@opengeni/db 0.27.7 → 0.27.9

package/dist/codex-token-resolver.d.ts

@@ -1,7 +1,47 @@
 import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
 import { type CodexTokenSnapshot, type CodexUsagePayload, type CodexFetch, type CodexRateLimitResetCreditsDetails, type ResetCreditFetchFailureReason, refreshCodexToken } from "@opengeni/codex";
 import { encryptEnvironmentValue } from "./environment-crypto";
-import { loadCodexCredentialForRun, recordCodexTokenRefresh, setCodexCredentialStatus, withCodexCredentialRefreshLock, type Database } from "./index";
+import type { Database } from "./database";
+export type CodexCredentialTokens = {
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+};
+export type CodexCredentialForRun = {
+    id: string;
+    version: number;
+    workspaceId: string;
+    tokens: CodexCredentialTokens;
+    chatgptAccountId: string | null;
+    scopes: string | null;
+    planType: string | null;
+    isFedramp: boolean;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    status: string;
+    lastError: string | null;
+};
+export type CodexAccountUsageSnapshot = {
+    primaryUsedPercent?: number | null;
+    primaryResetAt?: Date | null;
+    secondaryUsedPercent?: number | null;
+    secondaryResetAt?: Date | null;
+    checkedAt?: Date;
+    resetCreditAvailableCount?: number | null;
+    resetCreditsCheckedAt?: Date | null;
+};
+type CodexCredentialRefreshInput = {
+    id: string;
+    version: number;
+    workspaceId: string;
+    credentialEncrypted: string;
+    expiresAt: Date | null;
+    lastRefreshAt: Date;
+};
+type CodexCredentialStatusTarget = {
+    id: string;
+    version: number;
+};
 export type CodexTokenDeadlineClock = {
     setTimeout: (callback: () => void, delayMs: number) => ReturnType<typeof globalThis.setTimeout>;
     clearTimeout: (handle: ReturnType<typeof globalThis.setTimeout>) => void;
@@ -19,15 +59,16 @@ export type CodexTokenDeadlineOptions = {
  */
 export declare function withCodexTokenDeadline<T>(operation: Promise<T>, options?: CodexTokenDeadlineOptions): Promise<T>;
 export type CodexAuthDeps = {
-    loadCredential: typeof loadCodexCredentialForRun;
-    recordRefresh: typeof recordCodexTokenRefresh;
-    setStatus: typeof setCodexCredentialStatus;
+    loadCredential: (db: Database, settings: Settings, workspaceId: string, credentialId: string) => Promise<CodexCredentialForRun | null>;
+    recordRefresh: (db: Database, input: CodexCredentialRefreshInput) => Promise<boolean>;
+    setStatus: (db: Database, workspaceId: string, status: "active" | "needs_relogin" | "error", lastError: string | null, target: CodexCredentialStatusTarget) => Promise<boolean>;
     refresh: typeof refreshCodexToken;
     encrypt: typeof encryptEnvironmentValue;
     keyBytes: typeof environmentsEncryptionKeyBytes;
-    withRefreshLock: typeof withCodexCredentialRefreshLock;
+    withRefreshLock: <T>(db: Database, workspaceId: string, credentialId: string, fn: (lockedDb: Database) => Promise<T>) => Promise<T>;
+    recordUsage?: (db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot) => Promise<boolean>;
 };
-export declare function buildCodexTokenResolver(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps?: CodexAuthDeps): {
+export declare function buildCodexTokenResolver(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps: CodexAuthDeps): {
     getToken: () => Promise<CodexTokenSnapshot>;
     refresh: () => Promise<CodexTokenSnapshot>;
 };
@@ -45,7 +86,7 @@ export declare function buildCodexTokenResolver(db: Database, settings: Settings
  * A refresh that stamps needs_relogin returns { status:"error", reason } and never
  * hits the provider; a transient refresh error returns a plain error payload.
  */
-export declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): Promise<CodexUsagePayload>;
+export declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps: CodexAuthDeps, fetchImpl?: CodexFetch): Promise<CodexUsagePayload>;
 export type CodexRateLimitResetCreditsAccountResult = {
     ok: true;
     status: number;
@@ -61,4 +102,5 @@ export type CodexRateLimitResetCreditsAccountResult = {
  * this server-side function. Detailed rows are returned to the route only and
  * are never persisted as redemption authority.
  */
-export declare function fetchCodexRateLimitResetCreditsForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): Promise<CodexRateLimitResetCreditsAccountResult>;
+export declare function fetchCodexRateLimitResetCreditsForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps: CodexAuthDeps, fetchImpl?: CodexFetch): Promise<CodexRateLimitResetCreditsAccountResult>;
+export {};

package/dist/connection-token-resolver.d.ts

@@ -1,9 +1,47 @@
 import { environmentsEncryptionKeyBytes, type McpServerConnectionRef, type Settings } from "@opengeni/config";
-import type { ConnectionCredentialsPort, McpConnectionResourceScope, McpCredentialAuthNeededReason, McpCredentialsRequest, TurnInitiator, TurnInitiatorContext } from "@opengeni/contracts";
+import type { ConnectionKind, ConnectionCredentialsPort, ConnectionStatus, McpConnectionResourceScope, McpCredentialAuthNeededReason, McpCredentialsRequest, TurnInitiator, TurnInitiatorContext } from "@opengeni/contracts";
 import { type DnsLookup, type FetchLike } from "@opengeni/network";
 export { isPrivateAddress } from "@opengeni/network";
 import { encryptEnvironmentValue } from "./environment-crypto";
-import { loadConnectionCredentialForBroker, recordConnectionTokenRefresh, recordConnectionUsed, setConnectionStatus, type ConnectionCredentialForBroker, type Database } from "./index";
+import type { Database } from "./database";
+export type ConnectionCredentialForBroker = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    providerDomain: string;
+    kind: ConnectionKind;
+    status: ConnectionStatus;
+    credential: Record<string, unknown>;
+    grantedScopes: string[];
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    version: number;
+    metadata: Record<string, unknown>;
+};
+export type ConnectionCredentialLookupInput = {
+    workspaceId: string;
+    connectionId?: string;
+    providerDomain: string;
+    kind?: ConnectionKind;
+    subjectId?: string | null;
+    allowSubjectOwned?: boolean;
+};
+export type ConnectionTokenRefreshInput = {
+    id: string;
+    version: number;
+    workspaceId: string;
+    credentialEncrypted: string;
+    expiresAt: Date | null;
+    grantedScopes?: string[];
+    lastRefreshAt: Date;
+    subjectId?: string | null;
+};
+export type ConnectionStatusGuard = {
+    id: string;
+    version: number;
+    subjectId?: string | null;
+};
 export type ResolveConnectionCredentialResult = {
     status: "ok";
     headers: Record<string, string>;
@@ -60,10 +98,10 @@ export declare class HostMcpCredentialBindingError extends Error {
  */
 export declare function buildHostConnectionTokenResolver(resolve: NonNullable<ConnectionCredentialsPort["mcpCredentials"]>, context: HostMcpCredentialResolverContext): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
 export type ConnectionBrokerDeps = {
-    loadCredential: typeof loadConnectionCredentialForBroker;
-    recordRefresh: typeof recordConnectionTokenRefresh;
-    setStatus: typeof setConnectionStatus;
-    recordUsed: typeof recordConnectionUsed;
+    loadCredential: (db: Database, settings: Settings, input: ConnectionCredentialLookupInput) => Promise<ConnectionCredentialForBroker | null>;
+    recordRefresh: (db: Database, input: ConnectionTokenRefreshInput) => Promise<boolean>;
+    setStatus: (db: Database, workspaceId: string, status: ConnectionStatus, lastError: string | null, guard: ConnectionStatusGuard) => Promise<boolean>;
+    recordUsed: (db: Database, workspaceId: string, connectionId: string, subjectId?: string | null) => Promise<void>;
     refresh: typeof refreshOAuthConnectionCredential;
     encrypt: typeof encryptEnvironmentValue;
     keyBytes: typeof environmentsEncryptionKeyBytes;
@@ -92,7 +130,7 @@ export type RefreshTransportOptions = {
     fetchImpl?: FetchLike;
     dnsLookup?: DnsLookup;
 };
-export declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps, options?: ConnectionTokenResolverOptions): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+export declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps: ConnectionBrokerDeps, options?: ConnectionTokenResolverOptions): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
 export declare class ConnectionRefreshHttpError extends Error {
     readonly httpStatus: number;
     readonly oauthErrorCode: string | null;

package/dist/database.d.ts

@@ -0,0 +1,137 @@
+import { type SQL } from "drizzle-orm";
+import type { PgDatabase, PgTransactionConfig } from "drizzle-orm/pg-core";
+import postgres from "postgres";
+import { type IdempotentPersistenceTransactionOptions } from "./persistence-errors";
+import * as schema from "./schema";
+export type Database = PgDatabase<any, typeof schema>;
+export type DbClient = {
+    db: Database;
+    close: () => Promise<void>;
+};
+export type RlsContext = {
+    accountId: string;
+    workspaceId?: string | null;
+};
+/**
+ * RLS posture for the connection OpenGeni's query layer runs over (Step I, §7.7).
+ *
+ * - `"force"` (DEFAULT — today's standalone behavior, byte-for-byte): OpenGeni
+ *   connects as a NON-OWNER role (`opengeni_app`) and every table carries
+ *   `FORCE ROW LEVEL SECURITY`, so the workspace/account GUCs set by
+ *   `setRlsContext` are the ONLY thing that admits rows — even the table owner
+ *   is subject to RLS. This is the Fork-A isolation guarantee.
+ * - `"scoped"` (embedded Fork-B opt-in): the host runs OpenGeni's queries over a
+ *   role that OWNS the dedicated schema (RLS need not be forced for that role),
+ *   relying on the host's own tenant boundary. OpenGeni STILL emits the
+ *   `set_config('opengeni.account_id'/'workspace_id', …)` GUCs defensively on
+ *   every scoped query, so the application query path is byte-identical between
+ *   the two strategies and the app code is RLS-mode-agnostic. The strategy is a
+ *   declared posture (consumed by `provisionRoles` and as a documented
+ *   invariant), NOT a query-path branch — there is deliberately no `if
+ *   (strategy === …)` anywhere in the helpers below. Picking `"scoped"` does not
+ *   relax any GUC; it only changes which DB role the host provisions/connects as
+ *   and asserts that the host accepts owning the isolation boundary.
+ */
+export type RlsStrategy = "force" | "scoped";
+/**
+ * Resolve a host-IdP/Better-Auth user *identifier* by email. Injected via
+ * `createDb({ userLookup })` (Step I). UNSET → today's raw parameterized select
+ * against Better Auth's `auth_users` table (see `getManagedUserByEmail`), which
+ * relies on the postgres-js array-shaped `db.execute` result. An embedded host
+ * whose identity lives elsewhere (a different IdP table, a different driver, or
+ * a non-`auth_users` user store) injects this closure so OpenGeni never touches
+ * `auth_users` directly. Returns the user id, or null when no such user exists.
+ */
+export type UserLookup = (db: Database, email: string) => Promise<string | null>;
+export type CreateDbOptions = {
+    /**
+     * The Postgres `search_path` for this connection (Step I, §7.8 runtime half).
+     * UNSET → today's behavior: NO `search_path` startup parameter is sent, so the
+     * server default applies (`public` for standalone, where every table + the
+     * `vector` extension + `gen_random_uuid()` live). For an embedded dedicated
+     * schema, pass e.g. `"opengeni,opengeni_private,public"` — postgres-js sends
+     * it as a per-session startup parameter (the supported, query-param-free way;
+     * URL `?search_path=` is IGNORED by postgres-js). Keep `public` LAST so the
+     * `vector` type and `gen_random_uuid()` (which live in `public` on the
+     * pgvector image) still resolve — the schema-isolation contract live footgun.
+     */
+    searchPath?: string;
+    /** RLS posture; defaults to `"force"` (today's standalone). */
+    rlsStrategy?: RlsStrategy;
+    /** Host-provided user-by-email resolver; unset → today's raw `auth_users` query. */
+    userLookup?: UserLookup;
+    /** postgres-js pool size; defaults to today's `10`. */
+    max?: number;
+    /**
+     * Connection-local default transaction isolation sent in the postgres-js
+     * startup parameters. This is intentionally not a role/database default:
+     * tests and embedded callers can exercise a different ambient isolation
+     * without mutating a shared PostgreSQL role or affecting other connections.
+     */
+    isolationLevel?: postgres.ConnectionParameters["default_transaction_isolation"];
+};
+/**
+ * The active RLS strategy + userLookup for an injected `Database`, recorded in a
+ * side WeakMap so helpers (and `getManagedUserByEmail`) can consult the host's
+ * binding without changing every call signature. A handle with no recorded
+ * config (e.g. one built outside `createDb`, or in a test) falls back to the
+ * standalone defaults: `rlsStrategy: "force"`, raw `auth_users` lookup.
+ */
+type DbBinding = {
+    rlsStrategy: RlsStrategy;
+    userLookup?: UserLookup;
+};
+/** The strategy bound to a handle (or the `"force"` default). */
+export declare function rlsStrategyFor(db: Database): RlsStrategy;
+/**
+ * Run a raw SQL query and read its rows as a typed array.
+ *
+ * Why this exists: the Step I driver widening (`Database = PgDatabase<any, …>`)
+ * deliberately sets the query-result HKT to `any` so `db.execute(…)` is callable
+ * across drivers whose raw-result shapes differ (postgres-js → row array;
+ * node-postgres → `{ rows }`). A side effect is that `db.execute<T>(…)` now
+ * resolves to `any`, erasing the per-row element type at the call site. OpenGeni's
+ * OWN internal raw queries usually run over the postgres-js handle `createDb`
+ * builds (array result), while an embedded host may inject a node-postgres style
+ * driver (`{ rows }`). Normalize those two standard shapes in one place; reject
+ * an unknown driver result rather than silently treating it as an empty query.
+ */
+export declare function rawRows<T extends Record<string, unknown>>(executor: Pick<Database, "execute">, query: SQL): Promise<T[]>;
+export declare function createDb(databaseUrl: string, options?: CreateDbOptions): DbClient;
+/**
+ * Register a host's `rlsStrategy`/`userLookup` against an externally-constructed
+ * `Database` handle (e.g. one the embedded host built from its own driver and
+ * injected, rather than via `createDb`). Lets the same WeakMap-backed lookups
+ * work for injected handles. Standalone never calls this (it uses `createDb`).
+ */
+export declare function registerDbBinding(db: Database, binding: {
+    rlsStrategy?: RlsStrategy;
+    userLookup?: UserLookup;
+}): void;
+export declare function setRlsContext(db: Database, context: RlsContext): Promise<void>;
+export declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+/**
+ * Run one bounded database operation on a transaction-pinned backend.
+ *
+ * Callers that also have an application deadline should check their abort
+ * signal before returning from `fn`; throwing there rolls the transaction back
+ * even when the application deadline won a surrounding Promise race.
+ */
+export declare function withDatabaseStatementTimeout<T>(db: Database, timeoutMs: number, fn: (db: Database) => Promise<T>): Promise<T>;
+export declare function rlsContextForWorkspace(db: Database, workspaceId: string): Promise<RlsContext>;
+export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
+export declare function retryWorkspacePersistence<T>(db: Database, workspaceId: string, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
+export declare function retryRlsPersistence<T>(db: Database, context: RlsContext, options: IdempotentPersistenceTransactionOptions, fn: (db: Database) => Promise<T>): Promise<T>;
+/**
+ * Personal workspace data needs both tenant and authenticated-principal GUCs.
+ * `session_pins` uses this helper so FORCE RLS rejects another member's rows
+ * even if a future query accidentally omits its explicit subject predicate.
+ */
+export declare function withWorkspaceSubjectRls<T>(db: Database, workspaceId: string, subjectId: string, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+/** Apply and verify actor-private RLS on an already transaction-pinned handle. */
+export declare function setSubjectRlsContext(db: Database, subjectId: string): Promise<void>;
+export declare function withWorkspaceUsageLock<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
+export declare function withAccountRls<T>(db: Database, accountId: string, fn: (db: Database) => Promise<T>): Promise<T>;
+/** Internal lookup for the host binding attached to a database handle. */
+export declare function dbBindingFor(db: Database): DbBinding | undefined;
+export {};

package/dist/index.d.ts

@@ -1,11 +1,10 @@
 import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityKind, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, McpPersonalConnectionDelegation, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetVariableMetadata, WorkspaceMember, WorkspaceRegisteredPack, Rig, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding } from "@opengeni/contracts";
 import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
+import { type CodexFetch } from "@opengeni/codex";
 export { isCodexBilledModel } from "@opengeni/codex";
 import { type SQL } from "drizzle-orm";
 export { frozenInitiatorForCommandActor, type FrozenTurnInitiator } from "./turn-initiator";
-import type { PgDatabase, PgTransactionConfig } from "drizzle-orm/pg-core";
-import postgres from "postgres";
 import { type SessionDiscoveryControl, type SessionCommandActor, type SessionTurnAttemptOutcome } from "./session-control";
 import { type SessionRealtimeContinuityEntry } from "./session-realtime-context";
 import * as schema from "./schema";
@@ -31,21 +30,16 @@ export { sanitizeMemoryText } from "./memory-domain";
 export { migrate, runMigrations } from "./migrate";
 export { provisionRoles, type ProvisionResult, type ProvisionRolesOptions, } from "./provision-roles";
 export * from "./memory-domain";
-export type Database = PgDatabase<any, typeof schema>;
+import { type Database } from "./database";
+export { createDb, registerDbBinding, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withWorkspaceRls, withWorkspaceSubjectRls, withWorkspaceUsageLock, type CreateDbOptions, type Database, type DbClient, type RlsContext, type RlsStrategy, type UserLookup, } from "./database";
+import { buildCodexTokenResolver as buildCodexTokenResolverCore, fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore, fetchCodexUsageForAccount as fetchCodexUsageForAccountCore, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun } from "./codex-token-resolver";
+import { buildConnectionTokenResolver as buildConnectionTokenResolverCore, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionTokenResolverOptions } from "./connection-token-resolver";
 /** Raised when a durable session tool-policy write lost its version fence. */
 export declare class SessionToolPolicyVersionConflictError extends Error {
     readonly currentVersion: number;
     readonly code = "SESSION_TOOL_POLICY_CONFLICT";
     constructor(currentVersion: number);
 }
-export type DbClient = {
-    db: Database;
-    close: () => Promise<void>;
-};
-export type RlsContext = {
-    accountId: string;
-    workspaceId?: string | null;
-};
 export type NestedAgentDepthPolicySource = "session" | "workspace" | "deployment" | "default";
 export type SessionDepthPolicy = {
     rootSessionId: string;
@@ -94,77 +88,6 @@ export declare class SessionSpawnDeniedDbError extends Error {
     readonly denial: SessionSpawnDenial;
     constructor(denial: SessionSpawnDenial);
 }
-/**
- * RLS posture for the connection OpenGeni's query layer runs over (Step I, §7.7).
- *
- * - `"force"` (DEFAULT — today's standalone behavior, byte-for-byte): OpenGeni
- *   connects as a NON-OWNER role (`opengeni_app`) and every table carries
- *   `FORCE ROW LEVEL SECURITY`, so the workspace/account GUCs set by
- *   `setRlsContext` are the ONLY thing that admits rows — even the table owner
- *   is subject to RLS. This is the Fork-A isolation guarantee.
- * - `"scoped"` (embedded Fork-B opt-in): the host runs OpenGeni's queries over a
- *   role that OWNS the dedicated schema (RLS need not be forced for that role),
- *   relying on the host's own tenant boundary. OpenGeni STILL emits the
- *   `set_config('opengeni.account_id'/'workspace_id', …)` GUCs defensively on
- *   every scoped query, so the application query path is byte-identical between
- *   the two strategies and the app code is RLS-mode-agnostic. The strategy is a
- *   declared posture (consumed by `provisionRoles` and as a documented
- *   invariant), NOT a query-path branch — there is deliberately no `if
- *   (strategy === …)` anywhere in the helpers below. Picking `"scoped"` does not
- *   relax any GUC; it only changes which DB role the host provisions/connects as
- *   and asserts that the host accepts owning the isolation boundary.
- */
-export type RlsStrategy = "force" | "scoped";
-/**
- * Resolve a host-IdP/Better-Auth user *identifier* by email. Injected via
- * `createDb({ userLookup })` (Step I). UNSET → today's raw parameterized select
- * against Better Auth's `auth_users` table (see `getManagedUserByEmail`), which
- * relies on the postgres-js array-shaped `db.execute` result. An embedded host
- * whose identity lives elsewhere (a different IdP table, a different driver, or
- * a non-`auth_users` user store) injects this closure so OpenGeni never touches
- * `auth_users` directly. Returns the user id, or null when no such user exists.
- */
-export type UserLookup = (db: Database, email: string) => Promise<string | null>;
-export type CreateDbOptions = {
-    /**
-     * The Postgres `search_path` for this connection (Step I, §7.8 runtime half).
-     * UNSET → today's behavior: NO `search_path` startup parameter is sent, so the
-     * server default applies (`public` for standalone, where every table + the
-     * `vector` extension + `gen_random_uuid()` live). For an embedded dedicated
-     * schema, pass e.g. `"opengeni,opengeni_private,public"` — postgres-js sends
-     * it as a per-session startup parameter (the supported, query-param-free way;
-     * URL `?search_path=` is IGNORED by postgres-js). Keep `public` LAST so the
-     * `vector` type and `gen_random_uuid()` (which live in `public` on the
-     * pgvector image) still resolve — the schema-isolation contract live footgun.
-     */
-    searchPath?: string;
-    /** RLS posture; defaults to `"force"` (today's standalone). */
-    rlsStrategy?: RlsStrategy;
-    /** Host-provided user-by-email resolver; unset → today's raw `auth_users` query. */
-    userLookup?: UserLookup;
-    /** postgres-js pool size; defaults to today's `10`. */
-    max?: number;
-    /**
-     * Connection-local default transaction isolation sent in the postgres-js
-     * startup parameters. This is intentionally not a role/database default:
-     * tests and embedded callers can exercise a different ambient isolation
-     * without mutating a shared PostgreSQL role or affecting other connections.
-     */
-    isolationLevel?: postgres.ConnectionParameters["default_transaction_isolation"];
-};
-/** The strategy bound to a handle (or the `"force"` default). */
-export declare function rlsStrategyFor(db: Database): RlsStrategy;
-export declare function createDb(databaseUrl: string, options?: CreateDbOptions): DbClient;
-/**
- * Register a host's `rlsStrategy`/`userLookup` against an externally-constructed
- * `Database` handle (e.g. one the embedded host built from its own driver and
- * injected, rather than via `createDb`). Lets the same WeakMap-backed lookups
- * work for injected handles. Standalone never calls this (it uses `createDb`).
- */
-export declare function registerDbBinding(db: Database, binding: {
-    rlsStrategy?: RlsStrategy;
-    userLookup?: UserLookup;
-}): void;
 export type HostExportKind = "session_event" | "usage_event";
 /**
  * A leased row did not satisfy this consumer build's export contract. Only
@@ -274,27 +197,6 @@ export declare function getHostExportConsumerStatus(db: Database, input: {
     kind: HostExportKind;
     consumerId: string;
 }): Promise<HostExportConsumerStatus | null>;
-export declare function setRlsContext(db: Database, context: RlsContext): Promise<void>;
-export declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
-/**
- * Run one bounded database operation on a transaction-pinned backend.
- *
- * Callers that also have an application deadline should check their abort
- * signal before returning from `fn`; throwing there rolls the transaction back
- * even when the application deadline won a surrounding Promise race.
- */
-export declare function withDatabaseStatementTimeout<T>(db: Database, timeoutMs: number, fn: (db: Database) => Promise<T>): Promise<T>;
-export declare function rlsContextForWorkspace(db: Database, workspaceId: string): Promise<RlsContext>;
-export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
-/**
- * Personal workspace data needs both tenant and authenticated-principal GUCs.
- * `session_pins` uses this helper so FORCE RLS rejects another member's rows
- * even if a future query accidentally omits its explicit subject predicate.
- */
-export declare function withWorkspaceSubjectRls<T>(db: Database, workspaceId: string, subjectId: string, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
-/** Apply and verify actor-private RLS on an already transaction-pinned handle. */
-export declare function setSubjectRlsContext(db: Database, subjectId: string): Promise<void>;
-export declare function withWorkspaceUsageLock<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
 export type DocumentIndexAuthority = {
     authorityKind: DocumentAuthorityKind;
     authorityWorkspaceId: string | null;
@@ -313,7 +215,6 @@ export declare function resolveDocumentIndexAuthority(db: Database, input: {
     workspaceId: string;
     documentId: string;
 }): Promise<DocumentIndexAuthority | null>;
-export declare function withAccountRls<T>(db: Database, accountId: string, fn: (db: Database) => Promise<T>): Promise<T>;
 export declare const allWorkspacePermissions: Permission[];
 export declare const allAccountPermissions: Permission[];
 export type BootstrapWorkspaceInput = {
@@ -710,6 +611,7 @@ export type WorkspaceStateMemoryRecord = {
 export type CreateSocialConnectionInput = {
     accountId: string;
     workspaceId: string;
+    subjectId?: string | null;
     provider: SocialProvider;
     accountHandle: string;
     accountName?: string | null;
@@ -724,6 +626,7 @@ export type CreateSocialConnectionInput = {
 export type UpsertSocialOAuthConnectionInput = {
     accountId: string;
     workspaceId: string;
+    subjectId?: string | null;
     provider: SocialProvider;
     accountHandle: string;
     accountName?: string | null;
@@ -735,6 +638,7 @@ export type UpsertSocialOAuthConnectionInput = {
 export type UpdateSocialConnectionCredentialInput = {
     workspaceId: string;
     connectionId: string;
+    subjectId?: string | null;
     credentialEncrypted?: string | null;
     status?: SocialConnectionStatus;
     tokenMetadata?: Record<string, unknown>;
@@ -742,6 +646,7 @@ export type UpdateSocialConnectionCredentialInput = {
 export type CreateSocialPostInput = {
     accountId: string;
     workspaceId: string;
+    subjectId?: string | null;
     connectionId: string;
     externalPostId?: string | null;
     url?: string | null;
@@ -862,21 +767,6 @@ export type SlackBotDeleteOperation = {
     createdAt: Date;
     updatedAt: Date;
 };
-export type ConnectionCredentialForBroker = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    subjectId: string | null;
-    providerDomain: string;
-    kind: ConnectionKind;
-    status: ConnectionStatus;
-    credential: Record<string, unknown>;
-    grantedScopes: string[];
-    expiresAt: Date | null;
-    lastRefreshAt: Date | null;
-    version: number;
-    metadata: Record<string, unknown>;
-};
 export type IntegrationOAuthClientForUse = {
     id: string;
     issuer: string;
@@ -1681,14 +1571,14 @@ export declare function upsertSocialOAuthConnection(db: Database, input: UpsertS
  * of mapSocialConnection so the encrypted bundle never rides along on list or
  * MCP responses.
  */
-export declare function loadSocialConnectionCredential(db: Database, workspaceId: string, connectionId: string): Promise<{
+export declare function loadSocialConnectionCredential(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<{
     connection: SocialConnection;
     credentialEncrypted: string | null;
 } | null>;
 export declare function updateSocialConnectionCredential(db: Database, input: UpdateSocialConnectionCredentialInput): Promise<SocialConnection | null>;
-export declare function listSocialConnections(db: Database, workspaceId: string, limit?: number): Promise<SocialConnection[]>;
-export declare function getSocialConnection(db: Database, workspaceId: string, connectionId: string): Promise<SocialConnection | null>;
-export declare function requireSocialConnection(db: Database, workspaceId: string, connectionId: string): Promise<SocialConnection>;
+export declare function listSocialConnections(db: Database, workspaceId: string, limit?: number, subjectId?: string | null): Promise<SocialConnection[]>;
+export declare function getSocialConnection(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<SocialConnection | null>;
+export declare function requireSocialConnection(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<SocialConnection>;
 export declare function createSocialPost(db: Database, input: CreateSocialPostInput): Promise<SocialPost>;
 /**
  * Idempotent bulk ingest for provider sync: rows already present under the
@@ -1699,6 +1589,7 @@ export declare function recordSyncedSocialPosts(db: Database, input: {
     accountId: string;
     workspaceId: string;
     connectionId: string;
+    subjectId?: string | null;
     posts: Array<{
         externalPostId: string;
         url?: string | null;
@@ -1714,6 +1605,7 @@ export declare function recordSyncedSocialPosts(db: Database, input: {
 }>;
 export declare function listSocialPosts(db: Database, options: {
     workspaceId: string;
+    subjectId?: string | null;
     connectionIds?: string[];
     since?: Date;
     limit?: number;
@@ -1970,25 +1862,6 @@ export declare function loadVariableSetForRun(db: Database, settings: Settings,
 export declare const loadWorkspaceEnvironmentForRun: typeof loadVariableSetForRun;
 /** @deprecated use VariableSetForRun */
 export type WorkspaceEnvironmentForRun = VariableSetForRun;
-export type CodexCredentialTokens = {
-    accessToken: string;
-    refreshToken: string;
-    idToken: string;
-};
-export type CodexCredentialForRun = {
-    id: string;
-    version: number;
-    workspaceId: string;
-    tokens: CodexCredentialTokens;
-    chatgptAccountId: string | null;
-    scopes: string | null;
-    planType: string | null;
-    isFedramp: boolean;
-    expiresAt: Date | null;
-    lastRefreshAt: Date | null;
-    status: string;
-    lastError: string | null;
-};
 /**
  * Login / rotation write (multi-account P1). Caller passes the PRE-encrypted
  * credential blob. Keyed on the composite partial index (workspace, chatgpt
@@ -2664,16 +2537,6 @@ export declare function completeCodexResetRedemption(db: Database, input: {
     outcome: CodexResetRedemptionOutcome;
 }): Promise<CodexCapacityMutationResult<CodexResetRedemptionAttempt | null>>;
 /** The P2 usage-cache snapshot written by the refreshing usage wrapper. */
-export type CodexAccountUsageSnapshot = {
-    primaryUsedPercent?: number | null;
-    primaryResetAt?: Date | null;
-    secondaryUsedPercent?: number | null;
-    secondaryResetAt?: Date | null;
-    /** Present only when the quota body parsed successfully. */
-    checkedAt?: Date;
-    resetCreditAvailableCount?: number | null;
-    resetCreditsCheckedAt?: Date | null;
-};
 /**
  * Cache-write for P2 quota bars: persist the five plaintext usage columns on a
  * SPECIFIC credential row. NEVER touches credential_encrypted. RLS-scoped, guarded
@@ -6375,6 +6238,7 @@ export type RequestSessionTurnRecoveryInput = {
     attemptId: string;
     reason: string;
     detail?: Record<string, unknown>;
+    providerRecoveryCount?: number;
     fromStatuses?: SessionTurnStatus[];
     providerArtifactInvalidation?: {
         codexCredentialId: string;
@@ -6501,6 +6365,7 @@ export declare function enqueueSessionWorkflowWakeInTransaction(tx: Database, in
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
 }): Promise<number>;
 /** Standalone transactional producer for operations not already in a DB txn. */
 export declare function enqueueSessionWorkflowWake(db: Database, input: {
@@ -6510,6 +6375,7 @@ export declare function enqueueSessionWorkflowWake(db: Database, input: {
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
 }): Promise<number>;
 /**
  * Re-deliver already-committed session work only when admission currently
@@ -6523,6 +6389,7 @@ export declare function enqueueSessionWorkflowWakeIfRunnable(db: Database, input
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
 }): Promise<number | null>;
 /** Claim only explicit, undelivered wake revisions; never infer work by scan. */
 export declare function claimPendingSessionWorkflowWakes(db: Database, limit?: number): Promise<SessionWorkflowWake[]>;
@@ -6662,6 +6529,10 @@ export declare function appendSessionEventsWithLockedSessionUpdate(db: Database,
     lockParentSession?: boolean;
 }): Promise<SessionEvent[]>;
 export declare function sessionSubject(workspaceId: string, sessionId: string): string;
-export * from "./codex-token-resolver";
-export * from "./connection-token-resolver";
+export declare function buildCodexTokenResolver(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps?: CodexAuthDeps): ReturnType<typeof buildCodexTokenResolverCore>;
+export declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): ReturnType<typeof fetchCodexUsageForAccountCore>;
+export declare function fetchCodexRateLimitResetCreditsForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): ReturnType<typeof fetchCodexRateLimitResetCreditsForAccountCore>;
+export declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps, options?: ConnectionTokenResolverOptions): ReturnType<typeof buildConnectionTokenResolverCore>;
+export { withCodexTokenDeadline, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun, type CodexCredentialTokens, type CodexRateLimitResetCreditsAccountResult, type CodexTokenDeadlineClock, type CodexTokenDeadlineOptions, } from "./codex-token-resolver";
+export { buildHostConnectionTokenResolver, ConnectionRefreshHttpError, HostMcpCredentialBindingError, HostMcpCredentialScopeError, isPrivateAddress, normalizeBearerScheme, refreshOAuthConnectionCredential, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionCredentialLookupInput, type ConnectionStatusGuard, type ConnectionTokenRefreshInput, type ConnectionTokenResolverOptions, type HostMcpCredentialResolverContext, type PermanentConnectionRefreshFailure, type RefreshTransportOptions, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, } from "./connection-token-resolver";
 export * from "./workspace-artifacts";