@opengeni/db 1.3.0 → 1.4.2

package/dist/legacy-tool-action-reviews.d.ts

@@ -0,0 +1,75 @@
+import { type Database } from "./database.js";
+/** Read-only presentation for SDK approvals created before durable connector
+ * reviews. Neither current catalogs nor display labels establish a provider.
+ * This never creates a request, changes a policy, or resumes an operation. */
+export declare function legacyToolActionReview(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    approvalId: string;
+}): Promise<{
+    args: Record<string, unknown>;
+    context: {
+        kind: "generic" | "gmail";
+        title?: string | undefined;
+        accountLabel?: string | undefined;
+        fieldLabels?: Record<string, string> | undefined;
+        protectedFields?: string[] | undefined;
+        email?: {
+            from: string;
+            to: string;
+            cc: string;
+            bcc: string;
+            subject: string;
+            textBody: string;
+            htmlBody: string;
+            contentSha256: string;
+            attachments: {
+                name: string;
+                mediaType: string;
+                bytes: number;
+            }[];
+        } | undefined;
+        samples?: {
+            id: string;
+            title: string;
+            subtitle?: string | undefined;
+            provenance: "provider_metadata";
+        }[] | undefined;
+    };
+    proven: boolean;
+    review: {
+        version: 1;
+        id: string;
+        actionDigest: string;
+        revision: string;
+        status: "approved" | "blocked" | "cancelled" | "completed" | "executing" | "expired" | "failed" | "partial" | "pending" | "rejected" | "revoked" | "stale" | "unavailable" | "unknown";
+        title: string;
+        accountLabel?: string | undefined;
+        consequence?: string | undefined;
+        effects: string[];
+        selectionCount?: number | undefined;
+        selectionKind?: "messages" | "threads" | undefined;
+        samples?: {
+            id: string;
+            title: string;
+            subtitle?: string | undefined;
+            provenance: "provider_metadata";
+        }[] | undefined;
+        fields: {
+            path: string;
+            label: string;
+            preview: string;
+            count?: number | undefined;
+            truncated: boolean;
+            protected?: boolean | undefined;
+        }[];
+        moreFields: number;
+        reason: string;
+        createdAt: string;
+        updatedAt: string;
+        approveLabel: string;
+        availableActions: ("approve" | "reject")[];
+        detailsAvailable: boolean;
+    };
+} | null>;

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-7S3O33NM.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-Y72DP3JF.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/mcp-operations.js

@@ -1,7 +1,7 @@
 import {
   withRlsContext
-} from "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   fromPostgresLosslessJson,

package/dist/modal-native-live-origin.d.ts

@@ -0,0 +1,75 @@
+import { type Database } from "./database.js";
+/** Structural V2 correlation scope. This is deliberately NOT an actor/grant. */
+export type ModalNativeLiveOriginScope = Readonly<{
+    version: 2;
+    declarationId: string;
+    planId: string;
+    creatorId: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    triggerEventId: string;
+    sandboxGroupId: string;
+    routeKind: "home";
+    routeTargetId: null;
+    routeEpoch: number;
+}>;
+export type ModalNativeLiveOriginProjection = Readonly<{
+    version: 1;
+    scope: ModalNativeLiveOriginScope;
+    initiator: {
+        kind: "subject" | "service";
+        subjectId: string;
+        initiatingHumanSubjectId: string;
+    };
+    membership: {
+        id: string;
+        authorizationRevision: string;
+        basis: "workspace_membership" | "personal_workspace";
+    };
+    acceptedAuthority: {
+        epoch: number;
+        visibility: "user_private" | "workspace_shared";
+        ownerOrganizationMembershipId: string | null;
+    };
+    currentAuthority: {
+        epoch: number;
+        executionEpoch: number;
+        visibility: "user_private" | "workspace_shared";
+        ownerSubjectId: string | null;
+        ownerOrganizationMembershipId: string | null;
+    };
+    control: {
+        workspaceRevision: string;
+        sessionVersion: string;
+    };
+    execution: {
+        workflowId: string;
+        workflowRunId: string;
+        activityId: string;
+    };
+    providerRecoveryCount: 0 | 1 | 2 | 3 | 4 | 5;
+    checkedAt: string;
+}>;
+export type ModalNativeLiveOriginResult = {
+    kind: "live";
+    projection: ModalNativeLiveOriginProjection;
+} | {
+    kind: "fenced";
+} | {
+    kind: "unsupported";
+    reason: "invalid_scope" | "human_unavailable" | "external_authority" | "not_premodel";
+};
+/**
+ * Private-server integration primitive, NOT host authentication or a grant.
+ * The caller must authenticate the exact host request separately and consume
+ * this projection in this SAME transaction. No native/provider awaits here.
+ * Enter before taking any tenancy/control/session/lease lock: SQL acquires the
+ * organization-membership -> tenancy -> canonical control/row prefix itself.
+ * Preserves all subject and tenant GUCs. SQL uncertainty propagates (including
+ * 55P03); no failed/aborted transaction is reported as successful admission.
+ */
+export declare function lockLiveNativeOriginalOriginTx(scopedTx: Database, scope: ModalNativeLiveOriginScope): Promise<ModalNativeLiveOriginResult>;

package/dist/organization-integration-policy.js

@@ -3,10 +3,10 @@ import {
   updateOrganizationIntegrationPolicy,
   withOrganizationIntegrationAcquisition,
   withOrganizationIntegrationPolicyFence
-} from "./chunk-AQMH2ZEH.js";
+} from "./chunk-A4J7EECR.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/organization-slack-bots.d.ts

@@ -48,7 +48,7 @@ export declare function availableSlackBotConnectionMetadata(db: Database, scope:
     metadata: {
         organizationSharingGeneration: number;
     };
-} | import("./index.js").ConnectionMetadataWithVerification)[]>;
+} | import("./connection-metadata.js").ConnectionMetadataWithVerification)[]>;
 /** Canonical organization-administrator authentication is supplied by a trusted
  * HTTP adapter. SQL separately rechecks live authority and exact bot identity. */
 export declare function setOrganizationSlackBotAccess(db: Database, input: {

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-7QWWTVYH.js";
+} from "./chunk-5ROHLEN6.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles

package/dist/retained-provider-commands.d.ts

@@ -18,24 +18,6 @@ export declare function retainedProviderCommandPersistence(db: Database, scope:
     requestCancellation: (reason: "provider_deadline" | "explicit_stop") => Promise<void>;
     cancellationRequested: () => Promise<boolean>;
     load: () => Promise<{
-        kind: "modal-control-v1";
-        sandboxId: string;
-        taskId: string;
-        execId: string;
-        pty?: boolean | undefined;
-        streams: {
-            stdout: {
-                batchIndex: number;
-                utf8Remainder: string;
-                exitCode: number | null;
-            };
-            stderr: {
-                batchIndex: number;
-                utf8Remainder: string;
-                exitCode: number | null;
-            };
-        };
-    } | {
         kind: "modal-router-v1";
         sandboxId: string;
         taskId: string;
@@ -61,8 +43,7 @@ export declare function retainedProviderCommandPersistence(db: Database, scope:
                 exitCode: number | null;
             };
         };
-    } | null>;
-    acknowledge: (command: SandboxProviderCommand) => Promise<{
+    } | {
         kind: "modal-control-v1";
         sandboxId: string;
         taskId: string;
@@ -80,7 +61,8 @@ export declare function retainedProviderCommandPersistence(db: Database, scope:
                 exitCode: number | null;
             };
         };
-    } | {
+    } | null>;
+    acknowledge: (command: SandboxProviderCommand) => Promise<{
         kind: "modal-router-v1";
         sandboxId: string;
         taskId: string;
@@ -106,6 +88,24 @@ export declare function retainedProviderCommandPersistence(db: Database, scope:
                 exitCode: number | null;
             };
         };
+    } | {
+        kind: "modal-control-v1";
+        sandboxId: string;
+        taskId: string;
+        execId: string;
+        pty?: boolean | undefined;
+        streams: {
+            stdout: {
+                batchIndex: number;
+                utf8Remainder: string;
+                exitCode: number | null;
+            };
+            stderr: {
+                batchIndex: number;
+                utf8Remainder: string;
+                exitCode: number | null;
+            };
+        };
     }>;
     reserveInput: (byteLength?: number) => Promise<number>;
     captureRouterPage: (page: RetainedRouterOutputPage) => Promise<{

package/dist/retained-provider-commands.js

@@ -14,13 +14,13 @@ import {
   retainedProviderCommandPersistence,
   supervisedCommandProtocolReady,
   validateRouterOutputAdvance
-} from "./chunk-6S5T6FSP.js";
-import "./chunk-BRVBLQAL.js";
-import "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-W75DRYG3.js";
+import "./chunk-K5MTNKJU.js";
+import "./chunk-JWBEE4CL.js";
+import "./chunk-TODVDGMO.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/runtime-posture.d.ts

@@ -7,7 +7,7 @@ export declare const SLACK_FILE_UPLOAD_OPERATIONS_TABLE = "slack_file_upload_ope
 export declare const WORK_CLAIM_CAPABILITY_ROUTINES: readonly ["upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)", "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)"];
 export declare const CLAUDE_SUBSCRIPTION_CAPABILITY_ROUTINES: string[];
 export declare const SUBSCRIPTION_ACCOUNT_CAPABILITY_ROUTINES: string[];
-export declare const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES: readonly [...string[], "open_private_session_create_capability(uuid, uuid, uuid, text)", "open_private_child_session_create_capability(uuid, uuid, uuid, uuid, uuid, uuid, integer)", "close_private_session_create_capability(uuid)", "resolve_session_attempt_personal_resources(uuid, uuid, uuid)", "list_owned_connection_accounts(uuid, uuid)", "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)", "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)", "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)", "revoke_self_user_resource_grant(uuid, uuid, uuid)", "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)", "preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamp with time zone, text)", "create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)", "list_scoped_variable_sets(uuid, uuid, uuid, text, text)", "count_scoped_variable_sets(uuid, uuid, text)", "mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean)", "read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer)", "materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid)", "connection_authority_convergence_audit_capability_active(uuid)", "resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)", "inspect_organization_connection_authority_convergence(uuid, integer, uuid)", "get_self_personal_github_repository_selection(uuid, uuid, text, uuid)", "mutate_self_personal_github_repository_selection(uuid, uuid, text, uuid, bigint, bigint, text, jsonb, boolean)", "create_personal_document_authority(uuid, uuid, uuid)", "resolve_document_original_file(uuid, uuid, text, uuid)", "resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)", "list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)", "reclassify_document_authority(jsonb)", "run_document_default_collection_backfill(jsonb)", "list_document_default_collection_backfill_runs(jsonb)", "get_document_default_collection_backfill_audit(jsonb)", "list_organization_document_authority_reclassifications(jsonb)", "create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean)", "list_scoped_rigs(uuid, uuid, uuid, text, text)", "count_scoped_rigs(uuid, uuid, text)", "mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean)", "finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean)", "list_scoped_enrollments(uuid, uuid, uuid, text)", "get_scoped_sandbox(uuid, uuid, uuid)", "authorize_scoped_sandbox_attach(uuid, uuid, uuid)", "materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer)", "authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean)", "list_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "detach_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint)", "clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint)", "create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb)", "materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text)", "scheduled_task_run_personal_resource_authority(uuid, uuid, uuid)", "scheduled_task_run_connection_authority_subject(uuid, uuid, uuid)", "scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint)", "record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint)", "clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint)", "scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint)", "scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint)", "validate_scheduled_agent_run_live_authority(uuid, uuid, uuid)", "scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid)", "scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "bind_scheduled_task_run_session(uuid, uuid, uuid, uuid)", "transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text)", "mutate_managed_sign_in_method(text, text, jsonb)", "assert_managed_sign_in_recovery(text, text, uuid, jsonb)", "replay_managed_sign_in_method(text, text, jsonb)", "claim_managed_sign_in_notification(uuid, text, text, integer)", "settle_managed_sign_in_notification(uuid, uuid, text)", "ensure_canonical_human_identity(text, text)", "validate_canonical_human_session(text, text, boolean)", "get_canonical_human_identity_projection(text)", "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)", "get_canonical_human_exact_login_binding(text, text)", "managed_auth_session_set_authority_state(text)", "managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)", "managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)", "managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)", "managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)", "managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)", "managed_auth_actor_mutation_fence(text, bigint, uuid)", "managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)", "managed_auth_actor_mutation_lease_release(text, uuid)", "managed_auth_actor_mutation_lease_validate(text, bigint, uuid)", "managed_auth_adopted_session_snapshot(text)", "managed_auth_isolated_session_reap(integer)", "managed_auth_expired_session_set_reap(integer)", "managed_auth_session_set_operation_receipt(text, uuid, text, text)", "get_organization_recovery_overview(uuid, text, jsonb, text, text)", "organization_recovery_command(jsonb)", "create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)", "archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)", "replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)", "resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)", "upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)", "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "session_private_actor_visible(uuid, uuid, uuid, text)", "session_reference_visible(uuid, uuid, uuid)", "session_visibility_lifecycle_capability_held()", "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer)", "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)", "resolve_xai_authority_pool(uuid, uuid, text, jsonb)", "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)", "xai_provider_account_authority_snapshot_v1_valid(jsonb)"];
+export declare const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES: readonly ["lock_live_native_original_origin_v2(jsonb)", "modal_native_origin_member_read_active(uuid, text)", ...string[], "open_private_session_create_capability(uuid, uuid, uuid, text)", "open_private_child_session_create_capability(uuid, uuid, uuid, uuid, uuid, uuid, integer)", "close_private_session_create_capability(uuid)", "resolve_session_attempt_personal_resources(uuid, uuid, uuid)", "list_owned_connection_accounts(uuid, uuid)", "accept_turn_personal_resource_attachment(uuid, uuid, uuid, uuid, text, integer, boolean, integer)", "list_self_user_resource_authorities(uuid, uuid, text, uuid, integer)", "issue_self_user_resource_grant(uuid, uuid, uuid, text, text, text, uuid, integer, boolean)", "revoke_self_user_resource_grant(uuid, uuid, uuid)", "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)", "preference_registry_create_knowledge_proposal_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, uuid, text, text, text, text, integer, text, jsonb, timestamp with time zone, text)", "create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)", "list_scoped_variable_sets(uuid, uuid, uuid, text, text)", "count_scoped_variable_sets(uuid, uuid, text)", "mutate_scoped_variable_set(uuid, uuid, uuid, text, text, boolean, text, boolean, text, text, boolean)", "read_scoped_variable_set_secret(uuid, uuid, uuid, text, text, text, uuid, uuid, uuid, integer)", "materialize_scoped_variable_set_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "materialize_scoped_variable_set_for_session(uuid, uuid, uuid, uuid)", "connection_authority_convergence_audit_capability_active(uuid)", "resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)", "inspect_organization_connection_authority_convergence(uuid, integer, uuid)", "get_self_personal_github_repository_selection(uuid, uuid, text, uuid)", "mutate_self_personal_github_repository_selection(uuid, uuid, text, uuid, bigint, bigint, text, jsonb, boolean)", "create_personal_document_authority(uuid, uuid, uuid)", "resolve_document_original_file(uuid, uuid, text, uuid)", "resolve_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid)", "list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)", "reclassify_document_authority(jsonb)", "run_document_default_collection_backfill(jsonb)", "list_document_default_collection_backfill_runs(jsonb)", "get_document_default_collection_backfill_audit(jsonb)", "list_organization_document_authority_reclassifications(jsonb)", "create_scoped_rig(uuid, uuid, text, text, text, text, jsonb, boolean)", "list_scoped_rigs(uuid, uuid, uuid, text, text)", "count_scoped_rigs(uuid, uuid, text)", "mutate_scoped_rig(uuid, uuid, uuid, text, text, boolean, text, boolean, boolean)", "finalize_scoped_enrollment(uuid, uuid, text, text, boolean, boolean, text, text, text, boolean)", "list_scoped_enrollments(uuid, uuid, uuid, text)", "get_scoped_sandbox(uuid, uuid, uuid)", "authorize_scoped_sandbox_attach(uuid, uuid, uuid)", "materialize_scoped_rig_version_for_attempt(uuid, uuid, uuid, uuid, uuid, integer)", "authorize_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "assert_session_attempt_personal_machine(uuid, uuid, uuid, uuid, uuid, integer, uuid, boolean)", "list_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "detach_scoped_machine_dependent_sessions(uuid, uuid, uuid)", "freeze_scheduled_task_personal_resources(uuid, uuid, uuid, bigint)", "clone_scheduled_task_personal_resource_authority(uuid, uuid, uuid, bigint, bigint)", "create_scheduled_agent_run_with_admission(uuid, uuid, uuid, uuid, bigint, text, text, text, timestamp with time zone, timestamp with time zone, jsonb)", "materialize_scheduled_task_reusable_session_from_run(uuid, uuid, uuid, uuid, uuid, bigint, text)", "scheduled_task_run_personal_resource_authority(uuid, uuid, uuid)", "scheduled_task_run_connection_authority_subject(uuid, uuid, uuid)", "scheduled_task_personal_resource_authority_subject(uuid, uuid, uuid, bigint)", "record_scheduled_task_revision_authority(uuid, uuid, uuid, bigint)", "clone_scheduled_task_revision_authority(uuid, uuid, uuid, bigint, bigint)", "scheduled_task_revision_authority_subject(uuid, uuid, uuid, bigint)", "scheduled_task_revision_authority_snapshot(uuid, uuid, uuid, bigint)", "validate_scheduled_agent_run_live_authority(uuid, uuid, uuid)", "scheduled_scoped_rig_version_metadata(uuid, uuid, text, uuid, uuid)", "scheduled_variable_set_expected_generation_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid)", "bind_scheduled_task_run_session(uuid, uuid, uuid, uuid)", "transition_scheduled_agent_run(uuid, uuid, uuid, uuid, uuid, text, text)", "mutate_managed_sign_in_method(text, text, jsonb)", "assert_managed_sign_in_recovery(text, text, uuid, jsonb)", "replay_managed_sign_in_method(text, text, jsonb)", "claim_managed_sign_in_notification(uuid, text, text, integer)", "settle_managed_sign_in_notification(uuid, uuid, text)", "ensure_canonical_human_identity(text, text)", "validate_canonical_human_session(text, text, boolean)", "get_canonical_human_identity_projection(text)", "apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text)", "get_canonical_human_exact_login_binding(text, text)", "managed_auth_session_set_authority_state(text)", "managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)", "managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)", "managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)", "managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)", "managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)", "managed_auth_actor_mutation_fence(text, bigint, uuid)", "managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)", "managed_auth_actor_mutation_lease_release(text, uuid)", "managed_auth_actor_mutation_lease_validate(text, bigint, uuid)", "managed_auth_adopted_session_snapshot(text)", "managed_auth_isolated_session_reap(integer)", "managed_auth_expired_session_set_reap(integer)", "managed_auth_session_set_operation_receipt(text, uuid, text, text)", "get_organization_recovery_overview(uuid, text, jsonb, text, text)", "organization_recovery_command(jsonb)", "create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer)", "archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer)", "replace_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, uuid, uuid, integer, text, text, integer, text)", "resolve_task_note_knowledge_promotion_source(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text)", "upsert_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, integer, text, text, text, text, text, text, text)", "release_session_work_claim_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text)", "session_private_actor_visible(uuid, uuid, uuid, text)", "session_reference_visible(uuid, uuid, uuid)", "session_visibility_lifecycle_capability_held()", "transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text, integer)", "xai_subscription_pool_visible(uuid, uuid, text, text, uuid)", "resolve_xai_authority_pool(uuid, uuid, text, jsonb)", "revalidate_xai_subscription_authority(uuid, text, uuid, jsonb)", "xai_provider_account_authority_snapshot_v1_valid(jsonb)"];
 /**
  * Boolean-only predicates that shared-table RLS policies must be able to
  * evaluate under table owners and SECURITY DEFINER roles unknown at migration

package/dist/sandbox-interaction-idle.d.ts

@@ -0,0 +1,22 @@
+import { type Database } from "./database.js";
+export declare const INTERACTION_ONLY_IDLE_BUCKETS: readonly ["lt_30m", "30m_2h", "2h_6h", "gte_6h"];
+export type InteractionOnlyIdleBucket = (typeof INTERACTION_ONLY_IDLE_BUCKETS)[number];
+export type InteractionOnlyLeaseCandidate = {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+};
+export declare function interactionOnlyIdleBucket(idleMs: number): InteractionOnlyIdleBucket;
+/**
+ * Read-only inventory of warm leases whose ONLY holders are Browser/Computer
+ * interaction holders, bucketed by time since the newest interaction activity
+ * (holder heartbeat, controller heartbeat, or last use). Interaction holders
+ * deliberately never expire by timestamp, so such a box stays warm until its
+ * session ends or the provider deadline; this makes that visible. Candidates
+ * come from the sanctioned cross-workspace warm-lease list; each workspace is
+ * then read under its own RLS scope. No lock beyond the snapshot is taken.
+ */
+export declare function countInteractionOnlyWarmLeasesByIdle(db: Database, candidates: InteractionOnlyLeaseCandidate[], options?: {
+    now?: Date;
+    maxWorkspaces?: number;
+}): Promise<Record<InteractionOnlyIdleBucket, number>>;

package/dist/schema.js

@@ -401,7 +401,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-DSNEIW5E.js";
+} from "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-background-commands.js

@@ -27,11 +27,11 @@ import {
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction,
   unobservableRetainedProcessOutcomeSql
-} from "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-JWBEE4CL.js";
+import "./chunk-TODVDGMO.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-command-output.js

@@ -1,11 +1,11 @@
 import {
   appendSessionCommandOutput
-} from "./chunk-BRVBLQAL.js";
-import "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-K5MTNKJU.js";
+import "./chunk-JWBEE4CL.js";
+import "./chunk-TODVDGMO.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-event-slices.js

@@ -1,9 +1,9 @@
 import {
   listSessionEventSlices,
   readSessionMessageSliceInScope
-} from "./chunk-VQX54TK3.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-B5C5SBSI.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/session-mcp-credential-rotation.js

@@ -1,23 +1,23 @@
 import {
   connectionMetadataMatchesBinding
-} from "./chunk-PNWWNEDM.js";
+} from "./chunk-OV5AUIBA.js";
 import {
   lockSessionEventWriteRows,
   organizationApiKeyAllowsWorkspace
-} from "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-JWBEE4CL.js";
+import "./chunk-TODVDGMO.js";
 import "./chunk-4UJCXBR2.js";
 import {
   rawRows,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-LRSIODCQ.js";
+} from "./chunk-IT3EYY2C.js";
 import {
   apiKeys,
   sessionCommandReceipts,
   sessionMcpServers,
   sessions
-} from "./chunk-DSNEIW5E.js";
+} from "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/session-realtime-billing.d.ts

@@ -0,0 +1,48 @@
+import type { SessionRealtimeModel } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+/** One provider connection of a live-voice mode, bounded by server observation. */
+export type SessionRealtimeBillableConnection = {
+    id: string;
+    startedAt: Date;
+    observedUntil: Date;
+};
+export type SessionRealtimeBillingFacts = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    realtimeId: string;
+    model: SessionRealtimeModel;
+    ownerSubjectId: string;
+    state: "active" | "ended";
+    connections: SessionRealtimeBillableConnection[];
+};
+/**
+ * The last instant the server itself observed the voice owner alive. An
+ * explicit owner-proven end is observed at `endedAt`; an expired lease only up
+ * to its last heartbeat (late lazy settlement never extends the bill); an
+ * active mode up to `now`, bounded by its lease.
+ */
+export declare function sessionRealtimeObservedUntil(mode: {
+    state: string;
+    endReason: string | null;
+    endedAt: Date | null;
+    lastHeartbeatAt: Date;
+    leaseExpiresAt: Date;
+}, now: Date): Date;
+/**
+ * Server-observed lifetime of every provider connection that was actually
+ * issued (an SDP answer or a minted client secret was returned). Failed or
+ * never-completed negotiations issued nothing billable.
+ */
+export declare function loadSessionRealtimeBillingFacts(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    realtimeId: string;
+    now?: Date;
+}): Promise<SessionRealtimeBillingFacts | null>;
+/** Which of these usage idempotency keys are already recorded for the account. */
+export declare function existingUsageEventIdempotencyKeys(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    keys: readonly string[];
+}): Promise<Set<string>>;

package/dist/session-realtime.d.ts

@@ -34,11 +34,17 @@ export type RenewSessionRealtimeInput = {
     expectedVersion: number;
     now?: Date;
     leaseMs?: number;
+    /**
+     * False keeps the current lease unchanged (owner still proven). Used when a
+     * deployment-funded call ran out of credits: the client drains and ends
+     * inside the remaining lease, and an ignoring client lapses on its own.
+     */
+    extendLease?: boolean;
 };
-export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs"> & {
+export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs" | "extendLease"> & {
     reason: Extract<SessionRealtimeEndReason, "user_stop" | "browser_unload">;
 };
-export type AssertSessionRealtimeOwnerInput = Omit<RenewSessionRealtimeInput, "leaseMs">;
+export type AssertSessionRealtimeOwnerInput = Omit<RenewSessionRealtimeInput, "leaseMs" | "extendLease">;
 export type SessionRealtimeMutationResult = {
     mode: SessionRealtimeMode;
     replay: boolean;

package/dist/session-tenancy.js

@@ -13,9 +13,9 @@ import {
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
   transitionSessionVisibility
-} from "./chunk-OI6YZXTU.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-DKFEUGM4.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/video-generation.js

@@ -29,10 +29,10 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-BID3CNN3.js";
+} from "./chunk-TODVDGMO.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/voice-transcription-settlement.d.ts

@@ -0,0 +1,36 @@
+import { CreditDebitAttribution } from "./credit-debit-attribution.js";
+import type { Database } from "./database.js";
+/** Usage source and credit debit type of deployment-funded voice transcription. */
+export declare const VOICE_TRANSCRIPTION_SOURCE_TYPE = "voice_transcription";
+export declare const VOICE_TRANSCRIPTION_DEBIT_TYPE = "voice_transcription_debit";
+/**
+ * Idempotency keys for one settled voice-transcription unit. Both derive from
+ * the workspace and the server-built unit id only, so an inline settlement, its
+ * in-process retry, and a later reconciliation converge on the same rows.
+ */
+export declare function voiceTranscriptionSettlementKeys(input: {
+    workspaceId: string;
+    sourceId: string;
+}): {
+    usageIdempotencyKey: string;
+    debitIdempotencyKey: string;
+};
+export type UnsettledVoiceTranscriptionCharge = {
+    sourceId: string;
+    amountMicros: number;
+    attribution: CreditDebitAttribution;
+};
+/**
+ * Voice usage receipts in one workspace whose credit debit never committed
+ * (the debit transaction failed after the receipt was durable). Bounded and
+ * ordered oldest first; `minAgeMilliseconds` leaves an in-flight inline
+ * settlement to finish with its full ledger metadata first. The scan walks the
+ * workspace's `model.cost` index range, so the window is short (3 days) and
+ * the statement is capped at 2 s; a timeout only defers reconciliation.
+ */
+export declare function listUnsettledVoiceTranscriptionCharges(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    limit?: number;
+    minAgeMilliseconds?: number;
+}): Promise<UnsettledVoiceTranscriptionCharge[]>;

package/dist/workspace-tool-defaults.js

@@ -1,12 +1,12 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-OEFNTGR3.js";
-import "./chunk-BID3CNN3.js";
+} from "./chunk-JWBEE4CL.js";
+import "./chunk-TODVDGMO.js";
 import "./chunk-4UJCXBR2.js";
 import {
   withWorkspaceRls
-} from "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";