@opengeni/db 3.7.4 → 4.0.0-canary.0

package/dist/insights.d.ts

@@ -21,6 +21,8 @@ export type ModelCallFactAggregateRow = {
     pricedCostMicros: number;
     estimatedProviderCostMicros: number;
     estimatedProviderCostKnownCalls: number;
+    equivalentCreditCostMicros: number;
+    equivalentCreditCostKnownCalls: number;
 };
 export type InsightsDayBucket = {
     day: string;
@@ -48,6 +50,8 @@ export type RootSessionDriverRow = {
     pricedCostMicros: number;
     estimatedProviderCostMicros: number;
     estimatedProviderCostKnownCalls: number;
+    equivalentCreditCostMicros: number;
+    equivalentCreditCostKnownCalls: number;
     totalTokens: number;
     cachedTokens: number;
     cacheInputTokens: number;
@@ -57,6 +61,8 @@ export type ScheduleFactAggregate = {
     pricedCostMicros: number;
     estimatedProviderCostMicros: number;
     estimatedProviderCostKnownCalls: number;
+    equivalentCreditCostMicros: number;
+    equivalentCreditCostKnownCalls: number;
     totalTokens: number;
     cachedTokens: number;
     cacheInputTokens: number;
@@ -116,6 +122,7 @@ export type RecentModelCallRow = {
     totalTokens: number | null;
     pricedCostMicros: number;
     estimatedProviderCostMicros: number | null;
+    equivalentCreditCostMicros: number | null;
     pricingSource: string | null;
 };
 export declare function sumUsageQuantityInRange(db: Database, input: {
@@ -153,6 +160,8 @@ export type ModelCallFactSeriesAggregate = {
     costMicros: number;
     estimatedProviderCostMicros: number;
     estimatedProviderCostKnownCalls: number;
+    equivalentCreditCostMicros: number;
+    equivalentCreditCostKnownCalls: number;
     inputTokens: number;
     outputTokens: number;
     cachedTokens: number;

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-DZCYW2WT.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-MX6V5F65.js";
+import "./chunk-UFAMOUWL.js";
+import "./chunk-QM6YOWHZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ManagedAuthActorMutationInFlightError,

package/dist/managed-user-setup.d.ts

@@ -42,6 +42,8 @@ export type OrganizationUserSetupDeliveryClaim = {
         role: "viewer" | "member" | "admin";
     }>;
     expiresAt: string;
+    setupTokenTransport: "fragment" | "query" | null;
+    payloadDigest: string | null;
 };
 export declare function claimOrganizationUserSetupDelivery(db: Database, input: {
     organizationId: string;
@@ -58,6 +60,7 @@ export declare function prepareOrganizationUserSetupDelivery(db: Database, input
     claimHolderId: string;
     tokenDigest: string;
     payloadDigest: string;
+    setupTokenTransport: "fragment" | "query";
     providerIdempotencyScope: string;
     providerIdempotencyRetentionSeconds: number;
 }): Promise<void>;

package/dist/mcp-oauth.d.ts

@@ -0,0 +1,80 @@
+import { type AccessGrant } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+export declare class McpOAuthClientRegistrationRateLimitError extends Error {
+    readonly name = "McpOAuthClientRegistrationRateLimitError";
+    readonly code = "mcp_oauth_client_registration_rate_limited";
+}
+export type McpOAuthClient = {
+    clientId: string;
+    redirectUris: string[];
+    clientName: string | null;
+    grantTypes: Array<"authorization_code" | "refresh_token">;
+    responseTypes: ["code"];
+    createdAt: Date;
+};
+export type McpOAuthGrantSnapshot = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    resource: string;
+    permissions: AccessGrant["permissions"];
+    toolIdentities: Array<{
+        serverId: string;
+        toolName: string;
+    }>;
+};
+export type McpOAuthAuthorizationRequest = McpOAuthGrantSnapshot & {
+    requestHash: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    state: string | null;
+    expiresAt: Date;
+};
+export type McpOAuthAccess = McpOAuthGrantSnapshot & {
+    tokenHash: string;
+    clientId: string;
+    refreshFamilyId: string;
+    refreshGeneration: number;
+    expiresAt: Date;
+};
+export declare function registerMcpOAuthClient(db: Database, input: {
+    clientId: string;
+    redirectUris: string[];
+    clientName: string | null;
+    grantTypes: Array<"authorization_code" | "refresh_token">;
+    responseTypes: ["code"];
+    registrationScopeHash: string;
+}): Promise<McpOAuthClient>;
+export declare function getMcpOAuthClient(db: Database, clientId: string): Promise<McpOAuthClient | null>;
+export declare function createMcpOAuthAuthorizationRequest(db: Database, input: McpOAuthAuthorizationRequest): Promise<void>;
+export declare function getMcpOAuthAuthorizationRequest(db: Database, requestHash: string): Promise<McpOAuthAuthorizationRequest | null>;
+export declare function deleteMcpOAuthAuthorizationRequest(db: Database, requestHash: string): Promise<void>;
+export declare function consumeMcpOAuthAuthorizationRequest(db: Database, input: {
+    requestHash: string;
+    subjectId: string;
+    codeHash: string;
+    codeExpiresAt: Date;
+}): Promise<McpOAuthAuthorizationRequest | null>;
+export declare function exchangeMcpOAuthAuthorizationCode(db: Database, input: {
+    codeHash: string;
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    codeChallenge: string;
+    accessTokenHash: string;
+    refreshTokenHash: string | null;
+    accessExpiresAt: Date;
+    refreshExpiresAt: Date;
+}): Promise<McpOAuthAccess | null>;
+export declare function rotateMcpOAuthRefreshToken(db: Database, input: {
+    refreshTokenHash: string;
+    clientId: string;
+    resource: string;
+    accessTokenHash: string;
+    nextRefreshTokenHash: string;
+    accessExpiresAt: Date;
+    refreshExpiresAt: Date;
+}): Promise<McpOAuthAccess | null>;
+export declare function resolveMcpOAuthAccessToken(db: Database, tokenHash: string): Promise<McpOAuthAccess | null>;
+export declare function resolveLiveMcpOAuthGrant(db: Database, access: McpOAuthAccess): Promise<AccessGrant | null>;

package/dist/migrate.d.ts

@@ -34,6 +34,7 @@ export type MigrationRuntimeOptions = {
  * scripts possible.
  */
 export declare function parseConcurrentIndexMigration(file: string, sqlText: string): ConcurrentIndexMigration | null;
+export declare function migrationApplicationRoles(schema: string | undefined, options: MigrationRuntimeOptions | undefined): string[];
 /**
  * Apply the OpenGeni SQL migration chain.
  *

package/dist/migrate.js

@@ -1,11 +1,13 @@
 import {
   migrate,
+  migrationApplicationRoles,
   parseConcurrentIndexMigration,
   runMigrations
-} from "./chunk-6DPJA36C.js";
+} from "./chunk-2XEZK4LF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   migrate,
+  migrationApplicationRoles,
   parseConcurrentIndexMigration,
   runMigrations
 };

package/dist/model-catalog.d.ts

@@ -0,0 +1,153 @@
+import { type Database } from "./database.js";
+export type DeploymentModelCatalogRow = {
+    document: unknown;
+    version: number;
+    updatedAt: Date;
+};
+export type WorkspaceCustomModelProviderKind = "vercel_gateway" | "openrouter";
+export type WorkspaceProviderCustomModel = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    providerKind: WorkspaceCustomModelProviderKind;
+    upstreamModelId: string;
+    label: string | null;
+    version: number;
+    createdBySubjectId: string;
+    retiredAt?: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type WorkspaceGatewayCustomModel = WorkspaceProviderCustomModel & {
+    providerKind: "vercel_gateway";
+};
+export type WorkspaceOpenRouterCustomModel = WorkspaceProviderCustomModel & {
+    providerKind: "openrouter";
+};
+export declare const MAX_WORKSPACE_GATEWAY_CUSTOM_MODELS = 100;
+export declare const MAX_WORKSPACE_GATEWAY_CUSTOM_MODEL_RECORDS = 1000;
+export declare const MAX_WORKSPACE_OPENROUTER_CUSTOM_MODELS = 100;
+export declare const MAX_WORKSPACE_OPENROUTER_CUSTOM_MODEL_RECORDS = 1000;
+export declare class WorkspaceGatewayCustomModelLimitError extends Error {
+    constructor();
+}
+export declare class WorkspaceGatewayCustomModelHistoryLimitError extends Error {
+    constructor();
+}
+export declare class WorkspaceOpenRouterCustomModelLimitError extends Error {
+    constructor();
+}
+export declare class WorkspaceOpenRouterCustomModelHistoryLimitError extends Error {
+    constructor();
+}
+/** Serialize one provider's custom-model mutations while allowing concurrent acceptance reads. */
+export declare function withWorkspaceProviderCustomModelReadLock<T>(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    providerKind: WorkspaceCustomModelProviderKind;
+}, fn: (db: Database) => Promise<T>): Promise<T>;
+/** Compatibility wrapper for existing Vercel AI Gateway admission callers. */
+export declare function withWorkspaceGatewayCustomModelReadLock<T>(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+}, fn: (db: Database) => Promise<T>): Promise<T>;
+export declare function withWorkspaceOpenRouterCustomModelReadLock<T>(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+}, fn: (db: Database) => Promise<T>): Promise<T>;
+/** Runtime read of the deployment-global singleton. Returns null when absent. */
+export declare function getDeploymentModelCatalog(db: Database): Promise<DeploymentModelCatalogRow | null>;
+export declare function listWorkspaceGatewayCustomModels(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+}): Promise<WorkspaceGatewayCustomModel[]>;
+export declare function listWorkspaceOpenRouterCustomModels(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+}): Promise<WorkspaceOpenRouterCustomModel[]>;
+/**
+ * Lock and re-read one active Gateway custom model at a fresh-selection commit
+ * boundary. The shared lock remains held until an existing outer transaction commits.
+ */
+export declare function lockActiveWorkspaceGatewayCustomModelForAdmission(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    upstreamModelId: string;
+}): Promise<WorkspaceGatewayCustomModel | null>;
+export declare function lockActiveWorkspaceOpenRouterCustomModelForAdmission(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    upstreamModelId: string;
+}): Promise<WorkspaceOpenRouterCustomModel | null>;
+export declare function replayWorkspaceGatewayCustomModelCreate(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    requestHash: string;
+}): Promise<{
+    outcome: "missing";
+} | {
+    outcome: "conflict";
+} | {
+    outcome: "success";
+    model: WorkspaceGatewayCustomModel;
+}>;
+export declare function replayWorkspaceOpenRouterCustomModelCreate(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    requestHash: string;
+}): Promise<{
+    outcome: "missing";
+} | {
+    outcome: "conflict";
+} | {
+    outcome: "success";
+    model: WorkspaceOpenRouterCustomModel;
+}>;
+type CreateWorkspaceProviderCustomModelInput = {
+    accountId: string;
+    workspaceId: string;
+    upstreamModelId: string;
+    label?: string | null;
+    operationId: string;
+    requestHash: string;
+    createdBySubjectId: string;
+};
+export declare function createWorkspaceGatewayCustomModel(db: Database, input: CreateWorkspaceProviderCustomModelInput): Promise<WorkspaceGatewayCustomModel | null>;
+export declare function createWorkspaceOpenRouterCustomModel(db: Database, input: CreateWorkspaceProviderCustomModelInput): Promise<WorkspaceOpenRouterCustomModel | null>;
+type DeleteWorkspaceProviderCustomModelInput = {
+    accountId: string;
+    workspaceId: string;
+    customModelId: string;
+    expectedVersion: number;
+    operationId: string;
+    requestHash: string;
+};
+export declare function deleteWorkspaceGatewayCustomModel(db: Database, input: DeleteWorkspaceProviderCustomModelInput): Promise<{
+    outcome: "success";
+    model: WorkspaceGatewayCustomModel;
+} | {
+    outcome: "conflict";
+} | {
+    outcome: "not_found";
+}>;
+export declare function deleteWorkspaceOpenRouterCustomModel(db: Database, input: DeleteWorkspaceProviderCustomModelInput): Promise<{
+    outcome: "success";
+    model: WorkspaceOpenRouterCustomModel;
+} | {
+    outcome: "conflict";
+} | {
+    outcome: "not_found";
+}>;
+export declare function getWorkspaceGatewayCustomModelForExecution(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    upstreamModelId: string;
+}): Promise<WorkspaceGatewayCustomModel | null>;
+export declare function getWorkspaceOpenRouterCustomModelForExecution(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    upstreamModelId: string;
+}): Promise<WorkspaceOpenRouterCustomModel | null>;
+export {};

package/dist/model-context-snapshots.d.ts

@@ -0,0 +1,20 @@
+import { ModelContextSnapshot, SessionModelContextResponse } from "@opengeni/contracts";
+import type { Database } from "./database.js";
+export declare class ModelContextSnapshotAuthorityError extends Error {
+    readonly code = "model_context_snapshot_authority_mismatch";
+    constructor();
+}
+export declare function persistModelContextSnapshot(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    snapshot: ModelContextSnapshot;
+}): Promise<void>;
+export declare function getLatestSessionModelContext(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+}): Promise<SessionModelContextResponse>;

package/dist/new-session-drafts.d.ts

@@ -69,6 +69,18 @@ export declare function rememberNewSessionSelectionInTransaction(db: Database, i
     subjectId: string;
     acceptedSelection: AcceptedNewSessionSelection;
 }): Promise<boolean>;
+/**
+ * Fence a fresh session shell on the exact actor-private draft it represents.
+ * The caller keeps this row lock through its create transaction, so a draft
+ * that was already stale cannot leave a committed, uninitialized session.
+ * The later atomic initializer still performs the authoritative consume.
+ */
+export declare function assertExactNewSessionDraftInTransaction(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    expectedRevision: number;
+    expectedSnapshot: NewSessionDraftSnapshot;
+}): Promise<void>;
 /**
  * Replace one exact accepted draft with the next-create safe seed. The row is
  * identity-serialized before the revision check so even the absent-row

package/dist/organization-membership-lifecycle.d.ts

@@ -1,4 +1,4 @@
-import { type CreateOrganizationResponse as CreateOrganizationResponseType, type OrganizationAdministrationMember as OrganizationAdministrationMemberType, type OrganizationAdministrationOverview as OrganizationAdministrationOverviewType, type OrganizationInvitation as OrganizationInvitationType, type OrganizationMember as OrganizationMemberType, type OrganizationPrivateSessionSettings as OrganizationPrivateSessionSettingsType, type OrganizationMembershipRole, type OrganizationRetentionDeletionClaim as OrganizationRetentionDeletionClaimType, type OrganizationRetentionDatabaseFinalization as OrganizationRetentionDatabaseFinalizationType, type OrganizationRetentionDeletionObject as OrganizationRetentionDeletionObjectType, type OrganizationRetentionDeletionPreview as OrganizationRetentionDeletionPreviewType, type OrganizationRetentionDeletionResult as OrganizationRetentionDeletionResultType, type OrganizationRetentionPolicy as OrganizationRetentionPolicyType, type OrganizationSummary as OrganizationSummaryType, type OrganizationWorkspaceAccess as OrganizationWorkspaceAccessType, type PutOrganizationWorkspaceMemberRequest, type RevokeOrganizationWorkspaceMemberResponse as RevokeOrganizationWorkspaceMemberResponseType, type UpdateOrganizationMemberRequest } from "@opengeni/contracts";
+import { type CreateAdditionalOrganizationResponse as CreateAdditionalOrganizationResponseType, type CreateOrganizationResponse as CreateOrganizationResponseType, type OrganizationAdministrationMember as OrganizationAdministrationMemberType, type OrganizationAdministrationOverview as OrganizationAdministrationOverviewType, type OrganizationInvitation as OrganizationInvitationType, type OrganizationMember as OrganizationMemberType, type OrganizationPrivateSessionSettings as OrganizationPrivateSessionSettingsType, type OrganizationMembershipRole, type OrganizationRetentionDeletionClaim as OrganizationRetentionDeletionClaimType, type OrganizationRetentionDatabaseFinalization as OrganizationRetentionDatabaseFinalizationType, type OrganizationRetentionDeletionObject as OrganizationRetentionDeletionObjectType, type OrganizationRetentionDeletionPreview as OrganizationRetentionDeletionPreviewType, type OrganizationRetentionDeletionResult as OrganizationRetentionDeletionResultType, type OrganizationRetentionPolicy as OrganizationRetentionPolicyType, type OrganizationSummary as OrganizationSummaryType, type OrganizationWorkspaceAccess as OrganizationWorkspaceAccessType, type PutOrganizationWorkspaceMemberRequest, type RevokeOrganizationWorkspaceMemberResponse as RevokeOrganizationWorkspaceMemberResponseType, type UpdateOrganizationMemberRequest } from "@opengeni/contracts";
 import type { Database } from "./database.js";
 export declare function createManagedOrganization(db: Database, input: {
     subjectId: string;
@@ -6,6 +6,13 @@ export declare function createManagedOrganization(db: Database, input: {
     name: string;
     operationId: string;
 }): Promise<CreateOrganizationResponseType>;
+export declare function createAdditionalManagedOrganization(db: Database, input: {
+    subjectId: string;
+    subjectLabel: string;
+    name: string;
+    workspaceName: string;
+    operationId: string;
+}): Promise<CreateAdditionalOrganizationResponseType>;
 type CommandBase = {
     organizationId: string;
     actorSubjectId: string;

package/dist/organization-model-providers.d.ts

@@ -0,0 +1,101 @@
+import { type Settings } from "@opengeni/config";
+import { type Database } from "./database.js";
+export type OrganizationModelProviderKind = "vercel_gateway" | "openrouter";
+export type OrganizationModelProviderConnection = {
+    providerKind: OrganizationModelProviderKind;
+    status: "active" | "revoked";
+    version: number;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type OrganizationModelProviderCustomModel = {
+    id: string;
+    accountId: string;
+    providerKind: OrganizationModelProviderKind;
+    upstreamModelId: string;
+    label: string | null;
+    version: number;
+    retiredAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export declare class OrganizationModelProviderConflictError extends Error {
+}
+export declare class OrganizationModelProviderLimitError extends Error {
+}
+export declare function organizationModelProviderCredentialDigest(credential: string): string;
+export declare function getOrganizationModelProviderConnection(db: Database, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    providerKind: OrganizationModelProviderKind;
+}): Promise<OrganizationModelProviderConnection | null>;
+export declare function upsertOrganizationModelProviderConnection(db: Database, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    providerKind: OrganizationModelProviderKind;
+    credentialEncrypted: string;
+    credentialDigest: string;
+    operationId: string;
+    expectedVersion?: number;
+}): Promise<OrganizationModelProviderConnection>;
+export declare function revokeOrganizationModelProviderConnection(db: Database, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    providerKind: OrganizationModelProviderKind;
+    operationId: string;
+    expectedVersion: number;
+}): Promise<OrganizationModelProviderConnection>;
+export declare function organizationModelProviderConnectionActiveForWorkspace(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    providerKind: OrganizationModelProviderKind;
+}): Promise<boolean>;
+export declare function loadOrganizationModelProviderApiKey(db: Database, settings: Settings, input: {
+    accountId: string;
+    workspaceId: string;
+    providerKind: OrganizationModelProviderKind;
+}): Promise<string | null>;
+export declare function listOrganizationModelProviderCustomModelsForWorkspace(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    providerKind: OrganizationModelProviderKind;
+    includeRetired?: boolean;
+}): Promise<OrganizationModelProviderCustomModel[]>;
+export declare function getOrganizationModelProviderCustomModelForExecution(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    providerKind: OrganizationModelProviderKind;
+    upstreamModelId: string;
+}): Promise<OrganizationModelProviderCustomModel | null>;
+export declare function withOrganizationModelProviderCustomModelReadLock<T>(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    providerKind: OrganizationModelProviderKind;
+}, use: (scopedDb: Database) => Promise<T>): Promise<T>;
+export declare function lockActiveOrganizationModelProviderCustomModelForAdmission(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    providerKind: OrganizationModelProviderKind;
+    upstreamModelId: string;
+}): Promise<OrganizationModelProviderCustomModel | null>;
+export declare function listOrganizationModelProviderCustomModels(db: Database, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    providerKind: OrganizationModelProviderKind;
+}): Promise<OrganizationModelProviderCustomModel[]>;
+export declare function createOrganizationModelProviderCustomModel(db: Database, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    providerKind: OrganizationModelProviderKind;
+    upstreamModelId: string;
+    label?: string;
+    operationId: string;
+}): Promise<OrganizationModelProviderCustomModel>;
+export declare function retireOrganizationModelProviderCustomModel(db: Database, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    providerKind: OrganizationModelProviderKind;
+    customModelId: string;
+    expectedVersion: number;
+    operationId: string;
+}): Promise<OrganizationModelProviderCustomModel>;

package/dist/pack-components.d.ts

@@ -5,6 +5,7 @@ export type PackInlineSkillRequirement = {
     key: string;
     capabilityId: string;
     name: string;
+    activationMode: "workspace_managed" | "session_selected";
     contentSha256: string;
 };
 export type StoredPackInstallationComponent = {

package/dist/pr-review.d.ts

@@ -68,6 +68,8 @@ export declare function createPrReviewRepositoryBinding(db: Database, input: {
     eventTypes: string[];
     configuration: Record<string, unknown>;
     sessionTemplate: AutomationSessionTemplate;
+    /** Trusted database-only admission seam. Throwing rolls the binding and trigger back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
 }): Promise<PrReviewRepositoryBinding>;
 /** Atomically converge one owner-authorized installation of the deployment
  * review App onto the Pack's ordinary source/trigger/binding model. Re-running
@@ -116,6 +118,13 @@ export declare function updatePrReviewRepositoryBinding(db: Database, input: {
     model?: string | null;
     additionalInstructions?: string | null;
     status?: "active" | "disabled";
+    /** Trusted database-only admission seam. Throwing rolls the binding revision back. */
+    beforeUpdateCommit?: (tx: Database, context: {
+        currentModel: string | null;
+        currentStatus: "active" | "disabled";
+        nextModel: string | null;
+        nextStatus: "active" | "disabled";
+    }) => Promise<void>;
 }): Promise<PrReviewRepositoryBinding | null>;
 export declare function deletePrReviewRepositoryBinding(db: Database, input: {
     accountId: string;

package/dist/provision-roles.js

@@ -1,6 +1,6 @@
 import {
   provisionRoles
-} from "./chunk-4NAR7FBA.js";
+} from "./chunk-3RI33YQN.js";
 import "./chunk-PZ5AY32C.js";
 export {
   provisionRoles