@opengeni/db 3.7.3-canary.0 → 3.7.4-canary.0

package/dist/{chunk-S3TDDCS2.js → chunk-JP6IYGYI.js}

@@ -1,11 +1,11 @@
 import {
   withRlsContext
-} from "./chunk-F6PBS6WE.js";
+} from "./chunk-ZTSJPFDH.js";
 import {
   sandboxRetainedProcesses,
   sessionBackgroundCommands,
   sessions
-} from "./chunk-O56DM5GZ.js";
+} from "./chunk-DXJ2WY6W.js";
 
 // src/session-background-commands.ts
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
@@ -513,4 +513,4 @@ export {
   settleSessionBackgroundCommandForRetainedProcess,
   settleConnectedMachineSessionBackgroundCommand
 };
-//# sourceMappingURL=chunk-S3TDDCS2.js.map
+//# sourceMappingURL=chunk-JP6IYGYI.js.map

package/dist/{chunk-SZAWDXQC.js → chunk-JS3AWDKZ.js}

@@ -2,7 +2,7 @@ import {
   rawRows,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-F6PBS6WE.js";
+} from "./chunk-ZTSJPFDH.js";
 import {
   connections,
   creditLedgerEntries,
@@ -14,7 +14,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-O56DM5GZ.js";
+} from "./chunk-DXJ2WY6W.js";
 
 // src/video-generation.ts
 import {
@@ -992,4 +992,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-SZAWDXQC.js.map
+//# sourceMappingURL=chunk-JS3AWDKZ.js.map

package/dist/{chunk-DZCYW2WT.js → chunk-LHKB62GC.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-F6PBS6WE.js";
+} from "./chunk-ZTSJPFDH.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-DZCYW2WT.js.map
+//# sourceMappingURL=chunk-LHKB62GC.js.map

package/dist/{chunk-US4IS6IV.js → chunk-QL4AHBYD.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-F6PBS6WE.js";
+} from "./chunk-ZTSJPFDH.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3540,4 +3540,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-US4IS6IV.js.map
+//# sourceMappingURL=chunk-QL4AHBYD.js.map

package/dist/{chunk-5NNCGFQY.js → chunk-VDXHLVDE.js}

@@ -5,7 +5,7 @@ import {
   withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-F6PBS6WE.js";
+} from "./chunk-ZTSJPFDH.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -481,4 +481,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-5NNCGFQY.js.map
+//# sourceMappingURL=chunk-VDXHLVDE.js.map

package/dist/{chunk-F6PBS6WE.js → chunk-ZTSJPFDH.js}

@@ -4,7 +4,7 @@ import {
   sessions,
   workspaceSessionActivityRevisions,
   workspaces
-} from "./chunk-O56DM5GZ.js";
+} from "./chunk-DXJ2WY6W.js";
 
 // src/persistence-errors.ts
 var SQLSTATE_KEYS = ["sqlState", "sqlstate", "code"];
@@ -755,4 +755,4 @@ export {
   withAccountRls,
   dbBindingFor
 };
-//# sourceMappingURL=chunk-F6PBS6WE.js.map
+//# sourceMappingURL=chunk-ZTSJPFDH.js.map

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-ZTSJPFDH.js";
+import "./chunk-DXJ2WY6W.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/editable-artifact-durable-export.ts

package/dist/editable-artifacts.js

@@ -8,9 +8,9 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-US4IS6IV.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-QL4AHBYD.js";
+import "./chunk-ZTSJPFDH.js";
+import "./chunk-DXJ2WY6W.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,

package/dist/index.d.ts

@@ -68,6 +68,7 @@ export { memoryTextForStorage } from "./memory-domain.js";
 export { migrate, runMigrations } from "./migrate.js";
 export { provisionRoles, type ProvisionResult, type ProvisionRolesOptions, } from "./provision-roles.js";
 export * from "./memory-domain.js";
+export * from "./model-catalog.js";
 import { type Database, type SessionActivityDatabase } from "./database.js";
 export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type SessionRlsActorContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type ManagedUserProfile, type UserLookup, type UserProfileLookup, } from "./database.js";
 export { withSessionRlsActorContext } from "./database.js";
@@ -849,6 +850,8 @@ export type CreateScheduledTaskInput = {
     variableSetId?: string | null;
     rigId?: string | null;
     metadata: Record<string, unknown>;
+    /** Trusted database-only admission seam. Throwing rolls the task creation back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
 };
 export type UpdateScheduledTaskInput = Partial<{
     name: string;
@@ -870,6 +873,8 @@ export type UpdateScheduledTaskInput = Partial<{
     authorityUpdatedBy: TurnInitiator;
     authorityUpdatedByContext: TurnInitiatorContext;
     authorityUpdatedByActor: AgentSessionCreationActor | null;
+    /** Trusted database-only admission seam. Throwing rolls the task update back. */
+    beforeUpdateCommit: (tx: Database) => Promise<void>;
 }>;
 export type CreatePackInstallationInput = {
     accountId: string;
@@ -992,6 +997,43 @@ export type CreateConnectionInput = {
     createdBySubjectId?: string | null;
     updatedBySubjectId?: string | null;
 };
+type UpsertWorkspaceProviderApiKeyConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    requestDigest: string;
+    credentialEncrypted: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    updatedBySubjectId: string;
+};
+type RotateWorkspaceProviderApiKeyConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    expectedVersion: number;
+    operationId: string;
+    requestDigest: string;
+    credentialEncrypted: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    updatedBySubjectId: string;
+};
+type RevokeWorkspaceProviderApiKeyConnectionsInput = {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    expectedVersion: number;
+    updatedBySubjectId: string;
+};
+export type UpsertWorkspaceVercelAiGatewayConnectionInput = UpsertWorkspaceProviderApiKeyConnectionInput;
+export type RotateWorkspaceVercelAiGatewayConnectionInput = RotateWorkspaceProviderApiKeyConnectionInput;
+export type RevokeWorkspaceVercelAiGatewayConnectionsInput = RevokeWorkspaceProviderApiKeyConnectionsInput;
+export type UpsertWorkspaceOpenRouterConnectionInput = UpsertWorkspaceProviderApiKeyConnectionInput;
+export type RotateWorkspaceOpenRouterConnectionInput = RotateWorkspaceProviderApiKeyConnectionInput;
+export type RevokeWorkspaceOpenRouterConnectionsInput = RevokeWorkspaceProviderApiKeyConnectionsInput;
 export type UpdateConnectionInput = {
     workspaceId: string;
     connectionId: string;
@@ -1886,6 +1928,15 @@ export declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityS
 export declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
 export declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
 export declare function createConnection(db: Database, input: CreateConnectionInput): Promise<ConnectionMetadataWithVerification>;
+/** Compatibility wrapper for the existing Vercel AI Gateway create/replay contract. */
+export declare function upsertWorkspaceVercelAiGatewayConnection(db: Database, input: UpsertWorkspaceVercelAiGatewayConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+export declare function upsertWorkspaceOpenRouterConnection(db: Database, input: UpsertWorkspaceOpenRouterConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+/** Compatibility wrapper for the existing Vercel AI Gateway rotation contract. */
+export declare function rotateWorkspaceVercelAiGatewayConnection(db: Database, input: RotateWorkspaceVercelAiGatewayConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+export declare function rotateWorkspaceOpenRouterConnection(db: Database, input: RotateWorkspaceOpenRouterConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+/** Compatibility wrapper for the existing Vercel AI Gateway revoke contract. */
+export declare function revokeWorkspaceVercelAiGatewayConnections(db: Database, input: RevokeWorkspaceVercelAiGatewayConnectionsInput): Promise<ConnectionMetadataWithVerification | null>;
+export declare function revokeWorkspaceOpenRouterConnections(db: Database, input: RevokeWorkspaceOpenRouterConnectionsInput): Promise<ConnectionMetadataWithVerification | null>;
 /**
  * Serialize one provider-principal/owner connection generation. Distinct OAuth
  * starts for the same principal converge on one row, while an explicit
@@ -2517,14 +2568,21 @@ export declare function loadConnectionCredentialForBroker(db: Database, settings
     allowSubjectOwned?: boolean;
     expectedAuthorityGeneration?: number;
 }): Promise<ConnectionCredentialForBroker | null>;
-export declare function workspaceVercelAiGatewayConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
 /** Metadata-only capability revision input; never selects/decrypts the API key. */
 export declare function getWorkspaceVercelAiGatewayConnectionMetadata(db: Database, workspaceId: string): Promise<{
     connectionId: string;
     version: number;
 } | null>;
+export declare function getWorkspaceOpenRouterConnectionMetadata(db: Database, workspaceId: string): Promise<{
+    connectionId: string;
+    version: number;
+} | null>;
+export declare function workspaceVercelAiGatewayConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
+export declare function workspaceOpenRouterConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
 /** Resolve only the reviewed workspace-shared AI Gateway credential shape. */
 export declare function loadWorkspaceVercelAiGatewayApiKey(db: Database, settings: Settings, workspaceId: string): Promise<string | null>;
+/** Resolve only the reviewed workspace-shared OpenRouter credential shape. */
+export declare function loadWorkspaceOpenRouterApiKey(db: Database, settings: Settings, workspaceId: string): Promise<string | null>;
 /**
  * Worker-only immutable credential lease for an asynchronous video operation.
  * The operation copies the already-encrypted credential envelope before its
@@ -2753,6 +2811,11 @@ export declare function createScheduledTaskRun(db: Database, input: {
     scheduledAt?: Date | null;
     firedAt?: Date;
     acceptedExecutionSnapshot?: ScheduledTaskRunAcceptedExecutionType | null;
+    /**
+     * Trusted database-only admission seam for a fresh agent occurrence.
+     * Throwing rolls back the run insert; exact producer replay skips it.
+     */
+    beforeFreshAgentRunCommit?: (tx: Database) => Promise<void>;
 }): Promise<ScheduledTaskRun>;
 export declare function getScheduledTaskRunAcceptedExecution(db: Database, input: {
     workspaceId: string;
@@ -4858,7 +4921,9 @@ export type SessionCreateInput = {
     /** Trusted, transaction-local linkage run after the exact session row and
      * MCP metadata exist but before either can commit. It must perform database
      * work only; throwing rolls the complete create/replay transaction back. */
-    beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
+    beforeCreateCommit?: (tx: Database, sessionId: string, context?: {
+        created: boolean;
+    }) => Promise<void>;
 };
 export declare function createSession(db: Database, input: SessionCreateInput): Promise<DbSession>;
 /**
@@ -4883,6 +4948,42 @@ export declare function createSessionWithIdempotencyKey(db: Database, input: Ses
     createIdempotencyKey: string;
 }): Promise<SessionCreateSuccessResult>;
 export declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
+/**
+ * Recover a keyed create before mutable create dependencies (notably the
+ * current model catalog) are consulted. A fully initialized queued turn gets a
+ * fresh durable wake revision from persisted state only; an uninitialized shell
+ * returns its persisted model so the caller can reopen it strictly as retained
+ * while the canonical keyed transaction repairs initialization. The same
+ * request-identity checks as transactional create replay run before any session
+ * or committed denial is returned.
+ */
+export type InitializedSessionCreateReplay = {
+    outcome: "session";
+    session: Session & {
+        initialTurnId: string | null;
+    };
+    temporalWorkflowId: string;
+    workflowWakeRevision: number | null;
+    changed: boolean;
+} | {
+    outcome: "pending";
+    session: Session;
+} | {
+    outcome: "denied";
+    denial: SessionSpawnDenial;
+};
+export declare function getInitializedSessionCreateReplay(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    activeManagedHumanSubjectId?: string;
+    createIdempotencyKey: string;
+    requestedSessionId?: string;
+    visibility?: "user_private" | "workspace_shared";
+    variableSetIds: string[];
+    initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
+    deferInitialTurn?: boolean;
+}): Promise<InitializedSessionCreateReplay | null>;
 export declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
 export type DeleteSessionTreeIfQuiescentResult = {
     status: "deleted";
@@ -7586,6 +7687,7 @@ export type SandboxRotationBacklog = {
     turnBlocked: number;
     directBlocked: number;
     processBlocked: number;
+    interactionBlocked: number;
 };
 export declare function readSandboxRotationBacklog(db: Database): Promise<SandboxRotationBacklog>;
 export type LegacyModalCheckpointSlot = {
@@ -8944,6 +9046,7 @@ export declare function materializeGoalContinuation(db: Database, input: {
         model: string;
         reasoningEffort: ReasoningEffort;
         latencyMode: LatencyMode;
+        turnExecutionPolicy?: TurnExecutionPolicyV1;
         tools: ToolRef[];
         sandboxBackend: SandboxBackend;
     };