@opengeni/db 6.0.1 → 6.0.3

package/dist/session-command-output.js

@@ -1,11 +1,11 @@
 import {
   appendSessionCommandOutput
-} from "./chunk-LSLNMENV.js";
-import "./chunk-CSVHCF3R.js";
-import "./chunk-I7HQL6FK.js";
+} from "./chunk-KZXWUXWV.js";
+import "./chunk-IB3SW3JW.js";
+import "./chunk-ZM5BA3TD.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+import "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-event-slices.js

@@ -1,9 +1,9 @@
 import {
   listSessionEventSlices,
   readSessionMessageSliceInScope
-} from "./chunk-FULLE5CF.js";
-import "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+} from "./chunk-WT7HG43Y.js";
+import "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-mcp-credential-rotation.js

@@ -1,19 +1,19 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-CSVHCF3R.js";
-import "./chunk-I7HQL6FK.js";
+} from "./chunk-IB3SW3JW.js";
+import "./chunk-ZM5BA3TD.js";
 import "./chunk-4UJCXBR2.js";
 import {
   rawRows,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 import {
   apiKeys,
   sessionCommandReceipts,
   sessionMcpServers,
   sessions
-} from "./chunk-GSB4ISHE.js";
+} from "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-JILAWE26.js";
-import "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+} from "./chunk-M5Z6II2P.js";
+import "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-I7HQL6FK.js";
-import "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+} from "./chunk-ZM5BA3TD.js";
+import "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/workspace-tool-defaults.js

@@ -1,12 +1,12 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-CSVHCF3R.js";
-import "./chunk-I7HQL6FK.js";
+} from "./chunk-IB3SW3JW.js";
+import "./chunk-ZM5BA3TD.js";
 import "./chunk-4UJCXBR2.js";
 import {
   withWorkspaceRls
-} from "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+} from "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 

package/drizzle/0508_deadline_command_workspace_capture.sql

@@ -0,0 +1,75 @@
+-- deployment-mode: rolling
+-- A scheduled Modal rotation may capture current files after a bounded
+-- cancellation grace, even if a legacy command remains active. Exact enrollment
+-- still requires a quiesced owner and no other holders/admissions.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+-- Keep the original cancellation intent immutable. A deadline can arrive after
+-- an explicit stop, so it needs its own clock for the bounded capture grace.
+ALTER TABLE sandbox_retained_processes
+  ADD COLUMN deadline_cancellation_requested_at timestamptz;
+
+DO $install$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($definition$
+    CREATE OR REPLACE FUNCTION opengeni_private.list_unobservable_command_drain_candidates(p_limit integer)
+    RETURNS TABLE(account_id uuid, workspace_id uuid, sandbox_group_id uuid)
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, %1$I, pg_temp
+    AS $body$
+    DECLARE inventory_id uuid;
+    BEGIN
+      IF p_limit < 1 OR p_limit > 100 THEN RAISE EXCEPTION 'invalid drain batch'; END IF;
+      inventory_id := opengeni_private.open_session_tenancy_fence_inventory(%1$I.session_tenancy_fence_target_schema());
+      RETURN QUERY SELECT lease.account_id, lease.workspace_id, lease.sandbox_group_id
+      FROM %1$I.sandbox_leases lease
+      WHERE lease.backend = 'modal' AND lease.liveness IN ('warm', 'draining')
+        AND (lease.unobservable_command_drain_ids IS NOT NULL OR EXISTS (
+          SELECT 1 FROM %1$I.sandbox_retained_processes process
+          WHERE process.lease_id = lease.id AND process.state = 'active'
+            AND (
+              process.last_reconcile_outcome IN (
+                'process_observation_unavailable', 'quarantined_process_observation_unavailable',
+                'provider_binding_missing', 'quarantined_provider_binding_missing',
+                'provider_binding_mismatch', 'quarantined_provider_binding_mismatch'
+              )
+              OR (
+                process.last_reconcile_outcome = 'provider_error'
+                AND process.reconcile_attempts >= 5
+                AND EXISTS (
+                  SELECT 1 FROM %1$I.session_background_commands command
+                  WHERE command.retained_process_id = process.id
+                    AND command.workspace_id = process.workspace_id
+                    AND command.session_id = process.session_id
+                    AND command.provider = 'managed' AND command.state = 'stopping'
+                    AND command.cancel_requested_at IS NOT NULL
+                )
+              )
+              OR (
+                lease.rotation_reason = 'provider_deadline'
+                AND lease.rotation_requested_at IS NOT NULL
+                AND process.deadline_cancellation_requested_at < now() - interval '2 minutes'
+                AND process.reconcile_attempts >= 1
+              )
+            )
+        ))
+      ORDER BY
+        CASE WHEN lease.rotation_reason = 'provider_deadline'
+          AND lease.rotation_requested_at IS NOT NULL THEN 0 ELSE 1 END,
+        CASE WHEN lease.rotation_reason = 'provider_deadline'
+          AND lease.rotation_requested_at IS NOT NULL
+          THEN lease.provider_deadline_at END NULLS LAST,
+        lease.unobservable_command_checked_at NULLS FIRST,
+        lease.id LIMIT p_limit;
+      PERFORM opengeni_private.close_session_tenancy_fence_inventory(inventory_id);
+    EXCEPTION WHEN OTHERS THEN
+      PERFORM opengeni_private.close_session_tenancy_fence_inventory(inventory_id);
+      RAISE;
+    END $body$;
+  $definition$, target_schema);
+  REVOKE ALL ON FUNCTION opengeni_private.list_unobservable_command_drain_candidates(integer) FROM PUBLIC;
+END $install$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0509_verified_signup_trial_credits.sql

@@ -0,0 +1,76 @@
+-- deployment-mode: rolling
+-- Only a newly completed, verified self-service organization setup can receive
+-- this campaign's $10 account credit. The API explicitly opts in per request;
+-- deploying this migration alone does not activate the offer. Older receipts,
+-- invited users, and additional organizations are never backfilled.
+
+CREATE FUNCTION opengeni_private.grant_verified_signup_trial_credit()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  verified_owner boolean;
+  account_owner boolean;
+  inserted_count integer;
+BEGIN
+  IF pg_catalog.current_setting('opengeni.verified_signup_trial_enabled', true)
+      IS DISTINCT FROM 'on' THEN
+    RETURN NEW;
+  END IF;
+
+  -- This is a defense in depth check: the sole receipt writer already checks
+  -- the canonical verified human and the absence of prior memberships.
+  SELECT candidate.email_verified IS TRUE
+  INTO verified_owner
+  FROM auth_users candidate
+  WHERE candidate.id = NEW.auth_user_id;
+  SELECT account.external_source = 'better-auth:user'
+    AND account.external_id = NEW.auth_user_id
+  INTO account_owner
+  FROM managed_accounts account
+  WHERE account.id = NEW.account_id;
+  IF verified_owner IS DISTINCT FROM TRUE
+    OR account_owner IS DISTINCT FROM TRUE
+    OR opengeni_private.current_subject_id() IS DISTINCT FROM 'user:' || NEW.auth_user_id
+    OR opengeni_private.current_account_id() IS DISTINCT FROM NEW.account_id
+    OR NEW.result ->> 'organizationId' IS DISTINCT FROM NEW.account_id::text
+  THEN
+    RAISE EXCEPTION 'verified signup trial requires an exact new owner'
+      USING ERRCODE = '42501';
+  END IF;
+
+  INSERT INTO credit_ledger_entries (
+    account_id, workspace_id, type, amount_micros, source_type, source_id,
+    idempotency_key, metadata
+  ) VALUES (
+    NEW.account_id, NULL, 'grant', 10000000, 'verified_signup_trial',
+    NEW.auth_user_id, 'verified-signup-trial:v1:' || NEW.auth_user_id,
+    pg_catalog.jsonb_build_object('campaign', 'verified_signup_trial_v1')
+  ) ON CONFLICT (idempotency_key) DO NOTHING;
+  GET DIAGNOSTICS inserted_count = ROW_COUNT;
+  IF inserted_count <> 1 THEN
+    RAISE EXCEPTION 'verified signup trial credit idempotency collision'
+      USING ERRCODE = '23505';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+
+REVOKE ALL ON FUNCTION opengeni_private.grant_verified_signup_trial_credit() FROM PUBLIC;
+DO $posture$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION opengeni_private.grant_verified_signup_trial_credit() '
+      || 'SET search_path = pg_catalog, %I, opengeni_private, pg_temp',
+    data_schema
+  );
+END
+$posture$;
+
+CREATE TRIGGER self_service_setup_trial_credit
+AFTER INSERT ON self_service_organization_setup_receipts
+FOR EACH ROW EXECUTE FUNCTION opengeni_private.grant_verified_signup_trial_credit();

package/drizzle/0510_knowledge_index_funding_wait.sql

@@ -0,0 +1,174 @@
+-- deployment-mode: rolling
+-- Preserve an unfinished projection while its account is unfunded. The same
+-- leased capability used by knowledge_index_work is required; no human or
+-- public request may put a different tenant's revision into this state.
+ALTER TABLE knowledge_index_jobs ADD COLUMN billing_mode text
+  CHECK (billing_mode IN ('usage_only','shadow','credits'));
+ALTER TABLE knowledge_index_jobs ADD COLUMN billed_generation integer;
+ALTER TABLE knowledge_index_jobs ADD COLUMN billing_rate_micros_per_million_bytes bigint
+  CHECK (billing_rate_micros_per_million_bytes >= 0);
+
+-- Freeze the mode at first work for a generation. Rows queued before the
+-- explicitly configured paid cutover cannot be retroactively charged, even
+-- if a worker restarts. Already-started generations keep their chosen mode.
+CREATE FUNCTION knowledge_index_billing_policy(
+  p_account uuid, p_revision uuid, p_lease uuid, p_requested text,
+  p_activation_at timestamptz, p_rate bigint
+)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $$
+DECLARE
+  job knowledge_index_jobs%ROWTYPE;
+  decided text;
+  frozen_rate bigint;
+  decision_outcome text;
+  previous text := current_setting('opengeni.knowledge_index_dispatcher',true);
+BEGIN
+  IF p_account IS DISTINCT FROM opengeni_private.current_account_id() OR
+     p_requested IS NULL OR p_requested NOT IN ('usage_only','shadow','credits') OR
+     p_activation_at IS NULL OR p_rate IS NULL OR p_rate < 0 OR
+     (p_requested='credits' AND p_rate=0) THEN
+    RAISE EXCEPTION 'Knowledge index billing policy unavailable' USING ERRCODE='42501';
+  END IF;
+  PERFORM set_config('opengeni.knowledge_index_dispatcher','1',true);
+  SELECT * INTO job FROM knowledge_index_jobs j WHERE j.account_id=p_account
+    AND j.revision_id=p_revision AND j.lease_id=p_lease AND j.state='running'
+    AND j.lease_until>clock_timestamp() FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'Knowledge index lease unavailable' USING ERRCODE='40001';
+  END IF;
+  IF job.billed_generation IS DISTINCT FROM job.generation THEN
+    decided:=CASE WHEN job.created_at>=p_activation_at THEN p_requested ELSE 'usage_only' END;
+    frozen_rate:=CASE WHEN decided='usage_only' THEN 0 ELSE p_rate END;
+  ELSE
+    decided:=job.billing_mode;
+    frozen_rate:=job.billing_rate_micros_per_million_bytes;
+  END IF;
+  IF decided='credits' THEN
+    SELECT d.outcome INTO decision_outcome FROM knowledge_entry_decisions d
+      WHERE d.account_id=p_account AND d.entry_id=job.entry_id AND d.revision_id=p_revision
+      ORDER BY d.version DESC LIMIT 1;
+    IF decision_outcome='rejected' THEN
+      UPDATE knowledge_index_jobs SET state='obsolete',lease_id=NULL,lease_until=NULL
+        WHERE revision_id=p_revision;
+      DELETE FROM knowledge_entry_vectors WHERE account_id=p_account AND revision_id=p_revision;
+      PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+      RETURN jsonb_build_object('mode','obsolete','rateMicrosPerMillionBytes',0);
+    END IF;
+  END IF;
+  -- A review-first draft is not a paid purchase. Keep its lease checkpoint
+  -- intact and poll until this exact revision is published; a rejected latest
+  -- revision may remain visible for review but must never incur an embedding
+  -- charge. Recheck on every batch so a publication change fences work.
+  IF decided='credits' AND NOT EXISTS (
+    SELECT 1 FROM knowledge_entries e WHERE e.account_id=p_account
+      AND e.id=job.entry_id AND e.published_revision_id=p_revision AND NOT e.archived
+  ) THEN
+    UPDATE knowledge_index_jobs SET state='pending',lease_id=NULL,lease_until=NULL,
+      last_failure='waiting_for_review',next_attempt_at=clock_timestamp()+interval '1 minute',
+      attempts=0 WHERE revision_id=p_revision;
+    PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+    RETURN jsonb_build_object('mode','awaiting_review','rateMicrosPerMillionBytes',0);
+  END IF;
+  IF job.billed_generation IS DISTINCT FROM job.generation THEN
+    UPDATE knowledge_index_jobs SET billing_mode=decided,billed_generation=job.generation,
+      billing_rate_micros_per_million_bytes=frozen_rate
+      WHERE revision_id=p_revision;
+  END IF;
+  PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+  RETURN jsonb_build_object('mode',decided,
+    'rateMicrosPerMillionBytes',coalesce(frozen_rate,0));
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+  RAISE;
+END $$;
+REVOKE ALL ON FUNCTION knowledge_index_billing_policy(uuid,uuid,uuid,text,timestamptz,bigint) FROM PUBLIC;
+
+CREATE FUNCTION knowledge_index_wait_for_funding(p_account uuid, p_revision uuid, p_lease uuid)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $$
+DECLARE
+  job knowledge_index_jobs%ROWTYPE;
+  previous text := current_setting('opengeni.knowledge_index_dispatcher',true);
+BEGIN
+  IF p_account IS DISTINCT FROM opengeni_private.current_account_id() THEN
+    RAISE EXCEPTION 'Knowledge index tenant mismatch' USING ERRCODE='42501';
+  END IF;
+  -- knowledge_index_jobs is FORCE-RLS and only the owner-definer dispatcher
+  -- policy may see the leased job. Restore the transaction-local capability
+  -- even if the lease fence fails.
+  PERFORM set_config('opengeni.knowledge_index_dispatcher','1',true);
+  SELECT * INTO job FROM knowledge_index_jobs j WHERE j.account_id=p_account
+    AND j.revision_id=p_revision AND j.lease_id=p_lease AND j.state='running'
+    AND j.lease_until>clock_timestamp() FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'Knowledge index lease unavailable' USING ERRCODE='40001';
+  END IF;
+  UPDATE knowledge_index_jobs SET state='pending',lease_id=NULL,lease_until=NULL,
+    last_failure='waiting_for_funding',next_attempt_at=clock_timestamp()+interval '1 minute',
+    attempts=0 WHERE revision_id=p_revision;
+  PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+  RETURN jsonb_build_object('status','pending');
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+  RAISE;
+END $$;
+REVOKE ALL ON FUNCTION knowledge_index_wait_for_funding(uuid,uuid,uuid) FROM PUBLIC;
+
+-- An approval/rejection can commit while a paid embedding provider is running.
+-- Recheck publication after the provider returns, then hold a share lock on
+-- that entry until the append, usage and debit transaction commits. A concurrent
+-- review writer takes FOR UPDATE and cannot change the publication in between.
+CREATE FUNCTION knowledge_index_paid_publication_guard(p_account uuid, p_revision uuid, p_lease uuid)
+RETURNS text LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $$
+DECLARE
+  job knowledge_index_jobs%ROWTYPE;
+  entry knowledge_entries%ROWTYPE;
+  decision_outcome text;
+  previous text := current_setting('opengeni.knowledge_index_dispatcher',true);
+BEGIN
+  IF p_account IS DISTINCT FROM opengeni_private.current_account_id() THEN
+    RAISE EXCEPTION 'Knowledge index tenant mismatch' USING ERRCODE='42501';
+  END IF;
+  PERFORM set_config('opengeni.knowledge_index_dispatcher','1',true);
+  SELECT * INTO job FROM knowledge_index_jobs j WHERE j.account_id=p_account
+    AND j.revision_id=p_revision AND j.lease_id=p_lease AND j.state='running'
+    AND j.lease_until>clock_timestamp() AND j.billing_mode='credits' FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'Paid Knowledge index lease unavailable' USING ERRCODE='40001';
+  END IF;
+  SELECT * INTO entry FROM knowledge_entries e WHERE e.account_id=p_account
+    AND e.id=job.entry_id FOR SHARE;
+  SELECT d.outcome INTO decision_outcome FROM knowledge_entry_decisions d
+    WHERE d.account_id=p_account AND d.entry_id=job.entry_id AND d.revision_id=p_revision
+    ORDER BY d.version DESC LIMIT 1;
+  IF decision_outcome='rejected' THEN
+    UPDATE knowledge_index_jobs SET state='obsolete',lease_id=NULL,lease_until=NULL
+      WHERE revision_id=p_revision;
+    DELETE FROM knowledge_entry_vectors WHERE account_id=p_account AND revision_id=p_revision;
+    PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+    RETURN 'obsolete';
+  END IF;
+  IF entry.id IS NULL OR entry.archived OR entry.published_revision_id IS DISTINCT FROM p_revision THEN
+    UPDATE knowledge_index_jobs SET state='pending',lease_id=NULL,lease_until=NULL,
+      last_failure='waiting_for_review',next_attempt_at=clock_timestamp()+interval '1 minute',
+      attempts=0 WHERE revision_id=p_revision;
+    PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+    RETURN 'awaiting_review';
+  END IF;
+  PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+  RETURN 'published';
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+  RAISE;
+END $$;
+REVOKE ALL ON FUNCTION knowledge_index_paid_publication_guard(uuid,uuid,uuid) FROM PUBLIC;
+DO $roles$
+DECLARE runtime_role text;
+BEGIN
+  FOR runtime_role IN SELECT jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) LOOP
+    IF runtime_role <> current_user AND EXISTS(SELECT 1 FROM pg_roles WHERE rolname=runtime_role) THEN
+      EXECUTE format('GRANT EXECUTE ON FUNCTION knowledge_index_billing_policy(uuid,uuid,uuid,text,timestamptz,bigint) TO %I',runtime_role);
+      EXECUTE format('GRANT EXECUTE ON FUNCTION knowledge_index_wait_for_funding(uuid,uuid,uuid) TO %I',runtime_role);
+      EXECUTE format('GRANT EXECUTE ON FUNCTION knowledge_index_paid_publication_guard(uuid,uuid,uuid) TO %I',runtime_role);
+    END IF;
+  END LOOP;
+END $roles$;

package/drizzle/0511_knowledge_visible_index_status.sql

@@ -0,0 +1,56 @@
+-- deployment-mode: rolling
+-- The dispatcher table is not readable by the app role. Recheck every exact
+-- visible revision through the canonical Knowledge reader before projecting a
+-- content-free status; an entry ID supplied by a caller is not an access grant.
+CREATE FUNCTION knowledge_visible_index_status(p_account uuid,p_workspace uuid,p_actor jsonb,p_items jsonb,p_view text)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $$
+DECLARE item jsonb; visible jsonb; result jsonb := '[]'::jsonb;
+  job knowledge_index_jobs%ROWTYPE;
+  previous text := current_setting('opengeni.knowledge_index_dispatcher',true);
+  status text;
+BEGIN
+  IF jsonb_typeof(p_items) IS DISTINCT FROM 'array' OR jsonb_array_length(p_items)>50
+    OR p_view IS NULL OR p_view NOT IN ('published','needs_review','archived','rejected') THEN
+    RAISE EXCEPTION 'Invalid Knowledge index status request' USING ERRCODE='22023';
+  END IF;
+  FOR item IN SELECT value FROM jsonb_array_elements(p_items) LOOP
+    IF jsonb_typeof(item) IS DISTINCT FROM 'object' OR (item->>'entryId') IS NULL
+      OR (item->>'revisionId') IS NULL THEN
+      RAISE EXCEPTION 'Invalid Knowledge index status item' USING ERRCODE='22023';
+    END IF;
+    visible := knowledge_entry_read(p_account,p_workspace,p_actor,
+      jsonb_build_object('operation','get','entryId',item->>'entryId','view',p_view,'limit',1));
+    IF visible#>>'{0,revision,id}' IS DISTINCT FROM item->>'revisionId'
+      OR visible#>>'{0,revision,kind}' IS DISTINCT FROM 'source' THEN
+      CONTINUE;
+    END IF;
+    PERFORM set_config('opengeni.knowledge_index_dispatcher','1',true);
+    SELECT * INTO job FROM knowledge_index_jobs j WHERE j.account_id=p_account
+      AND j.entry_id=(item->>'entryId')::uuid AND j.revision_id=(item->>'revisionId')::uuid;
+    PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+    status := CASE
+      WHEN job.revision_id IS NULL THEN 'saved'
+      WHEN job.state='ready' AND job.completed_generation=job.generation THEN 'indexed'
+      WHEN job.state='running' THEN 'indexing'
+      WHEN job.state='pending' AND job.last_failure='waiting_for_funding' THEN 'awaiting_funding'
+      WHEN job.state='pending' AND job.last_failure='source_unavailable' THEN 'source_unavailable'
+      WHEN job.state='pending' AND job.last_failure='embedding_unavailable' THEN 'provider_failed'
+      ELSE 'queued' END;
+    result := result || jsonb_build_array(jsonb_build_object(
+      'entryId',item->>'entryId','revisionId',item->>'revisionId','status',status));
+  END LOOP;
+  RETURN result;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM set_config('opengeni.knowledge_index_dispatcher',coalesce(previous,''),true);
+  RAISE;
+END $$;
+REVOKE ALL ON FUNCTION knowledge_visible_index_status(uuid,uuid,jsonb,jsonb,text) FROM PUBLIC;
+DO $roles$
+DECLARE runtime_role text;
+BEGIN
+  FOR runtime_role IN SELECT jsonb_array_elements_text(current_setting('opengeni.migration_application_roles')::jsonb) LOOP
+    IF runtime_role <> current_user AND EXISTS(SELECT 1 FROM pg_roles WHERE rolname=runtime_role) THEN
+      EXECUTE format('GRANT EXECUTE ON FUNCTION knowledge_visible_index_status(uuid,uuid,jsonb,jsonb,text) TO %I',runtime_role);
+    END IF;
+  END LOOP;
+END $roles$;

package/drizzle/0512_insights_fact_reads_hash_join.sql

@@ -0,0 +1,31 @@
+-- deployment-mode: rolling
+-- The five insights fact authority functions (0359, 0484) join the exact fact window
+-- against a MATERIALIZED visible-session CTE so private-session checks run once
+-- per session rather than once per fact. The planner estimates the fact window
+-- from occurred_at statistics, and a time-series window newer than the last
+-- ANALYZE (always true for "today", and for a week whenever autovacuum lags)
+-- is estimated as ~1 row. That misestimate turns the CTE join into a Nested
+-- Loop that rescans the whole CTE for every fact row: with 11k sessions and a
+-- 175k-row usage week the join costs ~2 billion comparisons (observed 5-14
+-- minutes per request on a staging workspace) while a hash join over the same
+-- inputs completes in well under a second.
+--
+-- Pin the hash-join-safe planner setting on the functions themselves. The
+-- setting is scoped to each function's own statements, the authorization,
+-- window, filter, and capability protocol is byte-for-byte unchanged, and
+-- ordinary statements planned outside these functions are unaffected.
+ALTER FUNCTION opengeni_private.visible_workspace_insights_usage_projection(
+  uuid, timestamp with time zone, timestamp with time zone, text[]
+) SET enable_nestloop = off;
+ALTER FUNCTION opengeni_private.visible_workspace_insights_usage_events(
+  uuid, timestamp with time zone, timestamp with time zone, text[]
+) SET enable_nestloop = off;
+ALTER FUNCTION opengeni_private.visible_workspace_insights_usage_events(
+  uuid, timestamp with time zone, timestamp with time zone
+) SET enable_nestloop = off;
+ALTER FUNCTION opengeni_private.visible_workspace_insights_model_call_facts(
+  uuid, timestamp with time zone, timestamp with time zone, text, text
+) SET enable_nestloop = off;
+ALTER FUNCTION opengeni_private.visible_workspace_insights_model_call_facts(
+  uuid, timestamp with time zone, timestamp with time zone
+) SET enable_nestloop = off;

package/drizzle/0513_message_fork_prefix_compaction.sql

@@ -0,0 +1,85 @@
+-- deployment-mode: rolling
+-- A message fork copies the retained model-facing prefix through its selected
+-- boundary. After real compaction, old rows are inactive and the replacement
+-- (including the summary) is active: copy only that active prefix. Never
+-- reinterpret a superseded message as a valid boundary. Opaque compaction
+-- items need the exact earlier durable compaction receipt to enter a fork.
+-- Inactive rows within a selected prefix require an earlier durable active
+-- checkpoint; a stray inactive row cannot silently disappear from the fork.
+-- The two blocks share the migration's implicit transaction: first verify
+-- every catalog-source anchor, then install the validated replacement. The
+-- preflight itself reads no tenant tables (the replacement function will).
+DO $preflight$
+DECLARE
+  definition text := pg_get_functiondef('fork_session_content(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,uuid)'::regprocedure);
+  anchor text;
+BEGIN
+  FOR anchor IN SELECT * FROM (VALUES
+    (E'AND history.turn_id = selected_turn_id\n        AND history.item ->> ''role'' = ''user'''),
+    (E'AND history.turn_id = selected_event.turn_id\n        AND history.item ->> ''role'' = ''assistant'''),
+    (E'AND history.session_id = p_source_session_id\n      AND (NOT history.active OR (history.position <> trunc(history.position)'),
+    (E'AND (NOT history.active OR (history.position <> trunc(history.position)'),
+    ('OR history.item ->> ''type'' = ''compaction'''),
+    (E'AND history.session_id = p_source_session_id AND history.position <= boundary_position'),
+    (E'AND source_item.session_id = p_source_session_id AND source_item.position <= boundary_position')
+  ) AS anchors(value) LOOP
+    IF (length(definition) - length(replace(definition, anchor, ''))) / length(anchor) <> 1 THEN
+      RAISE EXCEPTION 'message fork prefix rewrite did not match exactly once at %', left(anchor, 96);
+    END IF;
+  END LOOP;
+END
+$preflight$;
+
+DO $migration$
+DECLARE
+  target regprocedure := 'fork_session_content(uuid,uuid,uuid,text,uuid,text,boolean,text,text,integer,uuid)'::regprocedure;
+  definition text;
+  updated text;
+  change record;
+BEGIN
+  definition := pg_get_functiondef(target);
+  updated := definition;
+  FOR change IN SELECT * FROM (VALUES
+    (E'AND history.turn_id = selected_turn_id\n        AND history.item ->> ''role'' = ''user''',
+     E'AND history.turn_id = selected_turn_id\n        AND history.active\n        AND history.item ->> ''role'' = ''user'''),
+    (E'AND history.turn_id = selected_event.turn_id\n        AND history.item ->> ''role'' = ''assistant''',
+     E'AND history.turn_id = selected_event.turn_id\n        AND history.active\n        AND history.item ->> ''role'' = ''assistant'''),
+    (E'AND history.session_id = p_source_session_id\n      AND (NOT history.active OR (history.position <> trunc(history.position)',
+     E'AND history.session_id = p_source_session_id\n      AND history.position <= boundary_position\n      AND (NOT history.active OR (history.position <> trunc(history.position)'),
+    (E'AND (NOT history.active OR (history.position <> trunc(history.position)',
+     $replacement$AND ((NOT history.active AND NOT EXISTS (
+      SELECT 1 FROM session_events compaction_event
+      JOIN session_history_items summary_history
+        ON summary_history.account_id = compaction_event.account_id
+        AND summary_history.workspace_id = compaction_event.workspace_id
+        AND summary_history.session_id = compaction_event.session_id
+        AND summary_history.position::text = compaction_event.payload ->> 'summaryPosition'
+        AND summary_history.active
+      WHERE compaction_event.account_id = p_account_id
+        AND compaction_event.workspace_id = p_source_workspace_id
+        AND compaction_event.session_id = p_source_session_id
+        AND compaction_event.type = 'session.context.compacted'
+        AND compaction_event.sequence < selected_event.sequence
+        AND history.position < summary_history.position
+        AND summary_history.position <= boundary_position
+    )) OR (history.active AND history.position <> trunc(history.position)$replacement$),
+    ('OR history.item ->> ''type'' = ''compaction''',
+     $replacement$OR (history.active AND history.item ->> 'type' = 'compaction' AND NOT EXISTS (
+      SELECT 1 FROM session_events compaction_event
+      WHERE compaction_event.account_id = p_account_id
+        AND compaction_event.workspace_id = p_source_workspace_id
+        AND compaction_event.session_id = p_source_session_id
+        AND compaction_event.type = 'session.context.compacted'
+        AND compaction_event.payload ->> 'summaryPosition' = history.position::text
+        AND compaction_event.sequence < selected_event.sequence
+    ))$replacement$),
+    (E'AND history.session_id = p_source_session_id AND history.position <= boundary_position',
+     E'AND history.session_id = p_source_session_id AND history.active\n        AND history.position <= boundary_position'),
+    (E'AND source_item.session_id = p_source_session_id AND source_item.position <= boundary_position',
+     E'AND source_item.session_id = p_source_session_id AND source_item.active\n      AND source_item.position <= boundary_position')
+  ) AS rewrites(anchor, replacement) LOOP
+    updated := replace(updated, change.anchor, change.replacement);
+  END LOOP;
+  EXECUTE updated;
+END
+$migration$;

package/drizzle/0514_failed_session_variable_set_attach.sql

@@ -0,0 +1,25 @@
+-- deployment-mode: rolling
+-- A failed session can still attach its managed sandbox for an explicitly
+-- consented checkpoint restore. Keep its selected variable sets available to
+-- that attach; all existing scope, ownership, and revocation checks still run.
+DO $migration$
+DECLARE
+  target regprocedure := 'materialize_scoped_variable_set_for_session(uuid,uuid,uuid,uuid)'::regprocedure;
+  definition text := pg_get_functiondef(target);
+  before_status text := $before$AND session_value.status IN (
+      'queued', 'running', 'idle', 'requires_action', 'recovering', 'waiting_capacity'
+    )$before$;
+  after_status text := $after$AND session_value.status IN (
+      'queued', 'running', 'idle', 'requires_action', 'recovering', 'waiting_capacity', 'failed'
+    )$after$;
+BEGIN
+  IF (length(definition) - length(replace(definition, after_status, ''))) / length(after_status) = 1
+    AND (length(definition) - length(replace(definition, before_status, ''))) / length(before_status) = 0 THEN
+    RETURN;
+  END IF;
+  IF (length(definition) - length(replace(definition, before_status, ''))) / length(before_status) <> 1 THEN
+    RAISE EXCEPTION 'failed-session variable-set attach source contract changed';
+  END IF;
+  EXECUTE replace(definition, before_status, after_status);
+END
+$migration$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "6.0.1",
+  "version": "6.0.3",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -114,10 +114,10 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.6.1",
-    "@opengeni/codex": "^0.2.25",
-    "@opengeni/config": "^2.1.0",
-    "@opengeni/contracts": "^5.1.0",
+    "@opengeni/codemode": "^0.6.2",
+    "@opengeni/codex": "^0.2.26",
+    "@opengeni/config": "^2.1.1",
+    "@opengeni/contracts": "^5.1.1",
     "@opengeni/network": "^0.3.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"