@opengeni/api-router 3.2.2 → 3.4.0

package/dist/site-publishing/service.d.ts

@@ -1,6 +1,6 @@
 import { type ErrorCode, type Permission, type SiteHostMapRecord, type SiteHostnameAvailability, type SitePublication, type UpsertSitePublicationRequest } from "@opengeni/contracts";
 import type { AccessGrant } from "@opengeni/contracts";
-import { type ApiRouteDeps } from "@opengeni/core";
+import { type ApiRouteDeps, type cancelPublishedSiteSession } from "@opengeni/core";
 import { SitePublishingError, type PublishedSiteRecord, type SiteDataSite, type SiteHostnameEdgeState, type SitePublicationRecord, type SitePublishingScope, type StoredSiteLimitProfile } from "@opengeni/db";
 import { ApiHttpError } from "../http/api-error.js";
 import { type SiteContentScanner } from "./content-scanner.js";
@@ -40,13 +40,12 @@ export type SitePublishingEffects = {
 };
 /** Background effects running at once per process. */
 export declare const SITE_EFFECT_CONCURRENCY = 4;
+type SiteCancellation = (input: Parameters<typeof cancelPublishedSiteSession>[1]) => Promise<unknown>;
 /**
- * The app's in-process dispatch, registered with the site-runtime routes, so
- * publication changes can cancel a Site's conversations through the ordinary
- * session routes. Without it (the operator script) cancellation is skipped.
+ * Internal host lifecycle adapter. This never grants the Site service bearer
+ * ordinary session access and never impersonates a conversation's viewer.
  */
-export declare function setSitePublishingDispatch(settings: ApiRouteDeps["settings"], dispatch: (request: Request) => Promise<Response>): void;
-export declare function sitePublishingDispatch(settings: ApiRouteDeps["settings"]): ((request: Request) => Promise<Response>) | null;
+export declare function setSitePublishingCancellation(settings: ApiRouteDeps["settings"], cancel: SiteCancellation): void;
 type SitePublishingEffectsOptions = {
     fetch?: typeof fetch;
     backoffMs?: number;
@@ -164,11 +163,9 @@ export declare function siteServiceSessionRequest(deps: Pick<SitePublishingDeps,
  * Stop a Site's viewers after a takedown, unpublish or narrower access:
  * revoke every site-session now, and after commit cancel the Site's agent
  * conversations that may still be working (in-flight turns and queued
- * messages), as the Site itself through the ordinary control route. The
- * gateway refuses new work at once regardless: every site-runtime call
- * re-checks the publication. Without an in-process dispatch (the operator
- * script) the cancellation is skipped and logged; per-conversation caps
- * still bound what running turns can spend.
+ * messages), through the native cancel-only lifecycle adapter. The original
+ * actor survives queued background execution. No transcript access is granted.
+ * Every page is drained, including old conversations; there is no age cutoff.
  */
 export declare function stopSiteViewers(deps: SitePublishingDeps, scope: SitePublishingScope, siteId: string, options: {
     revokeSessions?: boolean;

package/dist/site-publishing/session-request-authority.d.ts

@@ -0,0 +1,3 @@
+export declare function bindSiteSessionRequestAuthority(request: Request, reauthorize: () => Promise<void>): void;
+/** Periodic SSE reauthorization must check the Site cookie, not only its delegate. */
+export declare function reauthorizeSiteSessionRequest(request: Request): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "3.2.2",
+  "version": "3.4.0",
   "description": "Opengeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -45,29 +45,29 @@
     "@keeper-security/secrets-manager-core": "17.6.0",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "3.2.2",
-    "@opengeni/artifact-tool": "3.2.2",
-    "@opengeni/capabilities": "3.2.2",
-    "@opengeni/codemode": "3.2.2",
-    "@opengeni/codex": "3.2.2",
-    "@opengeni/config": "3.2.2",
-    "@opengeni/contracts": "3.2.2",
-    "@opengeni/core": "3.2.2",
-    "@opengeni/db": "3.2.2",
-    "@opengeni/documents": "3.2.2",
-    "@opengeni/events": "3.2.2",
-    "@opengeni/github": "3.2.2",
-    "@opengeni/interaction": "3.2.2",
-    "@opengeni/network": "3.2.2",
-    "@opengeni/observability": "3.2.2",
-    "@opengeni/runtime": "3.2.2",
-    "@opengeni/storage": "3.2.2",
-    "@opengeni/tool-gateway": "3.2.2",
-    "@opengeni/vaults": "3.2.2",
-    "@opengeni/vaults-keeper": "3.2.2",
-    "@opengeni/vaults-onepassword": "3.2.2",
-    "@opengeni/vaults-protonpass": "3.2.2",
-    "@opengeni/xai-subscription": "3.2.2",
+    "@opengeni/agent-proto": "3.4.0",
+    "@opengeni/artifact-tool": "3.4.0",
+    "@opengeni/capabilities": "3.4.0",
+    "@opengeni/codemode": "3.4.0",
+    "@opengeni/codex": "3.4.0",
+    "@opengeni/config": "3.4.0",
+    "@opengeni/contracts": "3.4.0",
+    "@opengeni/core": "3.4.0",
+    "@opengeni/db": "3.4.0",
+    "@opengeni/documents": "3.4.0",
+    "@opengeni/events": "3.4.0",
+    "@opengeni/github": "3.4.0",
+    "@opengeni/interaction": "3.4.0",
+    "@opengeni/network": "3.4.0",
+    "@opengeni/observability": "3.4.0",
+    "@opengeni/runtime": "3.4.0",
+    "@opengeni/storage": "3.4.0",
+    "@opengeni/tool-gateway": "3.4.0",
+    "@opengeni/vaults": "3.4.0",
+    "@opengeni/vaults-keeper": "3.4.0",
+    "@opengeni/vaults-onepassword": "3.4.0",
+    "@opengeni/vaults-protonpass": "3.4.0",
+    "@opengeni/xai-subscription": "3.4.0",
     "@temporalio/client": "^1.17.0",
     "ajv": "^8.20.0",
     "better-auth": "^1.6.14",

package/src/access-grant-rls.ts

@@ -49,6 +49,55 @@ export function creditDebitAttributionForGrant(grant: AccessGrant): CreditDebitA
       : { kind: "unknown" };
 }
 
+/**
+ * Start `work` alongside an authorization `gate` instead of after it, so a
+ * request pays one database wait for both. The gate still decides: when it
+ * refuses, its error is the answer and `work`'s result or failure is dropped
+ * unread. Only use this for reads whose result is disclosed after the gate.
+ */
+export async function alongsideAuthorization<G, W>(
+  gate: Promise<G>,
+  work: () => Promise<W>,
+): Promise<[G, W]> {
+  const pending = work();
+  // Observed here so a refused gate never leaves an unhandled rejection.
+  pending.catch(() => undefined);
+  const decided = await gate;
+  return [decided, await pending];
+}
+
+type AgentLearningActor = {
+  kind: "agent";
+  sessionId: string;
+  turnId: string;
+  attemptId: string;
+  executionGeneration: number;
+};
+
+/** The attempt a well-formed agent-attempt grant claims to be; null otherwise. */
+function claimedLearningActor(grant: AccessGrant, sessionId: string): AgentLearningActor | null {
+  const turnId = grant.metadata?.turnId;
+  const attemptId = grant.metadata?.attemptId;
+  const executionGeneration = grant.metadata?.executionGeneration;
+  if (
+    typeof turnId !== "string" ||
+    typeof attemptId !== "string" ||
+    typeof executionGeneration !== "number"
+  ) {
+    return null;
+  }
+  return { kind: "agent", sessionId, turnId, attemptId, executionGeneration };
+}
+
+function sameLearningActor(left: AgentLearningActor, right: AgentLearningActor): boolean {
+  return (
+    left.sessionId === right.sessionId &&
+    left.turnId === right.turnId &&
+    left.attemptId === right.attemptId &&
+    left.executionGeneration === right.executionGeneration
+  );
+}
+
 export async function withAccessGrantSessionRlsContext<T>(
   deps: Pick<ApiRouteDeps, "db">,
   grant: AccessGrant,
@@ -63,19 +112,33 @@ export async function withAccessGrantSessionRlsContext<T>(
   if (typeof callerSessionId !== "string") {
     throw agentAttemptAuthorityError("malformed");
   }
-  try {
-    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, callerSessionId);
-    const learning = await freezeAgentLearningPolicy(deps.db, {
+  const freezeLearning = (actor: AgentLearningActor) =>
+    freezeAgentLearningPolicy(deps.db, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
-      actor: {
-        kind: "agent",
-        sessionId: actor.callerSessionId,
-        turnId: actor.turnId,
-        attemptId: actor.attemptId,
-        executionGeneration: actor.executionGeneration,
-      },
+      actor,
     });
+  try {
+    // The learning policy is keyed by the exact attempt, which a live actor
+    // takes verbatim from the grant's claims. Read it for the claimed attempt
+    // while the liveness check runs; it is used only once that check passes
+    // and names the same attempt, and is otherwise read again for the actor.
+    const claimed = claimedLearningActor(grant, callerSessionId);
+    const [actor, speculative] = await alongsideAuthorization(
+      requireLiveAgentAttemptAuthorization(deps.db, grant, callerSessionId),
+      async () => (claimed ? await freezeLearning(claimed) : null),
+    );
+    const verified: AgentLearningActor = {
+      kind: "agent",
+      sessionId: actor.callerSessionId,
+      turnId: actor.turnId,
+      attemptId: actor.attemptId,
+      executionGeneration: actor.executionGeneration,
+    };
+    const learning =
+      claimed && speculative && sameLearningActor(claimed, verified)
+        ? speculative
+        : await freezeLearning(verified);
     return await withCreditDebitAttribution(
       {
         kind: "turn",
@@ -87,6 +150,7 @@ export async function withAccessGrantSessionRlsContext<T>(
           {
             subjectId: actor.subjectId,
             initiatingHumanSubjectId: actor.initiatingHumanSubjectId,
+            agentRootSessionId: actor.callerRootSessionId,
             privateFileOwnerSubjectId:
               learning.defaultScope === "personal" ? learning.subjectId : null,
           },
@@ -100,3 +164,28 @@ export async function withAccessGrantSessionRlsContext<T>(
     throw error;
   }
 }
+
+/**
+ * Prove that an agent-attempt grant is the exact live attempt of its bound
+ * session, with the same refusal as {@link withAccessGrantSessionRlsContext},
+ * without installing that request's RLS actor context. For requests that read
+ * and disclose nothing scoped (MCP protocol handshakes), so they need the
+ * liveness fence but none of the actor's data scope.
+ */
+export async function requireLiveAgentAttemptGrant(
+  deps: Pick<ApiRouteDeps, "db">,
+  grant: AccessGrant,
+): Promise<void> {
+  const callerSessionId = grant.metadata?.sessionId;
+  if (grant.principalKind !== "agent_attempt" || typeof callerSessionId !== "string") {
+    throw agentAttemptAuthorityError("malformed");
+  }
+  try {
+    await requireLiveAgentAttemptAuthorization(deps.db, grant, callerSessionId);
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) {
+      throw agentAttemptAuthorityError(error.reason, error);
+    }
+    throw error;
+  }
+}

package/src/app.ts

@@ -110,6 +110,7 @@ import {
   dbSql,
   getManagedAuthSessionSetSnapshot,
   getWorkspace,
+  getWorkspaceSettings,
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets,
   resolveSessionMemoryAgentScope,
@@ -224,7 +225,11 @@ import {
   assertOrganizationUserSetupQueryTransportConfigured,
 } from "./auth/organization-user-setup";
 import { createApiSandboxClient, makeResumeBoxById } from "./sandbox/access";
-import { buildOpenGeniMcpServer } from "./mcp/server";
+import {
+  buildOpenGeniMcpProtocolServer,
+  buildOpenGeniMcpServer,
+  isOpenGeniMcpProtocolOnlyMessage,
+} from "./mcp/server";
 import {
   buildWorkspaceToolGatewayMcpServer,
   approveWorkspaceToolGatewayCall,
@@ -273,7 +278,11 @@ import {
   localBrowserRequestHost,
   markLocalInternalDispatch,
 } from "./http/local-browser-boundary";
-import { withAccessGrantSessionRlsContext } from "./access-grant-rls";
+import {
+  alongsideAuthorization,
+  requireLiveAgentAttemptGrant,
+  withAccessGrantSessionRlsContext,
+} from "./access-grant-rls";
 import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
@@ -1795,6 +1804,28 @@ export function createAppComposition(deps: AppDependencies): {
       throw error;
     }
     const grant = authorization.grant;
+    // MCP handshakes (initialize, ping, notifications) read and disclose
+    // nothing scoped. A session-bound agent attempt still proves it is the
+    // live attempt, but skips the workspace, catalog, Memory and admin reads
+    // that building the tool surface costs on every tools/* POST.
+    if (
+      c.req.method === "POST" &&
+      grant.principalKind === "agent_attempt" &&
+      typeof grant.metadata?.sessionId === "string" &&
+      (await isProtocolOnlyMcpRequest(boundedRequest))
+    ) {
+      await requireLiveAgentAttemptGrant(routeDeps, grant);
+      const transport = new WebStandardStreamableHTTPServerTransport({
+        enableJsonResponse: true,
+      });
+      const mcp = buildOpenGeniMcpProtocolServer(grant);
+      try {
+        await mcp.connect(transport);
+        return await handleMcpRequestWithClientAbort(transport, boundedRequest, c.req.raw.signal);
+      } finally {
+        await mcp.close().catch(() => undefined);
+      }
+    }
     // Admin actions dispatch back into this API as a person. Capture the
     // context now, before this request takes on the agent's database and
     // billing scope, so none of it carries into those actions.
@@ -1804,7 +1835,8 @@ export function createAppComposition(deps: AppDependencies): {
     return await withSessionAuthorizationReadReuse((reads) =>
       withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
         const boundSessionId = grant.metadata?.sessionId;
-        if (typeof boundSessionId === "string") {
+        const authorizeBoundSession = async () => {
+          if (typeof boundSessionId !== "string") return;
           try {
             await requireSessionAuthorization(routeDeps, grant, {
               sessionId: boundSessionId,
@@ -1822,16 +1854,14 @@ export function createAppComposition(deps: AppDependencies): {
             }
             throw error;
           }
-        }
-        if (c.req.method === "GET") return unsupportedGet();
-        reads.handOffToToolDispatch();
-        const workspace = await getWorkspace(routeDeps.db, workspaceId);
-        const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
-        const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode();
+        };
         const transport = new WebStandardStreamableHTTPServerTransport({
           enableJsonResponse: true,
         });
-        if (!grantUsesAttemptScopedMcp(grant)) {
+        if (c.req.method === "GET" || !grantUsesAttemptScopedMcp(grant)) {
+          await authorizeBoundSession();
+          if (c.req.method === "GET") return unsupportedGet();
+          reads.handOffToToolDispatch();
           const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
           const mcp = buildWorkspaceToolGatewayMcpServer(prepared, grant, routeDeps.observability);
           try {
@@ -1845,39 +1875,58 @@ export function createAppComposition(deps: AppDependencies): {
             await Promise.allSettled([mcp.close(), prepared.close()]);
           }
         }
-        const mcpDeps = await resolveWorkspaceMcpRouteDeps(routeDeps, grant);
-        // The bound session's frozen Memory selector (migration 0427) decides
-        // which Memory tools the attempt receives and which typed layers they
-        // read and write. A missing row resolves to no Memory tools.
-        const sessionMemory =
-          typeof boundSessionId === "string"
-            ? ((await resolveSessionMemoryAgentScope(
-                routeDeps.db,
-                workspaceId,
-                boundSessionId,
-                grant.metadata,
-              )) ?? {
-                mode: "off" as const,
-                userSubjectId: null,
-                rootSessionId: null,
-              })
-            : null;
-        // Checked live: allowed by the organization, given to this session,
-        // and the person who gave it is still an owner or admin.
-        const sessionAdminAccess =
-          typeof boundSessionId === "string" &&
-          (await resolveSessionAdminAuthority(routeDeps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            sessionId: boundSessionId,
-          }))
-            ? {
-                origin: new URL(c.req.url).origin,
-                dispatch: (request: Request) =>
-                  outsideAgentContext(async () => await app.fetch(request, c.env)),
-                signal: c.req.raw.signal,
-              }
-            : null;
+        // The tool surface is four independent reads: workspace settings, the
+        // model catalog, the session's frozen Memory selector and its admin
+        // access. Read them together, alongside the bound-session check, which
+        // still decides before any of them reaches the response.
+        const [, [workspaceSettings, mcpDeps, sessionMemory, sessionAdminAuthority]] =
+          await alongsideAuthorization(authorizeBoundSession(), () =>
+            Promise.all([
+              getWorkspaceSettings(routeDeps.db, workspaceId),
+              resolveWorkspaceMcpRouteDeps(routeDeps, grant),
+              // The bound session's frozen Memory selector (migration 0427)
+              // decides which Memory tools the attempt receives and which typed
+              // layers they read and write. A missing row resolves to no Memory
+              // tools.
+              typeof boundSessionId === "string"
+                ? resolveSessionMemoryAgentScope(
+                    routeDeps.db,
+                    workspaceId,
+                    boundSessionId,
+                    grant.metadata,
+                  ).then(
+                    (scope) =>
+                      scope ?? {
+                        mode: "off" as const,
+                        userSubjectId: null,
+                        rootSessionId: null,
+                      },
+                  )
+                : null,
+              // Checked live: allowed by the organization, given to this
+              // session, and the person who gave it is still an owner or admin.
+              typeof boundSessionId === "string"
+                ? resolveSessionAdminAuthority(routeDeps.db, {
+                    accountId: grant.accountId,
+                    workspaceId,
+                    sessionId: boundSessionId,
+                  })
+                : false,
+            ]),
+          );
+        reads.handOffToToolDispatch();
+        const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(
+          workspaceSettings ?? undefined,
+        );
+        const workspaceMemoryPromptMode = resolveWorkspaceMemoryPromptMode();
+        const sessionAdminAccess = sessionAdminAuthority
+          ? {
+              origin: new URL(c.req.url).origin,
+              dispatch: (request: Request) =>
+                outsideAgentContext(async () => await app.fetch(request, c.env)),
+              signal: c.req.raw.signal,
+            }
+          : null;
         const mcp = buildOpenGeniMcpServer(mcpDeps, grant, {
           requestOrigin: new URL(c.req.url).origin,
           workspaceMemoryEnabled,
@@ -2494,6 +2543,19 @@ async function validateCodexAccountTarget(request: Request): Promise<void> {
   }
 }
 
+/** Whether a POST carries only MCP protocol messages that touch no tool. */
+async function isProtocolOnlyMcpRequest(request: Request): Promise<boolean> {
+  let body: unknown;
+  try {
+    body = await request.clone().json();
+  } catch {
+    // The transport answers malformed bodies itself, on the full path.
+    return false;
+  }
+  const messages = Array.isArray(body) ? body : [body];
+  return messages.length > 0 && messages.every(isOpenGeniMcpProtocolOnlyMessage);
+}
+
 async function requireMcpAccessGrantAuthorization(
   c: Parameters<typeof requireAccessGrant>[0],
   deps: ApiRouteDeps,

package/src/billing-stripe-customer.ts

@@ -0,0 +1,40 @@
+import type Stripe from "stripe";
+
+export interface StripeCustomerTransaction {
+  read(): Promise<string | null>;
+  account(): Promise<{ name: string } | null>;
+  save(customer: Stripe.Customer): Promise<void>;
+}
+
+/** The adapter must hold the account advisory lock for this whole callback,
+ * including provider I/O and persistence. The stable provider key also recovers
+ * creation when Stripe succeeds but the database transaction rolls back. */
+export async function serializedStripeCustomer(input: {
+  stripe: Stripe;
+  accountId: string;
+  provider: string;
+  email?: string;
+  locked: (run: (tx: StripeCustomerTransaction) => Promise<string>) => Promise<string>;
+}): Promise<string> {
+  return await input.locked(async (tx) => {
+    const existing = await tx.read();
+    if (existing) return existing;
+    const account = await tx.account();
+    if (!account) throw new Error("account not found");
+    const created = await input.stripe.customers.create(
+      {
+        metadata: { opengeni_account_id: input.accountId },
+      },
+      { idempotencyKey: `billing-customer:${input.provider}:${input.accountId}` },
+    );
+    // Creation parameters must stay identical even if a different administrator
+    // retries after a rollback, or the organization is renamed in between.
+    // Profile updates are idempotent sets and do not create another customer.
+    const customer = await input.stripe.customers.update(created.id, {
+      name: account.name,
+      ...(input.email ? { email: input.email } : {}),
+    });
+    await tx.save(customer);
+    return customer.id;
+  });
+}

package/src/billing-subscription-store.ts

@@ -0,0 +1,121 @@
+import type { BillingPlanBalance, SubscriptionPlan } from "@opengeni/contracts";
+import {
+  assertBillingSubscriptionOperationRoot,
+  beginBillingSubscriptionOperation,
+  completeBillingSubscriptionOperation,
+  getBillingSubscriptionOperation,
+  nestedPostgresSqlState,
+  expirePlanCreditPeriod,
+  getBillingCustomer,
+  getManagedAccount,
+  getOrganizationPlanBalance,
+  readSubscriptionPlanCatalog,
+  replacePlanCreditPeriod,
+  upsertOrganizationPlan,
+  withRlsContext,
+  type Database,
+  type OrganizationPlanStateInput,
+  type PlanCreditPeriodInput,
+  type BillingSubscriptionOperation,
+  type BillingSubscriptionOperationKind,
+} from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+import { organizationPlans, planCreditPeriods } from "@opengeni/db/schema";
+import { and, eq, isNull, sql } from "drizzle-orm";
+
+export type StoredSubscriptionPlan = {
+  plan_key: string;
+  stripe_subscription_id: string | null;
+};
+
+export interface SubscriptionAccountStore {
+  operation(key: string): Promise<BillingSubscriptionOperation | null>;
+  beginOperation(input: {
+    operationKey: string;
+    kind: BillingSubscriptionOperationKind;
+    request: Record<string, unknown>;
+    intent: Record<string, unknown>;
+  }): Promise<BillingSubscriptionOperation>;
+  completeOperation(key: string, result: Record<string, unknown>): Promise<void>;
+  exists(): Promise<boolean>;
+  state(): Promise<StoredSubscriptionPlan | null>;
+  customer(provider: string): Promise<string | null>;
+  balance(): Promise<BillingPlanBalance | null>;
+  save(input: Omit<OrganizationPlanStateInput, "accountId">): Promise<void>;
+  replace(input: Omit<PlanCreditPeriodInput, "accountId">): Promise<void>;
+  expire(subscriptionId: string): Promise<void>;
+}
+
+export interface SubscriptionStore {
+  catalog(): Promise<{ revision: number; plans: SubscriptionPlan[] }>;
+  locked<T>(accountId: string, run: (store: SubscriptionAccountStore) => Promise<T>): Promise<T>;
+}
+
+/** Reuse the SQL seams in one outer transaction, membership/org fence before
+ * the credit-account lock. Stripe reads also run under this fence: concurrent
+ * deliveries cannot commit an older provider snapshot after a newer one. */
+export function subscriptionStore(db: Database): SubscriptionStore {
+  assertBillingSubscriptionOperationRoot(db);
+  return {
+    catalog: () => readSubscriptionPlanCatalog(db),
+    locked: (accountId, run) =>
+      withRlsContext(db, { accountId, workspaceId: null }, async (tx) => {
+        await tx.execute(
+          sql`select pg_advisory_xact_lock(hashtextextended(${`organization-membership:${accountId}`}, 0))`,
+        );
+        return await run({
+          operation: (key) => getBillingSubscriptionOperation(tx, accountId, key),
+          beginOperation: async (input) => {
+            try {
+              return await beginBillingSubscriptionOperation(tx, { ...input, accountId });
+            } catch (error) {
+              if (nestedPostgresSqlState(error) === "P0S02")
+                throw new HTTPException(409, {
+                  message: "Retry the pending subscription operation before starting another",
+                });
+              throw error;
+            }
+          },
+          completeOperation: async (operationKey, result) => {
+            await completeBillingSubscriptionOperation(tx, { accountId, operationKey, result });
+          },
+          exists: async () => Boolean(await getManagedAccount(tx, accountId)),
+          state: async () => {
+            const [row] = await tx
+              .select({
+                plan_key: organizationPlans.planKey,
+                stripe_subscription_id: organizationPlans.stripeSubscriptionId,
+              })
+              .from(organizationPlans)
+              .where(eq(organizationPlans.accountId, accountId))
+              .limit(1);
+            return row ?? null;
+          },
+          customer: async (provider) =>
+            (await getBillingCustomer(tx, accountId, provider))?.providerCustomerId ?? null,
+          balance: () => getOrganizationPlanBalance(tx, accountId),
+          save: async (input) => {
+            await upsertOrganizationPlan(tx, { ...input, accountId });
+          },
+          replace: async (input) => {
+            await replacePlanCreditPeriod(tx, { ...input, accountId });
+          },
+          expire: async (subscriptionId) => {
+            const periods = await tx
+              .select({ id: planCreditPeriods.id })
+              .from(planCreditPeriods)
+              .where(
+                and(
+                  eq(planCreditPeriods.accountId, accountId),
+                  eq(planCreditPeriods.stripeSubscriptionId, subscriptionId),
+                  isNull(planCreditPeriods.expiredAt),
+                ),
+              );
+            for (const period of periods) {
+              await expirePlanCreditPeriod(tx, { accountId, periodId: period.id, force: true });
+            }
+          },
+        });
+      }),
+  };
+}