@opengeni/db 6.0.1 → 6.0.3

package/dist/{chunk-XK6HXON2.js → chunk-UXFBXCHM.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withWorkspaceSubjectRls
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 
 // src/connect-attempts.ts
 import { createHash } from "crypto";
@@ -216,4 +216,4 @@ export {
   claimConnectOperation,
   finishConnectOperation
 };
-//# sourceMappingURL=chunk-XK6HXON2.js.map
+//# sourceMappingURL=chunk-UXFBXCHM.js.map

package/dist/{chunk-RXH5CFG3.js → chunk-VE2XK2KD.js}

@@ -1,16 +1,16 @@
 import {
   appendSessionCommandOutput
-} from "./chunk-LSLNMENV.js";
+} from "./chunk-KZXWUXWV.js";
 import {
   lockSessionEventWriteRows
-} from "./chunk-CSVHCF3R.js";
+} from "./chunk-IB3SW3JW.js";
 import {
   withRlsContext,
   withSessionActivityRlsContext
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 import {
   sandboxRetainedProcesses
-} from "./chunk-GSB4ISHE.js";
+} from "./chunk-IIPWNNVR.js";
 
 // src/retained-provider-commands.ts
 import { and, eq, sql } from "drizzle-orm";
@@ -242,7 +242,7 @@ async function retainedProcessCancellationRequested(db, scope) {
 async function requestRetainedProcessDeadlineCancellation(db, scope) {
   return withRlsContext(db, scope, async (tx) => {
     const [row] = await tx.select().from(sandboxRetainedProcesses).where(processWhere(scope)).for("update").limit(1);
-    if (!row || row.state !== "active" || !row.providerCommand || !supervisionDescriptor(row.providerCommand))
+    if (!row || row.state !== "active" || row.providerBackend !== "modal" || row.routeTargetId !== null)
       return false;
     const [lease] = await tx.execute(sql`
       select id from sandbox_leases where id = ${row.leaseId}
@@ -252,8 +252,12 @@ async function requestRetainedProcessDeadlineCancellation(db, scope) {
         and rotation_requested_at is not null and rotation_reason = 'provider_deadline' for update
     `);
     if (!lease) return false;
-    if (!row.cancellationRequestedAt)
-      await tx.update(sandboxRetainedProcesses).set({ cancellationRequestedAt: /* @__PURE__ */ new Date(), cancellationReason: "provider_deadline" }).where(processWhere(scope));
+    if (!row.deadlineCancellationRequestedAt || !row.cancellationRequestedAt) {
+      await tx.update(sandboxRetainedProcesses).set({
+        ...!row.cancellationRequestedAt ? { cancellationRequestedAt: sql`now()`, cancellationReason: "provider_deadline" } : {},
+        ...!row.deadlineCancellationRequestedAt ? { deadlineCancellationRequestedAt: sql`now()` } : {}
+      }).where(processWhere(scope));
+    }
     return true;
   });
 }
@@ -273,4 +277,4 @@ export {
   retainedProcessCancellationRequested,
   requestRetainedProcessDeadlineCancellation
 };
-//# sourceMappingURL=chunk-RXH5CFG3.js.map
+//# sourceMappingURL=chunk-VE2XK2KD.js.map

package/dist/{chunk-RXH5CFG3.js.map → chunk-VE2XK2KD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/retained-provider-commands.ts"],"sourcesContent":["import { and, eq, sql } from \"drizzle-orm\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport {\n  SandboxProviderCommand,\n  ModalRouterProviderCommand,\n  CommandSupervisionReceipt,\n  type SessionEvent,\n} from \"@opengeni/contracts\";\nimport { withRlsContext, withSessionActivityRlsContext, type Database } from \"./database\";\nimport { lockSessionEventWriteRows } from \"./session-control\";\nimport { appendSessionCommandOutput } from \"./session-command-output\";\nimport * as schema from \"./schema\";\n\nexport type ProcessScope = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  processId: string;\n};\n\n/** Bound to an already-authorized exact process scope by runtime wiring. */\nexport function retainedProviderCommandPersistence(\n  db: Database,\n  scope: ProcessScope,\n  publish?: (events: SessionEvent[]) => Promise<void>,\n) {\n  return {\n    recordSupervisionReceipt: (receipt: SupervisionReceipt) =>\n      recordRetainedSupervisionReceipt(db, scope, receipt),\n    loadSupervisionReceipt: () => loadRetainedSupervisionReceipt(db, scope),\n    requestCancellation: (reason: \"provider_deadline\" | \"explicit_stop\") =>\n      requestRetainedProcessCancellation(db, scope, reason),\n    cancellationRequested: () => retainedProcessCancellationRequested(db, scope),\n    load: () => getRetainedProviderCommand(db, scope),\n    acknowledge: (command: SandboxProviderCommand) =>\n      acknowledgeRetainedProviderOutput(db, scope, command),\n    reserveInput: (byteLength?: number) => reserveRetainedProviderInput(db, scope, byteLength),\n    captureRouterPage: async (page: RetainedRouterOutputPage) => {\n      const result = await captureRetainedRouterOutput(db, scope, page);\n      // A committed capture is authoritative even if live fanout fails.\n      if (result.events.length && publish) await publish(result.events).catch(() => undefined);\n      return { command: result.command, captured: result.captured };\n    },\n  };\n}\n\nfunction processWhere(scope: ProcessScope) {\n  return and(\n    eq(schema.sandboxRetainedProcesses.accountId, scope.accountId),\n    eq(schema.sandboxRetainedProcesses.workspaceId, scope.workspaceId),\n    eq(schema.sandboxRetainedProcesses.sessionId, scope.sessionId),\n    eq(schema.sandboxRetainedProcesses.id, scope.processId),\n  );\n}\n\nfunction sameExecution(a: SandboxProviderCommand, b: SandboxProviderCommand): boolean {\n  return (\n    a.kind === b.kind &&\n    a.sandboxId === b.sandboxId &&\n    a.taskId === b.taskId &&\n    a.execId === b.execId &&\n    Boolean(a.pty) === Boolean(b.pty) &&\n    isDeepStrictEqual(supervisionDescriptor(a), supervisionDescriptor(b))\n  );\n}\n\n/** Promotion and the opaque provider locator commit together. Preserve the\n * existing durable-but-output-rejected promotion contract: its typed rejection\n * is rethrown only AFTER this outer transaction has committed the locator. */\nexport function createProviderCommandRetainer<Input extends ProcessScope, Process>(\n  promote: (db: Database, input: Input) => Promise<Process>,\n  recoverDurablePromotion: (error: unknown) => Process | null,\n) {\n  return async function retainWorkspaceProviderCommand(\n    db: Database,\n    input: Input & { providerCommand?: SandboxProviderCommand | null },\n  ): Promise<Process> {\n    if (!input.providerCommand) return promote(db, input);\n    const command = SandboxProviderCommand.parse(input.providerCommand);\n    const result = await withRlsContext(db, input, async (tx) => {\n      let process: Process;\n      let rejection: unknown = null;\n      try {\n        process = await promote(tx, input);\n      } catch (error) {\n        const durable = recoverDurablePromotion(error);\n        if (durable === null) throw error;\n        process = durable;\n        rejection = error;\n      }\n      const [row] = await tx\n        .select()\n        .from(schema.sandboxRetainedProcesses)\n        .where(processWhere(input))\n        .for(\"update\")\n        .limit(1);\n      if (!row || row.providerBackend !== \"modal\" || row.providerInstanceId !== command.sandboxId)\n        throw new Error(\"Provider command does not match its retained sandbox\");\n      if (row.providerCommand) {\n        if (!sameExecution(SandboxProviderCommand.parse(row.providerCommand), command))\n          throw new Error(\"Retained process already has a different provider execution\");\n      } else {\n        await tx\n          .update(schema.sandboxRetainedProcesses)\n          .set({ providerCommand: command })\n          .where(processWhere(input));\n      }\n      return { process, rejection };\n    });\n    if (result.rejection) throw result.rejection;\n    return result.process;\n  };\n}\n\nexport async function getRetainedProviderCommand(\n  db: Database,\n  scope: ProcessScope,\n): Promise<SandboxProviderCommand | null> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select({ command: schema.sandboxRetainedProcesses.providerCommand })\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .limit(1);\n    return row?.command ? SandboxProviderCommand.parse(row.command) : null;\n  });\n}\n\n/** Call only after all output in this provider page has been durably captured.\n * A stale acknowledgment cannot roll back a cursor or erase terminal evidence. */\nexport async function acknowledgeRetainedProviderOutput(\n  db: Database,\n  scope: ProcessScope,\n  candidate: SandboxProviderCommand,\n): Promise<SandboxProviderCommand> {\n  const next = SandboxProviderCommand.parse(candidate);\n  if (next.kind !== \"modal-control-v1\")\n    throw new Error(\"Byte-offset command output requires atomic capture\");\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand) throw new Error(\"Retained provider command is unavailable\");\n    const previous = SandboxProviderCommand.parse(row.providerCommand);\n    if (previous.kind !== \"modal-control-v1\")\n      throw new Error(\"Legacy acknowledgment cannot advance byte-offset output\");\n    if (!sameExecution(previous, next))\n      throw new Error(\"Output acknowledgment changed provider execution identity\");\n    const merged = structuredClone(previous);\n    for (const stream of [\"stdout\", \"stderr\"] as const) {\n      const oldCursor = previous.streams[stream];\n      const newCursor = next.streams[stream];\n      if (newCursor.batchIndex < oldCursor.batchIndex) continue;\n      if (\n        (newCursor.batchIndex === oldCursor.batchIndex || oldCursor.exitCode !== null) &&\n        !isDeepStrictEqual(oldCursor, newCursor)\n      )\n        throw new Error(\"Provider output acknowledgment conflicts with retained evidence\");\n      merged.streams[stream] = newCursor;\n    }\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ providerCommand: merged })\n      .where(processWhere(scope));\n    return merged;\n  });\n}\n\nexport type RetainedRouterOutputPage = {\n  expected: ModalRouterProviderCommand;\n  command: ModalRouterProviderCommand;\n  stdout: string;\n  stderr: string;\n};\n\nexport function validateRouterOutputAdvance(page: RetainedRouterOutputPage): void {\n  const before = ModalRouterProviderCommand.parse(page.expected);\n  const after = ModalRouterProviderCommand.parse(page.command);\n  if (!sameExecution(before, after)) throw new Error(\"Output capture changed execution identity\");\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    const oldCursor = before.streams[stream],\n      cursor = after.streams[stream];\n    if (\n      cursor.byteOffset < oldCursor.byteOffset ||\n      (oldCursor.eof && (!cursor.eof || cursor.byteOffset !== oldCursor.byteOffset)) ||\n      (oldCursor.exitCode !== null && !isDeepStrictEqual(oldCursor, cursor))\n    )\n      throw new Error(\"Output capture cannot regress or rewrite terminal evidence\");\n    if (\n      cursor.byteOffset === oldCursor.byteOffset &&\n      !(!oldCursor.eof && cursor.eof) &&\n      (page[stream].length > 0 || cursor.utf8Remainder !== oldCursor.utf8Remainder)\n    )\n      throw new Error(\"Output without byte advancement requires the first EOF\");\n    if (cursor.eof && cursor.utf8Remainder !== \"\")\n      throw new Error(\"EOF must flush pending UTF-8 bytes\");\n    if (Buffer.byteLength(page[stream]) > 4 * 1024 * 1024)\n      throw new Error(\"Command output page exceeds its capture bound\");\n  }\n}\n\n/** Capture and offsets commit atomically. The session lock is acquired before\n * the process lock, matching the event-write lock order. A concurrent reader\n * with a stale cursor discards its page and reloads; it never appends overlapping\n * output or silently advances the other reader's cursor. */\nexport async function captureRetainedRouterOutput(\n  db: Database,\n  scope: ProcessScope,\n  page: RetainedRouterOutputPage,\n): Promise<{ command: ModalRouterProviderCommand; events: SessionEvent[]; captured: boolean }> {\n  validateRouterOutputAdvance(page);\n  return await withSessionActivityRlsContext(db, scope, async (tx) => {\n    const locks = await lockSessionEventWriteRows(tx, {\n      workspaceId: scope.workspaceId,\n      sessionIds: [scope.sessionId],\n      controlLock: \"share\",\n    });\n    if (locks.sessions[0]?.accountId !== scope.accountId)\n      throw new Error(\"Command output session not found\");\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand || row.providerBackend !== \"modal\")\n      throw new Error(\"Retained provider command is unavailable\");\n    const current = ModalRouterProviderCommand.parse(row.providerCommand);\n    if (!sameExecution(current, page.expected))\n      throw new Error(\"Output capture does not own this execution\");\n    if (!isDeepStrictEqual(current, page.expected))\n      return { command: current, events: [], captured: false };\n    const events: SessionEvent[] = [];\n    for (const stream of [\"stdout\", \"stderr\"] as const) {\n      const before = current.streams[stream],\n        after = page.command.streams[stream];\n      if (page[stream])\n        events.push(\n          ...(await appendSessionCommandOutput(tx, {\n            ...scope,\n            commandId: scope.processId,\n            stream,\n            streamFidelity: current.pty ? \"merged\" : \"separate\",\n            chunkId: `modal-router:${current.execId}:${stream}:${before.byteOffset}:${after.byteOffset}:${after.eof ? 1 : 0}`,\n            chunk: page[stream],\n          })),\n        );\n    }\n    if (supervisionDescriptor(page.command)) {\n      await tx.execute(\n        sql`select set_config('opengeni.supervised_output_capture_process_id', ${scope.processId}, true)`,\n      );\n    }\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({\n        providerCommand: page.command,\n        ...(supervisionDescriptor(page.command) &&\n        page.command.streams.stdout.eof &&\n        page.command.streams.stderr.eof &&\n        page.command.streams.stdout.exitCode === 0 &&\n        page.command.streams.stderr.exitCode === 0\n          ? { supervisionOutputCaptured: true }\n          : {}),\n      })\n      .where(processWhere(scope));\n    if (supervisionDescriptor(page.command)) {\n      await tx.execute(\n        sql`select set_config('opengeni.supervised_output_capture_process_id', '', true)`,\n      );\n    }\n    return { command: page.command, events, captured: true };\n  });\n}\n\n/** Reserve a strictly increasing provider stdin index before dispatch. An\n * ambiguous send consumes its index and is never silently replayed. */\nexport async function reserveRetainedProviderInput(\n  db: Database,\n  scope: ProcessScope,\n  byteLength?: number,\n): Promise<number> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand || row.state !== \"active\")\n      throw new Error(\"Active retained provider command is unavailable\");\n    if (row.cancellationRequestedAt || row.supervisionReceipt)\n      throw new Error(\"Retained command input is closed\");\n    const router = row.providerCommand.kind === \"modal-router-v1\";\n    if (router && (!Number.isSafeInteger(byteLength) || byteLength! <= 0))\n      throw new Error(\"Byte-offset stdin requires a positive byte reservation\");\n    const index = row.providerCommandInputIndex + (router ? byteLength! : 1);\n    if (!Number.isSafeInteger(index)) throw new Error(\"Provider stdin sequence exhausted\");\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ providerCommandInputIndex: index })\n      .where(processWhere(scope));\n    return router ? row.providerCommandInputIndex : index;\n  });\n}\n\nexport type SupervisionReceipt = CommandSupervisionReceipt;\n\nfunction supervisionDescriptor(command: SandboxProviderCommand) {\n  return command.kind === \"modal-router-v1\" ? command.supervision : undefined;\n}\n\n/** Fail before provider start, not after discovering an unprotected DB at retention. */\nexport async function supervisedCommandProtocolReady(db: Database): Promise<boolean> {\n  const [row] = await db.execute<{ ready: boolean }>(sql`\n    select count(*) = 5 as ready from pg_catalog.pg_trigger\n    where (tgrelid, tgname) in (\n      ('sandbox_retained_processes'::regclass, 'supervised_command_guard'),\n      ('sandbox_retained_processes'::regclass, 'supervised_provider_loss_commit_guard'),\n      ('sandbox_workspace_mutation_admissions'::regclass, 'supervised_command_admission_guard'),\n      ('sandbox_lease_holders'::regclass, 'supervised_command_holder_guard'),\n      ('sandbox_leases'::regclass, 'supervised_command_capture_guard')\n    ) and tgenabled in ('O', 'A') and not tgisinternal\n  `);\n  return row?.ready === true;\n}\n\n/** Only an authenticated control-channel receipt; never parsed stdout/stderr.\n * ACK the supervisor only after this transaction returns successfully. */\nexport async function recordRetainedSupervisionReceipt(\n  db: Database,\n  scope: ProcessScope,\n  receipt: SupervisionReceipt,\n): Promise<void> {\n  const proof = CommandSupervisionReceipt.parse(receipt);\n  await withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand || !supervisionDescriptor(row.providerCommand))\n      throw new Error(\"Supervised retained command is unavailable\");\n    // Trigger validates invocation binding, immutable replay and unsettled input.\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ supervisionReceipt: proof })\n      .where(processWhere(scope));\n  });\n}\n\nexport async function loadRetainedSupervisionReceipt(\n  db: Database,\n  scope: ProcessScope,\n): Promise<SupervisionReceipt | null> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select({ receipt: schema.sandboxRetainedProcesses.supervisionReceipt })\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .limit(1);\n    if (!row) throw new Error(\"Retained command is unavailable\");\n    return row.receipt ? CommandSupervisionReceipt.parse(row.receipt) : null;\n  });\n}\n\nexport async function requestRetainedProcessCancellation(\n  db: Database,\n  scope: ProcessScope,\n  reason: \"provider_deadline\" | \"explicit_stop\",\n): Promise<void> {\n  if (reason !== \"provider_deadline\" && reason !== \"explicit_stop\")\n    throw new Error(\"Invalid cancellation reason\");\n  await withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row) throw new Error(\"Retained command is unavailable\");\n    if (row.cancellationRequestedAt || row.state !== \"active\") return;\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ cancellationRequestedAt: new Date(), cancellationReason: reason })\n      .where(processWhere(scope));\n  });\n}\n\nexport async function retainedProcessCancellationRequested(\n  db: Database,\n  scope: ProcessScope,\n): Promise<boolean> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select({ at: schema.sandboxRetainedProcesses.cancellationRequestedAt })\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .limit(1);\n    if (!row) throw new Error(\"Retained command is unavailable\");\n    return row.at !== null;\n  });\n}\n\n/** Called by the reaper for an exact retained command. Ordinary completed turns\n * are intentionally irrelevant. Lock order remains process -> lease. */\nexport async function requestRetainedProcessDeadlineCancellation(\n  db: Database,\n  scope: ProcessScope,\n): Promise<boolean> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (\n      !row ||\n      row.state !== \"active\" ||\n      !row.providerCommand ||\n      !supervisionDescriptor(row.providerCommand)\n    )\n      return false;\n    const [lease] = await tx.execute<{ id: string }>(sql`\n      select id from sandbox_leases where id = ${row.leaseId}\n        and account_id = ${row.accountId} and workspace_id = ${row.workspaceId}\n        and sandbox_group_id = ${row.sandboxGroupId} and lease_epoch = ${row.leaseEpoch}\n        and backend = ${row.providerBackend} and instance_id = ${row.providerInstanceId}\n        and rotation_requested_at is not null and rotation_reason = 'provider_deadline' for update\n    `);\n    if (!lease) return false;\n    if (!row.cancellationRequestedAt)\n      await tx\n        .update(schema.sandboxRetainedProcesses)\n        .set({ cancellationRequestedAt: new Date(), cancellationReason: \"provider_deadline\" })\n        .where(processWhere(scope));\n    return true;\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,KAAK,IAAI,WAAW;AAC7B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAcA,SAAS,mCACd,IACA,OACA,SACA;AACA,SAAO;AAAA,IACL,0BAA0B,CAAC,YACzB,iCAAiC,IAAI,OAAO,OAAO;AAAA,IACrD,wBAAwB,MAAM,+BAA+B,IAAI,KAAK;AAAA,IACtE,qBAAqB,CAAC,WACpB,mCAAmC,IAAI,OAAO,MAAM;AAAA,IACtD,uBAAuB,MAAM,qCAAqC,IAAI,KAAK;AAAA,IAC3E,MAAM,MAAM,2BAA2B,IAAI,KAAK;AAAA,IAChD,aAAa,CAAC,YACZ,kCAAkC,IAAI,OAAO,OAAO;AAAA,IACtD,cAAc,CAAC,eAAwB,6BAA6B,IAAI,OAAO,UAAU;AAAA,IACzF,mBAAmB,OAAO,SAAmC;AAC3D,YAAM,SAAS,MAAM,4BAA4B,IAAI,OAAO,IAAI;AAEhE,UAAI,OAAO,OAAO,UAAU,QAAS,OAAM,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AACvF,aAAO,EAAE,SAAS,OAAO,SAAS,UAAU,OAAO,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,SAAS,aAAa,OAAqB;AACzC,SAAO;AAAA,IACL,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,IAC7D,GAAU,yBAAyB,aAAa,MAAM,WAAW;AAAA,IACjE,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,IAC7D,GAAU,yBAAyB,IAAI,MAAM,SAAS;AAAA,EACxD;AACF;AAEA,SAAS,cAAc,GAA2B,GAAoC;AACpF,SACE,EAAE,SAAS,EAAE,QACb,EAAE,cAAc,EAAE,aAClB,EAAE,WAAW,EAAE,UACf,EAAE,WAAW,EAAE,UACf,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,GAAG,KAChC,kBAAkB,sBAAsB,CAAC,GAAG,sBAAsB,CAAC,CAAC;AAExE;AAKO,SAAS,8BACd,SACA,yBACA;AACA,SAAO,eAAe,+BACpB,IACA,OACkB;AAClB,QAAI,CAAC,MAAM,gBAAiB,QAAO,QAAQ,IAAI,KAAK;AACpD,UAAM,UAAU,uBAAuB,MAAM,MAAM,eAAe;AAClE,UAAM,SAAS,MAAM,eAAe,IAAI,OAAO,OAAO,OAAO;AAC3D,UAAI;AACJ,UAAI,YAAqB;AACzB,UAAI;AACF,kBAAU,MAAM,QAAQ,IAAI,KAAK;AAAA,MACnC,SAAS,OAAO;AACd,cAAM,UAAU,wBAAwB,KAAK;AAC7C,YAAI,YAAY,KAAM,OAAM;AAC5B,kBAAU;AACV,oBAAY;AAAA,MACd;AACA,YAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,UAAI,CAAC,OAAO,IAAI,oBAAoB,WAAW,IAAI,uBAAuB,QAAQ;AAChF,cAAM,IAAI,MAAM,sDAAsD;AACxE,UAAI,IAAI,iBAAiB;AACvB,YAAI,CAAC,cAAc,uBAAuB,MAAM,IAAI,eAAe,GAAG,OAAO;AAC3E,gBAAM,IAAI,MAAM,6DAA6D;AAAA,MACjF,OAAO;AACL,cAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,iBAAiB,QAAQ,CAAC,EAChC,MAAM,aAAa,KAAK,CAAC;AAAA,MAC9B;AACA,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B,CAAC;AACD,QAAI,OAAO,UAAW,OAAM,OAAO;AACnC,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,eAAsB,2BACpB,IACA,OACwC;AACxC,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EAAE,SAAgB,yBAAyB,gBAAgB,CAAC,EACnE,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,MAAM,CAAC;AACV,WAAO,KAAK,UAAU,uBAAuB,MAAM,IAAI,OAAO,IAAI;AAAA,EACpE,CAAC;AACH;AAIA,eAAsB,kCACpB,IACA,OACA,WACiC;AACjC,QAAM,OAAO,uBAAuB,MAAM,SAAS;AACnD,MAAI,KAAK,SAAS;AAChB,UAAM,IAAI,MAAM,oDAAoD;AACtE,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,gBAAiB,OAAM,IAAI,MAAM,0CAA0C;AACrF,UAAM,WAAW,uBAAuB,MAAM,IAAI,eAAe;AACjE,QAAI,SAAS,SAAS;AACpB,YAAM,IAAI,MAAM,yDAAyD;AAC3E,QAAI,CAAC,cAAc,UAAU,IAAI;AAC/B,YAAM,IAAI,MAAM,2DAA2D;AAC7E,UAAM,SAAS,gBAAgB,QAAQ;AACvC,eAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,YAAM,YAAY,SAAS,QAAQ,MAAM;AACzC,YAAM,YAAY,KAAK,QAAQ,MAAM;AACrC,UAAI,UAAU,aAAa,UAAU,WAAY;AACjD,WACG,UAAU,eAAe,UAAU,cAAc,UAAU,aAAa,SACzE,CAAC,kBAAkB,WAAW,SAAS;AAEvC,cAAM,IAAI,MAAM,iEAAiE;AACnF,aAAO,QAAQ,MAAM,IAAI;AAAA,IAC3B;AACA,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,iBAAiB,OAAO,CAAC,EAC/B,MAAM,aAAa,KAAK,CAAC;AAC5B,WAAO;AAAA,EACT,CAAC;AACH;AASO,SAAS,4BAA4B,MAAsC;AAChF,QAAM,SAAS,2BAA2B,MAAM,KAAK,QAAQ;AAC7D,QAAM,QAAQ,2BAA2B,MAAM,KAAK,OAAO;AAC3D,MAAI,CAAC,cAAc,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,2CAA2C;AAC9F,aAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,UAAM,YAAY,OAAO,QAAQ,MAAM,GACrC,SAAS,MAAM,QAAQ,MAAM;AAC/B,QACE,OAAO,aAAa,UAAU,cAC7B,UAAU,QAAQ,CAAC,OAAO,OAAO,OAAO,eAAe,UAAU,eACjE,UAAU,aAAa,QAAQ,CAAC,kBAAkB,WAAW,MAAM;AAEpE,YAAM,IAAI,MAAM,4DAA4D;AAC9E,QACE,OAAO,eAAe,UAAU,cAChC,EAAE,CAAC,UAAU,OAAO,OAAO,SAC1B,KAAK,MAAM,EAAE,SAAS,KAAK,OAAO,kBAAkB,UAAU;AAE/D,YAAM,IAAI,MAAM,wDAAwD;AAC1E,QAAI,OAAO,OAAO,OAAO,kBAAkB;AACzC,YAAM,IAAI,MAAM,oCAAoC;AACtD,QAAI,OAAO,WAAW,KAAK,MAAM,CAAC,IAAI,IAAI,OAAO;AAC/C,YAAM,IAAI,MAAM,+CAA+C;AAAA,EACnE;AACF;AAMA,eAAsB,4BACpB,IACA,OACA,MAC6F;AAC7F,8BAA4B,IAAI;AAChC,SAAO,MAAM,8BAA8B,IAAI,OAAO,OAAO,OAAO;AAClE,UAAM,QAAQ,MAAM,0BAA0B,IAAI;AAAA,MAChD,aAAa,MAAM;AAAA,MACnB,YAAY,CAAC,MAAM,SAAS;AAAA,MAC5B,aAAa;AAAA,IACf,CAAC;AACD,QAAI,MAAM,SAAS,CAAC,GAAG,cAAc,MAAM;AACzC,YAAM,IAAI,MAAM,kCAAkC;AACpD,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,mBAAmB,IAAI,oBAAoB;AACnD,YAAM,IAAI,MAAM,0CAA0C;AAC5D,UAAM,UAAU,2BAA2B,MAAM,IAAI,eAAe;AACpE,QAAI,CAAC,cAAc,SAAS,KAAK,QAAQ;AACvC,YAAM,IAAI,MAAM,4CAA4C;AAC9D,QAAI,CAAC,kBAAkB,SAAS,KAAK,QAAQ;AAC3C,aAAO,EAAE,SAAS,SAAS,QAAQ,CAAC,GAAG,UAAU,MAAM;AACzD,UAAM,SAAyB,CAAC;AAChC,eAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,YAAM,SAAS,QAAQ,QAAQ,MAAM,GACnC,QAAQ,KAAK,QAAQ,QAAQ,MAAM;AACrC,UAAI,KAAK,MAAM;AACb,eAAO;AAAA,UACL,GAAI,MAAM,2BAA2B,IAAI;AAAA,YACvC,GAAG;AAAA,YACH,WAAW,MAAM;AAAA,YACjB;AAAA,YACA,gBAAgB,QAAQ,MAAM,WAAW;AAAA,YACzC,SAAS,gBAAgB,QAAQ,MAAM,IAAI,MAAM,IAAI,OAAO,UAAU,IAAI,MAAM,UAAU,IAAI,MAAM,MAAM,IAAI,CAAC;AAAA,YAC/G,OAAO,KAAK,MAAM;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,IACJ;AACA,QAAI,sBAAsB,KAAK,OAAO,GAAG;AACvC,YAAM,GAAG;AAAA,QACP,yEAAyE,MAAM,SAAS;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI;AAAA,MACH,iBAAiB,KAAK;AAAA,MACtB,GAAI,sBAAsB,KAAK,OAAO,KACtC,KAAK,QAAQ,QAAQ,OAAO,OAC5B,KAAK,QAAQ,QAAQ,OAAO,OAC5B,KAAK,QAAQ,QAAQ,OAAO,aAAa,KACzC,KAAK,QAAQ,QAAQ,OAAO,aAAa,IACrC,EAAE,2BAA2B,KAAK,IAClC,CAAC;AAAA,IACP,CAAC,EACA,MAAM,aAAa,KAAK,CAAC;AAC5B,QAAI,sBAAsB,KAAK,OAAO,GAAG;AACvC,YAAM,GAAG;AAAA,QACP;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,KAAK,SAAS,QAAQ,UAAU,KAAK;AAAA,EACzD,CAAC;AACH;AAIA,eAAsB,6BACpB,IACA,OACA,YACiB;AACjB,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,mBAAmB,IAAI,UAAU;AACzC,YAAM,IAAI,MAAM,iDAAiD;AACnE,QAAI,IAAI,2BAA2B,IAAI;AACrC,YAAM,IAAI,MAAM,kCAAkC;AACpD,UAAM,SAAS,IAAI,gBAAgB,SAAS;AAC5C,QAAI,WAAW,CAAC,OAAO,cAAc,UAAU,KAAK,cAAe;AACjE,YAAM,IAAI,MAAM,wDAAwD;AAC1E,UAAM,QAAQ,IAAI,6BAA6B,SAAS,aAAc;AACtE,QAAI,CAAC,OAAO,cAAc,KAAK,EAAG,OAAM,IAAI,MAAM,mCAAmC;AACrF,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,2BAA2B,MAAM,CAAC,EACxC,MAAM,aAAa,KAAK,CAAC;AAC5B,WAAO,SAAS,IAAI,4BAA4B;AAAA,EAClD,CAAC;AACH;AAIA,SAAS,sBAAsB,SAAiC;AAC9D,SAAO,QAAQ,SAAS,oBAAoB,QAAQ,cAAc;AACpE;AAGA,eAAsB,+BAA+B,IAAgC;AACnF,QAAM,CAAC,GAAG,IAAI,MAAM,GAAG,QAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GASlD;AACD,SAAO,KAAK,UAAU;AACxB;AAIA,eAAsB,iCACpB,IACA,OACA,SACe;AACf,QAAM,QAAQ,0BAA0B,MAAM,OAAO;AACrD,QAAM,eAAe,IAAI,OAAO,OAAO,OAAO;AAC5C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,mBAAmB,CAAC,sBAAsB,IAAI,eAAe;AACrE,YAAM,IAAI,MAAM,4CAA4C;AAE9D,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,oBAAoB,MAAM,CAAC,EACjC,MAAM,aAAa,KAAK,CAAC;AAAA,EAC9B,CAAC;AACH;AAEA,eAAsB,+BACpB,IACA,OACoC;AACpC,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EAAE,SAAgB,yBAAyB,mBAAmB,CAAC,EACtE,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,MAAM,CAAC;AACV,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iCAAiC;AAC3D,WAAO,IAAI,UAAU,0BAA0B,MAAM,IAAI,OAAO,IAAI;AAAA,EACtE,CAAC;AACH;AAEA,eAAsB,mCACpB,IACA,OACA,QACe;AACf,MAAI,WAAW,uBAAuB,WAAW;AAC/C,UAAM,IAAI,MAAM,6BAA6B;AAC/C,QAAM,eAAe,IAAI,OAAO,OAAO,OAAO;AAC5C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iCAAiC;AAC3D,QAAI,IAAI,2BAA2B,IAAI,UAAU,SAAU;AAC3D,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,yBAAyB,oBAAI,KAAK,GAAG,oBAAoB,OAAO,CAAC,EACvE,MAAM,aAAa,KAAK,CAAC;AAAA,EAC9B,CAAC;AACH;AAEA,eAAsB,qCACpB,IACA,OACkB;AAClB,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EAAE,IAAW,yBAAyB,wBAAwB,CAAC,EACtE,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,MAAM,CAAC;AACV,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iCAAiC;AAC3D,WAAO,IAAI,OAAO;AAAA,EACpB,CAAC;AACH;AAIA,eAAsB,2CACpB,IACA,OACkB;AAClB,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QACE,CAAC,OACD,IAAI,UAAU,YACd,CAAC,IAAI,mBACL,CAAC,sBAAsB,IAAI,eAAe;AAE1C,aAAO;AACT,UAAM,CAAC,KAAK,IAAI,MAAM,GAAG,QAAwB;AAAA,iDACJ,IAAI,OAAO;AAAA,2BACjC,IAAI,SAAS,uBAAuB,IAAI,WAAW;AAAA,iCAC7C,IAAI,cAAc,sBAAsB,IAAI,UAAU;AAAA,wBAC/D,IAAI,eAAe,sBAAsB,IAAI,kBAAkB;AAAA;AAAA,KAElF;AACD,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,CAAC,IAAI;AACP,YAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,yBAAyB,oBAAI,KAAK,GAAG,oBAAoB,oBAAoB,CAAC,EACpF,MAAM,aAAa,KAAK,CAAC;AAC9B,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/retained-provider-commands.ts"],"sourcesContent":["import { and, eq, sql } from \"drizzle-orm\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport {\n  SandboxProviderCommand,\n  ModalRouterProviderCommand,\n  CommandSupervisionReceipt,\n  type SessionEvent,\n} from \"@opengeni/contracts\";\nimport { withRlsContext, withSessionActivityRlsContext, type Database } from \"./database\";\nimport { lockSessionEventWriteRows } from \"./session-control\";\nimport { appendSessionCommandOutput } from \"./session-command-output\";\nimport * as schema from \"./schema\";\n\nexport type ProcessScope = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  processId: string;\n};\n\n/** Bound to an already-authorized exact process scope by runtime wiring. */\nexport function retainedProviderCommandPersistence(\n  db: Database,\n  scope: ProcessScope,\n  publish?: (events: SessionEvent[]) => Promise<void>,\n) {\n  return {\n    recordSupervisionReceipt: (receipt: SupervisionReceipt) =>\n      recordRetainedSupervisionReceipt(db, scope, receipt),\n    loadSupervisionReceipt: () => loadRetainedSupervisionReceipt(db, scope),\n    requestCancellation: (reason: \"provider_deadline\" | \"explicit_stop\") =>\n      requestRetainedProcessCancellation(db, scope, reason),\n    cancellationRequested: () => retainedProcessCancellationRequested(db, scope),\n    load: () => getRetainedProviderCommand(db, scope),\n    acknowledge: (command: SandboxProviderCommand) =>\n      acknowledgeRetainedProviderOutput(db, scope, command),\n    reserveInput: (byteLength?: number) => reserveRetainedProviderInput(db, scope, byteLength),\n    captureRouterPage: async (page: RetainedRouterOutputPage) => {\n      const result = await captureRetainedRouterOutput(db, scope, page);\n      // A committed capture is authoritative even if live fanout fails.\n      if (result.events.length && publish) await publish(result.events).catch(() => undefined);\n      return { command: result.command, captured: result.captured };\n    },\n  };\n}\n\nfunction processWhere(scope: ProcessScope) {\n  return and(\n    eq(schema.sandboxRetainedProcesses.accountId, scope.accountId),\n    eq(schema.sandboxRetainedProcesses.workspaceId, scope.workspaceId),\n    eq(schema.sandboxRetainedProcesses.sessionId, scope.sessionId),\n    eq(schema.sandboxRetainedProcesses.id, scope.processId),\n  );\n}\n\nfunction sameExecution(a: SandboxProviderCommand, b: SandboxProviderCommand): boolean {\n  return (\n    a.kind === b.kind &&\n    a.sandboxId === b.sandboxId &&\n    a.taskId === b.taskId &&\n    a.execId === b.execId &&\n    Boolean(a.pty) === Boolean(b.pty) &&\n    isDeepStrictEqual(supervisionDescriptor(a), supervisionDescriptor(b))\n  );\n}\n\n/** Promotion and the opaque provider locator commit together. Preserve the\n * existing durable-but-output-rejected promotion contract: its typed rejection\n * is rethrown only AFTER this outer transaction has committed the locator. */\nexport function createProviderCommandRetainer<Input extends ProcessScope, Process>(\n  promote: (db: Database, input: Input) => Promise<Process>,\n  recoverDurablePromotion: (error: unknown) => Process | null,\n) {\n  return async function retainWorkspaceProviderCommand(\n    db: Database,\n    input: Input & { providerCommand?: SandboxProviderCommand | null },\n  ): Promise<Process> {\n    if (!input.providerCommand) return promote(db, input);\n    const command = SandboxProviderCommand.parse(input.providerCommand);\n    const result = await withRlsContext(db, input, async (tx) => {\n      let process: Process;\n      let rejection: unknown = null;\n      try {\n        process = await promote(tx, input);\n      } catch (error) {\n        const durable = recoverDurablePromotion(error);\n        if (durable === null) throw error;\n        process = durable;\n        rejection = error;\n      }\n      const [row] = await tx\n        .select()\n        .from(schema.sandboxRetainedProcesses)\n        .where(processWhere(input))\n        .for(\"update\")\n        .limit(1);\n      if (!row || row.providerBackend !== \"modal\" || row.providerInstanceId !== command.sandboxId)\n        throw new Error(\"Provider command does not match its retained sandbox\");\n      if (row.providerCommand) {\n        if (!sameExecution(SandboxProviderCommand.parse(row.providerCommand), command))\n          throw new Error(\"Retained process already has a different provider execution\");\n      } else {\n        await tx\n          .update(schema.sandboxRetainedProcesses)\n          .set({ providerCommand: command })\n          .where(processWhere(input));\n      }\n      return { process, rejection };\n    });\n    if (result.rejection) throw result.rejection;\n    return result.process;\n  };\n}\n\nexport async function getRetainedProviderCommand(\n  db: Database,\n  scope: ProcessScope,\n): Promise<SandboxProviderCommand | null> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select({ command: schema.sandboxRetainedProcesses.providerCommand })\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .limit(1);\n    return row?.command ? SandboxProviderCommand.parse(row.command) : null;\n  });\n}\n\n/** Call only after all output in this provider page has been durably captured.\n * A stale acknowledgment cannot roll back a cursor or erase terminal evidence. */\nexport async function acknowledgeRetainedProviderOutput(\n  db: Database,\n  scope: ProcessScope,\n  candidate: SandboxProviderCommand,\n): Promise<SandboxProviderCommand> {\n  const next = SandboxProviderCommand.parse(candidate);\n  if (next.kind !== \"modal-control-v1\")\n    throw new Error(\"Byte-offset command output requires atomic capture\");\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand) throw new Error(\"Retained provider command is unavailable\");\n    const previous = SandboxProviderCommand.parse(row.providerCommand);\n    if (previous.kind !== \"modal-control-v1\")\n      throw new Error(\"Legacy acknowledgment cannot advance byte-offset output\");\n    if (!sameExecution(previous, next))\n      throw new Error(\"Output acknowledgment changed provider execution identity\");\n    const merged = structuredClone(previous);\n    for (const stream of [\"stdout\", \"stderr\"] as const) {\n      const oldCursor = previous.streams[stream];\n      const newCursor = next.streams[stream];\n      if (newCursor.batchIndex < oldCursor.batchIndex) continue;\n      if (\n        (newCursor.batchIndex === oldCursor.batchIndex || oldCursor.exitCode !== null) &&\n        !isDeepStrictEqual(oldCursor, newCursor)\n      )\n        throw new Error(\"Provider output acknowledgment conflicts with retained evidence\");\n      merged.streams[stream] = newCursor;\n    }\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ providerCommand: merged })\n      .where(processWhere(scope));\n    return merged;\n  });\n}\n\nexport type RetainedRouterOutputPage = {\n  expected: ModalRouterProviderCommand;\n  command: ModalRouterProviderCommand;\n  stdout: string;\n  stderr: string;\n};\n\nexport function validateRouterOutputAdvance(page: RetainedRouterOutputPage): void {\n  const before = ModalRouterProviderCommand.parse(page.expected);\n  const after = ModalRouterProviderCommand.parse(page.command);\n  if (!sameExecution(before, after)) throw new Error(\"Output capture changed execution identity\");\n  for (const stream of [\"stdout\", \"stderr\"] as const) {\n    const oldCursor = before.streams[stream],\n      cursor = after.streams[stream];\n    if (\n      cursor.byteOffset < oldCursor.byteOffset ||\n      (oldCursor.eof && (!cursor.eof || cursor.byteOffset !== oldCursor.byteOffset)) ||\n      (oldCursor.exitCode !== null && !isDeepStrictEqual(oldCursor, cursor))\n    )\n      throw new Error(\"Output capture cannot regress or rewrite terminal evidence\");\n    if (\n      cursor.byteOffset === oldCursor.byteOffset &&\n      !(!oldCursor.eof && cursor.eof) &&\n      (page[stream].length > 0 || cursor.utf8Remainder !== oldCursor.utf8Remainder)\n    )\n      throw new Error(\"Output without byte advancement requires the first EOF\");\n    if (cursor.eof && cursor.utf8Remainder !== \"\")\n      throw new Error(\"EOF must flush pending UTF-8 bytes\");\n    if (Buffer.byteLength(page[stream]) > 4 * 1024 * 1024)\n      throw new Error(\"Command output page exceeds its capture bound\");\n  }\n}\n\n/** Capture and offsets commit atomically. The session lock is acquired before\n * the process lock, matching the event-write lock order. A concurrent reader\n * with a stale cursor discards its page and reloads; it never appends overlapping\n * output or silently advances the other reader's cursor. */\nexport async function captureRetainedRouterOutput(\n  db: Database,\n  scope: ProcessScope,\n  page: RetainedRouterOutputPage,\n): Promise<{ command: ModalRouterProviderCommand; events: SessionEvent[]; captured: boolean }> {\n  validateRouterOutputAdvance(page);\n  return await withSessionActivityRlsContext(db, scope, async (tx) => {\n    const locks = await lockSessionEventWriteRows(tx, {\n      workspaceId: scope.workspaceId,\n      sessionIds: [scope.sessionId],\n      controlLock: \"share\",\n    });\n    if (locks.sessions[0]?.accountId !== scope.accountId)\n      throw new Error(\"Command output session not found\");\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand || row.providerBackend !== \"modal\")\n      throw new Error(\"Retained provider command is unavailable\");\n    const current = ModalRouterProviderCommand.parse(row.providerCommand);\n    if (!sameExecution(current, page.expected))\n      throw new Error(\"Output capture does not own this execution\");\n    if (!isDeepStrictEqual(current, page.expected))\n      return { command: current, events: [], captured: false };\n    const events: SessionEvent[] = [];\n    for (const stream of [\"stdout\", \"stderr\"] as const) {\n      const before = current.streams[stream],\n        after = page.command.streams[stream];\n      if (page[stream])\n        events.push(\n          ...(await appendSessionCommandOutput(tx, {\n            ...scope,\n            commandId: scope.processId,\n            stream,\n            streamFidelity: current.pty ? \"merged\" : \"separate\",\n            chunkId: `modal-router:${current.execId}:${stream}:${before.byteOffset}:${after.byteOffset}:${after.eof ? 1 : 0}`,\n            chunk: page[stream],\n          })),\n        );\n    }\n    if (supervisionDescriptor(page.command)) {\n      await tx.execute(\n        sql`select set_config('opengeni.supervised_output_capture_process_id', ${scope.processId}, true)`,\n      );\n    }\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({\n        providerCommand: page.command,\n        ...(supervisionDescriptor(page.command) &&\n        page.command.streams.stdout.eof &&\n        page.command.streams.stderr.eof &&\n        page.command.streams.stdout.exitCode === 0 &&\n        page.command.streams.stderr.exitCode === 0\n          ? { supervisionOutputCaptured: true }\n          : {}),\n      })\n      .where(processWhere(scope));\n    if (supervisionDescriptor(page.command)) {\n      await tx.execute(\n        sql`select set_config('opengeni.supervised_output_capture_process_id', '', true)`,\n      );\n    }\n    return { command: page.command, events, captured: true };\n  });\n}\n\n/** Reserve a strictly increasing provider stdin index before dispatch. An\n * ambiguous send consumes its index and is never silently replayed. */\nexport async function reserveRetainedProviderInput(\n  db: Database,\n  scope: ProcessScope,\n  byteLength?: number,\n): Promise<number> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand || row.state !== \"active\")\n      throw new Error(\"Active retained provider command is unavailable\");\n    if (row.cancellationRequestedAt || row.supervisionReceipt)\n      throw new Error(\"Retained command input is closed\");\n    const router = row.providerCommand.kind === \"modal-router-v1\";\n    if (router && (!Number.isSafeInteger(byteLength) || byteLength! <= 0))\n      throw new Error(\"Byte-offset stdin requires a positive byte reservation\");\n    const index = row.providerCommandInputIndex + (router ? byteLength! : 1);\n    if (!Number.isSafeInteger(index)) throw new Error(\"Provider stdin sequence exhausted\");\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ providerCommandInputIndex: index })\n      .where(processWhere(scope));\n    return router ? row.providerCommandInputIndex : index;\n  });\n}\n\nexport type SupervisionReceipt = CommandSupervisionReceipt;\n\nfunction supervisionDescriptor(command: SandboxProviderCommand) {\n  return command.kind === \"modal-router-v1\" ? command.supervision : undefined;\n}\n\n/** Fail before provider start, not after discovering an unprotected DB at retention. */\nexport async function supervisedCommandProtocolReady(db: Database): Promise<boolean> {\n  const [row] = await db.execute<{ ready: boolean }>(sql`\n    select count(*) = 5 as ready from pg_catalog.pg_trigger\n    where (tgrelid, tgname) in (\n      ('sandbox_retained_processes'::regclass, 'supervised_command_guard'),\n      ('sandbox_retained_processes'::regclass, 'supervised_provider_loss_commit_guard'),\n      ('sandbox_workspace_mutation_admissions'::regclass, 'supervised_command_admission_guard'),\n      ('sandbox_lease_holders'::regclass, 'supervised_command_holder_guard'),\n      ('sandbox_leases'::regclass, 'supervised_command_capture_guard')\n    ) and tgenabled in ('O', 'A') and not tgisinternal\n  `);\n  return row?.ready === true;\n}\n\n/** Only an authenticated control-channel receipt; never parsed stdout/stderr.\n * ACK the supervisor only after this transaction returns successfully. */\nexport async function recordRetainedSupervisionReceipt(\n  db: Database,\n  scope: ProcessScope,\n  receipt: SupervisionReceipt,\n): Promise<void> {\n  const proof = CommandSupervisionReceipt.parse(receipt);\n  await withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row?.providerCommand || !supervisionDescriptor(row.providerCommand))\n      throw new Error(\"Supervised retained command is unavailable\");\n    // Trigger validates invocation binding, immutable replay and unsettled input.\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ supervisionReceipt: proof })\n      .where(processWhere(scope));\n  });\n}\n\nexport async function loadRetainedSupervisionReceipt(\n  db: Database,\n  scope: ProcessScope,\n): Promise<SupervisionReceipt | null> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select({ receipt: schema.sandboxRetainedProcesses.supervisionReceipt })\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .limit(1);\n    if (!row) throw new Error(\"Retained command is unavailable\");\n    return row.receipt ? CommandSupervisionReceipt.parse(row.receipt) : null;\n  });\n}\n\nexport async function requestRetainedProcessCancellation(\n  db: Database,\n  scope: ProcessScope,\n  reason: \"provider_deadline\" | \"explicit_stop\",\n): Promise<void> {\n  if (reason !== \"provider_deadline\" && reason !== \"explicit_stop\")\n    throw new Error(\"Invalid cancellation reason\");\n  await withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (!row) throw new Error(\"Retained command is unavailable\");\n    if (row.cancellationRequestedAt || row.state !== \"active\") return;\n    await tx\n      .update(schema.sandboxRetainedProcesses)\n      .set({ cancellationRequestedAt: new Date(), cancellationReason: reason })\n      .where(processWhere(scope));\n  });\n}\n\nexport async function retainedProcessCancellationRequested(\n  db: Database,\n  scope: ProcessScope,\n): Promise<boolean> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select({ at: schema.sandboxRetainedProcesses.cancellationRequestedAt })\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .limit(1);\n    if (!row) throw new Error(\"Retained command is unavailable\");\n    return row.at !== null;\n  });\n}\n\n/** Record deadline cancellation for an exact retained Modal command. Legacy\n * PTY callers send Ctrl-C first because cancellation fences stdin; non-PTY\n * callers only probe, since Ctrl-C would be data. An earlier explicit stop\n * remains immutable; the deadline uses its own clock. Lock order: process -> lease. */\nexport async function requestRetainedProcessDeadlineCancellation(\n  db: Database,\n  scope: ProcessScope,\n): Promise<boolean> {\n  return withRlsContext(db, scope, async (tx) => {\n    const [row] = await tx\n      .select()\n      .from(schema.sandboxRetainedProcesses)\n      .where(processWhere(scope))\n      .for(\"update\")\n      .limit(1);\n    if (\n      !row ||\n      row.state !== \"active\" ||\n      row.providerBackend !== \"modal\" ||\n      row.routeTargetId !== null\n    )\n      return false;\n    const [lease] = await tx.execute<{ id: string }>(sql`\n      select id from sandbox_leases where id = ${row.leaseId}\n        and account_id = ${row.accountId} and workspace_id = ${row.workspaceId}\n        and sandbox_group_id = ${row.sandboxGroupId} and lease_epoch = ${row.leaseEpoch}\n        and backend = ${row.providerBackend} and instance_id = ${row.providerInstanceId}\n        and rotation_requested_at is not null and rotation_reason = 'provider_deadline' for update\n    `);\n    if (!lease) return false;\n    if (!row.deadlineCancellationRequestedAt || !row.cancellationRequestedAt) {\n      await tx\n        .update(schema.sandboxRetainedProcesses)\n        .set({\n          ...(!row.cancellationRequestedAt\n            ? { cancellationRequestedAt: sql`now()`, cancellationReason: \"provider_deadline\" }\n            : {}),\n          ...(!row.deadlineCancellationRequestedAt\n            ? { deadlineCancellationRequestedAt: sql`now()` }\n            : {}),\n        })\n        .where(processWhere(scope));\n    }\n    return true;\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,KAAK,IAAI,WAAW;AAC7B,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAcA,SAAS,mCACd,IACA,OACA,SACA;AACA,SAAO;AAAA,IACL,0BAA0B,CAAC,YACzB,iCAAiC,IAAI,OAAO,OAAO;AAAA,IACrD,wBAAwB,MAAM,+BAA+B,IAAI,KAAK;AAAA,IACtE,qBAAqB,CAAC,WACpB,mCAAmC,IAAI,OAAO,MAAM;AAAA,IACtD,uBAAuB,MAAM,qCAAqC,IAAI,KAAK;AAAA,IAC3E,MAAM,MAAM,2BAA2B,IAAI,KAAK;AAAA,IAChD,aAAa,CAAC,YACZ,kCAAkC,IAAI,OAAO,OAAO;AAAA,IACtD,cAAc,CAAC,eAAwB,6BAA6B,IAAI,OAAO,UAAU;AAAA,IACzF,mBAAmB,OAAO,SAAmC;AAC3D,YAAM,SAAS,MAAM,4BAA4B,IAAI,OAAO,IAAI;AAEhE,UAAI,OAAO,OAAO,UAAU,QAAS,OAAM,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AACvF,aAAO,EAAE,SAAS,OAAO,SAAS,UAAU,OAAO,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,SAAS,aAAa,OAAqB;AACzC,SAAO;AAAA,IACL,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,IAC7D,GAAU,yBAAyB,aAAa,MAAM,WAAW;AAAA,IACjE,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,IAC7D,GAAU,yBAAyB,IAAI,MAAM,SAAS;AAAA,EACxD;AACF;AAEA,SAAS,cAAc,GAA2B,GAAoC;AACpF,SACE,EAAE,SAAS,EAAE,QACb,EAAE,cAAc,EAAE,aAClB,EAAE,WAAW,EAAE,UACf,EAAE,WAAW,EAAE,UACf,QAAQ,EAAE,GAAG,MAAM,QAAQ,EAAE,GAAG,KAChC,kBAAkB,sBAAsB,CAAC,GAAG,sBAAsB,CAAC,CAAC;AAExE;AAKO,SAAS,8BACd,SACA,yBACA;AACA,SAAO,eAAe,+BACpB,IACA,OACkB;AAClB,QAAI,CAAC,MAAM,gBAAiB,QAAO,QAAQ,IAAI,KAAK;AACpD,UAAM,UAAU,uBAAuB,MAAM,MAAM,eAAe;AAClE,UAAM,SAAS,MAAM,eAAe,IAAI,OAAO,OAAO,OAAO;AAC3D,UAAI;AACJ,UAAI,YAAqB;AACzB,UAAI;AACF,kBAAU,MAAM,QAAQ,IAAI,KAAK;AAAA,MACnC,SAAS,OAAO;AACd,cAAM,UAAU,wBAAwB,KAAK;AAC7C,YAAI,YAAY,KAAM,OAAM;AAC5B,kBAAU;AACV,oBAAY;AAAA,MACd;AACA,YAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,UAAI,CAAC,OAAO,IAAI,oBAAoB,WAAW,IAAI,uBAAuB,QAAQ;AAChF,cAAM,IAAI,MAAM,sDAAsD;AACxE,UAAI,IAAI,iBAAiB;AACvB,YAAI,CAAC,cAAc,uBAAuB,MAAM,IAAI,eAAe,GAAG,OAAO;AAC3E,gBAAM,IAAI,MAAM,6DAA6D;AAAA,MACjF,OAAO;AACL,cAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,iBAAiB,QAAQ,CAAC,EAChC,MAAM,aAAa,KAAK,CAAC;AAAA,MAC9B;AACA,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B,CAAC;AACD,QAAI,OAAO,UAAW,OAAM,OAAO;AACnC,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,eAAsB,2BACpB,IACA,OACwC;AACxC,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EAAE,SAAgB,yBAAyB,gBAAgB,CAAC,EACnE,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,MAAM,CAAC;AACV,WAAO,KAAK,UAAU,uBAAuB,MAAM,IAAI,OAAO,IAAI;AAAA,EACpE,CAAC;AACH;AAIA,eAAsB,kCACpB,IACA,OACA,WACiC;AACjC,QAAM,OAAO,uBAAuB,MAAM,SAAS;AACnD,MAAI,KAAK,SAAS;AAChB,UAAM,IAAI,MAAM,oDAAoD;AACtE,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,gBAAiB,OAAM,IAAI,MAAM,0CAA0C;AACrF,UAAM,WAAW,uBAAuB,MAAM,IAAI,eAAe;AACjE,QAAI,SAAS,SAAS;AACpB,YAAM,IAAI,MAAM,yDAAyD;AAC3E,QAAI,CAAC,cAAc,UAAU,IAAI;AAC/B,YAAM,IAAI,MAAM,2DAA2D;AAC7E,UAAM,SAAS,gBAAgB,QAAQ;AACvC,eAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,YAAM,YAAY,SAAS,QAAQ,MAAM;AACzC,YAAM,YAAY,KAAK,QAAQ,MAAM;AACrC,UAAI,UAAU,aAAa,UAAU,WAAY;AACjD,WACG,UAAU,eAAe,UAAU,cAAc,UAAU,aAAa,SACzE,CAAC,kBAAkB,WAAW,SAAS;AAEvC,cAAM,IAAI,MAAM,iEAAiE;AACnF,aAAO,QAAQ,MAAM,IAAI;AAAA,IAC3B;AACA,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,iBAAiB,OAAO,CAAC,EAC/B,MAAM,aAAa,KAAK,CAAC;AAC5B,WAAO;AAAA,EACT,CAAC;AACH;AASO,SAAS,4BAA4B,MAAsC;AAChF,QAAM,SAAS,2BAA2B,MAAM,KAAK,QAAQ;AAC7D,QAAM,QAAQ,2BAA2B,MAAM,KAAK,OAAO;AAC3D,MAAI,CAAC,cAAc,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,2CAA2C;AAC9F,aAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,UAAM,YAAY,OAAO,QAAQ,MAAM,GACrC,SAAS,MAAM,QAAQ,MAAM;AAC/B,QACE,OAAO,aAAa,UAAU,cAC7B,UAAU,QAAQ,CAAC,OAAO,OAAO,OAAO,eAAe,UAAU,eACjE,UAAU,aAAa,QAAQ,CAAC,kBAAkB,WAAW,MAAM;AAEpE,YAAM,IAAI,MAAM,4DAA4D;AAC9E,QACE,OAAO,eAAe,UAAU,cAChC,EAAE,CAAC,UAAU,OAAO,OAAO,SAC1B,KAAK,MAAM,EAAE,SAAS,KAAK,OAAO,kBAAkB,UAAU;AAE/D,YAAM,IAAI,MAAM,wDAAwD;AAC1E,QAAI,OAAO,OAAO,OAAO,kBAAkB;AACzC,YAAM,IAAI,MAAM,oCAAoC;AACtD,QAAI,OAAO,WAAW,KAAK,MAAM,CAAC,IAAI,IAAI,OAAO;AAC/C,YAAM,IAAI,MAAM,+CAA+C;AAAA,EACnE;AACF;AAMA,eAAsB,4BACpB,IACA,OACA,MAC6F;AAC7F,8BAA4B,IAAI;AAChC,SAAO,MAAM,8BAA8B,IAAI,OAAO,OAAO,OAAO;AAClE,UAAM,QAAQ,MAAM,0BAA0B,IAAI;AAAA,MAChD,aAAa,MAAM;AAAA,MACnB,YAAY,CAAC,MAAM,SAAS;AAAA,MAC5B,aAAa;AAAA,IACf,CAAC;AACD,QAAI,MAAM,SAAS,CAAC,GAAG,cAAc,MAAM;AACzC,YAAM,IAAI,MAAM,kCAAkC;AACpD,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,mBAAmB,IAAI,oBAAoB;AACnD,YAAM,IAAI,MAAM,0CAA0C;AAC5D,UAAM,UAAU,2BAA2B,MAAM,IAAI,eAAe;AACpE,QAAI,CAAC,cAAc,SAAS,KAAK,QAAQ;AACvC,YAAM,IAAI,MAAM,4CAA4C;AAC9D,QAAI,CAAC,kBAAkB,SAAS,KAAK,QAAQ;AAC3C,aAAO,EAAE,SAAS,SAAS,QAAQ,CAAC,GAAG,UAAU,MAAM;AACzD,UAAM,SAAyB,CAAC;AAChC,eAAW,UAAU,CAAC,UAAU,QAAQ,GAAY;AAClD,YAAM,SAAS,QAAQ,QAAQ,MAAM,GACnC,QAAQ,KAAK,QAAQ,QAAQ,MAAM;AACrC,UAAI,KAAK,MAAM;AACb,eAAO;AAAA,UACL,GAAI,MAAM,2BAA2B,IAAI;AAAA,YACvC,GAAG;AAAA,YACH,WAAW,MAAM;AAAA,YACjB;AAAA,YACA,gBAAgB,QAAQ,MAAM,WAAW;AAAA,YACzC,SAAS,gBAAgB,QAAQ,MAAM,IAAI,MAAM,IAAI,OAAO,UAAU,IAAI,MAAM,UAAU,IAAI,MAAM,MAAM,IAAI,CAAC;AAAA,YAC/G,OAAO,KAAK,MAAM;AAAA,UACpB,CAAC;AAAA,QACH;AAAA,IACJ;AACA,QAAI,sBAAsB,KAAK,OAAO,GAAG;AACvC,YAAM,GAAG;AAAA,QACP,yEAAyE,MAAM,SAAS;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI;AAAA,MACH,iBAAiB,KAAK;AAAA,MACtB,GAAI,sBAAsB,KAAK,OAAO,KACtC,KAAK,QAAQ,QAAQ,OAAO,OAC5B,KAAK,QAAQ,QAAQ,OAAO,OAC5B,KAAK,QAAQ,QAAQ,OAAO,aAAa,KACzC,KAAK,QAAQ,QAAQ,OAAO,aAAa,IACrC,EAAE,2BAA2B,KAAK,IAClC,CAAC;AAAA,IACP,CAAC,EACA,MAAM,aAAa,KAAK,CAAC;AAC5B,QAAI,sBAAsB,KAAK,OAAO,GAAG;AACvC,YAAM,GAAG;AAAA,QACP;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,KAAK,SAAS,QAAQ,UAAU,KAAK;AAAA,EACzD,CAAC;AACH;AAIA,eAAsB,6BACpB,IACA,OACA,YACiB;AACjB,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,mBAAmB,IAAI,UAAU;AACzC,YAAM,IAAI,MAAM,iDAAiD;AACnE,QAAI,IAAI,2BAA2B,IAAI;AACrC,YAAM,IAAI,MAAM,kCAAkC;AACpD,UAAM,SAAS,IAAI,gBAAgB,SAAS;AAC5C,QAAI,WAAW,CAAC,OAAO,cAAc,UAAU,KAAK,cAAe;AACjE,YAAM,IAAI,MAAM,wDAAwD;AAC1E,UAAM,QAAQ,IAAI,6BAA6B,SAAS,aAAc;AACtE,QAAI,CAAC,OAAO,cAAc,KAAK,EAAG,OAAM,IAAI,MAAM,mCAAmC;AACrF,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,2BAA2B,MAAM,CAAC,EACxC,MAAM,aAAa,KAAK,CAAC;AAC5B,WAAO,SAAS,IAAI,4BAA4B;AAAA,EAClD,CAAC;AACH;AAIA,SAAS,sBAAsB,SAAiC;AAC9D,SAAO,QAAQ,SAAS,oBAAoB,QAAQ,cAAc;AACpE;AAGA,eAAsB,+BAA+B,IAAgC;AACnF,QAAM,CAAC,GAAG,IAAI,MAAM,GAAG,QAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GASlD;AACD,SAAO,KAAK,UAAU;AACxB;AAIA,eAAsB,iCACpB,IACA,OACA,SACe;AACf,QAAM,QAAQ,0BAA0B,MAAM,OAAO;AACrD,QAAM,eAAe,IAAI,OAAO,OAAO,OAAO;AAC5C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,KAAK,mBAAmB,CAAC,sBAAsB,IAAI,eAAe;AACrE,YAAM,IAAI,MAAM,4CAA4C;AAE9D,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,oBAAoB,MAAM,CAAC,EACjC,MAAM,aAAa,KAAK,CAAC;AAAA,EAC9B,CAAC;AACH;AAEA,eAAsB,+BACpB,IACA,OACoC;AACpC,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EAAE,SAAgB,yBAAyB,mBAAmB,CAAC,EACtE,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,MAAM,CAAC;AACV,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iCAAiC;AAC3D,WAAO,IAAI,UAAU,0BAA0B,MAAM,IAAI,OAAO,IAAI;AAAA,EACtE,CAAC;AACH;AAEA,eAAsB,mCACpB,IACA,OACA,QACe;AACf,MAAI,WAAW,uBAAuB,WAAW;AAC/C,UAAM,IAAI,MAAM,6BAA6B;AAC/C,QAAM,eAAe,IAAI,OAAO,OAAO,OAAO;AAC5C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iCAAiC;AAC3D,QAAI,IAAI,2BAA2B,IAAI,UAAU,SAAU;AAC3D,UAAM,GACH,OAAc,wBAAwB,EACtC,IAAI,EAAE,yBAAyB,oBAAI,KAAK,GAAG,oBAAoB,OAAO,CAAC,EACvE,MAAM,aAAa,KAAK,CAAC;AAAA,EAC9B,CAAC;AACH;AAEA,eAAsB,qCACpB,IACA,OACkB;AAClB,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EAAE,IAAW,yBAAyB,wBAAwB,CAAC,EACtE,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,MAAM,CAAC;AACV,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,iCAAiC;AAC3D,WAAO,IAAI,OAAO;AAAA,EACpB,CAAC;AACH;AAMA,eAAsB,2CACpB,IACA,OACkB;AAClB,SAAO,eAAe,IAAI,OAAO,OAAO,OAAO;AAC7C,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAY,wBAAwB,EACpC,MAAM,aAAa,KAAK,CAAC,EACzB,IAAI,QAAQ,EACZ,MAAM,CAAC;AACV,QACE,CAAC,OACD,IAAI,UAAU,YACd,IAAI,oBAAoB,WACxB,IAAI,kBAAkB;AAEtB,aAAO;AACT,UAAM,CAAC,KAAK,IAAI,MAAM,GAAG,QAAwB;AAAA,iDACJ,IAAI,OAAO;AAAA,2BACjC,IAAI,SAAS,uBAAuB,IAAI,WAAW;AAAA,iCAC7C,IAAI,cAAc,sBAAsB,IAAI,UAAU;AAAA,wBAC/D,IAAI,eAAe,sBAAsB,IAAI,kBAAkB;AAAA;AAAA,KAElF;AACD,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,CAAC,IAAI,mCAAmC,CAAC,IAAI,yBAAyB;AACxE,YAAM,GACH,OAAc,wBAAwB,EACtC,IAAI;AAAA,QACH,GAAI,CAAC,IAAI,0BACL,EAAE,yBAAyB,YAAY,oBAAoB,oBAAoB,IAC/E,CAAC;AAAA,QACL,GAAI,CAAC,IAAI,kCACL,EAAE,iCAAiC,WAAW,IAC9C,CAAC;AAAA,MACP,CAAC,EACA,MAAM,aAAa,KAAK,CAAC;AAAA,IAC9B;AACA,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}

package/dist/{chunk-FULLE5CF.js → chunk-WT7HG43Y.js}

@@ -1,11 +1,11 @@
 import {
   rawRows,
   withWorkspaceRls
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 import {
   sessionEvents,
   sessionTurns
-} from "./chunk-GSB4ISHE.js";
+} from "./chunk-IIPWNNVR.js";
 import {
   LOSSLESS_JSON_STRING_PREFIX,
   fromPostgresLosslessJson
@@ -244,4 +244,4 @@ export {
   readSessionMessageSliceInScope,
   listSessionEventSlices
 };
-//# sourceMappingURL=chunk-FULLE5CF.js.map
+//# sourceMappingURL=chunk-WT7HG43Y.js.map

package/dist/{chunk-I7HQL6FK.js → chunk-ZM5BA3TD.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-GSB4ISHE.js";
+} from "./chunk-IIPWNNVR.js";
 
 // src/video-generation.ts
 import {
@@ -1006,4 +1006,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-I7HQL6FK.js.map
+//# sourceMappingURL=chunk-ZM5BA3TD.js.map

package/dist/connect-attempts.js

@@ -7,9 +7,9 @@ import {
   getConnectAttempt,
   getConnectBeginReplay,
   listPendingConnectAttempts
-} from "./chunk-XK6HXON2.js";
-import "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+} from "./chunk-UXFBXCHM.js";
+import "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/database.d.ts

@@ -31,6 +31,14 @@ export type SessionRlsActorContext = {
     initiatingHumanSubjectId?: string | null;
 };
 export declare function currentSessionAttachmentReadAccess(): SessionAttachmentReadAccess | undefined;
+/**
+ * Stable identity of the ambient session RLS actor: every field that
+ * `setRlsContext` turns into database-visible GUCs or that scoped reads
+ * consult. Two callers with equal keys see exactly the same rows, so the key
+ * is safe for sharing a read result between them; `null` means no actor, in
+ * which case the subject GUC stays empty for every such caller.
+ */
+export declare function currentSessionRlsActorIdentityKey(): string | null;
 export declare function withSessionRlsActorContext<T>(actor: SessionRlsActorContext, fn: () => Promise<T>): Promise<T>;
 /**
  * RLS posture for the connection OpenGeni's query layer runs over (Step I, §7.7).

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+} from "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/editable-artifacts.js

@@ -9,9 +9,9 @@ import {
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor
-} from "./chunk-6ORJPCYW.js";
-import "./chunk-4CCFFLDZ.js";
-import "./chunk-GSB4ISHE.js";
+} from "./chunk-5UOWNKPP.js";
+import "./chunk-BG46J5HF.js";
+import "./chunk-IIPWNNVR.js";
 import "./chunk-S2TZ3F4L.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/index.d.ts

@@ -122,7 +122,7 @@ export * from "./memory-domain.js";
 export * from "./model-catalog.js";
 import { type Database, type SessionActivityDatabase } from "./database.js";
 export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type SessionRlsActorContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type ManagedUserProfile, type UserLookup, type UserProfileLookup, } from "./database.js";
-export { withSessionRlsActorContext } from "./database.js";
+export { currentSessionRlsActorIdentityKey, withSessionRlsActorContext } from "./database.js";
 export { withDatabaseTimingObserver, type DatabaseTimingObservation } from "./database-timing.js";
 export { normalizedCredentialHeaders } from "./connection-token-resolver.js";
 import { buildCodexTokenResolver as buildCodexTokenResolverCore, fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore, fetchCodexUsageForAccount as fetchCodexUsageForAccountCore, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialCooldownKind, type CodexCredentialForRun } from "./codex-token-resolver.js";
@@ -843,6 +843,26 @@ export declare function applyCreditDebitUpToBalance(db: Database, input: {
     balance: BillingBalance;
     debitedMicros: number;
 }>;
+/**
+ * Settle an already-consumed, OpenGeni-funded resource for its full cost.
+ * Admission happens before use; an in-flight operation can take the account
+ * below zero. Future grants and purchased top-ups net against that balance.
+ * Never use this helper to admit a new operation or for externally paid use.
+ */
+export declare function applyCreditDebitAfterUse(db: Database, input: {
+    accountId: string;
+    workspaceId?: string | null;
+    type: string;
+    amountMicros: number;
+    sourceType: string;
+    sourceId: string;
+    idempotencyKey: string;
+    metadata?: Record<string, unknown>;
+    occurredAt?: Date;
+}): Promise<{
+    balance: BillingBalance;
+    debitedMicros: number;
+}>;
 export declare function hasCreditLedgerEntry(db: Database, accountId: string, idempotencyKey: string): Promise<boolean>;
 export declare function getBillingCustomer(db: Database, accountId: string, provider?: string): Promise<{
     accountId: string;
@@ -1820,6 +1840,9 @@ export declare function recordRetainedScreenshotArtifactError(db: Database, inpu
 }): Promise<void>;
 /** Session-qualified lookup: a screenshot from another session is indistinguishable from absent. */
 export declare function getRetainedScreenshotArtifact(db: Database, workspaceId: string, sessionId: string, artifactId: string): Promise<RetainedScreenshotArtifact | null>;
+/** Recover a legacy damaged receipt only when its tool call has one exact
+ * screenshot in this session. Never infer an artifact across fork ancestry. */
+export declare function getRetainedScreenshotArtifactForToolCall(db: Database, workspaceId: string, sessionId: string, toolCallId: string): Promise<RetainedScreenshotArtifact | null>;
 export type RetainedScreenshotMaintenanceClaim = {
     action: "reconcile" | "delete";
     claimId: string;
@@ -6111,6 +6134,8 @@ export type PendingSessionToolCallInput = {
  * The receipt belongs to the logical turn so an approval resume can
  * settle it from a newer attempt. Duplicate SDK delivery converges on the
  * unique (turn, call) identity.
+ * Pass the root database handle so each rollback retry starts a fresh
+ * transaction, not a savepoint in a caller-owned transaction.
  */
 export declare function registerPendingSessionToolCall(db: Database, input: PendingSessionToolCallInput): Promise<{
     accepted: boolean;
@@ -6756,6 +6781,12 @@ export interface AcquireLeaseInput {
      *  attach, mirrored into the scoped stream token's claims. */
     viewerAuthorityEpoch?: number;
     backend: string;
+    /** Explicit compute policy at this admission boundary. Omission is legacy
+     * usage-only; only a priced credits backend needs prepaid admission. */
+    warmBilling?: {
+        mode: "usage_only" | "shadow" | "credits";
+        rateMicrosPerSecond: number;
+    };
     os?: string;
     image?: string | null;
     rigVersionId?: string | null;
@@ -6872,6 +6903,24 @@ export declare class SandboxViewerAdmissionBlockedError extends Error {
     readonly name = "SandboxViewerAdmissionBlockedError";
     constructor(workspaceId: string, sandboxGroupId: string, reason: SandboxViewerForceDrainReason);
 }
+export declare class SandboxPaidComputeAdmissionError extends Error {
+    readonly workspaceId: string;
+    readonly sandboxGroupId: string;
+    readonly name = "SandboxPaidComputeAdmissionError";
+    constructor(workspaceId: string, sandboxGroupId: string);
+}
+/**
+ * Fence the warm-time meter BEFORE requesting provider stop, including free
+ * and shadow usage. The immutable cutoff survives a stop-success/settlement-
+ * failure retry. A failed stop can undercount an idle retry, never count time
+ * after the provider stopped.
+ */
+export declare function markWarmBillingStopCutoff(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+}): Promise<Date | null>;
 export declare class SandboxLeaseRecoveryBlockedError extends Error {
     readonly sandboxGroupId: string;
     readonly leaseEpoch: number;
@@ -7475,7 +7524,7 @@ export type LeaseHolderHeartbeatStatus = {
 } | {
     holderAlive: true;
     leaseExtended: false;
-    fence: "epoch" | "liveness" | "rotation_requested";
+    fence: "epoch" | "liveness" | "rotation_requested" | "funding";
 };
 export declare function heartbeatLeaseHolderStatus(db: Database, input: {
     accountId: string;
@@ -7485,6 +7534,7 @@ export declare function heartbeatLeaseHolderStatus(db: Database, input: {
     holderId: string;
     leaseTtlMs: number;
     expectedEpoch: number;
+    billingMode?: "usage_only" | "shadow" | "credits";
 }): Promise<LeaseHolderHeartbeatStatus>;
 export declare function heartbeatLeaseHolder(db: Database, input: {
     accountId: string;
@@ -7494,6 +7544,7 @@ export declare function heartbeatLeaseHolder(db: Database, input: {
     holderId: string;
     leaseTtlMs: number;
     expectedEpoch: number;
+    billingMode?: "usage_only" | "shadow" | "credits";
 }): Promise<boolean>;
 export type ReinstateTurnLeaseHolderResult = {
     status: "present" | "reinstated";
@@ -7620,6 +7671,7 @@ export declare function reArmDrainingLease(db: Database, input: {
     workspaceId: string;
     sandboxGroupId: string;
     leaseTtlMs: number;
+    warmBilling?: AcquireLeaseInput["warmBilling"];
 }): Promise<{
     rearmed: boolean;
 }>;
@@ -7713,6 +7765,9 @@ export type SandboxRetainedProcess = {
     reconcileClaimedAt: string | null;
     reconcileAttempts: number;
     lastReconcileOutcome: string | null;
+    cancellationRequestedAt: string | null;
+    cancellationReason: string | null;
+    deadlineCancellationRequestedAt: string | null;
     reconcileProofOutcome: "exited" | "lost" | null;
     reconcileProofExitCode: number | null;
     reconcileProofReason: "provider_exit_banner" | "provider_session_lost_banner" | "provider_instance_not_found" | "provider_instance_terminated" | null;
@@ -9293,22 +9348,17 @@ export interface AccrueWarmSecondsResult {
     seconds: number;
     /** The monotonic tick index this accrual was recorded under. */
     tick: number;
-    /** usd_micros charged for this tick (0 when rate is 0). */
+    /** Internal usd_micros estimate for this tick (0 in usage_only mode). */
     costMicros: number;
 }
 /**
  * Accrue warm-seconds for the elapsed wall-clock since the lease's last meter
  * cursor, idempotent on (sandbox_group_id, lease_epoch, tick). EPOCH-FENCED +
- * liveness-guarded (warm only): a stale-epoch tick or a draining/cold lease is a
- * no-op, so a superseded writer that re-fires cannot mis-meter. The FIRST tick on
- * a never-metered lease (last_meter_at IS NULL) only SEEDS the cursor — it
- * accrues nothing (there is no prior cursor to diff against), matching the
- * "delta since last tick" contract. warmRateMicrosPerSecond > 0 also records a
- * sandbox.warm_cost event (cost = seconds x rate) AND debits the same micros from
- * the credit balance via applyCreditDebitUpToBalance (the model-cost precedent),
- * idempotent on the SAME (group, epoch, tick) key. The usage event is the
- * REQUESTED cost; the ledger is the ACTUAL debit (they legitimately differ when
- * balance is low — M2). Set debitCredits:false to meter without debiting.
+ * liveness-guarded (warm, or draining for a final provider-stop tick). The first
+ * interval begins at the warm transition's recovery timestamp. A draining tick
+ * is only allowed by the provider-stop path, never by the periodic reaper list.
+ * In credits mode the signed full-cost ledger debit, both usage rows and cursor
+ * commit together; a settlement failure rolls back the tick for retry.
  */
 export declare function accrueWarmSeconds(db: Database, input: {
     accountId: string;
@@ -9321,16 +9371,16 @@ export declare function accrueWarmSeconds(db: Database, input: {
     /** Optional attribution: the founding/observing session (visibility only — the
      *  group meter key makes the workspace charge correct regardless). */
     subjectId?: string | null;
-    /** Debit credits for warm-cost (default true). The force-drain at 0 balance
-     *  depends on this decrementing the balance. */
-    debitCredits?: boolean;
+    billingMode?: "usage_only" | "shadow" | "credits";
+    /** Final provider-stop tick, after provider termination and before cold CAS. */
+    finalDrain?: boolean;
 }): Promise<AccrueWarmSecondsResult>;
 export interface ForceDrainResult {
-    /** Whether the workspace was over a limit (0 balance or over the warm cap). */
+    /** Whether the workspace exceeded its optional warm cap. */
     overLimit: boolean;
     /** The reason, for observability. */
     reason: SandboxViewerForceDrainReason | null;
-    /** The (workspaceId, sandboxGroupId) viewer-only boxes CASed warm->draining. */
+    /** The (workspaceId, sandboxGroupId) holderless boxes CASed warm->draining. */
     drained: {
         workspaceId: string;
         sandboxGroupId: string;
@@ -9338,8 +9388,7 @@ export interface ForceDrainResult {
 }
 export declare function forceDrainOverLimitViewerOnlyBoxes(db: Database, input: {
     workspaceId: string;
-    /** account balance gate: when <= 0 (and a billing/managed mode is on) drain. */
-    balanceMicros: number;
+    /** Legacy caller option; balance belongs to paid admission, not draining. */
     enforceBalance: boolean;
     /** warm-second cap (cumulative this UTC month). 0 = unbounded (no cap gate). */
     maxWarmSecondsPerWorkspace: number;