@opengeni/db 0.27.9 → 0.28.1

package/dist/index.d.ts

@@ -1895,6 +1895,61 @@ export declare function upsertCodexSubscriptionCredential(db: Database, input: {
     /** Direct managed-cookie human who most recently connected this row. */
     connectedBySubjectId?: string | null;
 }): Promise<UpsertCodexSubscriptionCredentialResult>;
+export type CodexAppsSettings = {
+    credentialId: string | null;
+    version: number;
+    designatedAt: Date | null;
+};
+export declare function getCodexAppsSettings(db: Database, workspaceId: string): Promise<CodexAppsSettings>;
+export type CodexAppsCredentialAuthorization = {
+    credentialId: string;
+    ownerSubjectId: string;
+};
+export declare class CodexAppsAuthorizationRevokedError extends Error {
+    constructor();
+}
+/** Exact Apps credential and owner, independent of every inference-capacity field. */
+export declare function getCodexAppsCredentialAuthorizationForRun(db: Database, workspaceId: string): Promise<CodexAppsCredentialAuthorization | null>;
+/**
+ * Hold the exact designation, credential, and owner-membership authorization
+ * stable through one outbound Apps request. Clear/disconnect operations share
+ * the workspace advisory lock; credential or membership revocation must wait on
+ * the row locks. The callback deliberately runs inside this short transaction so
+ * no revocation can commit in the gap between a final check and network dispatch.
+ */
+export declare function withCodexAppsRequestAuthorization<T>(db: Database, input: {
+    workspaceId: string;
+    credentialId: string;
+}, use: () => Promise<T>): Promise<T>;
+export type DesignateCodexAppsCredentialResult = ({
+    kind: "updated";
+} & CodexAppsSettings) | ({
+    kind: "conflict" | "already_designated";
+} & CodexAppsSettings) | {
+    kind: "not_found";
+} | {
+    kind: "not_owner";
+} | {
+    kind: "forbidden";
+} | {
+    kind: "unavailable";
+};
+export declare function designateCodexAppsCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    expectedVersion: number;
+}): Promise<DesignateCodexAppsCredentialResult>;
+export type ClearCodexAppsCredentialResult = {
+    kind: "updated" | "unchanged" | "conflict" | "forbidden";
+} & CodexAppsSettings;
+export declare function clearCodexAppsCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    expectedVersion: number;
+}): Promise<ClearCodexAppsCredentialResult>;
 /**
  * The ONLY decrypt-read accessor. Fails closed. Never call from an API route that
  * returns the result.
@@ -2039,8 +2094,6 @@ export type CodexAccountStatus = {
     secondaryResetAt: Date | null;
     usageCheckedAt: Date | null;
     exhaustedUntil: Date | null;
-    connectorNamespaces: string[] | null;
-    connectorsCheckedAt: Date | null;
 };
 /**
  * A metadata-only scheduling candidate observed while the workspace's rotation
@@ -2137,8 +2190,6 @@ export declare function acquireCodexCredentialLease<T, TPolicyScope = never, TUn
     holderId: string;
     /** Pins must not move the workspace-global cursor. */
     advanceActivePointer: boolean;
-    /** Exact frozen credential for this same durable turn, if it is resuming. */
-    continuationCredentialId?: string | null;
     /**
      * Optional downstream parser for private accepted-turn policy metadata.
      * It is pure, runs under the turn/rotation transaction, and must not query
@@ -2147,8 +2198,8 @@ export declare function acquireCodexCredentialLease<T, TPolicyScope = never, TUn
     resolvePolicyScope?: CodexCredentialLeasePolicyScopeResolver<TPolicyScope>;
     /**
      * Optional downstream membership policy for NEW allocations only. A live
-     * lease or validated frozen credential is offered to the selector against
-     * the complete workspace rows first and can never be filtered out here.
+     * exact-turn lease is offered to the selector against the complete workspace
+     * rows first and can never be filtered out here.
      */
     filterNewAllocationCandidates?: CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagnostic>;
     leaseTtlMs?: number;
@@ -2619,20 +2670,6 @@ export declare function setCodexCredentialExhaustedWithWakeTargets(db: Database,
  * the Temporal re-dispatch (each failover is a NEW turn, but its event survives).
  */
 export declare function countConsecutiveReactiveRotations(db: Database, workspaceId: string, sessionId: string): Promise<number>;
-/**
- * P4 connector-set cache writer: persist the set of ORIGINAL-dotted connector
- * namespaces a SPECIFIC credential exposes via codex_apps (+ the freshness clock).
- * Modeled byte-for-byte on recordCodexAccountUsage / setCodexCredentialExhausted:
- * RLS-scoped, guarded by (id, workspace_id), and — critically — NO `version` bump and
- * NO `updatedAt` touch, so it can never race the (id, version) token-refresh CAS.
- *
- * The CALLER must only invoke this with a NON-EMPTY set: codex_apps connects
- * best-effort (a transient failure yields an empty tools/list), and overwriting a
- * known non-empty set with [] would falsely "drop" coverage on a flaky turn. A
- * genuinely connector-less account stays null (the ranker treats null as unknown).
- * Returns true iff a row was updated (false ⇒ the credential was disconnected under us).
- */
-export declare function recordCodexAccountConnectors(db: Database, workspaceId: string, credentialId: string, namespaces: string[]): Promise<boolean>;
 /** The supported rotation strategies (P3). */
 export declare const CODEX_ROTATION_STRATEGIES: readonly ["most_remaining", "round_robin", "drain_then_next", "sharded"];
 export type CodexRotationStrategy = (typeof CODEX_ROTATION_STRATEGIES)[number];
@@ -2678,13 +2715,13 @@ export declare function recordSessionActiveCodexCredential(db: Database, workspa
  * re-picks the most-recently-connected remaining account as active, atomically in
  * the same RLS txn. Returns whether a row was removed + the new active id.
  */
-export declare function disconnectCodexAccount(db: Database, workspaceId: string, credentialId: string): Promise<{
+export declare function disconnectCodexAccount(db: Database, workspaceId: string, credentialId: string, actorSubjectId?: string | null): Promise<{
     removed: boolean;
     newActiveCredentialId: string | null;
     blockedByUnresolvedRedemption: boolean;
 }>;
 /** Legacy "disconnect all"; atomically rejects when any provider work is unresolved. */
-export declare function disconnectAllCodexAccounts(db: Database, workspaceId: string): Promise<{
+export declare function disconnectAllCodexAccounts(db: Database, workspaceId: string, actorSubjectId?: string | null): Promise<{
     removed: number;
     blockedCredentialIds: string[];
 }>;
@@ -3224,7 +3261,6 @@ export declare function getLatestRunState(db: Database, workspaceId: string, ses
     turnId: string | null;
     serializedRunState: string;
     pendingApprovals: unknown[];
-    frozenCodexCredentialId: string | null;
     providerArtifactInvalidatedAt: Date | null;
 } | null>;
 export declare class HumanInputResponseValidationError extends Error {
@@ -3316,7 +3352,6 @@ export declare function appendSessionHistoryItems(db: Database, input: {
     turnId: string;
     expectedExecutionGeneration: number;
     expectedAttemptId: string;
-    producerCodexCredentialId?: string | null;
     modelToolOutputTruncationTokens?: number;
     items: Array<{
         position: number;
@@ -3387,9 +3422,9 @@ export declare function getSessionHistoryItems(db: Database, workspaceId: string
  * the table as an audit trail.
  */
 export declare function getActiveSessionHistoryItems(db: Database, workspaceId: string, sessionId: string): Promise<Array<{
+    id: string;
     position: number;
     item: Record<string, unknown>;
-    producerCodexCredentialId: string | null;
     providerArtifactInvalidatedAt: Date | null;
 }>>;
 /** Bounded finalized voice turns used only to resume a later realtime call. */
@@ -3458,11 +3493,8 @@ export declare function applyContextCompaction(db: Database, input: {
     expectedAttemptId: string;
     replacementItems: Array<Record<string, unknown>>;
     summaryItem: Record<string, unknown>;
-    replacementInputTokens: number;
     clearRequestedCompaction?: boolean;
     eventPayload?: Record<string, unknown>;
-    /** Tag inserted history rows with the Codex credential that produced them. */
-    producerCodexCredentialId?: string | null;
 }): Promise<ApplyContextCompactionResult>;
 /**
  * Attempt-fenced visible start of a compaction provider call. Emitted before
@@ -3525,8 +3557,9 @@ export declare function recordSkippedContextCompaction(db: Database, input: {
  */
 export declare function nextSessionHistoryPosition(db: Database, workspaceId: string, sessionId: string): Promise<number>;
 /**
- * Record the actual input-token count of the most recent turn's final model
- * call, for the next turn's pre-read compaction trigger.
+ * Replace the input-token count for the most recent authoritative terminal
+ * response. Null means that response supplied no usable final-call count, so
+ * the next turn must not reuse an older response's value for compaction.
  */
 export declare function setSessionLastInputTokensForTurnAttempt(db: Database, input: {
     workspaceId: string;
@@ -3534,7 +3567,7 @@ export declare function setSessionLastInputTokensForTurnAttempt(db: Database, in
     turnId: string;
     expectedExecutionGeneration: number;
     expectedAttemptId: string;
-    lastInputTokens: number;
+    lastInputTokens: number | null;
 }): Promise<boolean>;
 /** The neutral boundary left as the sole active history row after a clear. */
 export declare function clearedContextMarkerItem(): Record<string, unknown>;
@@ -3560,8 +3593,8 @@ export declare class SessionContextBusyError extends Error {
  *      reserved for an approval that paused mid-turn, and the API forbids a
  *      clear while such an approval or active turn exists.
  *
- * Also resets last_input_tokens to 0 so the next turn's compaction trigger
- * starts fresh against the now-short context.
+ * Also clears last_input_tokens because no provider has observed the new
+ * context yet.
  *
  * Idempotent: a re-run supersedes the (now sole, already-marker) active row,
  * inserts another marker at the next position. The post-condition (one active
@@ -5661,7 +5694,6 @@ export declare function saveRunState(db: Database, input: {
     expectedAttemptId: string;
     serializedRunState: string;
     pendingApprovals: unknown[];
-    frozenCodexCredentialId?: string | null;
 }): Promise<boolean>;
 export type CreateSessionGoalInput = {
     accountId: string;
@@ -6117,7 +6149,6 @@ export type ApplySessionTurnSettlementInput = {
     runState?: {
         serializedRunState: string;
         pendingApprovals: unknown[];
-        frozenCodexCredentialId?: string | null;
         humanInputRequests?: Array<{
             id: string;
             toolCallId: string;
@@ -6241,7 +6272,8 @@ export type RequestSessionTurnRecoveryInput = {
     providerRecoveryCount?: number;
     fromStatuses?: SessionTurnStatus[];
     providerArtifactInvalidation?: {
-        codexCredentialId: string;
+        historyItemIds: string[];
+        runStateId?: string;
         reason: "encrypted_content_rejected";
     };
 };
@@ -6536,3 +6568,4 @@ export declare function buildConnectionTokenResolver(db: Database, settings: Set
 export { withCodexTokenDeadline, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun, type CodexCredentialTokens, type CodexRateLimitResetCreditsAccountResult, type CodexTokenDeadlineClock, type CodexTokenDeadlineOptions, } from "./codex-token-resolver";
 export { buildHostConnectionTokenResolver, ConnectionRefreshHttpError, HostMcpCredentialBindingError, HostMcpCredentialScopeError, isPrivateAddress, normalizeBearerScheme, refreshOAuthConnectionCredential, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionCredentialLookupInput, type ConnectionStatusGuard, type ConnectionTokenRefreshInput, type ConnectionTokenResolverOptions, type HostMcpCredentialResolverContext, type PermanentConnectionRefreshFailure, type RefreshTransportOptions, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, } from "./connection-token-resolver";
 export * from "./workspace-artifacts";
+export * from "./transcription-recordings";