@opengeni/db 0.6.0 → 0.6.1

package/dist/provision-roles.d.ts

@@ -2,7 +2,7 @@ import { SessionEventType, Permission, ConnectionKind, ConnectionStatus, Capabil
 import { environmentsEncryptionKeyBytes, Settings, McpServerConnectionRef } from '@opengeni/config';
 import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
 import { PgDatabase } from 'drizzle-orm/pg-core';
-import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-Dsz6UHNv.js';
+import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-BUbuMteO.js';
 import 'drizzle-orm';
 import './migrate.js';
 
@@ -1836,6 +1836,11 @@ interface MeterableWarmLease {
 declare function listMeterableWarmLeases(db: Database): Promise<MeterableWarmLease[]>;
 declare function countQueuedTurns(db: Database): Promise<number>;
 declare function countSandboxLeasesByLiveness(db: Database): Promise<Record<SandboxLeaseLiveness, number>>;
+type CreditBalanceByAccount = {
+    accountId: string;
+    balanceMicros: number;
+};
+declare function listCreditBalancesByAccount(db: Database): Promise<CreditBalanceByAccount[]>;
 declare function listLiveModalSandboxLeaseAttributions(db: Database): Promise<LiveModalSandboxLeaseAttribution[]>;
 declare function reArmDrainingLease(db: Database, input: {
     accountId: string;
@@ -2423,4 +2428,4 @@ type LockedSessionUpdateResult = {
 declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { type MachineMetricsRow as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type CreateSocialConnectionInput as D, type CreateSocialPostInput as E, type Database as F, type DbClient as G, type DeviceEnrollmentRequestRecord as H, type DeviceEnrollmentStatus as I, type EnableCapabilityInstallationInput as J, type EnabledMcpCapabilityServer as K, type EnqueueSessionTurnInput as L, type EnrollmentExposure as M, type EnrollmentOs as N, type EnrollmentRecord as O, type EnrollmentStatus as P, type ProvisionResult, type ProvisionRolesOptions, type ForceDrainResult as Q, type GitHubInstallation as R, type GoalContinuationDecision as S, type ImportBatch as T, type IntegrationOAuthClientForUse as U, type LeaseHolderKind as V, type LeaseSnapshot as W, type ListKnowledgeMemoryOptions as X, type ListSessionEventsOptions as Y, type LiveModalSandboxLeaseAttribution as Z, MACHINE_METRICS_SERIES_INTERVAL_MS as _, type AcquireLeaseInput as a, countActiveApiKeysForWorkspace as a$, type MachineMetricsSample as a0, type MeterableWarmLease as a1, type ReapDrainable as a2, type RegisterWorkspacePackInput as a3, type RegistryCapabilityCatalogItemInput as a4, type RegistryCatalogSurfaceKey as a5, type ResolveConnectionCredentialInput as a6, type ResolveConnectionCredentialResult as a7, type RlsContext as a8, type RlsStrategy as a9, type WorkspaceEnvironmentForRun as aA, accrueWarmSeconds as aB, acquireLease as aC, allAccountPermissions as aD, allWorkspacePermissions as aE, appendSessionEvents as aF, appendSessionEventsAndUpdateSession as aG, appendSessionEventsWithLockedSessionUpdate as aH, appendSessionHistoryItems as aI, applyContextCompaction as aJ, applyCreditDebitUpToBalance as aK, applyCreditLedgerEntry as aL, approveDeviceEnrollmentRequest as aM, bootstrapWorkspace as aN, buildCodexTokenResolver as aO, buildConnectionTokenResolver as aP, cancelQueuedSessionTurn as aQ, claimNextQueuedTurn as aR, clearSessionContext as aS, clearedContextMarkerItem as aT, closePtySession as aU, commitWarmingToWarm as aV, completeFileUpload as aW, confirmDrainCold as aX, consumeDeviceEnrollmentRequest as aY, consumeIntegrationOAuthStateNonce as aZ, consumeSessionCompactionRequest as a_, SandboxImageConflictError as aa, type SandboxKind as ab, type SandboxLeaseLiveness as ac, SandboxLeaseSupersededError as ad, type SandboxPtySessionRow as ae, type SandboxRecord as af, type SessionCodexState as ag, type SessionMcpServerForRun as ah, type SessionRecordingCodec as ai, type SessionRecordingMode as aj, type SessionRecordingRow as ak, type SessionRecordingState as al, type StoreIntegrationOAuthClientInput as am, type StoredIntegrationOAuthClient as an, type StreamAcknowledgment as ao, type ToolspaceCallReservation as ap, type UpdateConnectionInput as aq, type UpdateImportBatchCountsInput as ar, type UpdateKnowledgeMemoryInput as as, type UpdateQueuedSessionTurnInput as at, type UpdateScheduledTaskInput as au, type UpdateSessionMcpServerCredentialsInput as av, type UpdateSessionMcpServerCredentialsResult as aw, type UserLookup as ax, type WakeParentForChildCompletionInput as ay, type WakeParentForChildCompletionResult as az, type AcquireLeaseResult as b, getCodexCredentialStatus as b$, countActiveSessionHistoryItems as b0, countActiveSessionsForWorkspace as b1, countActiveSessionsUsingEnvironment as b2, countConsecutiveReactiveRotations as b3, countQueuedTurns as b4, countSandboxLeasesByLiveness as b5, countScheduledTasksForWorkspace as b6, countScheduledTasksUsingEnvironment as b7, countSessionHistoryItems as b8, countTurnSessionHistoryItems as b9, deleteWorkspace as bA, deleteWorkspaceEnvironment as bB, deleteWorkspaceEnvironmentVariable as bC, deleteWorkspacePack as bD, denyDeviceEnrollmentRequest as bE, disableCapabilityInstallation as bF, disconnectAllCodexAccounts as bG, disconnectCodexAccount as bH, enableCapabilityInstallation as bI, enablePackInstallation as bJ, encryptEnvironmentValue as bK, enqueueSessionTurn as bL, ensureCodexRotationSettings as bM, ensureManagedAccessForUser as bN, evaluateGoalContinuation as bO, failWarmingToCold as bP, fetchCodexUsageForAccount as bQ, finalizeEnrollmentByToken as bR, findActiveApiKeyByHash as bS, finishTurn as bT, forceDrainOverLimitViewerOnlyBoxes as bU, getActiveSessionHistoryItems as bV, getAnySessionInGroup as bW, getBillingBalance as bX, getBillingCustomer as bY, getCapabilityCatalogItem as bZ, getCapabilityInstallation as b_, countWorkspaceEnvironments as ba, countWorkspacesForAccount as bb, createApiKey as bc, createConnection as bd, createDb as be, createDeviceEnrollmentRequest as bf, createEnrollment as bg, createFileUpload as bh, createImportBatch as bi, createKnowledgeMemory as bj, createSandbox as bk, createScheduledTask as bl, createScheduledTaskRun as bm, createSession as bn, createSessionGoal as bo, createSessionMcpServers as bp, createSessionWithIdempotencyKey as bq, createSocialConnection as br, createSocialPost as bs, createTurn as bt, createWorkspace as bu, createWorkspaceEnvironment as bv, decryptEnvironmentValue as bw, decryptedCapabilityHeaders as bx, deleteRecording as by, deleteScheduledTask as bz, type ActiveSandboxPointer as c, listScheduledTaskRuns as c$, getCodexRotationSettings as c0, getConnectionMetadata as c1, getDeviceEnrollmentRequestByDeviceCode as c2, getEnrollment as c3, getFile as c4, getFileUpload as c5, getKnowledgeMemory as c6, getLatestRunState as c7, getManagedAccount as c8, getManagedUserByEmail as c9, heartbeatLeaseHolder as cA, incrementTurnWorkerDeathRedispatches as cB, ingestMachineMetricsSample as cC, insertMachineMetricsSeries as cD, insertPtySession as cE, insertRecording as cF, isCodexBilledTurn as cG, isPrivateAddress as cH, isStripeWebhookProcessed as cI, listApiKeys as cJ, listCapabilityCatalogItems as cK, listCapabilityInstallations as cL, listCodexAccountStatuses as cM, listConnectionsMetadata as cN, listDistinctEnvironmentIdsInGroup as cO, listEnabledMcpCapabilityServers as cP, listEnrollments as cQ, listGitHubInstallationIdsForWorkspace as cR, listGitHubInstallationsForWorkspace as cS, listKnowledgeMemories as cT, listLiveModalSandboxLeaseAttributions as cU, listMeterableWarmLeases as cV, listOpenPtySessions as cW, listPackInstallations as cX, listRecordings as cY, listRegistryCatalogSurfaceKeys as cZ, listSandboxes as c_, getOpenPtySession as ca, getPackInstallation as cb, getPendingDeviceEnrollmentRequestByUserCode as cc, getPendingDeviceEnrollmentRequestByUserCodeGlobal as cd, getRecording as ce, getSandbox as cf, getSandboxSessionEnvelope as cg, getScheduledTask as ch, getSession as ci, getSessionByCreateIdempotencyKey as cj, getSessionCodexState as ck, getSessionEvent as cl, getSessionGoal as cm, getSessionHistoryItems as cn, getSessionTurn as co, getSocialConnection as cp, getStoredCapabilityHeaderCiphertext as cq, getStreamAcknowledgment as cr, getWorkspace as cs, getWorkspaceEnvironment as ct, getWorkspaceEnvironmentByName as cu, getWorkspaceEnvironmentValuesForRun as cv, getWorkspaceGrant as cw, getWorkspacePack as cx, grantWorkspaceAccess as cy, hasCreditLedgerEntry as cz, type AppendEventInput as d, revokeConnection as d$, listScheduledTasks as d0, listSessionEvents as d1, listSessionIdsInGroup as d2, listSessionMcpServerMetadata as d3, listSessionMcpServersForRun as d4, listSessionTurns as d5, listSessions as d6, listSocialConnections as d7, listSocialPosts as d8, listUsageEvents as d9, recordCodexAccountUsage as dA, recordCodexTokenRefresh as dB, recordConnectionTokenRefresh as dC, recordConnectionUsed as dD, recordLeaseDataPlaneUrl as dE, recordLeaseTerminalDataPlaneUrl as dF, recordSessionActiveCodexCredential as dG, recordStreamAcknowledgment as dH, recordStripeWebhookEvent as dI, recordUsageEvent as dJ, recordWarmingSandboxCreated as dK, refreshOAuthConnectionCredential as dL, registerDbBinding as dM, registerWorkspacePack as dN, releaseLeaseHolder as dO, removeWorkspaceMember as dP, renameCodexAccount as dQ, reorderQueuedSessionTurns as dR, requestSessionCompaction as dS, requeuePreemptedTurn as dT, requireFile as dU, requireScheduledTask as dV, requireSession as dW, requireSocialConnection as dX, requireWorkspace as dY, reserveToolspaceCallForTurn as dZ, revokeApiKey as d_, listWorkspaceEnvironments as da, listWorkspaceMembers as db, listWorkspacePacks as dc, listWorkspacesForSubject as dd, loadCodexCredentialForRun as de, loadConnectionCredentialForBroker as df, loadIntegrationOAuthClient as dg, loadWorkspaceEnvironmentForRun as dh, markFileUploadFailed as di, markStaleRegistryCatalogItems as dj, markStripeWebhookProcessed as dk, mcpServerIdForCapability as dl, nextSessionHistoryPosition as dm, orphanedResultRowIndicesForRepair as dn, persistDrainSnapshot as dp, reArmDrainingLease as dq, readActiveSandbox as dr, readLease as ds, readMachineMetricsLatest as dt, readMachineMetricsLatestForWorkspace as du, readMachineMetricsSeries as dv, reapStaleLeaseHolders as dw, reapStaleLeaseHoldersGlobal as dx, recordAuditEvent as dy, recordCodexAccountConnectors as dz, CODEX_ROTATION_STRATEGIES as e, revokeEnrollment as e0, revokeViewer as e1, rlsContextForWorkspace as e2, rlsStrategyFor as e3, sanitizeEventPayload as e4, sanitizeEventString as e5, saveRunState as e6, sessionSubject as e7, setActiveCodexCredential as e8, setActiveSandbox as e9, updateSessionMcpServerCredentials as eA, updateSessionTitle as eB, updateWorkspace as eC, updateWorkspaceEnvironment as eD, upsertBillingCustomer as eE, upsertCapabilityCatalogItem as eF, upsertCodexSubscriptionCredential as eG, upsertGitHubInstallation as eH, upsertMachineMetricsLatest as eI, upsertRegistryCapabilityCatalogItem as eJ, upsertSandboxSessionEnvelope as eK, upsertSessionGoal as eL, wakeParentSessionForChildCompletion as eM, withAccountRls as eN, withRlsContext as eO, withWorkspaceRls as eP, withWorkspaceUsageLock as eQ, workspaceCodexSubscriptionActive as eR, setCodexCredentialExhausted as ea, setCodexCredentialStatus as eb, setConnectionStatus as ec, setEnrollmentDisplayState as ed, setRlsContext as ee, setSessionCodexPin as ef, setSessionGoalLastContinuationTurn as eg, setSessionGoalStatus as eh, setSessionLastInputTokens as ei, setSessionStatus as ej, setTemporalWorkflowId as ek, setWorkspaceEnvironmentVariable as el, storeIntegrationOAuthClient as em, sumUsageQuantity as en, touchEnrollmentLastSeen as eo, updateCodexRotationSettings as ep, updateConnection as eq, updateImportBatchCounts as er, updateKnowledgeMemory as es, updatePackInstallationStatus as et, updatePtySessionActivity as eu, updateQueuedSessionTurn as ev, updateRecording as ew, updateScheduledTask as ex, updateScheduledTaskRun as ey, updateSessionGoal as ez, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type ConnectionBrokerDeps as n, type ConnectionCredentialForBroker as o, ConnectionRefreshHttpError as p, provisionRoles, type ConsumeOAuthStateNonceInput as q, type CreateCapabilityCatalogItemInput as r, type CreateConnectionInput as s, type CreateDbOptions as t, type CreateImportBatchInput as u, type CreateKnowledgeMemoryInput as v, type CreatePackInstallationInput as w, type CreateScheduledTaskInput as x, type CreateSessionGoalInput as y, type CreateSessionMcpServerInput as z };
+export { MACHINE_METRICS_SERIES_INTERVAL_MS as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type CreateSocialConnectionInput as D, type CreateSocialPostInput as E, type CreditBalanceByAccount as F, type Database as G, type DbClient as H, type DeviceEnrollmentRequestRecord as I, type DeviceEnrollmentStatus as J, type EnableCapabilityInstallationInput as K, type EnabledMcpCapabilityServer as L, type EnqueueSessionTurnInput as M, type EnrollmentExposure as N, type EnrollmentOs as O, type EnrollmentRecord as P, type ProvisionResult, type ProvisionRolesOptions, type EnrollmentStatus as Q, type ForceDrainResult as R, type GitHubInstallation as S, type GoalContinuationDecision as T, type ImportBatch as U, type IntegrationOAuthClientForUse as V, type LeaseHolderKind as W, type LeaseSnapshot as X, type ListKnowledgeMemoryOptions as Y, type ListSessionEventsOptions as Z, type LiveModalSandboxLeaseAttribution as _, type AcquireLeaseInput as a, consumeSessionCompactionRequest as a$, type MachineMetricsRow as a0, type MachineMetricsSample as a1, type MeterableWarmLease as a2, type ReapDrainable as a3, type RegisterWorkspacePackInput as a4, type RegistryCapabilityCatalogItemInput as a5, type RegistryCatalogSurfaceKey as a6, type ResolveConnectionCredentialInput as a7, type ResolveConnectionCredentialResult as a8, type RlsContext as a9, type WakeParentForChildCompletionResult as aA, type WorkspaceEnvironmentForRun as aB, accrueWarmSeconds as aC, acquireLease as aD, allAccountPermissions as aE, allWorkspacePermissions as aF, appendSessionEvents as aG, appendSessionEventsAndUpdateSession as aH, appendSessionEventsWithLockedSessionUpdate as aI, appendSessionHistoryItems as aJ, applyContextCompaction as aK, applyCreditDebitUpToBalance as aL, applyCreditLedgerEntry as aM, approveDeviceEnrollmentRequest as aN, bootstrapWorkspace as aO, buildCodexTokenResolver as aP, buildConnectionTokenResolver as aQ, cancelQueuedSessionTurn as aR, claimNextQueuedTurn as aS, clearSessionContext as aT, clearedContextMarkerItem as aU, closePtySession as aV, commitWarmingToWarm as aW, completeFileUpload as aX, confirmDrainCold as aY, consumeDeviceEnrollmentRequest as aZ, consumeIntegrationOAuthStateNonce as a_, type RlsStrategy as aa, SandboxImageConflictError as ab, type SandboxKind as ac, type SandboxLeaseLiveness as ad, SandboxLeaseSupersededError as ae, type SandboxPtySessionRow as af, type SandboxRecord as ag, type SessionCodexState as ah, type SessionMcpServerForRun as ai, type SessionRecordingCodec as aj, type SessionRecordingMode as ak, type SessionRecordingRow as al, type SessionRecordingState as am, type StoreIntegrationOAuthClientInput as an, type StoredIntegrationOAuthClient as ao, type StreamAcknowledgment as ap, type ToolspaceCallReservation as aq, type UpdateConnectionInput as ar, type UpdateImportBatchCountsInput as as, type UpdateKnowledgeMemoryInput as at, type UpdateQueuedSessionTurnInput as au, type UpdateScheduledTaskInput as av, type UpdateSessionMcpServerCredentialsInput as aw, type UpdateSessionMcpServerCredentialsResult as ax, type UserLookup as ay, type WakeParentForChildCompletionInput as az, type AcquireLeaseResult as b, getCapabilityInstallation as b$, countActiveApiKeysForWorkspace as b0, countActiveSessionHistoryItems as b1, countActiveSessionsForWorkspace as b2, countActiveSessionsUsingEnvironment as b3, countConsecutiveReactiveRotations as b4, countQueuedTurns as b5, countSandboxLeasesByLiveness as b6, countScheduledTasksForWorkspace as b7, countScheduledTasksUsingEnvironment as b8, countSessionHistoryItems as b9, deleteScheduledTask as bA, deleteWorkspace as bB, deleteWorkspaceEnvironment as bC, deleteWorkspaceEnvironmentVariable as bD, deleteWorkspacePack as bE, denyDeviceEnrollmentRequest as bF, disableCapabilityInstallation as bG, disconnectAllCodexAccounts as bH, disconnectCodexAccount as bI, enableCapabilityInstallation as bJ, enablePackInstallation as bK, encryptEnvironmentValue as bL, enqueueSessionTurn as bM, ensureCodexRotationSettings as bN, ensureManagedAccessForUser as bO, evaluateGoalContinuation as bP, failWarmingToCold as bQ, fetchCodexUsageForAccount as bR, finalizeEnrollmentByToken as bS, findActiveApiKeyByHash as bT, finishTurn as bU, forceDrainOverLimitViewerOnlyBoxes as bV, getActiveSessionHistoryItems as bW, getAnySessionInGroup as bX, getBillingBalance as bY, getBillingCustomer as bZ, getCapabilityCatalogItem as b_, countTurnSessionHistoryItems as ba, countWorkspaceEnvironments as bb, countWorkspacesForAccount as bc, createApiKey as bd, createConnection as be, createDb as bf, createDeviceEnrollmentRequest as bg, createEnrollment as bh, createFileUpload as bi, createImportBatch as bj, createKnowledgeMemory as bk, createSandbox as bl, createScheduledTask as bm, createScheduledTaskRun as bn, createSession as bo, createSessionGoal as bp, createSessionMcpServers as bq, createSessionWithIdempotencyKey as br, createSocialConnection as bs, createSocialPost as bt, createTurn as bu, createWorkspace as bv, createWorkspaceEnvironment as bw, decryptEnvironmentValue as bx, decryptedCapabilityHeaders as by, deleteRecording as bz, type ActiveSandboxPointer as c, listRegistryCatalogSurfaceKeys as c$, getCodexCredentialStatus as c0, getCodexRotationSettings as c1, getConnectionMetadata as c2, getDeviceEnrollmentRequestByDeviceCode as c3, getEnrollment as c4, getFile as c5, getFileUpload as c6, getKnowledgeMemory as c7, getLatestRunState as c8, getManagedAccount as c9, hasCreditLedgerEntry as cA, heartbeatLeaseHolder as cB, incrementTurnWorkerDeathRedispatches as cC, ingestMachineMetricsSample as cD, insertMachineMetricsSeries as cE, insertPtySession as cF, insertRecording as cG, isCodexBilledTurn as cH, isPrivateAddress as cI, isStripeWebhookProcessed as cJ, listApiKeys as cK, listCapabilityCatalogItems as cL, listCapabilityInstallations as cM, listCodexAccountStatuses as cN, listConnectionsMetadata as cO, listCreditBalancesByAccount as cP, listDistinctEnvironmentIdsInGroup as cQ, listEnabledMcpCapabilityServers as cR, listEnrollments as cS, listGitHubInstallationIdsForWorkspace as cT, listGitHubInstallationsForWorkspace as cU, listKnowledgeMemories as cV, listLiveModalSandboxLeaseAttributions as cW, listMeterableWarmLeases as cX, listOpenPtySessions as cY, listPackInstallations as cZ, listRecordings as c_, getManagedUserByEmail as ca, getOpenPtySession as cb, getPackInstallation as cc, getPendingDeviceEnrollmentRequestByUserCode as cd, getPendingDeviceEnrollmentRequestByUserCodeGlobal as ce, getRecording as cf, getSandbox as cg, getSandboxSessionEnvelope as ch, getScheduledTask as ci, getSession as cj, getSessionByCreateIdempotencyKey as ck, getSessionCodexState as cl, getSessionEvent as cm, getSessionGoal as cn, getSessionHistoryItems as co, getSessionTurn as cp, getSocialConnection as cq, getStoredCapabilityHeaderCiphertext as cr, getStreamAcknowledgment as cs, getWorkspace as ct, getWorkspaceEnvironment as cu, getWorkspaceEnvironmentByName as cv, getWorkspaceEnvironmentValuesForRun as cw, getWorkspaceGrant as cx, getWorkspacePack as cy, grantWorkspaceAccess as cz, type AppendEventInput as d, reserveToolspaceCallForTurn as d$, listSandboxes as d0, listScheduledTaskRuns as d1, listScheduledTasks as d2, listSessionEvents as d3, listSessionIdsInGroup as d4, listSessionMcpServerMetadata as d5, listSessionMcpServersForRun as d6, listSessionTurns as d7, listSessions as d8, listSocialConnections as d9, recordAuditEvent as dA, recordCodexAccountConnectors as dB, recordCodexAccountUsage as dC, recordCodexTokenRefresh as dD, recordConnectionTokenRefresh as dE, recordConnectionUsed as dF, recordLeaseDataPlaneUrl as dG, recordLeaseTerminalDataPlaneUrl as dH, recordSessionActiveCodexCredential as dI, recordStreamAcknowledgment as dJ, recordStripeWebhookEvent as dK, recordUsageEvent as dL, recordWarmingSandboxCreated as dM, refreshOAuthConnectionCredential as dN, registerDbBinding as dO, registerWorkspacePack as dP, releaseLeaseHolder as dQ, removeWorkspaceMember as dR, renameCodexAccount as dS, reorderQueuedSessionTurns as dT, requestSessionCompaction as dU, requeuePreemptedTurn as dV, requireFile as dW, requireScheduledTask as dX, requireSession as dY, requireSocialConnection as dZ, requireWorkspace as d_, listSocialPosts as da, listUsageEvents as db, listWorkspaceEnvironments as dc, listWorkspaceMembers as dd, listWorkspacePacks as de, listWorkspacesForSubject as df, loadCodexCredentialForRun as dg, loadConnectionCredentialForBroker as dh, loadIntegrationOAuthClient as di, loadWorkspaceEnvironmentForRun as dj, markFileUploadFailed as dk, markStaleRegistryCatalogItems as dl, markStripeWebhookProcessed as dm, mcpServerIdForCapability as dn, nextSessionHistoryPosition as dp, orphanedResultRowIndicesForRepair as dq, persistDrainSnapshot as dr, reArmDrainingLease as ds, readActiveSandbox as dt, readLease as du, readMachineMetricsLatest as dv, readMachineMetricsLatestForWorkspace as dw, readMachineMetricsSeries as dx, reapStaleLeaseHolders as dy, reapStaleLeaseHoldersGlobal as dz, CODEX_ROTATION_STRATEGIES as e, revokeApiKey as e0, revokeConnection as e1, revokeEnrollment as e2, revokeViewer as e3, rlsContextForWorkspace as e4, rlsStrategyFor as e5, sanitizeEventPayload as e6, sanitizeEventString as e7, saveRunState as e8, sessionSubject as e9, updateScheduledTaskRun as eA, updateSessionGoal as eB, updateSessionMcpServerCredentials as eC, updateSessionTitle as eD, updateWorkspace as eE, updateWorkspaceEnvironment as eF, upsertBillingCustomer as eG, upsertCapabilityCatalogItem as eH, upsertCodexSubscriptionCredential as eI, upsertGitHubInstallation as eJ, upsertMachineMetricsLatest as eK, upsertRegistryCapabilityCatalogItem as eL, upsertSandboxSessionEnvelope as eM, upsertSessionGoal as eN, wakeParentSessionForChildCompletion as eO, withAccountRls as eP, withRlsContext as eQ, withWorkspaceRls as eR, withWorkspaceUsageLock as eS, workspaceCodexSubscriptionActive as eT, setActiveCodexCredential as ea, setActiveSandbox as eb, setCodexCredentialExhausted as ec, setCodexCredentialStatus as ed, setConnectionStatus as ee, setEnrollmentDisplayState as ef, setRlsContext as eg, setSessionCodexPin as eh, setSessionGoalLastContinuationTurn as ei, setSessionGoalStatus as ej, setSessionLastInputTokens as ek, setSessionStatus as el, setTemporalWorkflowId as em, setWorkspaceEnvironmentVariable as en, storeIntegrationOAuthClient as eo, sumUsageQuantity as ep, touchEnrollmentLastSeen as eq, updateCodexRotationSettings as er, updateConnection as es, updateImportBatchCounts as et, updateKnowledgeMemory as eu, updatePackInstallationStatus as ev, updatePtySessionActivity as ew, updateQueuedSessionTurn as ex, updateRecording as ey, updateScheduledTask as ez, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type ConnectionBrokerDeps as n, type ConnectionCredentialForBroker as o, ConnectionRefreshHttpError as p, provisionRoles, type ConsumeOAuthStateNonceInput as q, type CreateCapabilityCatalogItemInput as r, type CreateConnectionInput as s, type CreateDbOptions as t, type CreateImportBatchInput as u, type CreateKnowledgeMemoryInput as v, type CreatePackInstallationInput as w, type CreateScheduledTaskInput as x, type CreateSessionGoalInput as y, type CreateSessionMcpServerInput as z };

package/dist/{schema-Dsz6UHNv.d.ts → schema-BUbuMteO.d.ts}

@@ -6418,7 +6418,7 @@ declare const sessionRecordings: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "session_recordings";
             dataType: "string";
             columnType: "PgText";
-            data: "failed" | "available" | "recording" | "finalizing";
+            data: "recording" | "finalizing" | "available" | "failed";
             driverParam: string;
             notNull: true;
             hasDefault: false;

package/dist/schema.d.ts

@@ -1,3 +1,3 @@
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
-export { i as agentRunStates, j as apiKeys, k as auditEvents, l as billingCustomers, m as capabilityCatalogItems, n as capabilityInstallations, o as codexRotationSettings, p as codexSubscriptionCredentials, q as connections, r as creditLedgerEntries, t as deviceEnrollmentRequests, d as deviceEnrollmentStatusValues, u as documentBases, v as documentChunks, w as documents, a as enrollmentExposureValues, e as enrollmentOsValues, b as enrollmentStatusValues, x as enrollments, y as fileUploads, z as files, A as githubInstallations, B as importBatches, C as integrationOauthClients, D as integrationOauthStateNonces, E as knowledgeMemories, F as machineMetricsLatest, G as machineMetricsSeries, H as managedAccounts, I as packInstallations, c as sandboxKindValues, J as sandboxLeaseHolders, K as sandboxLeaseLivenessValues, L as sandboxLeases, M as sandboxPtySessions, N as sandboxSessionEnvelopes, O as sandboxes, P as scheduledTaskRuns, Q as scheduledTasks, R as sessionEvents, S as sessionGoals, T as sessionHistoryItems, U as sessionMcpServers, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues, V as sessionRecordings, W as sessionTurns, X as sessions, Y as socialConnections, Z as socialPosts, _ as stripeWebhookEvents, $ as usageEvents, a0 as workspaceEnvironmentVariables, a1 as workspaceEnvironments, a2 as workspaceMemberships, a3 as workspacePacks, a4 as workspaces } from './schema-Dsz6UHNv.js';
+export { i as agentRunStates, j as apiKeys, k as auditEvents, l as billingCustomers, m as capabilityCatalogItems, n as capabilityInstallations, o as codexRotationSettings, p as codexSubscriptionCredentials, q as connections, r as creditLedgerEntries, t as deviceEnrollmentRequests, d as deviceEnrollmentStatusValues, u as documentBases, v as documentChunks, w as documents, a as enrollmentExposureValues, e as enrollmentOsValues, b as enrollmentStatusValues, x as enrollments, y as fileUploads, z as files, A as githubInstallations, B as importBatches, C as integrationOauthClients, D as integrationOauthStateNonces, E as knowledgeMemories, F as machineMetricsLatest, G as machineMetricsSeries, H as managedAccounts, I as packInstallations, c as sandboxKindValues, J as sandboxLeaseHolders, K as sandboxLeaseLivenessValues, L as sandboxLeases, M as sandboxPtySessions, N as sandboxSessionEnvelopes, O as sandboxes, P as scheduledTaskRuns, Q as scheduledTasks, R as sessionEvents, S as sessionGoals, T as sessionHistoryItems, U as sessionMcpServers, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues, V as sessionRecordings, W as sessionTurns, X as sessions, Y as socialConnections, Z as socialPosts, _ as stripeWebhookEvents, $ as usageEvents, a0 as workspaceEnvironmentVariables, a1 as workspaceEnvironments, a2 as workspaceMemberships, a3 as workspacePacks, a4 as workspaces } from './schema-BUbuMteO.js';

package/drizzle/0043_credit_balance_observability.sql

@@ -0,0 +1,22 @@
+-- 0043_credit_balance_observability.sql
+-- Cross-account billing balance reads for Prometheus gauges. This mirrors the
+-- observability count SECURITY DEFINER functions so workers can refresh global
+-- process metrics without disabling FORCE RLS on account-scoped tables.
+
+CREATE OR REPLACE FUNCTION opengeni_private.credit_balance_by_account()
+RETURNS TABLE (account_id uuid, balance_micros bigint)
+LANGUAGE sql
+SECURITY DEFINER
+AS $$
+  SELECT L.account_id, coalesce(sum(L.amount_micros), 0)::bigint AS balance_micros
+  FROM credit_ledger_entries L
+  GROUP BY L.account_id
+  ORDER BY L.account_id;
+$$;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.credit_balance_by_account() TO opengeni_app;
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.1",
-    "@opengeni/config": "^0.3.0",
+    "@opengeni/config": "^0.4.0",
     "@opengeni/contracts": "^0.9.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"

package/src/index.ts

@@ -6009,6 +6009,22 @@ export async function countSandboxLeasesByLiveness(db: Database): Promise<Record
   return counts;
 }
 
+export type CreditBalanceByAccount = {
+  accountId: string;
+  balanceMicros: number;
+};
+
+export async function listCreditBalancesByAccount(db: Database): Promise<CreditBalanceByAccount[]> {
+  const rows = await rawRows<{ account_id: string; balance_micros: number | string }>(db, sql`
+    select account_id, balance_micros
+    from opengeni_private.credit_balance_by_account()
+  `);
+  return rows.map((row) => ({
+    accountId: row.account_id,
+    balanceMicros: Number(row.balance_micros),
+  }));
+}
+
 // Cross-workspace live Modal lease read for the provider-side orphan sweep. The
 // SECURITY DEFINER function is the sanctioned RLS bypass; see migration 0036.
 export async function listLiveModalSandboxLeaseAttributions(db: Database): Promise<LiveModalSandboxLeaseAttribution[]> {
@@ -8896,6 +8912,9 @@ function mapCapabilityCatalogItem(row: typeof schema.capabilityCatalogItems.$inf
     runtime,
     enabled: false,
     enabledReason: null,
+    // Overwritten by applyCapabilityEnablement in @opengeni/core, which knows
+    // the installation; a freshly-read catalog row carries no connection.
+    connectionRef: null,
     metadata: row.metadata,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),