
-          "payloadCodecVersion"
-        )
-      ).returning();
-      if (inserted)
-        events.push({
-          id: inserted.id,
-          workspaceId: input.workspaceId,
-          sessionId: input.sessionId,
-          sequence: inserted.sequence,
-          type: "sandbox.command.output.delta",
-          payload: fromPostgresLosslessJson(inserted.payload, inserted.payloadCodecVersion),
-          occurredAt: inserted.occurredAt.toISOString(),
-          clientEventId,
-          turnId: null,
-          turnGeneration: null,
-          turnAttemptId: null,
-          turnAssociation: null,
-          duplicateOfEventId: null,
-          duplicateReason: null
-        });
-    }
-    if (sequence !== session.lastSequence) {
-      await tx.update(sessions).set({ lastSequence: sequence }).where(
-        and(
-          eq(sessions.workspaceId, input.workspaceId),
-          eq(sessions.id, input.sessionId)
-        )
-      );
-    }
-    return events;
-  });
-}
 export {
   appendSessionCommandOutput
 };

package/dist/session-command-output.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/session-command-output.ts"],"sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport type { SessionEvent } from \"@opengeni/contracts\";\nimport type { Database } from \"./database\";\nimport { withSessionActivityRlsContext } from \"./database\";\nimport { lockSessionEventWriteRows } from \"./session-control\";\nimport { fromPostgresLosslessJson, withLosslessContentWriteVersion } from \"./lossless-json\";\nimport * as schema from \"./schema\";\n\nexport type SessionCommandOutputInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  commandId: string;\n  /** Stable identity of this consumed provider chunk, reused on persistence retry. */\n  chunkId: string;\n  stream: \"stdout\" | \"stderr\";\n  streamFidelity?: \"separate\" | \"merged\";\n  chunk: string;\n};\n\n/** Capture is independent of terminal observation and remains valid after the\n * launching attempt ends. Only an exact retained process/background command in\n * this session is eligible; this helper never creates command authority. */\nexport async function appendSessionCommandOutput(\n  db: Database,\n  input: SessionCommandOutputInput,\n): Promise<SessionEvent[]> {\n  if (!input.chunkId || input.chunkId.length > 200)\n    throw new Error(\"Invalid command output chunk ID\");\n  if (!input.chunk) return [];\n  return await withSessionActivityRlsContext(db, input, async (tx) => {\n    const events: SessionEvent[] = [];\n    const locks = await lockSessionEventWriteRows(tx, {\n      workspaceId: input.workspaceId,\n      controlLock: \"share\",\n      sessionIds: [input.sessionId],\n    });\n    const session = locks.sessions[0];\n    if (!session || session.accountId !== input.accountId)\n      throw new Error(\"Command output session not found\");\n    const [command] = await tx\n      .select({ id: schema.sessionBackgroundCommands.id })\n      .from(schema.sessionBackgroundCommands)\n      .where(\n        and(\n          eq(schema.sessionBackgroundCommands.accountId, input.accountId),\n          eq(schema.sessionBackgroundCommands.workspaceId, input.workspaceId),\n          eq(schema.sessionBackgroundCommands.sessionId, input.sessionId),\n          eq(schema.sessionBackgroundCommands.id, input.commandId),\n        ),\n      )\n      .limit(1);\n    if (!command) {\n      const [process] = await tx\n        .select({ id: schema.sandboxRetainedProcesses.id })\n        .from(schema.sandboxRetainedProcesses)\n        .where(\n          and(\n            eq(schema.sandboxRetainedProcesses.accountId, input.accountId),\n            eq(schema.sandboxRetainedProcesses.workspaceId, input.workspaceId),\n            eq(schema.sandboxRetainedProcesses.sessionId, input.sessionId),\n            eq(schema.sandboxRetainedProcesses.id, input.commandId),\n          ),\n        )\n        .limit(1);\n      if (!process) throw new Error(\"Command output has no retained command identity\");\n    }\n    let sequence = session.lastSequence;\n    let part = 0;\n    for (let offset = 0; offset < input.chunk.length;) {\n      let end = Math.min(offset + 16_384, input.chunk.length);\n      if (end < input.chunk.length && /[\\uD800-\\uDBFF]/u.test(input.chunk[end - 1]!)) end -= 1;\n      const clientEventId = `command-output:${input.commandId}:${input.chunkId}:${input.stream}:${part++}`;\n      const chunk = input.chunk.slice(offset, end);\n      offset = end;\n      const [existing] = await tx\n        .select({\n          payload: schema.sessionEvents.payload,\n          version: schema.sessionEvents.payloadCodecVersion,\n        })\n        .from(schema.sessionEvents)\n        .where(\n          and(\n            eq(schema.sessionEvents.workspaceId, input.workspaceId),\n            eq(schema.sessionEvents.sessionId, input.sessionId),\n            eq(schema.sessionEvents.clientEventId, clientEventId),\n          ),\n        )\n        .limit(1);\n      if (existing) {\n        const payload = fromPostgresLosslessJson(existing.payload, existing.version) as Record<\n          string,\n          unknown\n        >;\n        if (\n          payload.chunk !== chunk ||\n          payload.commandId !== input.commandId ||\n          payload.stream !== input.stream\n        ) {\n          throw new Error(\"Command output retry changed the captured chunk\");\n        }\n        continue;\n      }\n      const [inserted] = await tx\n        .insert(schema.sessionEvents)\n        .values(\n          withLosslessContentWriteVersion(\n            {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              sessionId: input.sessionId,\n              sequence: ++sequence,\n              type: \"sandbox.command.output.delta\",\n              clientEventId,\n              payload: {\n                commandId: input.commandId,\n                stream: input.stream,\n                streamFidelity: input.streamFidelity ?? \"separate\",\n                chunk,\n              },\n            },\n            \"payload\",\n            \"payloadCodecVersion\",\n          ),\n        )\n        .returning();\n      if (inserted)\n        events.push({\n          id: inserted.id,\n          workspaceId: input.workspaceId,\n          sessionId: input.sessionId,\n          sequence: inserted.sequence,\n          type: \"sandbox.command.output.delta\",\n          payload: fromPostgresLosslessJson(inserted.payload, inserted.payloadCodecVersion),\n          occurredAt: inserted.occurredAt.toISOString(),\n          clientEventId,\n          turnId: null,\n          turnGeneration: null,\n          turnAttemptId: null,\n          turnAssociation: null,\n          duplicateOfEventId: null,\n          duplicateReason: null,\n        });\n    }\n    if (sequence !== session.lastSequence) {\n      await tx\n        .update(schema.sessions)\n        .set({ lastSequence: sequence })\n        .where(\n          and(\n            eq(schema.sessions.workspaceId, input.workspaceId),\n            eq(schema.sessions.id, input.sessionId),\n          ),\n        );\n    }\n    return events;\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,KAAK,UAAU;AAuBxB,eAAsB,2BACpB,IACA,OACyB;AACzB,MAAI,CAAC,MAAM,WAAW,MAAM,QAAQ,SAAS;AAC3C,UAAM,IAAI,MAAM,iCAAiC;AACnD,MAAI,CAAC,MAAM,MAAO,QAAO,CAAC;AAC1B,SAAO,MAAM,8BAA8B,IAAI,OAAO,OAAO,OAAO;AAClE,UAAM,SAAyB,CAAC;AAChC,UAAM,QAAQ,MAAM,0BAA0B,IAAI;AAAA,MAChD,aAAa,MAAM;AAAA,MACnB,aAAa;AAAA,MACb,YAAY,CAAC,MAAM,SAAS;AAAA,IAC9B,CAAC;AACD,UAAM,UAAU,MAAM,SAAS,CAAC;AAChC,QAAI,CAAC,WAAW,QAAQ,cAAc,MAAM;AAC1C,YAAM,IAAI,MAAM,kCAAkC;AACpD,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAO,EAAE,IAAW,0BAA0B,GAAG,CAAC,EAClD,KAAY,yBAAyB,EACrC;AAAA,MACC;AAAA,QACE,GAAU,0BAA0B,WAAW,MAAM,SAAS;AAAA,QAC9D,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,QAClE,GAAU,0BAA0B,WAAW,MAAM,SAAS;AAAA,QAC9D,GAAU,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACzD;AAAA,IACF,EACC,MAAM,CAAC;AACV,QAAI,CAAC,SAAS;AACZ,YAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAO,EAAE,IAAW,yBAAyB,GAAG,CAAC,EACjD,KAAY,wBAAwB,EACpC;AAAA,QACC;AAAA,UACE,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,UAC7D,GAAU,yBAAyB,aAAa,MAAM,WAAW;AAAA,UACjE,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,UAC7D,GAAU,yBAAyB,IAAI,MAAM,SAAS;AAAA,QACxD;AAAA,MACF,EACC,MAAM,CAAC;AACV,UAAI,CAAC,QAAS,OAAM,IAAI,MAAM,iDAAiD;AAAA,IACjF;AACA,QAAI,WAAW,QAAQ;AACvB,QAAI,OAAO;AACX,aAAS,SAAS,GAAG,SAAS,MAAM,MAAM,UAAS;AACjD,UAAI,MAAM,KAAK,IAAI,SAAS,OAAQ,MAAM,MAAM,MAAM;AACtD,UAAI,MAAM,MAAM,MAAM,UAAU,mBAAmB,KAAK,MAAM,MAAM,MAAM,CAAC,CAAE,EAAG,QAAO;AACvF,YAAM,gBAAgB,kBAAkB,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM;AAClG,YAAM,QAAQ,MAAM,MAAM,MAAM,QAAQ,GAAG;AAC3C,eAAS;AACT,YAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAO;AAAA,QACN,SAAgB,cAAc;AAAA,QAC9B,SAAgB,cAAc;AAAA,MAChC,CAAC,EACA,KAAY,aAAa,EACzB;AAAA,QACC;AAAA,UACE,GAAU,cAAc,aAAa,MAAM,WAAW;AAAA,UACtD,GAAU,cAAc,WAAW,MAAM,SAAS;AAAA,UAClD,GAAU,cAAc,eAAe,aAAa;AAAA,QACtD;AAAA,MACF,EACC,MAAM,CAAC;AACV,UAAI,UAAU;AACZ,cAAM,UAAU,yBAAyB,SAAS,SAAS,SAAS,OAAO;AAI3E,YACE,QAAQ,UAAU,SAClB,QAAQ,cAAc,MAAM,aAC5B,QAAQ,WAAW,MAAM,QACzB;AACA,gBAAM,IAAI,MAAM,iDAAiD;AAAA,QACnE;AACA;AAAA,MACF;AACA,YAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAc,aAAa,EAC3B;AAAA,QACC;AAAA,UACE;AAAA,YACE,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,WAAW,MAAM;AAAA,YACjB,UAAU,EAAE;AAAA,YACZ,MAAM;AAAA,YACN;AAAA,YACA,SAAS;AAAA,cACP,WAAW,MAAM;AAAA,cACjB,QAAQ,MAAM;AAAA,cACd,gBAAgB,MAAM,kBAAkB;AAAA,cACxC;AAAA,YACF;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF,EACC,UAAU;AACb,UAAI;AACF,eAAO,KAAK;AAAA,UACV,IAAI,SAAS;AAAA,UACb,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,UAAU,SAAS;AAAA,UACnB,MAAM;AAAA,UACN,SAAS,yBAAyB,SAAS,SAAS,SAAS,mBAAmB;AAAA,UAChF,YAAY,SAAS,WAAW,YAAY;AAAA,UAC5C;AAAA,UACA,QAAQ;AAAA,UACR,gBAAgB;AAAA,UAChB,eAAe;AAAA,UACf,iBAAiB;AAAA,UACjB,oBAAoB;AAAA,UACpB,iBAAiB;AAAA,QACnB,CAAC;AAAA,IACL;AACA,QAAI,aAAa,QAAQ,cAAc;AACrC,YAAM,GACH,OAAc,QAAQ,EACtB,IAAI,EAAE,cAAc,SAAS,CAAC,EAC9B;AAAA,QACC;AAAA,UACE,GAAU,SAAS,aAAa,MAAM,WAAW;AAAA,UACjD,GAAU,SAAS,IAAI,MAAM,SAAS;AAAA,QACxC;AAAA,MACF;AAAA,IACJ;AACA,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/session-control.d.ts

@@ -223,6 +223,8 @@ export type WorkspaceControlLockOptions = {
     /** Share an already running budget (used by the admission helper). */
     budget?: WorkspaceControlLockBudget;
 };
+/** Run one lock-acquiring statement under the remaining budget. */
+export declare function boundedLockStep<T>(db: Database, workspaceId: string, budget: WorkspaceControlLockBudget | null, step: () => Promise<T>): Promise<T>;
 /**
  * Lock the mandatory workspace inference-control row.
  *
@@ -381,7 +383,9 @@ export declare function assertSessionAuthoritySnapshot(input: {
     authorityVisibility: unknown;
     authorityOwnerOrganizationMembershipId: unknown;
 }): SessionAuthoritySnapshot;
-export declare function sessionAuthoritySnapshotMatchesSession(snapshot: SessionAuthoritySnapshot, session: Pick<typeof schema.sessions.$inferSelect, "authorityEpoch" | "visibility" | "ownerOrganizationMembershipId">): boolean;
+export declare function sessionAuthoritySnapshotMatchesSession(snapshot: SessionAuthoritySnapshot, session: Pick<typeof schema.sessions.$inferSelect, "authorityEpoch" | "visibility" | "ownerOrganizationMembershipId"> & {
+    executionAuthorityEpoch?: number;
+}): boolean;
 export declare function sessionAuthoritySnapshotsEqual(left: Pick<SessionAuthoritySnapshot, "authorityEpoch" | "authorityVisibility" | "authorityOwnerOrganizationMembershipId">, right: Pick<SessionAuthoritySnapshot, "authorityEpoch" | "authorityVisibility" | "authorityOwnerOrganizationMembershipId">): boolean;
 /**
  * Close the exact first-class owner while the caller still holds the owning

package/dist/session-event-slices.d.ts

@@ -1,3 +1,4 @@
+import { type SessionEvent } from "@opengeni/contracts";
 import { type Database } from "./database.js";
 type ListSessionEventPageOptions = import("./index.js").ListSessionEventPageOptions;
 type SessionEventPage = import("./index.js").SessionEventPage;
@@ -19,6 +20,15 @@ export type SessionEventSlice = {
 export type SessionEventSlicePage = SessionEventPage & {
     slices?: Record<number, SessionEventSlice>;
 };
+type SliceIdentity = Pick<SessionEvent, "id" | "sequence" | "type" | "turnId" | "turnAssociation" | "duplicateOfEventId">;
+/** Internal search projection, NOT authorization. The scanner has selected this
+ * exact identity under its subject RLS/list filters and still holds that same
+ * transaction and tenancy/membership fences. Reuse them rather than creating
+ * two nested scopes and rediscovering the identity for every scalar window.
+ * The scalar query still checks the exact workspace/session/event and RLS.
+ * Keep the codec/window implementation shared with the conversation reader.
+ */
+export declare function readSessionMessageSliceInScope(db: Database, workspaceId: string, sessionId: string, identity: SliceIdentity, offset: number, windows?: number): Promise<SessionEventSlice | undefined>;
 /** Bounded transfer over retained scalar truth. JSONB extraction/detoasting still
  * costs PostgreSQL work proportional to the individual source value, not history.
  * This is a read projection, not authorization: the MCP caller must authorize the

package/dist/session-event-slices.js

@@ -1,227 +1,13 @@
 import {
-  rawRows,
-  withWorkspaceRls
-} from "./chunk-DPONPYJD.js";
-import {
-  sessionEvents,
-  sessionTurns
-} from "./chunk-F73UKJY6.js";
-import {
-  LOSSLESS_JSON_STRING_PREFIX,
-  fromPostgresLosslessJson
-} from "./chunk-S2TZ3F4L.js";
+  listSessionEventSlices,
+  readSessionMessageSliceInScope
+} from "./chunk-CDAT6EKW.js";
+import "./chunk-CJI6G254.js";
+import "./chunk-MN5PZMEK.js";
+import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
-
-// src/session-event-slices.ts
-import { and, asc, desc, eq, gt, inArray, lt, notInArray, sql } from "drizzle-orm";
-import { resolveSessionEventTypeFilters } from "@opengeni/contracts";
-var WINDOW = 8192;
-var STRUCTURED_BYTES = 1024 * 1024;
-async function listSessionEventSlices(db, workspaceId, sessionId, options, legacyRead) {
-  if (options.legacyUtf16) {
-    if (!legacyRead) throw new Error("Legacy continuation requires its original bounded reader");
-    return legacyRead({
-      ...options,
-      limit: 1,
-      maxBytes: 1024 * 1024
-    });
-  }
-  const offset = options.sourceOffset ?? 0;
-  if (!Number.isSafeInteger(offset) || offset < 0 || offset > 2147483647)
-    throw new Error("Invalid message continuation offset");
-  const direction = options.direction ?? (options.before === void 0 ? "after" : "before");
-  const limit = options.sourceSequence ? 1 : Math.max(1, Math.min(options.limit ?? 8, 8));
-  const filters = resolveSessionEventTypeFilters(options);
-  const predicates = [
-    eq(sessionEvents.workspaceId, workspaceId),
-    eq(sessionEvents.sessionId, sessionId),
-    gt(sessionEvents.sequence, Math.min(options.after ?? 0, 2147483647)),
-    // Same indexed exclusion as the audit/discovery reader. Do not substitute
-    // turn status: terminal-before-claim prompts must remain excluded too.
-    sql`(${sessionEvents.type} <> 'user.message' or not exists (
-      select 1 from ${sessionTurns} unclaimed_prompt_turn
-      where unclaimed_prompt_turn.workspace_id = ${workspaceId}
-        and unclaimed_prompt_turn.workspace_id = ${sessionEvents.workspaceId}
-        and unclaimed_prompt_turn.session_id = ${sessionEvents.sessionId}
-        and unclaimed_prompt_turn.trigger_event_id = ${sessionEvents.id}
-        and unclaimed_prompt_turn.source in ('user', 'api')
-        and unclaimed_prompt_turn.started_at is null
-    ))`
-  ];
-  if (options.before !== void 0 && options.before <= 2147483647)
-    predicates.push(lt(sessionEvents.sequence, options.before));
-  if (filters.includeTypes.length)
-    predicates.push(inArray(sessionEvents.type, filters.includeTypes));
-  if (filters.excludeTypes.length)
-    predicates.push(notInArray(sessionEvents.type, filters.excludeTypes));
-  const identities = await withWorkspaceRls(
-    db,
-    workspaceId,
-    (tx) => tx.select({
-      id: sessionEvents.id,
-      sequence: sessionEvents.sequence,
-      type: sql`case when octet_length(${sessionEvents.type}) <= 256 then ${sessionEvents.type} else 'session.event.envelope_omitted' end`,
-      turnId: sessionEvents.turnId,
-      turnAssociation: sql`case when ${sessionEvents.turnAssociation} is null then null when ${sessionEvents.turnAssociation} = 'current' then 'current' else 'late_rejected' end`,
-      duplicateOfEventId: sessionEvents.duplicateOfEventId
-    }).from(sessionEvents).where(and(...predicates)).orderBy(
-      direction === "before" ? desc(sessionEvents.sequence) : asc(sessionEvents.sequence)
-    ).limit(limit + 1)
-  );
-  const ordered = identities.slice(0, limit).map(
-    (identity) => ({
-      ...identity,
-      workspaceId,
-      sessionId,
-      payload: {},
-      occurredAt: ""
-    })
-  );
-  const page = {
-    events: [],
-    hasMore: identities.length > limit,
-    bytes: 2,
-    fullPayloadsExact: true,
-    direction,
-    coveredSequence: null,
-    nextAfter: null,
-    nextBefore: null,
-    truncatedBy: identities.length > limit ? "count" : null
-  };
-  const slices = {};
-  const events = [];
-  let consumed = 0;
-  await withWorkspaceRls(db, workspaceId, async (tx) => {
-    for (const event of ordered) {
-      consumed++;
-      if (event.duplicateOfEventId || event.turnAssociation && event.turnAssociation !== "current")
-        continue;
-      const p = sessionEvents.payload;
-      const output = event.type === "agent.toolCall.output";
-      let value = sql`${p}->'text'`;
-      if (options.view === "tools")
-        value = output ? sql`${p}->'output'` : sql`coalesce(nullif(${p}->'arguments', 'null'::jsonb), ${p}->'args')`;
-      else if (options.view === "results")
-        value = event.type === "turn.completed" ? sql`coalesce(nullif(${p}->'output', 'null'::jsonb), ${p}->'result')` : sql`${p}`;
-      const include = options.view !== "tools" || (output ? options.includeOutput : options.includeArguments);
-      if (!include) value = sql`null::jsonb`;
-      const start = options.sourceSequence === event.sequence ? offset : 0;
-      const prefix = LOSSLESS_JSON_STRING_PREFIX;
-      const raw = sql`raw`;
-      const encoded = sql`encoded`;
-      const tagged = sql`case when version = 1
-        and left(${raw}, ${prefix.length}) = ${prefix}
-        and length(${encoded}) > 0
-        and ${encoded} ~ '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
-        then (length(${encoded}) / 4 * 3 - case when right(${encoded}, 2) = '==' then 2 when right(${encoded}, 1) = '=' then 1 else 0 end) % 2 = 0
-          and encode(decode(right(${encoded}, 4), 'base64'), 'base64') = right(${encoded}, 4)
-        else false end`;
-      const group = Math.floor(Math.max(0, start - 1) / 3);
-      const safeMetadata = (key) => sql`case when octet_length((${p}->${key})::text) <= 4096 then ${p}->${key} else null end`;
-      const callId = sql`coalesce(nullif(${p}->'callId', 'null'::jsonb), nullif(${p}->'call_id', 'null'::jsonb), ${p}->'id')`;
-      const metadataSql = options.view === "tools" ? sql`jsonb_strip_nulls(jsonb_build_object(
-          'callId', case when octet_length((${callId})::text) <= 4096 then ${callId} else null end,
-          'identityOmitted', case when octet_length((${callId})::text) > 4096 or octet_length((${p}->'name')::text) > 4096 then true else null end,
-          'name', ${safeMetadata("name")}, 'isError', case when ${p}->'isError' = 'true'::jsonb or (${output} and ${p}->'output'->'isError' = 'true'::jsonb) then true else null end,
-          'maintenance', case when ${p} ? 'maintenance' then true else null end,
-          'segmentLimit', case when ${p} ? 'segmentLimit' then true else null end))` : options.view === "results" && event.type === "turn.completed" ? sql`jsonb_strip_nulls(jsonb_build_object(
-            'maintenance', case when ${p} ? 'maintenance' then true else null end,
-            'segmentLimit', case when ${p} ? 'segmentLimit' then true else null end))` : sql`'{}'::jsonb`;
-      const [row] = await rawRows(
-        tx,
-        sql`with source as (
-        select ${value} as value, ${metadataSql} as metadata,
-          ${sessionEvents.payloadCodecVersion} as version
-        from ${sessionEvents}
-        where ${sessionEvents.workspaceId} = ${workspaceId}
-          and ${sessionEvents.sessionId} = ${sessionId}
-          and ${sessionEvents.id} = ${event.id}
-          and (${sessionEvents.turnAssociation} is null or ${sessionEvents.turnAssociation} = 'current')
-          and ${sessionEvents.duplicateOfEventId} is null
-        limit 1
-      ), scalar as (
-        select *, jsonb_typeof(value) as kind,
-          case when jsonb_typeof(value) = 'string' then value #>> '{}' else null end as raw,
-          case when jsonb_typeof(value) <> 'string' then octet_length(value::text) else 0 end as structured_bytes
-        from source offset 0
-      ), encoding as (
-        select *, case when version = 1 and left(raw, ${prefix.length}) = ${prefix}
-          then substring(raw from ${prefix.length + 1}::integer) else null end as encoded
-        from scalar offset 0
-      ), validated as (
-        select *, ${tagged} as tagged from encoding offset 0
-      )
-      select metadata, version, kind, tagged,
-        case when kind = 'string' then
-          case when tagged then (length(encoded) / 4 * 3 - case when right(encoded, 2) = '==' then 2 when right(encoded, 1) = '=' then 1 else 0 end) / 2
-          else length(raw) end else 0 end as total,
-        case when kind = 'string' then
-          case when tagged then substring(encoded from ${Math.min(group * 8 + 1, 2147483647)}::integer for ${Math.ceil((WINDOW + 6) / 3) * 8}::integer)
-          else substring(raw from ${Math.min(start + 1, 2147483647)}::integer for ${WINDOW}::integer) end else null end as window,
-        case when kind <> 'string' and structured_bytes <= ${STRUCTURED_BYTES} then value else null end as structured,
-        coalesce(kind <> 'string' and structured_bytes > ${STRUCTURED_BYTES}, false) as omitted
-      from validated`
-      );
-      if (!row) continue;
-      const metadata = fromPostgresLosslessJson(row.metadata, row.version);
-      for (const [key, budget] of [
-        ["callId", 4096],
-        ["name", 1024]
-      ]) {
-        if (metadata[key] !== void 0 && Buffer.byteLength(JSON.stringify(metadata[key]), "utf8") > budget) {
-          delete metadata[key];
-          metadata.identityOmitted = true;
-        }
-      }
-      let text = row.window ?? "";
-      if (row.tagged) {
-        text = fromPostgresLosslessJson(prefix + text, 1);
-        const local = start - group * 3;
-        if (local > 0 && /[\uD800-\uDBFF]/.test(text[local - 1]) && /[\uDC00-\uDFFF]/.test(text[local] ?? ""))
-          throw new Error("Invalid message continuation offset: splits a surrogate pair");
-        text = text.slice(local, local + WINDOW);
-        if (start + text.length < row.total && /[\uD800-\uDBFF]/.test(text.at(-1)))
-          text = text.slice(0, -1);
-      }
-      if (start > row.total && row.kind === "string")
-        throw new Error("Invalid message continuation offset");
-      const logical = row.omitted ? {} : row.kind === "string" ? text : fromPostgresLosslessJson(row.structured, row.version);
-      let payload = { ...metadata };
-      if (options.view === "tools") {
-        if (row.kind !== null) payload[output ? "output" : "arguments"] = logical;
-      } else if (options.view === "results") {
-        if (event.type === "turn.completed") payload.output = logical;
-        else payload = logical ?? {};
-      } else payload.text = logical;
-      if (row.omitted) payload = { ...payload, sourceOmitted: true };
-      if (row.kind === "string" || row.omitted)
-        slices[event.sequence] = {
-          offset: start,
-          total: row.total,
-          unit: row.tagged ? "utf16" : "codepoint",
-          text,
-          omitted: row.omitted
-        };
-      events.push({ ...event, payload });
-      if (row.kind !== "string" && Buffer.byteLength(JSON.stringify(payload)) > WINDOW) break;
-      if (row.kind === "string" && start + (row.tagged ? text.length : Array.from(text).length) < row.total)
-        break;
-    }
-  });
-  return {
-    ...page,
-    events: events.sort((a, b) => a.sequence - b.sequence),
-    hasMore: page.hasMore || consumed < ordered.length,
-    coveredSequence: consumed ? {
-      first: Math.min(ordered[0].sequence, ordered[consumed - 1].sequence),
-      last: Math.max(ordered[0].sequence, ordered[consumed - 1].sequence)
-    } : null,
-    bytes: Buffer.byteLength(JSON.stringify(events), "utf8"),
-    fullPayloadsExact: !Object.values(slices).some((slice) => slice.omitted),
-    slices
-  };
-}
 export {
-  listSessionEventSlices
+  listSessionEventSlices,
+  readSessionMessageSliceInScope
 };
 //# sourceMappingURL=session-event-slices.js.map

package/dist/session-event-slices.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/session-event-slices.ts"],"sourcesContent":["import { and, asc, desc, eq, gt, inArray, lt, notInArray, sql, type SQL } from \"drizzle-orm\";\nimport { resolveSessionEventTypeFilters, type SessionEvent } from \"@opengeni/contracts\";\nimport { rawRows, withWorkspaceRls, type Database } from \"./database\";\ntype ListSessionEventPageOptions = import(\"./index\").ListSessionEventPageOptions;\ntype SessionEventPage = import(\"./index\").SessionEventPage;\nimport { fromPostgresLosslessJson, LOSSLESS_JSON_STRING_PREFIX } from \"./lossless-json\";\nimport * as schema from \"./schema\";\n\nexport type SessionEventSliceOptions = ListSessionEventPageOptions & {\n  sourceSequence?: number;\n  sourceOffset?: number;\n  view?: \"conversation\" | \"results\" | \"tools\";\n  includeArguments?: boolean;\n  includeOutput?: boolean;\n  legacyUtf16?: boolean;\n};\nexport type SessionEventSlice = {\n  offset: number;\n  total: number;\n  unit: \"codepoint\" | \"utf16\";\n  text: string;\n  omitted: boolean;\n};\nexport type SessionEventSlicePage = SessionEventPage & {\n  slices?: Record<number, SessionEventSlice>;\n};\nconst WINDOW = 8192;\nconst STRUCTURED_BYTES = 1024 * 1024;\n\n/** Bounded transfer over retained scalar truth. JSONB extraction/detoasting still\n * costs PostgreSQL work proportional to the individual source value, not history.\n * This is a read projection, not authorization: the MCP caller must authorize the\n * target on every request. Both metadata and scalar reads retain workspace RLS.\n */\nexport async function listSessionEventSlices(\n  db: Database,\n  workspaceId: string,\n  sessionId: string,\n  options: SessionEventSliceOptions,\n  legacyRead?: (options: ListSessionEventPageOptions) => Promise<SessionEventPage>,\n): Promise<SessionEventSlicePage> {\n  // Finish an already-issued UTF-16 cursor using its original bounded reader.\n  // New messages use source slices; no cursor offset is silently reinterpreted.\n  if (options.legacyUtf16) {\n    if (!legacyRead) throw new Error(\"Legacy continuation requires its original bounded reader\");\n    return legacyRead({\n      ...options,\n      limit: 1,\n      maxBytes: 1024 * 1024,\n    });\n  }\n  const offset = options.sourceOffset ?? 0;\n  if (!Number.isSafeInteger(offset) || offset < 0 || offset > 2_147_483_647)\n    throw new Error(\"Invalid message continuation offset\");\n  const direction = options.direction ?? (options.before === undefined ? \"after\" : \"before\");\n  const limit = options.sourceSequence ? 1 : Math.max(1, Math.min(options.limit ?? 8, 8));\n  const filters = resolveSessionEventTypeFilters(options);\n  const predicates: SQL[] = [\n    eq(schema.sessionEvents.workspaceId, workspaceId),\n    eq(schema.sessionEvents.sessionId, sessionId),\n    gt(schema.sessionEvents.sequence, Math.min(options.after ?? 0, 2_147_483_647)),\n    // Same indexed exclusion as the audit/discovery reader. Do not substitute\n    // turn status: terminal-before-claim prompts must remain excluded too.\n    sql`(${schema.sessionEvents.type} <> 'user.message' or not exists (\n      select 1 from ${schema.sessionTurns} unclaimed_prompt_turn\n      where unclaimed_prompt_turn.workspace_id = ${workspaceId}\n        and unclaimed_prompt_turn.workspace_id = ${schema.sessionEvents.workspaceId}\n        and unclaimed_prompt_turn.session_id = ${schema.sessionEvents.sessionId}\n        and unclaimed_prompt_turn.trigger_event_id = ${schema.sessionEvents.id}\n        and unclaimed_prompt_turn.source in ('user', 'api')\n        and unclaimed_prompt_turn.started_at is null\n    ))`,\n  ];\n  if (options.before !== undefined && options.before <= 2_147_483_647)\n    predicates.push(lt(schema.sessionEvents.sequence, options.before));\n  if (filters.includeTypes.length)\n    predicates.push(inArray(schema.sessionEvents.type, filters.includeTypes));\n  if (filters.excludeTypes.length)\n    predicates.push(notInArray(schema.sessionEvents.type, filters.excludeTypes));\n  // Unlike audit `none` mode, this identity query does not compute a payload\n  // projection merely to report its size. Only the selected scalar is extracted.\n  const identities = await withWorkspaceRls(db, workspaceId, (tx) =>\n    tx\n      .select({\n        id: schema.sessionEvents.id,\n        sequence: schema.sessionEvents.sequence,\n        type: sql<string>`case when octet_length(${schema.sessionEvents.type}) <= 256 then ${schema.sessionEvents.type} else 'session.event.envelope_omitted' end`,\n        turnId: schema.sessionEvents.turnId,\n        turnAssociation: sql<\n          string | null\n        >`case when ${schema.sessionEvents.turnAssociation} is null then null when ${schema.sessionEvents.turnAssociation} = 'current' then 'current' else 'late_rejected' end`,\n        duplicateOfEventId: schema.sessionEvents.duplicateOfEventId,\n      })\n      .from(schema.sessionEvents)\n      .where(and(...predicates))\n      .orderBy(\n        direction === \"before\"\n          ? desc(schema.sessionEvents.sequence)\n          : asc(schema.sessionEvents.sequence),\n      )\n      .limit(limit + 1),\n  );\n  const ordered = identities.slice(0, limit).map(\n    (identity) =>\n      ({\n        ...identity,\n        workspaceId,\n        sessionId,\n        payload: {},\n        occurredAt: \"\",\n      }) as SessionEvent,\n  );\n  const page: SessionEventPage = {\n    events: [],\n    hasMore: identities.length > limit,\n    bytes: 2,\n    fullPayloadsExact: true,\n    direction,\n    coveredSequence: null,\n    nextAfter: null,\n    nextBefore: null,\n    truncatedBy: identities.length > limit ? \"count\" : null,\n  };\n  const slices: Record<number, SessionEventSlice> = {};\n  const events: SessionEvent[] = [];\n  let consumed = 0;\n  await withWorkspaceRls(db, workspaceId, async (tx) => {\n    for (const event of ordered) {\n      consumed++;\n      if (\n        event.duplicateOfEventId ||\n        (event.turnAssociation && event.turnAssociation !== \"current\")\n      )\n        continue;\n      const p = schema.sessionEvents.payload;\n      const output = event.type === \"agent.toolCall.output\";\n      let value: SQL = sql`${p}->'text'`;\n      if (options.view === \"tools\")\n        value = output\n          ? sql`${p}->'output'`\n          : sql`coalesce(nullif(${p}->'arguments', 'null'::jsonb), ${p}->'args')`;\n      else if (options.view === \"results\")\n        value =\n          event.type === \"turn.completed\"\n            ? sql`coalesce(nullif(${p}->'output', 'null'::jsonb), ${p}->'result')`\n            : sql`${p}`;\n      const include =\n        options.view !== \"tools\" || (output ? options.includeOutput : options.includeArguments);\n      if (!include) value = sql`null::jsonb`;\n      const start = options.sourceSequence === event.sequence ? offset : 0;\n      const prefix = LOSSLESS_JSON_STRING_PREFIX;\n      const raw = sql`raw`;\n      const encoded = sql`encoded`;\n      // Match exactly the JS codec's canonical-base64/even-byte acceptance.\n      // A malformed active marker remains literal, just like the shared codec.\n      const tagged = sql`case when version = 1\n        and left(${raw}, ${prefix.length}) = ${prefix}\n        and length(${encoded}) > 0\n        and ${encoded} ~ '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'\n        then (length(${encoded}) / 4 * 3 - case when right(${encoded}, 2) = '==' then 2 when right(${encoded}, 1) = '=' then 1 else 0 end) % 2 = 0\n          and encode(decode(right(${encoded}, 4), 'base64'), 'base64') = right(${encoded}, 4)\n        else false end`;\n      // Aligned base64 windows represent groups of three UTF-16 units. Include\n      // one preceding and one following unit to validate/avoid pair splits.\n      const group = Math.floor(Math.max(0, start - 1) / 3);\n      const safeMetadata = (key: string) =>\n        sql`case when octet_length((${p}->${key})::text) <= 4096 then ${p}->${key} else null end`;\n      const callId = sql`coalesce(nullif(${p}->'callId', 'null'::jsonb), nullif(${p}->'call_id', 'null'::jsonb), ${p}->'id')`;\n      const metadataSql =\n        options.view === \"tools\"\n          ? sql`jsonb_strip_nulls(jsonb_build_object(\n          'callId', case when octet_length((${callId})::text) <= 4096 then ${callId} else null end,\n          'identityOmitted', case when octet_length((${callId})::text) > 4096 or octet_length((${p}->'name')::text) > 4096 then true else null end,\n          'name', ${safeMetadata(\"name\")}, 'isError', case when ${p}->'isError' = 'true'::jsonb or (${output} and ${p}->'output'->'isError' = 'true'::jsonb) then true else null end,\n          'maintenance', case when ${p} ? 'maintenance' then true else null end,\n          'segmentLimit', case when ${p} ? 'segmentLimit' then true else null end))`\n          : options.view === \"results\" && event.type === \"turn.completed\"\n            ? sql`jsonb_strip_nulls(jsonb_build_object(\n            'maintenance', case when ${p} ? 'maintenance' then true else null end,\n            'segmentLimit', case when ${p} ? 'segmentLimit' then true else null end))`\n            : sql`'{}'::jsonb`;\n      const [row] = await rawRows<{\n        metadata: unknown;\n        version: number | null;\n        kind: string | null;\n        tagged: boolean;\n        total: number;\n        window: string | null;\n        structured: unknown;\n        omitted: boolean;\n      }>(\n        tx,\n        sql`with source as (\n        select ${value} as value, ${metadataSql} as metadata,\n          ${schema.sessionEvents.payloadCodecVersion} as version\n        from ${schema.sessionEvents}\n        where ${schema.sessionEvents.workspaceId} = ${workspaceId}\n          and ${schema.sessionEvents.sessionId} = ${sessionId}\n          and ${schema.sessionEvents.id} = ${event.id}\n          and (${schema.sessionEvents.turnAssociation} is null or ${schema.sessionEvents.turnAssociation} = 'current')\n          and ${schema.sessionEvents.duplicateOfEventId} is null\n        limit 1\n      ), scalar as (\n        select *, jsonb_typeof(value) as kind,\n          case when jsonb_typeof(value) = 'string' then value #>> '{}' else null end as raw,\n          case when jsonb_typeof(value) <> 'string' then octet_length(value::text) else 0 end as structured_bytes\n        from source offset 0\n      ), encoding as (\n        select *, case when version = 1 and left(raw, ${prefix.length}) = ${prefix}\n          then substring(raw from ${prefix.length + 1}::integer) else null end as encoded\n        from scalar offset 0\n      ), validated as (\n        select *, ${tagged} as tagged from encoding offset 0\n      )\n      select metadata, version, kind, tagged,\n        case when kind = 'string' then\n          case when tagged then (length(encoded) / 4 * 3 - case when right(encoded, 2) = '==' then 2 when right(encoded, 1) = '=' then 1 else 0 end) / 2\n          else length(raw) end else 0 end as total,\n        case when kind = 'string' then\n          case when tagged then substring(encoded from ${Math.min(group * 8 + 1, 2_147_483_647)}::integer for ${Math.ceil((WINDOW + 6) / 3) * 8}::integer)\n          else substring(raw from ${Math.min(start + 1, 2_147_483_647)}::integer for ${WINDOW}::integer) end else null end as window,\n        case when kind <> 'string' and structured_bytes <= ${STRUCTURED_BYTES} then value else null end as structured,\n        coalesce(kind <> 'string' and structured_bytes > ${STRUCTURED_BYTES}, false) as omitted\n      from validated`,\n      );\n      if (!row) continue;\n      const metadata = fromPostgresLosslessJson(row.metadata, row.version) as Record<\n        string,\n        unknown\n      >;\n      // Codec decoding can expand JSON escaping (notably NUL/lone surrogates).\n      // Keep identities bounded too, without falling back to a different alias.\n      for (const [key, budget] of [\n        [\"callId\", 4096],\n        [\"name\", 1024],\n      ] as const) {\n        if (\n          metadata[key] !== undefined &&\n          Buffer.byteLength(JSON.stringify(metadata[key]), \"utf8\") > budget\n        ) {\n          delete metadata[key];\n          metadata.identityOmitted = true;\n        }\n      }\n      let text = row.window ?? \"\";\n      if (row.tagged) {\n        // Window lengths are multiples of eight, so each partial block is also\n        // a complete canonical encoding accepted by the existing lossless codec.\n        text = fromPostgresLosslessJson(prefix + text, 1);\n        const local = start - group * 3;\n        if (\n          local > 0 &&\n          /[\\uD800-\\uDBFF]/.test(text[local - 1]!) &&\n          /[\\uDC00-\\uDFFF]/.test(text[local] ?? \"\")\n        )\n          throw new Error(\"Invalid message continuation offset: splits a surrogate pair\");\n        text = text.slice(local, local + WINDOW);\n        if (start + text.length < row.total && /[\\uD800-\\uDBFF]/.test(text.at(-1)!))\n          text = text.slice(0, -1);\n      }\n      if (start > row.total && row.kind === \"string\")\n        throw new Error(\"Invalid message continuation offset\");\n      const logical = row.omitted\n        ? {}\n        : row.kind === \"string\"\n          ? text\n          : fromPostgresLosslessJson(row.structured, row.version);\n      let payload: Record<string, unknown> = { ...metadata };\n      if (options.view === \"tools\") {\n        if (row.kind !== null) payload[output ? \"output\" : \"arguments\"] = logical;\n      } else if (options.view === \"results\") {\n        if (event.type === \"turn.completed\") payload.output = logical;\n        else payload = (logical as Record<string, unknown>) ?? {};\n      } else payload.text = logical;\n      if (row.omitted) payload = { ...payload, sourceOmitted: true };\n      if (row.kind === \"string\" || row.omitted)\n        slices[event.sequence] = {\n          offset: start,\n          total: row.total,\n          unit: row.tagged ? \"utf16\" : \"codepoint\",\n          text,\n          omitted: row.omitted,\n        };\n      events.push({ ...event, payload });\n      // One large structured value preserves the previous bounded JSON path,\n      // without accumulating several megabyte-sized values in one source page.\n      if (row.kind !== \"string\" && Buffer.byteLength(JSON.stringify(payload)) > WINDOW) break;\n      if (\n        row.kind === \"string\" &&\n        start + (row.tagged ? text.length : Array.from(text).length) < row.total\n      )\n        break;\n    }\n  });\n  // Preserve scan advancement even when every identity was excluded above.\n  return {\n    ...page,\n    events: events.sort((a, b) => a.sequence - b.sequence),\n    hasMore: page.hasMore || consumed < ordered.length,\n    coveredSequence: consumed\n      ? {\n          first: Math.min(ordered[0]!.sequence, ordered[consumed - 1]!.sequence),\n          last: Math.max(ordered[0]!.sequence, ordered[consumed - 1]!.sequence),\n        }\n      : null,\n    bytes: Buffer.byteLength(JSON.stringify(events), \"utf8\"),\n    fullPayloadsExact: !Object.values(slices).some((slice) => slice.omitted),\n    slices,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,KAAK,KAAK,MAAM,IAAI,IAAI,SAAS,IAAI,YAAY,WAAqB;AAC/E,SAAS,sCAAyD;AAyBlE,IAAM,SAAS;AACf,IAAM,mBAAmB,OAAO;AAOhC,eAAsB,uBACpB,IACA,aACA,WACA,SACA,YACgC;AAGhC,MAAI,QAAQ,aAAa;AACvB,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,0DAA0D;AAC3F,WAAO,WAAW;AAAA,MAChB,GAAG;AAAA,MACH,OAAO;AAAA,MACP,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH;AACA,QAAM,SAAS,QAAQ,gBAAgB;AACvC,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,SAAS;AAC1D,UAAM,IAAI,MAAM,qCAAqC;AACvD,QAAM,YAAY,QAAQ,cAAc,QAAQ,WAAW,SAAY,UAAU;AACjF,QAAM,QAAQ,QAAQ,iBAAiB,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI,QAAQ,SAAS,GAAG,CAAC,CAAC;AACtF,QAAM,UAAU,+BAA+B,OAAO;AACtD,QAAM,aAAoB;AAAA,IACxB,GAAU,cAAc,aAAa,WAAW;AAAA,IAChD,GAAU,cAAc,WAAW,SAAS;AAAA,IAC5C,GAAU,cAAc,UAAU,KAAK,IAAI,QAAQ,SAAS,GAAG,UAAa,CAAC;AAAA;AAAA;AAAA,IAG7E,OAAc,cAAc,IAAI;AAAA,sBACP,YAAY;AAAA,mDACU,WAAW;AAAA,mDACJ,cAAc,WAAW;AAAA,iDAC3B,cAAc,SAAS;AAAA,uDACjB,cAAc,EAAE;AAAA;AAAA;AAAA;AAAA,EAI5E;AACA,MAAI,QAAQ,WAAW,UAAa,QAAQ,UAAU;AACpD,eAAW,KAAK,GAAU,cAAc,UAAU,QAAQ,MAAM,CAAC;AACnE,MAAI,QAAQ,aAAa;AACvB,eAAW,KAAK,QAAe,cAAc,MAAM,QAAQ,YAAY,CAAC;AAC1E,MAAI,QAAQ,aAAa;AACvB,eAAW,KAAK,WAAkB,cAAc,MAAM,QAAQ,YAAY,CAAC;AAG7E,QAAM,aAAa,MAAM;AAAA,IAAiB;AAAA,IAAI;AAAA,IAAa,CAAC,OAC1D,GACG,OAAO;AAAA,MACN,IAAW,cAAc;AAAA,MACzB,UAAiB,cAAc;AAAA,MAC/B,MAAM,6BAA4C,cAAc,IAAI,iBAAwB,cAAc,IAAI;AAAA,MAC9G,QAAe,cAAc;AAAA,MAC7B,iBAAiB,gBAEI,cAAc,eAAe,2BAAkC,cAAc,eAAe;AAAA,MACjH,oBAA2B,cAAc;AAAA,IAC3C,CAAC,EACA,KAAY,aAAa,EACzB,MAAM,IAAI,GAAG,UAAU,CAAC,EACxB;AAAA,MACC,cAAc,WACV,KAAY,cAAc,QAAQ,IAClC,IAAW,cAAc,QAAQ;AAAA,IACvC,EACC,MAAM,QAAQ,CAAC;AAAA,EACpB;AACA,QAAM,UAAU,WAAW,MAAM,GAAG,KAAK,EAAE;AAAA,IACzC,CAAC,cACE;AAAA,MACC,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,SAAS,CAAC;AAAA,MACV,YAAY;AAAA,IACd;AAAA,EACJ;AACA,QAAM,OAAyB;AAAA,IAC7B,QAAQ,CAAC;AAAA,IACT,SAAS,WAAW,SAAS;AAAA,IAC7B,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB;AAAA,IACA,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,aAAa,WAAW,SAAS,QAAQ,UAAU;AAAA,EACrD;AACA,QAAM,SAA4C,CAAC;AACnD,QAAM,SAAyB,CAAC;AAChC,MAAI,WAAW;AACf,QAAM,iBAAiB,IAAI,aAAa,OAAO,OAAO;AACpD,eAAW,SAAS,SAAS;AAC3B;AACA,UACE,MAAM,sBACL,MAAM,mBAAmB,MAAM,oBAAoB;AAEpD;AACF,YAAM,IAAW,cAAc;AAC/B,YAAM,SAAS,MAAM,SAAS;AAC9B,UAAI,QAAa,MAAM,CAAC;AACxB,UAAI,QAAQ,SAAS;AACnB,gBAAQ,SACJ,MAAM,CAAC,eACP,sBAAsB,CAAC,kCAAkC,CAAC;AAAA,eACvD,QAAQ,SAAS;AACxB,gBACE,MAAM,SAAS,mBACX,sBAAsB,CAAC,+BAA+B,CAAC,gBACvD,MAAM,CAAC;AACf,YAAM,UACJ,QAAQ,SAAS,YAAY,SAAS,QAAQ,gBAAgB,QAAQ;AACxE,UAAI,CAAC,QAAS,SAAQ;AACtB,YAAM,QAAQ,QAAQ,mBAAmB,MAAM,WAAW,SAAS;AACnE,YAAM,SAAS;AACf,YAAM,MAAM;AACZ,YAAM,UAAU;AAGhB,YAAM,SAAS;AAAA,mBACF,GAAG,KAAK,OAAO,MAAM,OAAO,MAAM;AAAA,qBAChC,OAAO;AAAA,cACd,OAAO;AAAA,uBACE,OAAO,+BAA+B,OAAO,iCAAiC,OAAO;AAAA,oCACxE,OAAO,sCAAsC,OAAO;AAAA;AAIlF,YAAM,QAAQ,KAAK,MAAM,KAAK,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;AACnD,YAAM,eAAe,CAAC,QACpB,8BAA8B,CAAC,KAAK,GAAG,yBAAyB,CAAC,KAAK,GAAG;AAC3E,YAAM,SAAS,sBAAsB,CAAC,sCAAsC,CAAC,gCAAgC,CAAC;AAC9G,YAAM,cACJ,QAAQ,SAAS,UACb;AAAA,8CACkC,MAAM,yBAAyB,MAAM;AAAA,uDAC5B,MAAM,oCAAoC,CAAC;AAAA,oBAC9E,aAAa,MAAM,CAAC,0BAA0B,CAAC,mCAAmC,MAAM,QAAQ,CAAC;AAAA,qCAChF,CAAC;AAAA,sCACA,CAAC,gDAC3B,QAAQ,SAAS,aAAa,MAAM,SAAS,mBAC3C;AAAA,uCACyB,CAAC;AAAA,wCACA,CAAC,gDAC3B;AACR,YAAM,CAAC,GAAG,IAAI,MAAM;AAAA,QAUlB;AAAA,QACA;AAAA,iBACS,KAAK,cAAc,WAAW;AAAA,YAC5B,cAAc,mBAAmB;AAAA,eAC9B,aAAa;AAAA,gBACZ,cAAc,WAAW,MAAM,WAAW;AAAA,gBAC1C,cAAc,SAAS,MAAM,SAAS;AAAA,gBACtC,cAAc,EAAE,MAAM,MAAM,EAAE;AAAA,iBAC7B,cAAc,eAAe,eAAsB,cAAc,eAAe;AAAA,gBACjF,cAAc,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wDAQC,OAAO,MAAM,OAAO,MAAM;AAAA,oCAC9C,OAAO,SAAS,CAAC;AAAA;AAAA;AAAA,oBAGjC,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yDAO+B,KAAK,IAAI,QAAQ,IAAI,GAAG,UAAa,CAAC,iBAAiB,KAAK,MAAM,SAAS,KAAK,CAAC,IAAI,CAAC;AAAA,oCAC3G,KAAK,IAAI,QAAQ,GAAG,UAAa,CAAC,iBAAiB,MAAM;AAAA,6DAChC,gBAAgB;AAAA,2DAClB,gBAAgB;AAAA;AAAA,MAErE;AACA,UAAI,CAAC,IAAK;AACV,YAAM,WAAW,yBAAyB,IAAI,UAAU,IAAI,OAAO;AAMnE,iBAAW,CAAC,KAAK,MAAM,KAAK;AAAA,QAC1B,CAAC,UAAU,IAAI;AAAA,QACf,CAAC,QAAQ,IAAI;AAAA,MACf,GAAY;AACV,YACE,SAAS,GAAG,MAAM,UAClB,OAAO,WAAW,KAAK,UAAU,SAAS,GAAG,CAAC,GAAG,MAAM,IAAI,QAC3D;AACA,iBAAO,SAAS,GAAG;AACnB,mBAAS,kBAAkB;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,OAAO,IAAI,UAAU;AACzB,UAAI,IAAI,QAAQ;AAGd,eAAO,yBAAyB,SAAS,MAAM,CAAC;AAChD,cAAM,QAAQ,QAAQ,QAAQ;AAC9B,YACE,QAAQ,KACR,kBAAkB,KAAK,KAAK,QAAQ,CAAC,CAAE,KACvC,kBAAkB,KAAK,KAAK,KAAK,KAAK,EAAE;AAExC,gBAAM,IAAI,MAAM,8DAA8D;AAChF,eAAO,KAAK,MAAM,OAAO,QAAQ,MAAM;AACvC,YAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,kBAAkB,KAAK,KAAK,GAAG,EAAE,CAAE;AACxE,iBAAO,KAAK,MAAM,GAAG,EAAE;AAAA,MAC3B;AACA,UAAI,QAAQ,IAAI,SAAS,IAAI,SAAS;AACpC,cAAM,IAAI,MAAM,qCAAqC;AACvD,YAAM,UAAU,IAAI,UAChB,CAAC,IACD,IAAI,SAAS,WACX,OACA,yBAAyB,IAAI,YAAY,IAAI,OAAO;AAC1D,UAAI,UAAmC,EAAE,GAAG,SAAS;AACrD,UAAI,QAAQ,SAAS,SAAS;AAC5B,YAAI,IAAI,SAAS,KAAM,SAAQ,SAAS,WAAW,WAAW,IAAI;AAAA,MACpE,WAAW,QAAQ,SAAS,WAAW;AACrC,YAAI,MAAM,SAAS,iBAAkB,SAAQ,SAAS;AAAA,YACjD,WAAW,WAAuC,CAAC;AAAA,MAC1D,MAAO,SAAQ,OAAO;AACtB,UAAI,IAAI,QAAS,WAAU,EAAE,GAAG,SAAS,eAAe,KAAK;AAC7D,UAAI,IAAI,SAAS,YAAY,IAAI;AAC/B,eAAO,MAAM,QAAQ,IAAI;AAAA,UACvB,QAAQ;AAAA,UACR,OAAO,IAAI;AAAA,UACX,MAAM,IAAI,SAAS,UAAU;AAAA,UAC7B;AAAA,UACA,SAAS,IAAI;AAAA,QACf;AACF,aAAO,KAAK,EAAE,GAAG,OAAO,QAAQ,CAAC;AAGjC,UAAI,IAAI,SAAS,YAAY,OAAO,WAAW,KAAK,UAAU,OAAO,CAAC,IAAI,OAAQ;AAClF,UACE,IAAI,SAAS,YACb,SAAS,IAAI,SAAS,KAAK,SAAS,MAAM,KAAK,IAAI,EAAE,UAAU,IAAI;AAEnE;AAAA,IACJ;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,OAAO,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AAAA,IACrD,SAAS,KAAK,WAAW,WAAW,QAAQ;AAAA,IAC5C,iBAAiB,WACb;AAAA,MACE,OAAO,KAAK,IAAI,QAAQ,CAAC,EAAG,UAAU,QAAQ,WAAW,CAAC,EAAG,QAAQ;AAAA,MACrE,MAAM,KAAK,IAAI,QAAQ,CAAC,EAAG,UAAU,QAAQ,WAAW,CAAC,EAAG,QAAQ;AAAA,IACtE,IACA;AAAA,IACJ,OAAO,OAAO,WAAW,KAAK,UAAU,MAAM,GAAG,MAAM;AAAA,IACvD,mBAAmB,CAAC,OAAO,OAAO,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,OAAO;AAAA,IACvE;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/session-file-attachments.d.ts

@@ -0,0 +1,28 @@
+import type { FileAsset, ResourceRef, SessionAuthorizationActor } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+/** Only call during verified human initial/Send/Steer acceptance, in its transaction. */
+export declare function acceptSessionFileAttachments(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    subjectId: string;
+    resources: ResourceRef[];
+}): Promise<void>;
+export type SessionAttachmentReadAccess = {
+    sessionId: string;
+    authorityEpoch: number;
+    actor: Pick<SessionAuthorizationActor, "kind" | "subjectId"> & Partial<{
+        callerSessionId: string;
+        turnId: string;
+        attemptId: string;
+        executionGeneration: number;
+    }>;
+};
+/** Core must prove session authorization; workers supply their live own-session attempt. */
+export declare function readSessionFileAttachments(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    fileIds: readonly string[];
+    access: SessionAttachmentReadAccess;
+}): Promise<FileAsset[]>;