@opengeni/db 0.27.0 → 0.27.7

package/dist/session-realtime-context.d.ts

@@ -1,7 +1,7 @@
 import type { Database } from "./index";
 export declare const SESSION_REALTIME_CONTEXT_MAX_BYTES = 65536;
 export declare const SESSION_REALTIME_TAIL_SOURCE = "transcript_tail_flush";
-export declare const SESSION_REALTIME_TAIL_INSTRUCTION = "The user just ended their realtime session. Here is the remaining handoff/transcript tail. You probably do not have to do anything; acknowledge the handoff unless the transcript itself asks for something.";
+export declare const SESSION_REALTIME_TAIL_INSTRUCTION = "The user just ended the realtime voice session but remains reachable by text. Ending voice changes only the communication mode; it does not stop, pause, or complete existing work. Treat the remaining transcript tail as additional context. If work was already underway, continue it from the current state. Change or stop that work only if the user explicitly requested it. If nothing was underway and the transcript contains no unhandled request, acknowledge briefly; otherwise handle any unhandled request.";
 export type SessionRealtimeContextProjection = {
     id: string;
     workspaceId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.27.0",
+  "version": "0.27.7",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -51,9 +51,9 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.10",
-    "@opengeni/config": "^0.10.7",
-    "@opengeni/contracts": "^0.36.0",
-    "@opengeni/network": "^0.1.1",
+    "@opengeni/config": "^0.10.11",
+    "@opengeni/contracts": "^0.38.1",
+    "@opengeni/network": "^0.2.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/index.ts

@@ -1106,6 +1106,31 @@ export async function withRlsContext<T>(
   }, transactionConfig);
 }
 
+/**
+ * Run one bounded database operation on a transaction-pinned backend.
+ *
+ * Callers that also have an application deadline should check their abort
+ * signal before returning from `fn`; throwing there rolls the transaction back
+ * even when the application deadline won a surrounding Promise race.
+ */
+export async function withDatabaseStatementTimeout<T>(
+  db: Database,
+  timeoutMs: number,
+  fn: (db: Database) => Promise<T>,
+): Promise<T> {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("withDatabaseStatementTimeout requires a positive timeout");
+  }
+  const boundedTimeoutMs = Math.max(1, Math.floor(timeoutMs));
+  return await db.transaction(async (tx) => {
+    const scoped = tx as unknown as Database;
+    await scoped.execute(
+      sql`select set_config('statement_timeout', ${`${boundedTimeoutMs}ms`}, true)`,
+    );
+    return await fn(scoped);
+  });
+}
+
 export async function rlsContextForWorkspace(
   db: Database,
   workspaceId: string,
@@ -3698,6 +3723,10 @@ export type StoreIntegrationOAuthClientInput = {
 
 export type ReplaceIntegrationOAuthClientInput = StoreIntegrationOAuthClientInput;
 
+export type ReplaceIntegrationOAuthClientIfCurrentInput = ReplaceIntegrationOAuthClientInput & {
+  expectedClientId: string;
+};
+
 export type ConsumeOAuthStateNonceInput = {
   accountId: string;
   workspaceId: string;
@@ -7930,6 +7959,30 @@ export async function replaceIntegrationOAuthClient(
   return mapStoredIntegrationOAuthClient(row);
 }
 
+export async function replaceIntegrationOAuthClientIfCurrent(
+  db: Database,
+  input: ReplaceIntegrationOAuthClientIfCurrentInput,
+): Promise<StoredIntegrationOAuthClient | null> {
+  const [row] = await db
+    .update(schema.integrationOauthClients)
+    .set({
+      authorizationServer: input.authorizationServer,
+      clientId: input.clientId,
+      clientSecretEncrypted: input.clientSecretEncrypted ?? null,
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ?? "none",
+      metadata: input.metadata ?? {},
+      updatedAt: new Date(),
+    })
+    .where(
+      and(
+        eq(schema.integrationOauthClients.issuer, input.issuer),
+        eq(schema.integrationOauthClients.clientId, input.expectedClientId),
+      ),
+    )
+    .returning();
+  return row ? mapStoredIntegrationOAuthClient(row) : null;
+}
+
 function mapStoredIntegrationOAuthClient(
   row: typeof schema.integrationOauthClients.$inferSelect,
 ): StoredIntegrationOAuthClient {
@@ -43994,6 +44047,7 @@ function mapSession(
     // the fence exact even if the column type ever drifts (the lease-epoch lesson).
     activeSandboxId: row.activeSandboxId ?? null,
     activeEpoch: Number(row.activeEpoch),
+    workingDir: row.workingDir ?? null,
     variableSetId: row.variableSetId,
     environmentId: row.variableSetId,
     // The rig + frozen rig version the session rides (M3). Both null for a

package/src/session-realtime-context.ts

@@ -10,7 +10,7 @@ import { submitHumanPromptInTransaction } from "./session-queue-commands";
 export const SESSION_REALTIME_CONTEXT_MAX_BYTES = 65_536;
 export const SESSION_REALTIME_TAIL_SOURCE = "transcript_tail_flush";
 export const SESSION_REALTIME_TAIL_INSTRUCTION =
-  "The user just ended their realtime session. Here is the remaining handoff/transcript tail. You probably do not have to do anything; acknowledge the handoff unless the transcript itself asks for something.";
+  "The user just ended the realtime voice session but remains reachable by text. Ending voice changes only the communication mode; it does not stop, pause, or complete existing work. Treat the remaining transcript tail as additional context. If work was already underway, continue it from the current state. Change or stop that work only if the user explicitly requested it. If nothing was underway and the transcript contains no unhandled request, acknowledge briefly; otherwise handle any unhandled request.";
 
 export type SessionRealtimeContextProjection = {
   id: string;