@opengeni/api-router 3.2.2 → 3.4.0

package/dist/access-grant-rls.d.ts

@@ -7,4 +7,19 @@ import { type CreditDebitAttribution } from "@opengeni/db";
  * resolved through the validated middleware context installed below.
  */
 export declare function creditDebitAttributionForGrant(grant: AccessGrant): CreditDebitAttribution;
+/**
+ * Start `work` alongside an authorization `gate` instead of after it, so a
+ * request pays one database wait for both. The gate still decides: when it
+ * refuses, its error is the answer and `work`'s result or failure is dropped
+ * unread. Only use this for reads whose result is disclosed after the gate.
+ */
+export declare function alongsideAuthorization<G, W>(gate: Promise<G>, work: () => Promise<W>): Promise<[G, W]>;
 export declare function withAccessGrantSessionRlsContext<T>(deps: Pick<ApiRouteDeps, "db">, grant: AccessGrant, fn: () => Promise<T>): Promise<T>;
+/**
+ * Prove that an agent-attempt grant is the exact live attempt of its bound
+ * session, with the same refusal as {@link withAccessGrantSessionRlsContext},
+ * without installing that request's RLS actor context. For requests that read
+ * and disclose nothing scoped (MCP protocol handshakes), so they need the
+ * liveness fence but none of the actor's data scope.
+ */
+export declare function requireLiveAgentAttemptGrant(deps: Pick<ApiRouteDeps, "db">, grant: AccessGrant): Promise<void>;

package/dist/app.js

@@ -28,7 +28,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-PQBHZ2YH.js";
+} from "./chunk-6DZ4H5JQ.js";
 import "./chunk-OGQDXVXY.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,

package/dist/billing-stripe-customer.d.ts

@@ -0,0 +1,18 @@
+import type Stripe from "stripe";
+export interface StripeCustomerTransaction {
+    read(): Promise<string | null>;
+    account(): Promise<{
+        name: string;
+    } | null>;
+    save(customer: Stripe.Customer): Promise<void>;
+}
+/** The adapter must hold the account advisory lock for this whole callback,
+ * including provider I/O and persistence. The stable provider key also recovers
+ * creation when Stripe succeeds but the database transaction rolls back. */
+export declare function serializedStripeCustomer(input: {
+    stripe: Stripe;
+    accountId: string;
+    provider: string;
+    email?: string;
+    locked: (run: (tx: StripeCustomerTransaction) => Promise<string>) => Promise<string>;
+}): Promise<string>;

package/dist/billing-subscription-store.d.ts

@@ -0,0 +1,34 @@
+import type { BillingPlanBalance, SubscriptionPlan } from "@opengeni/contracts";
+import { type Database, type OrganizationPlanStateInput, type PlanCreditPeriodInput, type BillingSubscriptionOperation, type BillingSubscriptionOperationKind } from "@opengeni/db";
+export type StoredSubscriptionPlan = {
+    plan_key: string;
+    stripe_subscription_id: string | null;
+};
+export interface SubscriptionAccountStore {
+    operation(key: string): Promise<BillingSubscriptionOperation | null>;
+    beginOperation(input: {
+        operationKey: string;
+        kind: BillingSubscriptionOperationKind;
+        request: Record<string, unknown>;
+        intent: Record<string, unknown>;
+    }): Promise<BillingSubscriptionOperation>;
+    completeOperation(key: string, result: Record<string, unknown>): Promise<void>;
+    exists(): Promise<boolean>;
+    state(): Promise<StoredSubscriptionPlan | null>;
+    customer(provider: string): Promise<string | null>;
+    balance(): Promise<BillingPlanBalance | null>;
+    save(input: Omit<OrganizationPlanStateInput, "accountId">): Promise<void>;
+    replace(input: Omit<PlanCreditPeriodInput, "accountId">): Promise<void>;
+    expire(subscriptionId: string): Promise<void>;
+}
+export interface SubscriptionStore {
+    catalog(): Promise<{
+        revision: number;
+        plans: SubscriptionPlan[];
+    }>;
+    locked<T>(accountId: string, run: (store: SubscriptionAccountStore) => Promise<T>): Promise<T>;
+}
+/** Reuse the SQL seams in one outer transaction, membership/org fence before
+ * the credit-account lock. Stripe reads also run under this fence: concurrent
+ * deliveries cannot commit an older provider snapshot after a newer one. */
+export declare function subscriptionStore(db: Database): SubscriptionStore;

package/dist/billing-subscriptions.d.ts

@@ -0,0 +1,64 @@
+import type { BillingSubscriptionCatalog, BillingSubscriptionChange, SubscriptionPlan } from "@opengeni/contracts";
+import Stripe from "stripe";
+import type { SubscriptionStore } from "./billing-subscription-store.js";
+/** Enterprise is assigned only by operators, never inferred from an embedder. */
+export declare function selfServicePlan(plan: SubscriptionPlan): boolean;
+export declare function subscriptionItem(subscription: Stripe.Subscription): Stripe.SubscriptionItem;
+export declare function subscriptionCheckoutParams(input: {
+    accountId: string;
+    customerId: string;
+    priceId: string;
+    successUrl: string;
+    cancelUrl: string;
+}): Stripe.Checkout.SessionCreateParams;
+export declare function subscriptionWebhookEvent(event: Stripe.Event): boolean;
+export declare class StripeSubscriptions {
+    private readonly stripe;
+    private readonly store;
+    private readonly enabled;
+    private readonly provider;
+    constructor(stripe: Stripe, store: SubscriptionStore, enabled: boolean, provider: "stripe:live" | "stripe:test");
+    private requireEnabled;
+    catalog(accountId: string): Promise<BillingSubscriptionCatalog>;
+    private paidPlan;
+    private subscriptions;
+    checkout(input: {
+        accountId: string;
+        customerId: string;
+        planKey: string;
+        idempotencyKey: string;
+        successUrl: string;
+        cancelUrl: string;
+    }): Promise<{
+        checkoutSessionId: string;
+        url: string;
+    }>;
+    private current;
+    /** Two independent commits are essential: provider success cannot roll back
+     * the immutable target when local reconciliation fails. Replays resolve the
+     * receipt before looking at the organization's current subscription/catalog. */
+    private mutate;
+    private providerMutation;
+    private intent;
+    private target;
+    private unchanged;
+    /** Stripe fails the entire update for an incomplete immediate payment. Only
+     * its paid invoice may replace the old allowance, never the update itself. */
+    upgrade(input: {
+        accountId: string;
+        planKey: string;
+        idempotencyKey: string;
+    }): Promise<BillingSubscriptionChange>;
+    change(input: {
+        accountId: string;
+        planKey: string;
+        idempotencyKey: string;
+    }): Promise<BillingSubscriptionChange>;
+    cancel(input: {
+        accountId: string;
+        idempotencyKey: string;
+    }): Promise<BillingSubscriptionChange>;
+    handleEvent(event: Stripe.Event): Promise<boolean>;
+    private synchronize;
+    private rejectDuplicate;
+}