@opengeni/db 0.27.3 → 0.27.7

package/dist/index.d.ts

@@ -276,6 +276,14 @@ export declare function getHostExportConsumerStatus(db: Database, input: {
 }): Promise<HostExportConsumerStatus | null>;
 export declare function setRlsContext(db: Database, context: RlsContext): Promise<void>;
 export declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+/**
+ * Run one bounded database operation on a transaction-pinned backend.
+ *
+ * Callers that also have an application deadline should check their abort
+ * signal before returning from `fn`; throwing there rolls the transaction back
+ * even when the application deadline won a surrounding Promise race.
+ */
+export declare function withDatabaseStatementTimeout<T>(db: Database, timeoutMs: number, fn: (db: Database) => Promise<T>): Promise<T>;
 export declare function rlsContextForWorkspace(db: Database, workspaceId: string): Promise<RlsContext>;
 export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
 /**
@@ -900,6 +908,9 @@ export type StoreIntegrationOAuthClientInput = {
     metadata?: Record<string, unknown>;
 };
 export type ReplaceIntegrationOAuthClientInput = StoreIntegrationOAuthClientInput;
+export type ReplaceIntegrationOAuthClientIfCurrentInput = ReplaceIntegrationOAuthClientInput & {
+    expectedClientId: string;
+};
 export type ConsumeOAuthStateNonceInput = {
     accountId: string;
     workspaceId: string;
@@ -1588,6 +1599,7 @@ export declare function recordConnectionUsed(db: Database, workspaceId: string,
 export declare function loadIntegrationOAuthClient(db: Database, settings: Settings, issuer: string): Promise<IntegrationOAuthClientForUse | null>;
 export declare function storeIntegrationOAuthClient(db: Database, input: StoreIntegrationOAuthClientInput): Promise<StoredIntegrationOAuthClient>;
 export declare function replaceIntegrationOAuthClient(db: Database, input: ReplaceIntegrationOAuthClientInput): Promise<StoredIntegrationOAuthClient>;
+export declare function replaceIntegrationOAuthClientIfCurrent(db: Database, input: ReplaceIntegrationOAuthClientIfCurrentInput): Promise<StoredIntegrationOAuthClient | null>;
 export declare function consumeIntegrationOAuthStateNonce(db: Database, input: ConsumeOAuthStateNonceInput): Promise<boolean>;
 export declare function createKnowledgeMemory(db: Database, input: CreateKnowledgeMemoryInput): Promise<KnowledgeMemory>;
 export declare function updateKnowledgeMemory(db: Database, workspaceId: string, memoryId: string, input: UpdateKnowledgeMemoryInput, embedder?: MemoryEmbedder): Promise<KnowledgeMemory>;

package/dist/index.js

@@ -5065,7 +5065,7 @@ async function steerAgentSessionInTransaction(db, input) {
 // src/session-realtime-context.ts
 var SESSION_REALTIME_CONTEXT_MAX_BYTES = 65536;
 var SESSION_REALTIME_TAIL_SOURCE = "transcript_tail_flush";
-var SESSION_REALTIME_TAIL_INSTRUCTION = "The user just ended their realtime session. Here is the remaining handoff/transcript tail. You probably do not have to do anything; acknowledge the handoff unless the transcript itself asks for something.";
+var SESSION_REALTIME_TAIL_INSTRUCTION = "The user just ended the realtime voice session but remains reachable by text. Ending voice changes only the communication mode; it does not stop, pause, or complete existing work. Treat the remaining transcript tail as additional context. If work was already underway, continue it from the current state. Change or stop that work only if the user explicitly requested it. If nothing was underway and the transcript contains no unhandled request, acknowledge briefly; otherwise handle any unhandled request.";
 function deterministicUuid2(seed) {
   const bytes = createHash3("sha256").update(seed, "utf8").digest().subarray(0, 16);
   bytes[6] = (bytes[6] ?? 0) & 15 | 80;
@@ -14145,6 +14145,19 @@ async function withRlsContext(db, context, fn, transactionConfig) {
     return await fn(scoped);
   }, transactionConfig);
 }
+async function withDatabaseStatementTimeout(db, timeoutMs, fn) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("withDatabaseStatementTimeout requires a positive timeout");
+  }
+  const boundedTimeoutMs = Math.max(1, Math.floor(timeoutMs));
+  return await db.transaction(async (tx) => {
+    const scoped = tx;
+    await scoped.execute(
+      sql14`select set_config('statement_timeout', ${`${boundedTimeoutMs}ms`}, true)`
+    );
+    return await fn(scoped);
+  });
+}
 async function rlsContextForWorkspace(db, workspaceId) {
   const [row] = await db.select({ accountId: workspaces.accountId }).from(workspaces).where(eq17(workspaces.id, workspaceId)).limit(1);
   if (!row) {
@@ -17998,6 +18011,22 @@ async function replaceIntegrationOAuthClient(db, input) {
   }
   return mapStoredIntegrationOAuthClient(row);
 }
+async function replaceIntegrationOAuthClientIfCurrent(db, input) {
+  const [row] = await db.update(integrationOauthClients).set({
+    authorizationServer: input.authorizationServer,
+    clientId: input.clientId,
+    clientSecretEncrypted: input.clientSecretEncrypted ?? null,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ?? "none",
+    metadata: input.metadata ?? {},
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(
+    and17(
+      eq17(integrationOauthClients.issuer, input.issuer),
+      eq17(integrationOauthClients.clientId, input.expectedClientId)
+    )
+  ).returning();
+  return row ? mapStoredIntegrationOAuthClient(row) : null;
+}
 function mapStoredIntegrationOAuthClient(row) {
   return {
     id: row.id,
@@ -40148,6 +40177,7 @@ function mapSession(row, effectiveControl, mcpServers = [], pin = mapSessionPin(
     // the fence exact even if the column type ever drifts (the lease-epoch lesson).
     activeSandboxId: row.activeSandboxId ?? null,
     activeEpoch: Number(row.activeEpoch),
+    workingDir: row.workingDir ?? null,
     variableSetId: row.variableSetId,
     environmentId: row.variableSetId,
     // The rig + frozen rig version the session rides (M3). Both null for a
@@ -41528,6 +41558,7 @@ export {
   reopenSlackInteractionDelivery,
   replaceExpiredWorkspaceArchiveCapture,
   replaceIntegrationOAuthClient,
+  replaceIntegrationOAuthClientIfCurrent,
   requestDueSandboxRotationsGlobal,
   requestSessionCompaction,
   requestSessionTurnRecovery,
@@ -41682,6 +41713,7 @@ export {
   withCodexCapacityMutation,
   withCodexCredentialRefreshLock,
   withCodexTokenDeadline,
+  withDatabaseStatementTimeout,
   withRlsContext,
   withWorkspaceRls,
   withWorkspaceSubjectRls,