@opengeni/db 0.31.1 → 0.36.1

package/dist/task-notes.d.ts

@@ -0,0 +1,85 @@
+import { type TaskNoteKind as TaskNoteKindType } from "@opengeni/contracts";
+import type { Database } from "./database.js";
+export type TaskNoteAttemptClaims = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+};
+export type CreateTaskNoteInput = TaskNoteAttemptClaims & {
+    operationId: string;
+    kind: TaskNoteKindType;
+    text: string;
+    expiresInDays: number;
+};
+export type ArchiveTaskNoteInput = TaskNoteAttemptClaims & {
+    operationId: string;
+    noteId: string;
+    expectedVersion: number;
+    reason: string;
+};
+export type ListTaskNotesInput = TaskNoteAttemptClaims & {
+    includeArchived?: boolean;
+    limit?: number;
+};
+export declare function createTaskNote(db: Database, input: CreateTaskNoteInput): Promise<{
+    note: {
+        id: string;
+        rootSessionId: string;
+        kind: "artifact" | "blocker" | "decision" | "finding" | "handoff" | "ownership";
+        text: string;
+        status: "active" | "archived";
+        version: number;
+        expiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+        archivedAt: string | null;
+        provenance: {
+            actorKind: "human" | "service";
+            sourceSessionId: string;
+            sourceTurnId: string;
+        };
+    };
+    replayed: boolean;
+}>;
+export declare function archiveTaskNote(db: Database, input: ArchiveTaskNoteInput): Promise<{
+    note: {
+        id: string;
+        rootSessionId: string;
+        kind: "artifact" | "blocker" | "decision" | "finding" | "handoff" | "ownership";
+        text: string;
+        status: "active" | "archived";
+        version: number;
+        expiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+        archivedAt: string | null;
+        provenance: {
+            actorKind: "human" | "service";
+            sourceSessionId: string;
+            sourceTurnId: string;
+        };
+    };
+    replayed: boolean;
+}>;
+export declare function listTaskNotes(db: Database, input: ListTaskNotesInput): Promise<{
+    notes: {
+        id: string;
+        rootSessionId: string;
+        kind: "artifact" | "blocker" | "decision" | "finding" | "handoff" | "ownership";
+        text: string;
+        status: "active" | "archived";
+        version: number;
+        expiresAt: string;
+        createdAt: string;
+        updatedAt: string;
+        archivedAt: string | null;
+        provenance: {
+            actorKind: "human" | "service";
+            sourceSessionId: string;
+            sourceTurnId: string;
+        };
+    }[];
+}>;

package/dist/video-generation.d.ts

@@ -70,6 +70,15 @@ export declare function admitVideoGenerationOperation(db: Database, input: Admit
     operation: VideoGenerationOperation;
     created: boolean;
 }>;
+/** Persist a rotated provider token before it is used for another remote call. */
+export declare function rotateVideoGenerationCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    requestDigest: string;
+    expectedCredentialEncrypted: string;
+    credentialEncrypted: string;
+}): Promise<VideoGenerationOperation>;
 /**
  * Seal a reference-bearing operation only after every immutable staging object
  * has been uploaded and independently verified by the worker.  The source

package/dist/video-generation.js

@@ -25,12 +25,13 @@ import {
   mediaGenerationResultForOperation,
   mediaGenerationResultForStoredOperation,
   rescheduleVideoGenerationOperation,
+  rotateVideoGenerationCredential,
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-NBE6CHRI.js";
-import "./chunk-ISI2TIUG.js";
-import "./chunk-MWDVXQOL.js";
+} from "./chunk-VTPRIXKG.js";
+import "./chunk-Z7VYMNPZ.js";
+import "./chunk-5KTIEDX7.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,
@@ -59,6 +60,7 @@ export {
   mediaGenerationResultForOperation,
   mediaGenerationResultForStoredOperation,
   rescheduleVideoGenerationOperation,
+  rotateVideoGenerationCredential,
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy

package/dist/xai-subscription.d.ts

@@ -0,0 +1,326 @@
+import { type XaiProviderAccountAuthoritySnapshotV1 as XaiAuthoritySnapshot } from "@opengeni/contracts";
+import type { Database } from "./database.js";
+import * as schema from "./schema.js";
+export type XaiAccountAuthorityScope = "workspace" | "user";
+export type XaiCredentialStatus = "active" | "needs_relogin" | "error" | "disabled";
+export type XaiCredentialSecretV1 = {
+    version: 1;
+    accessToken?: string;
+    refreshToken?: string;
+    sessionToken?: string;
+    cookie?: string;
+};
+export type XaiSubscriptionAccountMetadata = {
+    id: string;
+    scope: XaiAccountAuthorityScope;
+    providerAccountId: string | null;
+    label: string | null;
+    accountEmail: string | null;
+    planType: string | null;
+    status: XaiCredentialStatus;
+    allocatorEnabled: boolean;
+    version: number;
+    allocatorVersion: number;
+    allocatorUpdatedAt: Date | null;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    lastError: string | null;
+    quotaUsedPercent: number | null;
+    quotaResetAt: Date | null;
+    quotaCheckedAt: Date | null;
+    exhaustedUntil: Date | null;
+    selectionCount: number;
+    lastSelectedAt: Date | null;
+    connectedBySubjectId: string | null;
+};
+export type XaiCredentialForRun = XaiSubscriptionAccountMetadata & {
+    secret: XaiCredentialSecretV1;
+    authoritySnapshot: XaiAuthoritySnapshot;
+};
+export type XaiCredentialLeaseResult = {
+    credentialId: string | null;
+    rotationEnabled: boolean;
+    reused: boolean;
+    holderId: string | null;
+    generation: number | null;
+    leasedUntil: Date | null;
+    accounts: XaiSubscriptionAccountMetadata[];
+};
+export declare const XAI_CREDENTIAL_LEASE_TTL_MS: number;
+/** Stable session sharding, matching Codex's cache-affinity contract. */
+export declare function xaiCredentialShardIndex(sessionId: string, candidateCount: number): number;
+export declare function createXaiSubscriptionCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    scope?: XaiAccountAuthorityScope;
+    encryptionKey: Uint8Array;
+    secret: XaiCredentialSecretV1;
+    providerAccountId?: string | null;
+    label?: string | null;
+    accountEmail?: string | null;
+    planType?: string | null;
+    expiresAt?: Date | null;
+}): Promise<{
+    account: XaiSubscriptionAccountMetadata;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}>;
+export declare function upsertXaiSubscriptionCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    credentialId?: string | null;
+    authoritySnapshot?: XaiAuthoritySnapshot;
+    scope?: XaiAccountAuthorityScope;
+    encryptionKey: Uint8Array;
+    secret: XaiCredentialSecretV1;
+    providerAccountId?: string | null;
+    label?: string | null;
+    accountEmail?: string | null;
+    planType?: string | null;
+    expiresAt?: Date | null;
+}): Promise<{
+    account: XaiSubscriptionAccountMetadata;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}>;
+export declare function listXaiSubscriptionAccountsMetadata(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+}): Promise<XaiSubscriptionAccountMetadata[]>;
+/**
+ * Metadata-only readiness check for the SuperGrok model catalog.
+ *
+ * Like Codex, allocator eligibility is runtime scheduling state, not connection
+ * readiness. With rotation enabled any healthy account makes the rail ready;
+ * with rotation disabled the explicit active account is authoritative.
+ */
+export declare function workspaceXaiSubscriptionActive(db: Database, settings: {
+    readonly supergrokSubscriptionEnabled: boolean;
+}, workspaceId: string, subjectId: string): Promise<boolean>;
+export declare function getXaiSubscriptionAccountMetadata(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+}): Promise<XaiSubscriptionAccountMetadata | null>;
+export declare function getXaiSubscriptionAccountAuthoritySnapshot(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+}): Promise<XaiAuthoritySnapshot | null>;
+/**
+ * Resolve the provider-account authority frozen on a newly accepted human turn.
+ * Workspace authority is the default. A caller's private pool becomes effective
+ * only after that exact pool has an active credential pointer, which is set by
+ * the caller's explicit private connection/activation action.
+ */
+export declare function resolveXaiProviderAccountAuthoritySnapshotForAcceptance(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+}): Promise<XaiAuthoritySnapshot>;
+/** Transaction-local acceptance resolver. The caller must already have set the
+ * exact authenticated subject GUC on this same transaction. */
+export declare function resolveXaiProviderAccountAuthoritySnapshotForAcceptanceInTransaction(db: Database, input: {
+    workspaceId: string;
+}): Promise<XaiAuthoritySnapshot>;
+export declare function updateXaiSubscriptionAccountSettings(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    expectedVersion: number;
+    label?: string | null;
+    allocatorEnabled?: boolean;
+}): Promise<XaiSubscriptionAccountMetadata>;
+export type XaiAllocatorUpdateResult = {
+    kind: "updated" | "unchanged" | "conflict";
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedAt: Date | null;
+} | {
+    kind: "not_found";
+};
+export declare function updateXaiAllocatorEligibility(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    enabled: boolean;
+    expectedVersion: number;
+}): Promise<XaiAllocatorUpdateResult>;
+export declare function renameXaiSubscriptionAccount(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    label: string | null;
+}): Promise<XaiSubscriptionAccountMetadata | null>;
+export declare function disconnectXaiSubscriptionCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}): Promise<boolean>;
+export declare function materializeXaiCredentialForRun(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    encryptionKey: Uint8Array;
+}): Promise<XaiCredentialForRun>;
+export type XaiSerializedCredentialRefreshResult = {
+    credential: XaiCredentialForRun;
+    refreshed: boolean;
+};
+/**
+ * Refresh one connected xAI account under a database row lock.
+ *
+ * OAuth refresh tokens may rotate. Multiple sessions are allowed to share the
+ * same account, so an unlocked read-refresh-write sequence can make one
+ * successful refresh invalidate every other in-flight refresh. This operation
+ * re-reads the secret after acquiring the lock and skips the provider call when
+ * another request already installed a newer token pair.
+ */
+export declare function refreshXaiSubscriptionCredentialSerialized(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    encryptionKey: Uint8Array;
+    observedAccessToken: string | undefined;
+    observedRefreshToken: string | undefined;
+    refresh: (current: XaiCredentialForRun) => Promise<{
+        secret: XaiCredentialSecretV1;
+        expiresAt: Date | null;
+    }>;
+}): Promise<XaiSerializedCredentialRefreshResult>;
+export declare function acquireXaiCredentialLease(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    turnId: string;
+    holderId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    pinnedCredentialId?: string | null;
+    pinSource?: "manual" | "policy" | null;
+    now?: Date;
+    leaseTtlMs?: number;
+}): Promise<XaiCredentialLeaseResult>;
+/**
+ * Select an authorized connected account for a non-turn operation (voice,
+ * transcription, media). Rotation uses the same stable session/request shard
+ * as turns, but does not create a capacity lease: one account may serve many
+ * concurrent upstream sessions just like Codex subscriptions.
+ */
+export declare function selectXaiCredentialForUse(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    shardKey: string;
+    pinnedCredentialId?: string | null;
+    pinSource?: "manual" | "policy" | null;
+    now?: Date;
+}): Promise<{
+    credentialId: string | null;
+    rotationEnabled: boolean;
+    accounts: XaiSubscriptionAccountMetadata[];
+}>;
+export declare function releaseXaiCredentialLease(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    turnId: string;
+    holderId: string;
+    generation: number;
+}): Promise<boolean>;
+export declare function heartbeatXaiCredentialLeaseUntil(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    turnId: string;
+    holderId: string;
+    generation: number;
+    leaseTtlMs?: number;
+    now?: Date;
+}): Promise<Date | null>;
+export declare function getXaiRotationSettings(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}): Promise<typeof schema.xaiRotationSettings.$inferSelect | null>;
+export declare function ensureXaiRotationSettings(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}): Promise<typeof schema.xaiRotationSettings.$inferSelect>;
+export declare function setActiveXaiCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    credentialId: string;
+}): Promise<boolean>;
+export declare function setInitialActiveXaiCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    credentialId: string;
+}): Promise<boolean>;
+export declare function disconnectXaiSubscriptionCredentialAndRepick(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}): Promise<{
+    disconnected: boolean;
+    newActiveCredentialId: string | null;
+}>;
+export declare function updateXaiRotationSettings(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    expectedVersion: number;
+    rotationEnabled: boolean;
+}): Promise<typeof schema.xaiRotationSettings.$inferSelect>;
+export declare function setXaiSessionAccountPin(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    credentialId: string | null;
+    pinSource: "manual" | "policy" | null;
+    /** undefined = unconditional human write; null = row must not exist. */
+    expectedVersion?: number | null;
+}): Promise<typeof schema.xaiSessionAccountPins.$inferSelect>;
+export declare function getXaiSessionAccountPin(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}): Promise<typeof schema.xaiSessionAccountPins.$inferSelect | null>;
+export declare function recordXaiSessionLastAccount(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    credentialId: string;
+}): Promise<typeof schema.xaiSessionAccountPins.$inferSelect>;
+export declare function updateXaiQuotaMetadata(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    credentialId: string;
+    quotaUsedPercent: number | null;
+    quotaResetAt: Date | null;
+    quotaCheckedAt: Date;
+    exhaustedUntil: Date | null;
+}): Promise<boolean>;
+export declare function wakeXaiCapacityWaiters(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+    reason: string;
+    now?: Date;
+}): Promise<number>;