@opengeni/db 1.3.0 → 1.4.0

package/dist/legacy-tool-action-reviews.d.ts

@@ -0,0 +1,75 @@
+import { type Database } from "./database.js";
+/** Read-only presentation for SDK approvals created before durable connector
+ * reviews. Neither current catalogs nor display labels establish a provider.
+ * This never creates a request, changes a policy, or resumes an operation. */
+export declare function legacyToolActionReview(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    approvalId: string;
+}): Promise<{
+    args: Record<string, unknown>;
+    context: {
+        kind: "generic" | "gmail";
+        title?: string | undefined;
+        accountLabel?: string | undefined;
+        fieldLabels?: Record<string, string> | undefined;
+        protectedFields?: string[] | undefined;
+        email?: {
+            from: string;
+            to: string;
+            cc: string;
+            bcc: string;
+            subject: string;
+            textBody: string;
+            htmlBody: string;
+            contentSha256: string;
+            attachments: {
+                name: string;
+                mediaType: string;
+                bytes: number;
+            }[];
+        } | undefined;
+        samples?: {
+            id: string;
+            title: string;
+            subtitle?: string | undefined;
+            provenance: "provider_metadata";
+        }[] | undefined;
+    };
+    proven: boolean;
+    review: {
+        version: 1;
+        id: string;
+        actionDigest: string;
+        revision: string;
+        status: "approved" | "blocked" | "cancelled" | "completed" | "executing" | "expired" | "failed" | "partial" | "pending" | "rejected" | "revoked" | "stale" | "unavailable" | "unknown";
+        title: string;
+        accountLabel?: string | undefined;
+        consequence?: string | undefined;
+        effects: string[];
+        selectionCount?: number | undefined;
+        selectionKind?: "messages" | "threads" | undefined;
+        samples?: {
+            id: string;
+            title: string;
+            subtitle?: string | undefined;
+            provenance: "provider_metadata";
+        }[] | undefined;
+        fields: {
+            path: string;
+            label: string;
+            preview: string;
+            count?: number | undefined;
+            truncated: boolean;
+            protected?: boolean | undefined;
+        }[];
+        moreFields: number;
+        reason: string;
+        createdAt: string;
+        updatedAt: string;
+        approveLabel: string;
+        availableActions: ("approve" | "reject")[];
+        detailsAvailable: boolean;
+    };
+} | null>;

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-7S3O33NM.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-UQELJ6OM.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/mcp-operations.js

@@ -1,7 +1,7 @@
 import {
   withRlsContext
-} from "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   fromPostgresLosslessJson,

package/dist/organization-integration-policy.js

@@ -3,10 +3,10 @@ import {
   updateOrganizationIntegrationPolicy,
   withOrganizationIntegrationAcquisition,
   withOrganizationIntegrationPolicyFence
-} from "./chunk-AQMH2ZEH.js";
+} from "./chunk-BA52ITIY.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/organization-slack-bots.d.ts

@@ -48,7 +48,7 @@ export declare function availableSlackBotConnectionMetadata(db: Database, scope:
     metadata: {
         organizationSharingGeneration: number;
     };
-} | import("./index.js").ConnectionMetadataWithVerification)[]>;
+} | import("./connection-metadata.js").ConnectionMetadataWithVerification)[]>;
 /** Canonical organization-administrator authentication is supplied by a trusted
  * HTTP adapter. SQL separately rechecks live authority and exact bot identity. */
 export declare function setOrganizationSlackBotAccess(db: Database, input: {

package/dist/retained-provider-commands.js

@@ -14,13 +14,13 @@ import {
   retainedProviderCommandPersistence,
   supervisedCommandProtocolReady,
   validateRouterOutputAdvance
-} from "./chunk-6S5T6FSP.js";
-import "./chunk-BRVBLQAL.js";
-import "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-CKDHKQS4.js";
+import "./chunk-AMK3FNOW.js";
+import "./chunk-NT7OGKYX.js";
+import "./chunk-T3CYF3DH.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/schema.js

@@ -401,7 +401,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-DSNEIW5E.js";
+} from "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-background-commands.js

@@ -27,11 +27,11 @@ import {
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction,
   unobservableRetainedProcessOutcomeSql
-} from "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-NT7OGKYX.js";
+import "./chunk-T3CYF3DH.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-command-output.js

@@ -1,11 +1,11 @@
 import {
   appendSessionCommandOutput
-} from "./chunk-BRVBLQAL.js";
-import "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-AMK3FNOW.js";
+import "./chunk-NT7OGKYX.js";
+import "./chunk-T3CYF3DH.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-event-slices.js

@@ -1,9 +1,9 @@
 import {
   listSessionEventSlices,
   readSessionMessageSliceInScope
-} from "./chunk-VQX54TK3.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-3WUCM7YF.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-mcp-credential-rotation.js

@@ -1,23 +1,23 @@
 import {
   connectionMetadataMatchesBinding
-} from "./chunk-PNWWNEDM.js";
+} from "./chunk-EMYA6XNE.js";
 import {
   lockSessionEventWriteRows,
   organizationApiKeyAllowsWorkspace
-} from "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-NT7OGKYX.js";
+import "./chunk-T3CYF3DH.js";
 import "./chunk-4UJCXBR2.js";
 import {
   rawRows,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-LRSIODCQ.js";
+} from "./chunk-27T4AP25.js";
 import {
   apiKeys,
   sessionCommandReceipts,
   sessionMcpServers,
   sessions
-} from "./chunk-DSNEIW5E.js";
+} from "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/session-realtime-billing.d.ts

@@ -0,0 +1,48 @@
+import type { SessionRealtimeModel } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+/** One provider connection of a live-voice mode, bounded by server observation. */
+export type SessionRealtimeBillableConnection = {
+    id: string;
+    startedAt: Date;
+    observedUntil: Date;
+};
+export type SessionRealtimeBillingFacts = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    realtimeId: string;
+    model: SessionRealtimeModel;
+    ownerSubjectId: string;
+    state: "active" | "ended";
+    connections: SessionRealtimeBillableConnection[];
+};
+/**
+ * The last instant the server itself observed the voice owner alive. An
+ * explicit owner-proven end is observed at `endedAt`; an expired lease only up
+ * to its last heartbeat (late lazy settlement never extends the bill); an
+ * active mode up to `now`, bounded by its lease.
+ */
+export declare function sessionRealtimeObservedUntil(mode: {
+    state: string;
+    endReason: string | null;
+    endedAt: Date | null;
+    lastHeartbeatAt: Date;
+    leaseExpiresAt: Date;
+}, now: Date): Date;
+/**
+ * Server-observed lifetime of every provider connection that was actually
+ * issued (an SDP answer or a minted client secret was returned). Failed or
+ * never-completed negotiations issued nothing billable.
+ */
+export declare function loadSessionRealtimeBillingFacts(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    realtimeId: string;
+    now?: Date;
+}): Promise<SessionRealtimeBillingFacts | null>;
+/** Which of these usage idempotency keys are already recorded for the account. */
+export declare function existingUsageEventIdempotencyKeys(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    keys: readonly string[];
+}): Promise<Set<string>>;

package/dist/session-realtime.d.ts

@@ -34,11 +34,17 @@ export type RenewSessionRealtimeInput = {
     expectedVersion: number;
     now?: Date;
     leaseMs?: number;
+    /**
+     * False keeps the current lease unchanged (owner still proven). Used when a
+     * deployment-funded call ran out of credits: the client drains and ends
+     * inside the remaining lease, and an ignoring client lapses on its own.
+     */
+    extendLease?: boolean;
 };
-export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs"> & {
+export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs" | "extendLease"> & {
     reason: Extract<SessionRealtimeEndReason, "user_stop" | "browser_unload">;
 };
-export type AssertSessionRealtimeOwnerInput = Omit<RenewSessionRealtimeInput, "leaseMs">;
+export type AssertSessionRealtimeOwnerInput = Omit<RenewSessionRealtimeInput, "leaseMs" | "extendLease">;
 export type SessionRealtimeMutationResult = {
     mode: SessionRealtimeMode;
     replay: boolean;

package/dist/session-tenancy.js

@@ -13,9 +13,9 @@ import {
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
   transitionSessionVisibility
-} from "./chunk-OI6YZXTU.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-VCHK4D6S.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/video-generation.js

@@ -29,10 +29,10 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-BID3CNN3.js";
+} from "./chunk-T3CYF3DH.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/voice-transcription-settlement.d.ts

@@ -0,0 +1,36 @@
+import { CreditDebitAttribution } from "./credit-debit-attribution.js";
+import type { Database } from "./database.js";
+/** Usage source and credit debit type of deployment-funded voice transcription. */
+export declare const VOICE_TRANSCRIPTION_SOURCE_TYPE = "voice_transcription";
+export declare const VOICE_TRANSCRIPTION_DEBIT_TYPE = "voice_transcription_debit";
+/**
+ * Idempotency keys for one settled voice-transcription unit. Both derive from
+ * the workspace and the server-built unit id only, so an inline settlement, its
+ * in-process retry, and a later reconciliation converge on the same rows.
+ */
+export declare function voiceTranscriptionSettlementKeys(input: {
+    workspaceId: string;
+    sourceId: string;
+}): {
+    usageIdempotencyKey: string;
+    debitIdempotencyKey: string;
+};
+export type UnsettledVoiceTranscriptionCharge = {
+    sourceId: string;
+    amountMicros: number;
+    attribution: CreditDebitAttribution;
+};
+/**
+ * Voice usage receipts in one workspace whose credit debit never committed
+ * (the debit transaction failed after the receipt was durable). Bounded and
+ * ordered oldest first; `minAgeMilliseconds` leaves an in-flight inline
+ * settlement to finish with its full ledger metadata first. The scan walks the
+ * workspace's `model.cost` index range, so the window is short (3 days) and
+ * the statement is capped at 2 s; a timeout only defers reconciliation.
+ */
+export declare function listUnsettledVoiceTranscriptionCharges(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    limit?: number;
+    minAgeMilliseconds?: number;
+}): Promise<UnsettledVoiceTranscriptionCharge[]>;

package/dist/workspace-tool-defaults.js

@@ -1,12 +1,12 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-NT7OGKYX.js";
+import "./chunk-T3CYF3DH.js";
 import "./chunk-4UJCXBR2.js";
 import {
   withWorkspaceRls
-} from "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-27T4AP25.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/drizzle/0623_voice_transcription_attribution.sql

@@ -0,0 +1,128 @@
+-- deployment-mode: rolling
+-- Retain exact transcription payer receipts for member allowance attribution.
+-- The API freezes the authenticated payer; ledger metadata alone is not proof.
+DO $constraints$
+DECLARE item record;
+BEGIN
+  FOR item IN SELECT conname, pg_get_constraintdef(oid) AS definition FROM pg_constraint
+    WHERE conrelid='opengeni_private.usage_allowance_attribution_receipts'::regclass AND contype='c'
+  LOOP
+    IF (item.definition LIKE '%source_kind%' AND item.definition LIKE '%knowledge_query%') THEN
+      EXECUTE format('ALTER TABLE opengeni_private.usage_allowance_attribution_receipts DROP CONSTRAINT %I',item.conname);
+    END IF;
+  END LOOP;
+END $constraints$;
+ALTER TABLE opengeni_private.usage_allowance_attribution_receipts
+  ADD CONSTRAINT usage_attribution_source_kind CHECK (source_kind IN ('turn','schedule','knowledge_query','voice_transcription')),
+  ADD CONSTRAINT usage_attribution_source_shape CHECK (coalesce(
+    (source_kind='knowledge_query' AND session_id IS NULL AND quantity IS NOT NULL
+      AND idempotency_key='knowledge.query_cost:'||source_id)
+    OR (source_kind='voice_transcription' AND session_id IS NULL AND quantity IS NOT NULL
+      AND idempotency_key='voice.transcription_cost:'||source_id)
+    OR (source_kind IN ('turn','schedule') AND quantity IS NULL AND idempotency_key IS NULL),false));
+
+CREATE OR REPLACE FUNCTION capture_usage_allowance_attribution()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path FROM CURRENT AS $$
+DECLARE
+  v_source_kind text; v_source_id text; v_session_id uuid; v_attribution jsonb;
+  v_quantity bigint; v_idempotency_key text; opened integer;
+BEGIN
+  IF TG_TABLE_NAME='session_turns' THEN
+    IF TG_OP='UPDATE' AND (NEW.id IS DISTINCT FROM OLD.id
+      OR NEW.account_id IS DISTINCT FROM OLD.account_id OR NEW.workspace_id IS DISTINCT FROM OLD.workspace_id
+      OR NEW.session_id IS DISTINCT FROM OLD.session_id
+      OR NEW.initiating_human_subject_id IS DISTINCT FROM OLD.initiating_human_subject_id) THEN
+      RAISE EXCEPTION 'Allowance turn attribution is immutable' USING ERRCODE='23514';
+    END IF;
+    v_source_kind:='turn'; v_source_id:=NEW.id::text; v_session_id:=NEW.session_id;
+    v_attribution:=jsonb_build_object('kind','turn','turnId',NEW.id,
+      'initiatingHumanSubjectId',NEW.initiating_human_subject_id);
+  ELSIF TG_TABLE_NAME='scheduled_task_runs' THEN
+    IF TG_OP='UPDATE' AND (NEW.id IS DISTINCT FROM OLD.id
+      OR NEW.account_id IS DISTINCT FROM OLD.account_id OR NEW.workspace_id IS DISTINCT FROM OLD.workspace_id
+      OR NEW.accepted_execution_snapshot->'causalHumanSubjectId' IS DISTINCT FROM
+        OLD.accepted_execution_snapshot->'causalHumanSubjectId') THEN
+      RAISE EXCEPTION 'Allowance scheduled attribution is immutable' USING ERRCODE='23514';
+    END IF;
+    v_source_kind:='schedule'; v_source_id:=NEW.id::text;
+    v_attribution:=CASE WHEN NOT coalesce(NEW.accepted_execution_snapshot ? 'causalHumanSubjectId',false)
+      THEN '{"kind":"unknown"}'::jsonb
+      WHEN NEW.accepted_execution_snapshot->>'causalHumanSubjectId' IS NULL THEN '{"kind":"service"}'::jsonb
+      ELSE jsonb_build_object('kind','human',
+        'initiatingHumanSubjectId',NEW.accepted_execution_snapshot->>'causalHumanSubjectId') END;
+  ELSIF TG_TABLE_NAME='usage_events' THEN
+    IF TG_OP='UPDATE' THEN
+      IF ((OLD.source_resource_type='knowledge_query' AND OLD.event_type='document.query_embedding_cost')
+        OR (OLD.source_resource_type='voice_transcription' AND OLD.event_type='model.cost'))
+        AND (NEW.account_id IS DISTINCT FROM OLD.account_id OR NEW.workspace_id IS DISTINCT FROM OLD.workspace_id
+          OR NEW.source_resource_type IS DISTINCT FROM OLD.source_resource_type
+          OR NEW.source_resource_id IS DISTINCT FROM OLD.source_resource_id
+          OR NEW.event_type IS DISTINCT FROM OLD.event_type OR NEW.quantity IS DISTINCT FROM OLD.quantity
+          OR NEW.idempotency_key IS DISTINCT FROM OLD.idempotency_key
+          OR NEW.initiator_context->'creditDebitAttribution' IS DISTINCT FROM
+            OLD.initiator_context->'creditDebitAttribution') THEN
+        RAISE EXCEPTION 'Allowance query attribution is immutable' USING ERRCODE='23514';
+      END IF;
+      RETURN NEW;
+    END IF;
+    IF NEW.workspace_id IS NULL OR NEW.source_resource_id IS NULL THEN RETURN NEW; END IF;
+    IF NEW.source_resource_type='knowledge_query' AND NEW.event_type='document.query_embedding_cost'
+      AND NEW.idempotency_key='knowledge.query_cost:'||NEW.source_resource_id THEN
+      v_source_kind:='knowledge_query';
+    ELSIF NEW.source_resource_type='voice_transcription' AND NEW.event_type='model.cost'
+      AND NEW.idempotency_key='voice.transcription_cost:'||NEW.source_resource_id THEN
+      v_source_kind:='voice_transcription';
+    ELSE RETURN NEW;
+    END IF;
+    v_source_id:=NEW.source_resource_id;
+    v_quantity:=NEW.quantity; v_idempotency_key:=NEW.idempotency_key;
+    -- Copy only attribution fields, never the initiator envelope/query/content.
+    v_attribution:=NEW.initiator_context->'creditDebitAttribution';
+    v_attribution:=CASE v_attribution->>'kind'
+      WHEN 'human' THEN jsonb_build_object('kind','human',
+        'initiatingHumanSubjectId',v_attribution->'initiatingHumanSubjectId')
+      WHEN 'turn' THEN jsonb_build_object('kind','turn','turnId',v_attribution->'turnId',
+        'initiatingHumanSubjectId',v_attribution->'initiatingHumanSubjectId')
+      WHEN 'service' THEN '{"kind":"service"}'::jsonb
+      ELSE '{"kind":"unknown"}'::jsonb END;
+  ELSE
+    RAISE EXCEPTION 'Unknown allowance attribution source' USING ERRCODE='55000';
+  END IF;
+  IF TG_OP='UPDATE' THEN RETURN NEW; END IF;
+  INSERT INTO opengeni_private.usage_allowance_capabilities VALUES
+    (pg_backend_pid(),pg_current_xact_id(),TG_TABLE_SCHEMA,NEW.account_id,NEW.workspace_id)
+    ON CONFLICT DO NOTHING;
+  GET DIAGNOSTICS opened=ROW_COUNT;
+  INSERT INTO opengeni_private.usage_allowance_attribution_receipts
+    (account_id,workspace_id,source_kind,source_id,session_id,attribution,quantity,idempotency_key)
+    VALUES(NEW.account_id,NEW.workspace_id,v_source_kind,v_source_id,v_session_id,v_attribution,v_quantity,v_idempotency_key);
+  IF opened=1 THEN
+    DELETE FROM opengeni_private.usage_allowance_capabilities
+      WHERE backend_pid=pg_backend_pid() AND transaction_id=pg_current_xact_id_if_assigned()
+        AND data_schema=TG_TABLE_SCHEMA AND account_id=NEW.account_id AND workspace_id=NEW.workspace_id;
+  END IF;
+  RETURN NEW;
+END $$;
+
+DO $debit$
+DECLARE definition text:=pg_get_functiondef('count_workspace_allowance_debit()'::regprocedure);
+  anchor text:=$anchor$IF NEW.source_type='knowledge_query' THEN$anchor$;
+  replacement text:=$replacement$IF NEW.source_type='voice_transcription' THEN
+    SELECT receipt.attribution INTO attribution FROM opengeni_private.usage_allowance_attribution_receipts receipt
+    WHERE receipt.account_id=NEW.account_id AND receipt.workspace_id=NEW.workspace_id
+      AND receipt.source_kind='voice_transcription' AND receipt.source_id=NEW.source_id
+      AND receipt.idempotency_key='voice.transcription_cost:'||NEW.source_id
+      AND receipt.quantity=amount AND NEW.type='voice_transcription_debit';
+    attribution:=coalesce(attribution,'{"kind":"unknown"}'::jsonb);
+  ELSIF NEW.source_type='knowledge_query' THEN$replacement$;
+BEGIN
+  IF strpos(definition,anchor)=0 OR strpos(substr(definition,strpos(definition,anchor)+length(anchor)),anchor)>0 THEN
+    RAISE EXCEPTION 'Unexpected allowance debit source branch' USING ERRCODE='55000';
+  END IF;
+  EXECUTE replace(definition,anchor,replacement);
+END $debit$;
+
+DO $harden$
+BEGIN
+  EXECUTE format('ALTER FUNCTION %I.capture_usage_allowance_attribution() SET search_path=pg_catalog,%I,pg_temp', current_schema(), current_schema());
+END $harden$;

package/drizzle/0624_azure_live_realtime_model.sql

@@ -0,0 +1,30 @@
+-- deployment-mode: rolling
+-- Admit configured Azure GPT Live WebRTC sessions.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+ALTER TABLE "session_realtime_modes"
+  DROP CONSTRAINT "session_realtime_modes_model_check";
+
+ALTER TABLE "session_realtime_modes"
+  ADD CONSTRAINT "session_realtime_modes_model_check"
+  CHECK (
+    "model" IN (
+      'opengeni-azure/gpt-live-1',
+      'gpt-live-1-boulder-alpha',
+      'supergrok/grok-voice-think-fast-2.0',
+      'opengeni-gateway/openai/gpt-realtime-2.1',
+      'opengeni-gateway/openai/gpt-realtime-mini',
+      'opengeni-gateway/xai/grok-voice-think-fast-2.0',
+      'workspace-gateway/openai/gpt-realtime-2.1',
+      'workspace-gateway/openai/gpt-realtime-mini',
+      'workspace-gateway/xai/grok-voice-think-fast-2.0'
+    )
+  ) NOT VALID;
+
+ALTER TABLE "session_realtime_modes"
+  VALIDATE CONSTRAINT "session_realtime_modes_model_check";
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0625_transcription_billing_refusal_codes.sql

@@ -0,0 +1,29 @@
+-- deployment-mode: rolling
+-- Persist the exact credit/allowance refusal on a resumable recording and its
+-- segment, so a reloaded recording still explains why it stopped. Widening an
+-- allowed-value CHECK only; no row is rewritten.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+ALTER TABLE "transcription_recordings"
+  DROP CONSTRAINT "transcription_recordings_error_code_check";
+
+ALTER TABLE "transcription_recordings"
+  ADD CONSTRAINT "transcription_recordings_error_code_check"
+  CHECK ("error_code" IS NULL OR "error_code" IN (
+    'permission_denied', 'not_supported', 'network', 'provider', 'policy_blocked',
+    'timeout', 'cancelled', 'unavailable', 'too_large', 'invalid_audio', 'unknown',
+    'insufficient_credits', 'allowance_exhausted', 'monthly_model_cost_limit'
+  ));
+
+ALTER TABLE "transcription_recording_segments"
+  DROP CONSTRAINT "transcription_recording_segments_error_code_check";
+
+ALTER TABLE "transcription_recording_segments"
+  ADD CONSTRAINT "transcription_recording_segments_error_code_check"
+  CHECK ("error_code" IS NULL OR "error_code" IN (
+    'permission_denied', 'not_supported', 'network', 'provider', 'policy_blocked',
+    'timeout', 'cancelled', 'unavailable', 'too_large', 'invalid_audio', 'unknown',
+    'insufficient_credits', 'allowance_exhausted', 'monthly_model_cost_limit'
+  ));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -115,12 +115,12 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "1.3.0",
-    "@opengeni/codex": "1.3.0",
-    "@opengeni/config": "1.3.0",
-    "@opengeni/contracts": "1.3.0",
-    "@opengeni/network": "1.3.0",
-    "@opengeni/observability": "1.3.0",
+    "@opengeni/codemode": "1.4.0",
+    "@opengeni/codex": "1.4.0",
+    "@opengeni/config": "1.4.0",
+    "@opengeni/contracts": "1.4.0",
+    "@opengeni/network": "1.4.0",
+    "@opengeni/observability": "1.4.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },