@opengeni/db 0.28.9 → 0.36.0

package/dist/attached-browser-devices.d.ts

@@ -0,0 +1,42 @@
+import { type AttachedBrowserDevice as AttachedBrowserDeviceValue, type AttachedBrowserDeviceListResponse as AttachedBrowserDeviceListResponseValue, type AttachedBrowserInventorySnapshot as AttachedBrowserInventorySnapshotValue } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+export declare class AttachedBrowserDeviceNotFoundError extends Error {
+    readonly name = "AttachedBrowserDeviceNotFoundError";
+}
+export declare class AttachedBrowserInventoryConflictError extends Error {
+    readonly name = "AttachedBrowserInventoryConflictError";
+}
+export type ReconcileAttachedBrowserInventoryResult = {
+    accepted: boolean;
+    changed: boolean;
+    revision: number;
+};
+/** Reconcile one full browser-bridge snapshot. The enrollment row serializes
+ *  concurrent heartbeats; a lower revision from the same bridge generation is
+ *  ignored, and a replay only refreshes liveness. */
+export declare function reconcileAttachedBrowserInventory(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    snapshot: AttachedBrowserInventorySnapshotValue;
+}): Promise<ReconcileAttachedBrowserInventoryResult>;
+/** Immediately mark every live Chrome profile on a cleanly disconnected agent
+ *  offline. Historical endpoint rows remain discoverable and reconnect in place. */
+export declare function disconnectAttachedBrowserDevices(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+}): Promise<{
+    changed: boolean;
+    revision: number;
+}>;
+export declare function listAttachedBrowserDevices(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    includeDisconnected?: boolean;
+}): Promise<AttachedBrowserDeviceListResponseValue>;
+export declare function getAttachedBrowserDevice(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    deviceId: string;
+}): Promise<AttachedBrowserDeviceValue>;

package/dist/attempt-tool-catalogs.d.ts

@@ -0,0 +1,16 @@
+import type { AttemptToolCatalog } from "@opengeni/contracts";
+import type { Database } from "./database.js";
+export declare class AttemptToolCatalogAuthorityError extends Error {
+    readonly code = "attempt_tool_catalog_authority_mismatch";
+    constructor();
+}
+export declare class AttemptToolCatalogConflictError extends Error {
+    readonly code = "attempt_tool_catalog_conflict";
+    constructor();
+}
+export declare function persistAttemptToolCatalog(db: Database, input: AttemptToolCatalog): Promise<AttemptToolCatalog>;
+export declare function getAttemptToolCatalog(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+}): Promise<AttemptToolCatalog | null>;

package/dist/browser-auth.d.ts

@@ -0,0 +1,299 @@
+import { type AuthRun as AuthRunValue, type AuthRunListResponse as AuthRunListResponseValue, type AuthRunMutationResponse as AuthRunMutationResponseValue, type CreateInteractionInterventionRequest as CreateInteractionInterventionRequestValue, type CreateNetworkRouteRequest as CreateNetworkRouteRequestValue, type CreateSiteAuthConnectionRequest as CreateSiteAuthConnectionRequestValue, type BrowserExternalAuthResult as BrowserExternalAuthResultValue, type ExternalAuthInteractiveRequest as ExternalAuthInteractiveRequestValue, type ExternalAuthRunRequest as ExternalAuthRunRequestValue, type ExternalAuthRunResponse as ExternalAuthRunResponseValue, type InteractionIntervention as InteractionInterventionValue, type InteractionInterventionListResponse as InteractionInterventionListResponseValue, type InteractionInterventionMutationResponse as InteractionInterventionMutationResponseValue, type NetworkRoute as NetworkRouteValue, type NetworkRouteListResponse as NetworkRouteListResponseValue, type NetworkRouteMutationResponse as NetworkRouteMutationResponseValue, type ProtectedAuthFillRequest as ProtectedAuthFillRequestValue, type ProtectedAuthFillResponse as ProtectedAuthFillResponseValue, type ReportAuthRunRequest as ReportAuthRunRequestValue, type ResolveInteractionInterventionRequest as ResolveInteractionInterventionRequestValue, type RequestHumanInteractionToolInput as RequestHumanInteractionToolInputValue, type SessionEvent, type SiteAuthAuthority as SiteAuthAuthorityValue, type SiteAuthConnection as SiteAuthConnectionValue, type SiteAuthConnectionListResponse as SiteAuthConnectionListResponseValue, type SiteAuthConnectionMutationResponse as SiteAuthConnectionMutationResponseValue, type StartAuthRunRequest as StartAuthRunRequestValue, type UpdateNetworkRouteRequest as UpdateNetworkRouteRequestValue, type UpdateSiteAuthConnectionRequest as UpdateSiteAuthConnectionRequestValue, type VerifyAuthRunRequest as VerifyAuthRunRequestValue } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+import * as schema from "./schema.js";
+type ResourceOperationRow = typeof schema.interactionResourceOperations.$inferSelect;
+type InteractionMutationScope = {
+    accountId: string;
+    workspaceId: string;
+    actorSubjectId: string;
+};
+export declare class InteractionResourceNotFoundError extends Error {
+    readonly name = "InteractionResourceNotFoundError";
+}
+export declare class InteractionResourceConflictError extends Error {
+    readonly name = "InteractionResourceConflictError";
+}
+export declare class InteractionResourceStateError extends Error {
+    readonly name = "InteractionResourceStateError";
+}
+export type SiteAuthMaintenanceClaim = {
+    operationId: string;
+    sessionId: string;
+    accountId: string;
+    workspaceId: string;
+    siteAuthConnectionId: string;
+    connectionVersion: number;
+    action: "health_check" | "repair";
+    dueAt: Date;
+    claimedAt: Date;
+    name: string;
+    accountLabel: string;
+    loginUrl: string | null;
+    verificationUrlPrefixes: string[];
+    preferredIdentityId: string | null;
+    preferredPlacement: SiteAuthConnectionValue["preferredPlacement"];
+    preferredNetworkRouteId: string | null;
+    healthPolicy: SiteAuthConnectionValue["healthPolicy"];
+    verificationState: SiteAuthConnectionValue["verificationState"];
+};
+/** Claim a bounded cross-workspace batch. Stale pre-start claims keep the same
+ * operation/session ids, so worker loss repairs one durable dispatch. */
+export declare function claimSiteAuthMaintenance(db: Database, input: {
+    claimTimeoutMs: number;
+    limit: number;
+}): Promise<SiteAuthMaintenanceClaim[]>;
+/** Link the exact hidden maintenance claim to its service-created session in
+ * the caller's create transaction. A false result must abort that transaction. */
+export declare function confirmSiteAuthMaintenanceSessionInTransaction(tx: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    siteAuthConnectionId: string;
+    operationId: string;
+    sessionId: string;
+}): Promise<boolean>;
+/** Standalone wrapper retained for exact DB callers and tests. Session creation
+ * uses the in-transaction form so a changed claim cannot leave an empty shell. */
+export declare function confirmSiteAuthMaintenanceSession(db: Database, input: Parameters<typeof confirmSiteAuthMaintenanceSessionInTransaction>[1]): Promise<boolean>;
+/** Release an exact claim that failed before a maintenance session started. */
+export declare function deferSiteAuthMaintenance(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    siteAuthConnectionId: string;
+    operationId: string;
+    sessionId: string;
+    retryAt: Date;
+}): Promise<boolean>;
+export declare function listNetworkRoutes(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    includeArchived?: boolean;
+}): Promise<NetworkRouteListResponseValue>;
+export declare function getNetworkRoute(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    routeId: string;
+}): Promise<NetworkRouteValue>;
+export declare function createNetworkRoute(db: Database, input: InteractionMutationScope & CreateNetworkRouteRequestValue): Promise<NetworkRouteMutationResponseValue>;
+export declare function updateNetworkRoute(db: Database, input: InteractionMutationScope & {
+    routeId: string;
+} & UpdateNetworkRouteRequestValue): Promise<NetworkRouteMutationResponseValue>;
+export declare function listSiteAuthConnections(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    includeArchived?: boolean;
+}): Promise<SiteAuthConnectionListResponseValue>;
+export declare function getSiteAuthConnection(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    siteAuthConnectionId: string;
+}): Promise<SiteAuthConnectionValue>;
+export declare function createSiteAuthConnection(db: Database, input: InteractionMutationScope & CreateSiteAuthConnectionRequestValue): Promise<SiteAuthConnectionMutationResponseValue>;
+export declare function updateSiteAuthConnection(db: Database, input: InteractionMutationScope & {
+    siteAuthConnectionId: string;
+} & UpdateSiteAuthConnectionRequestValue): Promise<SiteAuthConnectionMutationResponseValue>;
+type ExternalAuthOperationMetadata = {
+    schemaVersion: 1;
+    authRunVersion: number;
+    authority: Extract<SiteAuthAuthorityValue, {
+        kind: "external_provider";
+    }>;
+};
+export type ExternalAuthPreparation = {
+    run: AuthRunValue;
+    authority: ExternalAuthOperationMetadata["authority"];
+    operationState: ResourceOperationRow["state"];
+    response: ExternalAuthRunResponseValue | null;
+    replayed: boolean;
+};
+export type ProtectedAuthFillPreparation = {
+    run: AuthRunValue;
+    authority: SiteAuthAuthorityValue;
+    origins: string[];
+    credentialVersion: number | null;
+    operationState: ResourceOperationRow["state"];
+    response: ProtectedAuthFillResponseValue | null;
+    replayed: boolean;
+};
+export declare function getProtectedAuthFillPreparation(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+} & ProtectedAuthFillRequestValue): Promise<ProtectedAuthFillPreparation | null>;
+export declare function listAuthRuns(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    browserSessionId?: string;
+    siteAuthConnectionId?: string;
+    includeSettled?: boolean;
+}): Promise<AuthRunListResponseValue>;
+export declare function getAuthRun(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    authRunId: string;
+}): Promise<AuthRunValue>;
+export type ExternalAuthInteractiveContext = {
+    run: AuthRunValue;
+    authority: Extract<SiteAuthAuthorityValue, {
+        kind: "external_provider";
+    }>;
+};
+/** Resolve only the durable authority needed to reveal an external provider's
+ * hosted login UI. The hosted URL itself is deliberately never persisted. */
+export declare function getExternalAuthInteractiveContext(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+} & ExternalAuthInteractiveRequestValue): Promise<ExternalAuthInteractiveContext>;
+export declare function startAuthRun(db: Database, input: InteractionMutationScope & {
+    browserSessionId: string;
+    controllerGeneration: string;
+    /** Trusted attempt provenance supplied by the API grant. */
+    originatingSessionId?: string | null;
+} & StartAuthRunRequestValue): Promise<AuthRunMutationResponseValue>;
+export type SettleSessionMaintenanceResult = {
+    cancelledAuthRuns: number;
+    releasedClaim: boolean;
+};
+/** A terminal-for-now maintenance session cannot leave an AuthRun or its claim
+ * pinned. Interventions settle linked runs first; this covers every other path. */
+export declare function settleSessionMaintenanceInTransaction(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+}): Promise<SettleSessionMaintenanceResult>;
+export declare function reportAuthRun(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    controllerGeneration: string;
+} & ReportAuthRunRequestValue): Promise<AuthRunMutationResponseValue>;
+export declare function getExternalAuthPreparation(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+} & ExternalAuthRunRequestValue): Promise<ExternalAuthPreparation | null>;
+export declare function prepareExternalAuth(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+} & ExternalAuthRunRequestValue): Promise<ExternalAuthPreparation>;
+export declare function dispatchExternalAuth(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    operationId: string;
+}): Promise<ResourceOperationRow["state"]>;
+export declare function completeExternalAuth(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    operationId: string;
+    result: BrowserExternalAuthResultValue;
+    target?: {
+        id: string;
+        targetGeneration: string;
+        documentGeneration: string | null;
+    };
+    intervention?: {
+        originatingSessionId: string;
+        originatingTurnId?: string | null;
+        originatingAttemptId?: string | null;
+        originatingToolOperationId?: string | null;
+        expiresInSeconds: number;
+    };
+}): Promise<ExternalAuthRunResponseValue>;
+export declare function prepareProtectedAuthFill(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    credentialVersion: number | null;
+} & ProtectedAuthFillRequestValue): Promise<ProtectedAuthFillPreparation>;
+export declare function dispatchProtectedAuthFill(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    operationId: string;
+}): Promise<ResourceOperationRow["state"]>;
+export declare function completeProtectedAuthFill(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    operationId: string;
+    status: ProtectedAuthFillResponseValue["status"];
+    targetGeneration?: string;
+    documentGeneration?: string | null;
+    failureCode?: string;
+    intervention?: {
+        originatingSessionId: string;
+        originatingTurnId?: string | null;
+        originatingAttemptId?: string | null;
+        originatingToolOperationId?: string | null;
+        kind: "manual_login" | "mfa" | "external_action" | "confirmation" | "other";
+        reason: string;
+        expiresInSeconds: number;
+    };
+}): Promise<ProtectedAuthFillResponseValue>;
+export declare function markProtectedAuthFillOutcomeUnknown(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    operationId: string;
+    errorCode: string;
+}): Promise<void>;
+export declare function verifyAuthRun(db: Database, input: InteractionMutationScope & {
+    authRunId: string;
+    controllerGeneration: string;
+    targetId: string;
+    targetGeneration: string;
+    documentGeneration: string | null;
+    url: string;
+} & VerifyAuthRunRequestValue): Promise<AuthRunMutationResponseValue>;
+export declare function listInteractionInterventions(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    resourceKind?: "browser_session" | "computer_session";
+    resourceId?: string;
+    includeSettled?: boolean;
+}): Promise<InteractionInterventionListResponseValue>;
+export declare function getInteractionIntervention(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    interventionId: string;
+}): Promise<InteractionInterventionValue>;
+export type AttemptInteractionInterventionRequest = {
+    id: string;
+    operationId: string;
+    accountId: string;
+    workspaceId: string;
+    originatingSessionId: string;
+    originatingTurnId: string;
+    originatingAttemptId: string;
+    toolCallId: string;
+    input: RequestHumanInteractionToolInputValue;
+};
+/**
+ * Persist one interaction interruption inside the same transaction as its
+ * frozen Agent RunState. This is deliberately transaction-local: callers must
+ * already hold the session/turn/attempt settlement locks and RLS context.
+ */
+export declare function persistAttemptInteractionInterventionInTransaction(db: Database, raw: AttemptInteractionInterventionRequest): Promise<InteractionInterventionValue>;
+export declare function getInteractionInterventionApprovalTarget(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    interventionId: string;
+}): Promise<{
+    sessionId: string;
+    toolCallId: string;
+} | null>;
+export declare function getInteractionInterventionResumeForEvent(db: Database, workspaceId: string, sessionId: string, event: Pick<SessionEvent, "type" | "payload">): Promise<{
+    toolCallId: string;
+    intervention: InteractionInterventionValue;
+} | null>;
+export declare function createInteractionIntervention(db: Database, input: InteractionMutationScope & CreateInteractionInterventionRequestValue & {
+    originatingSessionId: string;
+    originatingTurnId?: string | null;
+    originatingAttemptId?: string | null;
+    originatingToolOperationId?: string | null;
+}): Promise<InteractionInterventionMutationResponseValue>;
+export declare function resolveInteractionInterventionInTransaction(db: Database, input: InteractionMutationScope & {
+    interventionId: string;
+} & ResolveInteractionInterventionRequestValue): Promise<InteractionInterventionMutationResponseValue>;
+export declare function resolveInteractionIntervention(db: Database, input: InteractionMutationScope & {
+    interventionId: string;
+} & ResolveInteractionInterventionRequestValue): Promise<InteractionInterventionMutationResponseValue>;
+/**
+ * Cancel every still-open intervention created by a logical agent turn when
+ * that turn becomes terminal. The caller already owns the turn-settlement
+ * transaction, so no resource can outlive the terminal session truth.
+ */
+export declare function cancelTurnInteractionInterventionsInTransaction(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+}): Promise<number>;
+export declare function cancelOpenInteractionInterventions(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    resourceKind: "browser_session" | "computer_session";
+    resourceId: string;
+}): Promise<number>;
+export {};

package/dist/browser-downloads.d.ts

@@ -0,0 +1,51 @@
+import { type BrowserDownload as BrowserDownloadValue, type BrowserDownloadSaveRequest as BrowserDownloadSaveRequestValue, type BrowserDownloadSaveResponse as BrowserDownloadSaveResponseValue } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+import * as schema from "./schema.js";
+type OperationRow = typeof schema.interactionResourceOperations.$inferSelect;
+type SaveMetadata = {
+    browserSessionId: string;
+    controllerGeneration: string;
+    sourceSessionId: string;
+    destinationPath: string;
+    overwrite: boolean;
+    fileId: string;
+    uploadId: string;
+    objectKey: string;
+    safeFilename: string;
+    contentType: string;
+    download: BrowserDownloadValue;
+};
+export type BrowserDownloadSavePreparation = SaveMetadata & {
+    operationId: string;
+    state: OperationRow["state"];
+    errorCode: string | null;
+    replayed: boolean;
+    dispatchedNow: boolean;
+    response: BrowserDownloadSaveResponseValue | null;
+};
+type SaveIdentity = {
+    accountId: string;
+    workspaceId: string;
+    actorSubjectId: string;
+    browserSessionId: string;
+    downloadId: string;
+    request: BrowserDownloadSaveRequestValue;
+};
+export declare function findBrowserDownloadSave(db: Database, inputValue: SaveIdentity): Promise<BrowserDownloadSavePreparation | null>;
+export declare function prepareBrowserDownloadSave(db: Database, inputValue: SaveIdentity & {
+    sourceSessionId: string;
+    download: BrowserDownloadValue;
+    fileId: string;
+    safeFilename: string;
+    contentType: string;
+    bucket: string;
+    objectKey: string;
+    uploadExpiresAt: Date;
+}): Promise<BrowserDownloadSavePreparation>;
+export declare function dispatchBrowserDownloadSave(db: Database, inputValue: SaveIdentity): Promise<BrowserDownloadSavePreparation>;
+export declare function completeBrowserDownloadSave(db: Database, inputValue: SaveIdentity): Promise<BrowserDownloadSaveResponseValue>;
+export declare function settleBrowserDownloadSaveFailure(db: Database, inputValue: SaveIdentity & {
+    state: "failed" | "outcome_unknown";
+    errorCode: string;
+}): Promise<void>;
+export {};

package/dist/browser-identities.d.ts

@@ -0,0 +1,137 @@
+import { type BrowserIdentity as BrowserIdentityValue, type BrowserIdentityListResponse as BrowserIdentityListResponseValue, type BrowserIdentityMutationResponse as BrowserIdentityMutationResponseValue, type BrowserRevision as BrowserRevisionValue, type BrowserRevisionListResponse as BrowserRevisionListResponseValue, type BrowserRevisionMaterialization as BrowserRevisionMaterializationValue, type InteractionError as InteractionErrorValue, type PublishBrowserRevisionResponse as PublishBrowserRevisionResponseValue, type UpdateBrowserIdentityRequest as UpdateBrowserIdentityRequestValue } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+import { type BrowserStateArtifactCommitInput } from "./browser-state-artifacts.js";
+export declare class BrowserIdentityNotFoundError extends Error {
+    readonly name = "BrowserIdentityNotFoundError";
+}
+export declare class BrowserIdentityConflictError extends Error {
+    readonly name = "BrowserIdentityConflictError";
+}
+export declare class BrowserIdentityStateError extends Error {
+    readonly name = "BrowserIdentityStateError";
+}
+export type BrowserRevisionPublicationPreparation = {
+    kind: "completed";
+    response: PublishBrowserRevisionResponseValue;
+} | {
+    kind: "pending";
+    operationState: "prepared" | "dispatched";
+    browserSessionId: string;
+    controllerGeneration: string;
+    identity: BrowserIdentityValue;
+    parentRevisionId: string | null;
+};
+export type BrowserRevisionPublicationDispatch = {
+    kind: "completed";
+    response: PublishBrowserRevisionResponseValue;
+} | {
+    kind: "dispatched";
+    browserSessionId: string;
+    controllerGeneration: string;
+    replayed: boolean;
+};
+export type BrowserRevisionArtifactAuthority = {
+    revision: BrowserRevisionValue;
+    artifacts: Array<{
+        componentId: string;
+        artifactId: string;
+        objectKey: string;
+        encryptedDataKey: string;
+        contentDigest: string;
+        manifestDigest: string;
+        artifactDigest: string;
+        sizeBytes: number;
+        format: string;
+        materialization: BrowserRevisionMaterializationValue;
+    }>;
+};
+export declare function listBrowserIdentities(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    includeArchived?: boolean;
+}): Promise<BrowserIdentityListResponseValue>;
+export declare function getBrowserIdentity(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    identityId: string;
+}): Promise<BrowserIdentityValue>;
+export declare function listBrowserRevisions(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    identityId: string;
+}): Promise<BrowserRevisionListResponseValue>;
+export declare function createBrowserIdentity(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    name: string;
+    actorSubjectId: string;
+}): Promise<BrowserIdentityMutationResponseValue>;
+export declare function updateBrowserIdentity(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    identityId: string;
+    actorSubjectId: string;
+} & UpdateBrowserIdentityRequestValue): Promise<BrowserIdentityMutationResponseValue>;
+export declare function browserRevisionPublicationRequestDigest(input: {
+    browserSessionId: string;
+    identityId: string;
+    expectedHeadGeneration: number;
+    advanceDefault: boolean;
+    actorSubjectId: string;
+}): string;
+export declare function prepareBrowserRevisionPublication(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    browserSessionId: string;
+    identityId: string;
+    expectedHeadGeneration: number;
+    advanceDefault: boolean;
+    actorSubjectId: string;
+}): Promise<BrowserRevisionPublicationPreparation>;
+export declare function dispatchBrowserRevisionPublication(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    browserSessionId: string;
+    controllerGeneration: string;
+    identityId: string;
+    expectedHeadGeneration: number;
+    advanceDefault: boolean;
+    actorSubjectId: string;
+    stateUpload?: {
+        objectKey: string;
+        cleanupAfter: Date;
+    };
+}): Promise<BrowserRevisionPublicationDispatch>;
+export declare function commitBrowserRevisionPublication(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    browserSessionId: string;
+    controllerGeneration: string;
+    identityId: string;
+    expectedHeadGeneration: number;
+    advanceDefault: boolean;
+    actorSubjectId: string;
+    manifestDigest: string;
+    artifacts: readonly BrowserStateArtifactCommitInput[];
+}): Promise<PublishBrowserRevisionResponseValue>;
+export declare function failBrowserRevisionPublication(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    browserSessionId: string;
+    controllerGeneration: string;
+    state?: "failed" | "outcome_unknown";
+    error: InteractionErrorValue;
+}): Promise<void>;
+/** Server-only storage authority used to restore a revision. Never project this
+ *  result through HTTP, MCP, Codemode output, or the public SDK. */
+export declare function getBrowserRevisionArtifactAuthority(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    identityId: string;
+    revisionId: string;
+}): Promise<BrowserRevisionArtifactAuthority>;