@opengeni/db 0.27.8 → 0.27.9

package/dist/insights.d.ts

@@ -1,4 +1,4 @@
-import type { Database } from "./index";
+import type { Database } from "./database";
 export type InsightsTimeWindow = {
     since: Date;
     until: Date;

package/dist/memory-governance.d.ts

@@ -1,4 +1,4 @@
-import type { Database } from "./index";
+import type { Database } from "./database";
 import { type MemoryOperationPlanInput, type MemoryRevertPlanInput } from "./memory-domain";
 export declare class MemoryGovernanceAuthorityError extends Error {
     readonly name = "MemoryGovernanceAuthorityError";

package/dist/new-session-drafts.d.ts

@@ -1,5 +1,5 @@
 import type { NewSessionDraftOptions, LatencyMode, ReasoningEffort, ResourceRef, ToolRef } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 import * as schema from "./schema";
 export type NewSessionDraftRow = typeof schema.newSessionDrafts.$inferSelect;
 export declare class NewSessionDraftConflictError extends Error {

package/dist/preference-registry.d.ts

@@ -1,5 +1,5 @@
 import { PreferenceRegistryDescriptor, type CreatePreferenceRegistryProposalRequest, type PreferenceRegistryConflictStrategy, type PreferenceRegistryScope, type PreferenceRegistryStatus } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 export declare class PreferenceRegistryNotFoundError extends Error {
     readonly name = "PreferenceRegistryNotFoundError";
 }

package/dist/provision-roles.d.ts

@@ -1,4 +1,4 @@
-import type { RlsStrategy } from "./index";
+import type { RlsStrategy } from "./database";
 export type ProvisionResult = {
     appRole: string | null;
     hostExportRole: string | null;

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-IHPCI4GV.js";
+} from "./chunk-2JFRTKTG.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/runtime-posture.d.ts

@@ -1,4 +1,4 @@
-import type { Database, RlsStrategy } from "./index";
+import type { Database, RlsStrategy } from "./database";
 /**
  * The complete standalone tenant-table contract. Adding or removing a
  * FORCE-RLS table is an architectural change: update this list in the same

package/dist/schema.d.ts

@@ -6930,6 +6930,7 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
             driverParam: unknown;
             notNull: true;
@@ -6948,6 +6949,7 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
         }>;
         toolPolicy: import("drizzle-orm/pg-core").PgColumn<{
@@ -11958,6 +11960,7 @@ export declare const sessionTurns: import("drizzle-orm/pg-core").PgTableWithColu
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
             driverParam: unknown;
             notNull: true;
@@ -11976,6 +11979,7 @@ export declare const sessionTurns: import("drizzle-orm/pg-core").PgTableWithColu
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
         }>;
         cancelledBy: import("drizzle-orm/pg-core").PgColumn<{
@@ -14751,6 +14755,7 @@ export declare const sessionSystemUpdates: import("drizzle-orm/pg-core").PgTable
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
             driverParam: unknown;
             notNull: true;
@@ -14769,6 +14774,7 @@ export declare const sessionSystemUpdates: import("drizzle-orm/pg-core").PgTable
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
         }>;
         state: import("drizzle-orm/pg-core").PgColumn<{
@@ -15088,6 +15094,7 @@ export declare const sessionSystemUpdateOutbox: import("drizzle-orm/pg-core").Pg
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
             driverParam: unknown;
             notNull: true;
@@ -15106,6 +15113,7 @@ export declare const sessionSystemUpdateOutbox: import("drizzle-orm/pg-core").Pg
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
         }>;
         status: import("drizzle-orm/pg-core").PgColumn<{
@@ -22720,6 +22728,7 @@ export declare const scheduledTasks: import("drizzle-orm/pg-core").PgTableWithCo
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
             driverParam: unknown;
             notNull: true;
@@ -22738,6 +22747,7 @@ export declare const scheduledTasks: import("drizzle-orm/pg-core").PgTableWithCo
                 ownerSubjectId: string;
                 providerDomain: string;
                 kind?: "api_key" | "app_install" | "delegated" | "oauth2" | undefined;
+                connectionType?: "mcp" | "social" | undefined;
             }[];
         }>;
         reusableSessionId: import("drizzle-orm/pg-core").PgColumn<{
@@ -27176,6 +27186,23 @@ export declare const socialConnections: import("drizzle-orm/pg-core").PgTableWit
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        subjectId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "subject_id";
+            tableName: "social_connections";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         provider: import("drizzle-orm/pg-core").PgColumn<{
             name: "provider";
             tableName: "social_connections";

package/dist/schema.js

@@ -139,7 +139,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-M6EOXYHK.js";
+} from "./chunk-NX2JNJJP.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,

package/dist/scoped-knowledge.d.ts

@@ -1,5 +1,5 @@
 import type { EligibleKnowledgeClaim, KnowledgeChangeProposalRecord, KnowledgeClaimEvidencePolarity, KnowledgeClaimOrigin, KnowledgeClaimRecord, KnowledgeClaimRelationType, KnowledgeClaimReviewState, KnowledgeDocumentVersionRecord, KnowledgeFactObjectKind, KnowledgeFactRecord, KnowledgeLifecycleEventType, KnowledgeLifecycleState, KnowledgeProviderRecord, KnowledgeSourceAclVersionRecord, KnowledgeSourceObjectRecord, KnowledgeSourceRecord, KnowledgeSyncRunRecord, ScopedKnowledgeActor, ScopedKnowledgeScope } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 type KnowledgeWriteContext = {
     accountId: string;
     workspaceId: string;

package/dist/session-control.d.ts

@@ -1,5 +1,5 @@
 import { type SessionMcpApprovalPolicy, type TurnInitiatorContext } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 import * as schema from "./schema";
 export declare const SESSION_ANCESTRY_LIMIT = 10000;
 export type WorkspaceControlLockMode = "none" | "share" | "update";

package/dist/session-queue-commands.d.ts

@@ -1,5 +1,5 @@
 import { ResourceRef, type McpPersonalConnectionDelegation, type LatencyMode, type ReasoningEffort, type TurnExecutionPolicyV1 } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 import { type SessionCommandActor, type SessionCommandReceiptRow } from "./session-control";
 import * as schema from "./schema";
 export type QueueCommandConflictCode = "QUEUE_VERSION_CHANGED" | "QUEUE_PROMPT_STARTED" | "QUEUE_ANCHOR_CHANGED" | "PROMPT_CHANGED" | "DRAFT_CHANGED" | "DRAFT_NOT_EMPTY" | "EDIT_SOURCE_CHANGED";

package/dist/session-realtime-context.d.ts

@@ -1,4 +1,4 @@
-import type { Database } from "./index";
+import type { Database } from "./database";
 export declare const SESSION_REALTIME_CONTEXT_MAX_BYTES = 65536;
 export declare const SESSION_REALTIME_TAIL_SOURCE = "transcript_tail_flush";
 export declare const SESSION_REALTIME_TAIL_INSTRUCTION = "The user just ended the realtime voice session but remains reachable by text. Ending voice changes only the communication mode; it does not stop, pause, or complete existing work. Treat the remaining transcript tail as additional context. If work was already underway, continue it from the current state. Change or stop that work only if the user explicitly requested it. If nothing was underway and the transcript contains no unhandled request, acknowledge briefly; otherwise handle any unhandled request.";

package/dist/session-realtime-ledger.d.ts

@@ -1,5 +1,5 @@
 import { type SessionRealtimeMode } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 import { type AssertSessionRealtimeOwnerInput } from "./session-realtime";
 export declare const SESSION_REALTIME_LEDGER_MAX_BATCH = 64;
 export declare const SESSION_REALTIME_LEDGER_MAX_TEXT_BYTES = 131072;

package/dist/session-realtime-mirror.d.ts

@@ -1,5 +1,5 @@
 import type { HumanInputQuestion, HumanInputResponse } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 import * as schema from "./schema";
 export type SessionRealtimeMirrorChannel = "speakable" | "commentary" | null;
 export type MirrorSessionRealtimeContextInput = {

package/dist/session-realtime-state.d.ts

@@ -1,2 +1,2 @@
-import type { Database } from "./index";
+import type { Database } from "./database";
 export declare function sessionRealtimeIsActiveInTransaction(db: Database, workspaceId: string, sessionId: string, now?: Date): Promise<boolean>;

package/dist/session-realtime-terminal.d.ts

@@ -1,4 +1,4 @@
-import type { Database } from "./index";
+import type { Database } from "./database";
 export type ProjectSessionRealtimeDelegationTerminalInput = {
     accountId: string;
     workspaceId: string;

package/dist/session-realtime.d.ts

@@ -1,5 +1,5 @@
 import type { SessionRealtimeEndReason, SessionRealtimeMode, SessionRealtimeModel } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 import * as schema from "./schema";
 export { sessionRealtimeIsActiveInTransaction } from "./session-realtime-state";
 export declare const SESSION_REALTIME_LEASE_MS = 30000;

package/dist/session-tool-call-settlement.d.ts

@@ -1,5 +1,5 @@
 import type { SessionEvent } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 export declare const TOOL_RESULT_TYPE_BY_CALL_TYPE: Readonly<Record<string, string>>;
 export declare function historyCallId(item: Record<string, unknown>): string | null;
 export declare function historyItemType(item: Record<string, unknown>): string | null;

package/dist/turn-initiator.d.ts

@@ -1,5 +1,5 @@
 import { type TurnInitiator, type TurnInitiatorContext } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 import type { SessionCommandActor } from "./session-control";
 export declare const UNATTRIBUTED_LEGACY_INITIATOR: TurnInitiator;
 export type FrozenTurnInitiator = {

package/dist/workspace-artifacts.d.ts

@@ -1,5 +1,5 @@
 import type { WorkspaceArtifact, WorkspaceArtifactDetailResponse, WorkspaceArtifactMutationResponse, WorkspaceArtifactVersion } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 type ArtifactMutationToolName = "artifacts_create" | "artifacts_publish" | "artifacts_rollback";
 export declare class WorkspaceArtifactNotFoundError extends Error {
     readonly name = "WorkspaceArtifactNotFoundError";

package/dist/workspace-instruction-policies.d.ts

@@ -1,6 +1,6 @@
 import { WorkspaceInstructionPolicySnapshot } from "@opengeni/contracts";
 import type { WorkspaceInstructionPolicyActivationResponse, WorkspaceInstructionPolicyDiffResponse, WorkspaceInstructionPolicyDraftProvenanceSource, WorkspaceInstructionPolicyHead, WorkspaceInstructionPolicyListQuery, WorkspaceInstructionPolicyListResponse, WorkspaceInstructionPolicyOnboardingProposal, WorkspaceInstructionPolicyOnboardingProposalListQuery, WorkspaceInstructionPolicyOnboardingProposalListResponse, WorkspaceInstructionPolicyProvenanceSource, WorkspaceInstructionPolicyRevision, WorkspaceInstructionPolicyTarget } from "@opengeni/contracts";
-import type { Database } from "./index";
+import type { Database } from "./database";
 type DraftRequestInput = WorkspaceInstructionPolicyTarget & {
     operationId: string;
     accountId: string;

package/drizzle/0171_social_connection_subject_ownership.sql

@@ -0,0 +1,53 @@
+-- deployment-mode: rolling
+-- Extend first-party social credentials with the same workspace/personal ownership boundary as MCP connections.
+
+ALTER TABLE social_connections
+  ADD COLUMN subject_id text;
+
+DROP INDEX social_connections_workspace_provider_handle_idx;
+CREATE UNIQUE INDEX social_connections_workspace_provider_handle_idx
+  ON social_connections (workspace_id, provider, account_handle)
+  WHERE subject_id IS NULL;
+CREATE UNIQUE INDEX social_connections_subject_provider_handle_idx
+  ON social_connections (workspace_id, subject_id, provider)
+  WHERE subject_id IS NOT NULL;
+CREATE INDEX social_connections_subject_provider_status_idx
+  ON social_connections (workspace_id, subject_id, provider, status);
+
+DROP POLICY workspace_isolation ON social_connections;
+CREATE POLICY workspace_isolation ON social_connections
+  USING (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND (
+      subject_id IS NULL
+      OR subject_id = nullif(current_setting('opengeni.subject_id', true), '')
+    )
+  )
+  WITH CHECK (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND (
+      subject_id IS NULL
+      OR subject_id = nullif(current_setting('opengeni.subject_id', true), '')
+    )
+  );
+
+DROP POLICY workspace_isolation ON social_posts;
+CREATE POLICY workspace_isolation ON social_posts
+  USING (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND EXISTS (
+      SELECT 1
+      FROM social_connections connection
+      WHERE connection.id = social_posts.connection_id
+        AND connection.workspace_id = social_posts.workspace_id
+    )
+  )
+  WITH CHECK (
+    opengeni_private.workspace_rls_visible(account_id, workspace_id)
+    AND EXISTS (
+      SELECT 1
+      FROM social_connections connection
+      WHERE connection.id = social_posts.connection_id
+        AND connection.workspace_id = social_posts.workspace_id
+    )
+  );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.27.8",
+  "version": "0.27.9",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -51,8 +51,8 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.10",
-    "@opengeni/config": "^0.10.11",
-    "@opengeni/contracts": "^0.38.1",
+    "@opengeni/config": "^0.10.12",
+    "@opengeni/contracts": "^0.38.2",
     "@opengeni/network": "^0.2.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"

package/src/codex-token-resolver.ts

@@ -3,7 +3,7 @@
 // Hoisted here from apps/worker/src/activities/codex-auth.ts so BOTH the worker
 // (turn-time bearer for the streamed run) AND the api (the /wham/usage quota-bar
 // reads) drive ONE resolver — no duplicated refresh/CAS/single-flight logic. The
-// worker re-exports buildCodexTokenResolver from this module for back-compat, so
+// worker re-exports buildCodexTokenResolver from @opengeni/db for back-compat, so
 // the agent-turn.ts call site is unchanged.
 //
 // Why @opengeni/db is the right home: the resolver only orchestrates accessors
@@ -35,15 +35,52 @@ import {
   refreshCodexToken,
 } from "@opengeni/codex";
 import { encryptEnvironmentValue } from "./environment-crypto";
-import {
-  loadCodexCredentialForRun,
-  recordCodexAccountUsage,
-  recordCodexTokenRefresh,
-  setCodexCredentialStatus,
-  withCodexCredentialRefreshLock,
-  type CodexCredentialForRun,
-  type Database,
-} from "./index";
+import type { Database } from "./database";
+
+export type CodexCredentialTokens = {
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+};
+
+export type CodexCredentialForRun = {
+  id: string;
+  version: number;
+  workspaceId: string;
+  tokens: CodexCredentialTokens;
+  chatgptAccountId: string | null;
+  scopes: string | null;
+  planType: string | null;
+  isFedramp: boolean;
+  expiresAt: Date | null;
+  lastRefreshAt: Date | null;
+  status: string;
+  lastError: string | null;
+};
+
+export type CodexAccountUsageSnapshot = {
+  primaryUsedPercent?: number | null;
+  primaryResetAt?: Date | null;
+  secondaryUsedPercent?: number | null;
+  secondaryResetAt?: Date | null;
+  checkedAt?: Date;
+  resetCreditAvailableCount?: number | null;
+  resetCreditsCheckedAt?: Date | null;
+};
+
+type CodexCredentialRefreshInput = {
+  id: string;
+  version: number;
+  workspaceId: string;
+  credentialEncrypted: string;
+  expiresAt: Date | null;
+  lastRefreshAt: Date;
+};
+
+type CodexCredentialStatusTarget = {
+  id: string;
+  version: number;
+};
 
 // Single-flight per CREDENTIAL INSTANCE (row id + version), process-module scope.
 // Keying by the loaded credential's id+version — NOT by workspaceId alone (P1-b) —
@@ -142,25 +179,37 @@ export async function withCodexTokenDeadline<T>(
 
 // Dependencies are injectable so the lifecycle logic (single-flight, staleness,
 // needs_relogin transition) is unit-testable without a database. Production uses
-// the real db + codex functions via the default bag.
+// the root composition wrapper supplies the real db + codex functions.
 export type CodexAuthDeps = {
-  loadCredential: typeof loadCodexCredentialForRun;
-  recordRefresh: typeof recordCodexTokenRefresh;
-  setStatus: typeof setCodexCredentialStatus;
+  loadCredential: (
+    db: Database,
+    settings: Settings,
+    workspaceId: string,
+    credentialId: string,
+  ) => Promise<CodexCredentialForRun | null>;
+  recordRefresh: (db: Database, input: CodexCredentialRefreshInput) => Promise<boolean>;
+  setStatus: (
+    db: Database,
+    workspaceId: string,
+    status: "active" | "needs_relogin" | "error",
+    lastError: string | null,
+    target: CodexCredentialStatusTarget,
+  ) => Promise<boolean>;
   refresh: typeof refreshCodexToken;
   encrypt: typeof encryptEnvironmentValue;
   keyBytes: typeof environmentsEncryptionKeyBytes;
-  withRefreshLock: typeof withCodexCredentialRefreshLock;
-};
-
-const defaultDeps: CodexAuthDeps = {
-  loadCredential: loadCodexCredentialForRun,
-  recordRefresh: recordCodexTokenRefresh,
-  setStatus: setCodexCredentialStatus,
-  refresh: refreshCodexToken,
-  encrypt: encryptEnvironmentValue,
-  keyBytes: environmentsEncryptionKeyBytes,
-  withRefreshLock: withCodexCredentialRefreshLock,
+  withRefreshLock: <T>(
+    db: Database,
+    workspaceId: string,
+    credentialId: string,
+    fn: (lockedDb: Database) => Promise<T>,
+  ) => Promise<T>;
+  recordUsage?: (
+    db: Database,
+    workspaceId: string,
+    credentialId: string,
+    snapshot: CodexAccountUsageSnapshot,
+  ) => Promise<boolean>;
 };
 
 export function buildCodexTokenResolver(
@@ -173,7 +222,7 @@ export function buildCodexTokenResolver(
   // 0 rows against the now-inactive row — so a refresh racing a switch can never
   // clobber the newly-active account. The single-flight map needs zero change.
   credentialId: string,
-  deps: CodexAuthDeps = defaultDeps,
+  deps: CodexAuthDeps,
 ): { getToken: () => Promise<CodexTokenSnapshot>; refresh: () => Promise<CodexTokenSnapshot> } {
   const snapshot = (cred: CodexCredentialForRun): CodexTokenSnapshot => ({
     accessToken: cred.tokens.accessToken,
@@ -336,9 +385,10 @@ export async function fetchCodexUsageForAccount(
   settings: Settings,
   workspaceId: string,
   credentialId: string,
+  deps: CodexAuthDeps,
   fetchImpl: CodexFetch = fetch,
 ): Promise<CodexUsagePayload> {
-  const resolver = buildCodexTokenResolver(db, settings, workspaceId, credentialId);
+  const resolver = buildCodexTokenResolver(db, settings, workspaceId, credentialId, deps);
   let token: CodexTokenSnapshot;
   try {
     token = await resolver.getToken();
@@ -373,27 +423,29 @@ export async function fetchCodexUsageForAccount(
     // cached without erasing or falsely refreshing the last valid quota truth.
     // Cache-write is best-effort: a disconnect under us (false) or a transient
     // write error must NOT sink the freshly-read result we are about to return.
-    await recordCodexAccountUsage(db, workspaceId, credentialId, {
-      ...(parsedQuota
-        ? {
-            primaryUsedPercent: normalized.fiveHour?.percent ?? null,
-            primaryResetAt: normalized.fiveHour?.resetAt
-              ? new Date(normalized.fiveHour.resetAt)
-              : null,
-            secondaryUsedPercent: normalized.weekly?.percent ?? null,
-            secondaryResetAt: normalized.weekly?.resetAt
-              ? new Date(normalized.weekly.resetAt)
-              : null,
-            checkedAt,
-          }
-        : {}),
-      ...(normalized.rateLimitResetCredits
-        ? {
-            resetCreditAvailableCount: normalized.rateLimitResetCredits.availableCount,
-            resetCreditsCheckedAt: checkedAt,
-          }
-        : {}),
-    }).catch(() => undefined);
+    await deps
+      .recordUsage?.(db, workspaceId, credentialId, {
+        ...(parsedQuota
+          ? {
+              primaryUsedPercent: normalized.fiveHour?.percent ?? null,
+              primaryResetAt: normalized.fiveHour?.resetAt
+                ? new Date(normalized.fiveHour.resetAt)
+                : null,
+              secondaryUsedPercent: normalized.weekly?.percent ?? null,
+              secondaryResetAt: normalized.weekly?.resetAt
+                ? new Date(normalized.weekly.resetAt)
+                : null,
+              checkedAt,
+            }
+          : {}),
+        ...(normalized.rateLimitResetCredits
+          ? {
+              resetCreditAvailableCount: normalized.rateLimitResetCredits.availableCount,
+              resetCreditsCheckedAt: checkedAt,
+            }
+          : {}),
+      })
+      .catch(() => undefined);
   }
 
   return normalized;
@@ -418,9 +470,10 @@ export async function fetchCodexRateLimitResetCreditsForAccount(
   settings: Settings,
   workspaceId: string,
   credentialId: string,
+  deps: CodexAuthDeps,
   fetchImpl: CodexFetch = fetch,
 ): Promise<CodexRateLimitResetCreditsAccountResult> {
-  const resolver = buildCodexTokenResolver(db, settings, workspaceId, credentialId);
+  const resolver = buildCodexTokenResolver(db, settings, workspaceId, credentialId, deps);
   let token: CodexTokenSnapshot;
   try {
     token = await resolver.getToken();