@opengeni/db 1.0.1 → 3.2.0-canary.0

package/src/insights.ts

@@ -82,6 +82,20 @@ export type ModelCallFacetRow = {
   model: string;
 };
 
+export type ModelContextContributionAggregate = {
+  estimatedTokens: number;
+  utf8Bytes: number;
+  coveredCalls: number;
+  totalCalls: number;
+  sources: Array<{
+    source: string;
+    items: number;
+    utf8Bytes: number;
+    estimatedTokens: number;
+    calls: number;
+  }>;
+};
+
 export type SessionDepthAggregate = {
   depth: number;
   sessions: number;
@@ -645,6 +659,99 @@ export async function listRecentModelCalls(
   });
 }
 
+export async function aggregateModelContextContributions(
+  db: Database,
+  input: InsightsTimeWindow & {
+    workspaceId: string;
+    provider?: string | null;
+    model?: string | null;
+  },
+): Promise<ModelContextContributionAggregate> {
+  const context = await rlsContextForWorkspace(db, input.workspaceId);
+  return await withRlsContext(db, context, async (scopedDb) => {
+    const clauses = [
+      eq(schema.modelCallFacts.workspaceId, input.workspaceId),
+      gte(schema.modelCallFacts.occurredAt, input.since),
+      lt(schema.modelCallFacts.occurredAt, input.until),
+      ...(input.provider ? [eq(schema.modelCallFacts.provider, input.provider)] : []),
+      ...(input.model ? [eq(schema.modelCallFacts.model, input.model)] : []),
+    ];
+    type ContributionRow = {
+      total_calls: number | string;
+      covered_calls: number | string;
+      source: string | null;
+      items: number | string | null;
+      utf8_bytes: number | string | null;
+      estimated_tokens: number | string | null;
+      calls: number | string | null;
+    };
+    const rows = (await scopedDb.execute(sql<ContributionRow>`
+      with filtered as (
+        select
+          ${schema.modelCallFacts.id} as id,
+          ${schema.modelCallFacts.contextContributions} as context_contributions
+        from ${schema.modelCallFacts}
+        where ${and(...clauses)}
+      ), coverage as (
+        select
+          count(*)::bigint as total_calls,
+          count(context_contributions)::bigint as covered_calls
+        from filtered
+      ), source_rows as (
+        select
+          filtered.id,
+          contribution->>'source' as source,
+          (contribution->>'items')::bigint as items,
+          (contribution->>'utf8Bytes')::bigint as utf8_bytes,
+          (contribution->>'estimatedTokens')::bigint as estimated_tokens
+        from filtered
+        cross join lateral jsonb_array_elements(filtered.context_contributions) contribution
+      ), source_totals as (
+        select
+          source,
+          sum(items)::bigint as items,
+          sum(utf8_bytes)::bigint as utf8_bytes,
+          sum(estimated_tokens)::bigint as estimated_tokens,
+          count(distinct id)::bigint as calls
+        from source_rows
+        group by source
+      )
+      select
+        coverage.total_calls,
+        coverage.covered_calls,
+        source_totals.source,
+        source_totals.items,
+        source_totals.utf8_bytes,
+        source_totals.estimated_tokens,
+        source_totals.calls
+      from coverage
+      left join source_totals on true
+      order by source_totals.estimated_tokens desc nulls last, source_totals.source
+    `)) as ContributionRow[];
+    const first = rows[0];
+    const sources = rows.flatMap((row) =>
+      row.source
+        ? [
+            {
+              source: row.source,
+              items: Number(row.items ?? 0),
+              utf8Bytes: Number(row.utf8_bytes ?? 0),
+              estimatedTokens: Number(row.estimated_tokens ?? 0),
+              calls: Number(row.calls ?? 0),
+            },
+          ]
+        : [],
+    );
+    return {
+      estimatedTokens: sources.reduce((sum, row) => sum + row.estimatedTokens, 0),
+      utf8Bytes: sources.reduce((sum, row) => sum + row.utf8Bytes, 0),
+      coveredCalls: Number(first?.covered_calls ?? 0),
+      totalCalls: Number(first?.total_calls ?? 0),
+      sources,
+    };
+  });
+}
+
 export async function aggregateScheduleFacts(
   db: Database,
   input: InsightsTimeWindow & {

package/src/integration-bindings.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 
 import { stableJson } from "@opengeni/contracts";
-import { and, asc, eq, or, sql } from "drizzle-orm";
+import { and, asc, eq, inArray, or, sql } from "drizzle-orm";
 
 import type { Database } from "./database";
 import { effectiveCapabilityOwnerSql } from "./capability-components";
@@ -184,6 +184,7 @@ export async function upsertIntegrationFacetBinding(
     await addIntegrationFacetBindingOwner(db, created.id, input);
     return { row: created, changed: true };
   }
+  await assertPersonalBindingConnectionRebindAuthority(db, existing, input);
   if (existing.bindingKey !== input.bindingKey) {
     throw new IntegrationFacetBindingOwnershipConflictError(
       "Integration runtime identity is already assigned to another instance",
@@ -244,11 +245,70 @@ export async function upsertIntegrationFacetBinding(
   return { row, changed };
 }
 
+async function assertPersonalBindingConnectionRebindAuthority(
+  db: Database,
+  existing: typeof schema.integrationFacetBindings.$inferSelect,
+  input: Pick<
+    UpsertIntegrationFacetBindingInput,
+    "accountId" | "workspaceId" | "connectionId" | "createdBySubjectId"
+  >,
+): Promise<void> {
+  const nextConnectionId = input.connectionId ?? null;
+  if (!existing.connectionId || existing.connectionId === nextConnectionId) return;
+  // Personal Connections are visible through the app role only to their exact
+  // subject, so a missing current row is an authority failure, not absence.
+  const [currentConnection] = await db
+    .select({ subjectId: schema.connections.subjectId })
+    .from(schema.connections)
+    .where(
+      and(
+        eq(schema.connections.id, existing.connectionId),
+        eq(schema.connections.accountId, input.accountId),
+        eq(schema.connections.workspaceId, input.workspaceId),
+      ),
+    )
+    .limit(1);
+  if (!currentConnection) {
+    throw new IntegrationFacetBindingOwnershipConflictError(
+      "Personal Integration instance belongs to another subject and cannot be changed in place",
+    );
+  }
+  if (!currentConnection.subjectId) return;
+  if (currentConnection.subjectId !== input.createdBySubjectId || nextConnectionId === null) {
+    throw new IntegrationFacetBindingOwnershipConflictError(
+      "Personal Integration instance belongs to another subject and cannot be changed in place",
+    );
+  }
+  const [nextConnection] = await db
+    .select({ subjectId: schema.connections.subjectId })
+    .from(schema.connections)
+    .where(
+      and(
+        eq(schema.connections.id, nextConnectionId),
+        eq(schema.connections.accountId, input.accountId),
+        eq(schema.connections.workspaceId, input.workspaceId),
+      ),
+    )
+    .limit(1);
+  if (!nextConnection || nextConnection.subjectId !== currentConnection.subjectId) {
+    throw new IntegrationFacetBindingOwnershipConflictError(
+      "Personal Integration instance Connection ownership cannot be changed",
+    );
+  }
+}
+
 export async function listIntegrationFacetBindingOwners(
   db: Database,
   bindingId: string,
 ): Promise<IntegrationFacetBindingOwner[]> {
-  return await loadIntegrationFacetBindingOwners(db, bindingId, true);
+  return (await listIntegrationFacetBindingOwnersForBindings(db, [bindingId])).get(bindingId) ?? [];
+}
+
+export async function listIntegrationFacetBindingOwnersForBindings(
+  db: Database,
+  bindingIds: string[],
+): Promise<Map<string, IntegrationFacetBindingOwner[]>> {
+  return await loadIntegrationFacetBindingOwnersForBindings(db, bindingIds, true);
 }
 
 async function loadIntegrationFacetBindingOwners(
@@ -256,8 +316,26 @@ async function loadIntegrationFacetBindingOwners(
   bindingId: string,
   effectiveOnly: boolean,
 ): Promise<IntegrationFacetBindingOwner[]> {
+  return (
+    (await loadIntegrationFacetBindingOwnersForBindings(db, [bindingId], effectiveOnly)).get(
+      bindingId,
+    ) ?? []
+  );
+}
+
+async function loadIntegrationFacetBindingOwnersForBindings(
+  db: Database,
+  bindingIds: string[],
+  effectiveOnly: boolean,
+): Promise<Map<string, IntegrationFacetBindingOwner[]>> {
+  const uniqueBindingIds = [...new Set(bindingIds)];
+  const ownersByBindingId = new Map(
+    uniqueBindingIds.map((bindingId) => [bindingId, [] as IntegrationFacetBindingOwner[]]),
+  );
+  if (uniqueBindingIds.length === 0) return ownersByBindingId;
   const rows = await db
     .select({
+      bindingId: schema.integrationFacetBindingOwners.bindingId,
       kind: schema.integrationFacetBindingOwners.ownerKind,
       id: schema.integrationFacetBindingOwners.ownerId,
       removable: schema.integrationFacetBindingOwners.removable,
@@ -265,7 +343,7 @@ async function loadIntegrationFacetBindingOwners(
     .from(schema.integrationFacetBindingOwners)
     .where(
       and(
-        eq(schema.integrationFacetBindingOwners.bindingId, bindingId),
+        inArray(schema.integrationFacetBindingOwners.bindingId, uniqueBindingIds),
         effectiveOnly
           ? effectiveCapabilityOwnerSql(
               schema.integrationFacetBindingOwners.ownerKind,
@@ -275,10 +353,11 @@ async function loadIntegrationFacetBindingOwners(
       ),
     )
     .orderBy(
+      asc(schema.integrationFacetBindingOwners.bindingId),
       asc(schema.integrationFacetBindingOwners.ownerKind),
       asc(schema.integrationFacetBindingOwners.ownerId),
     );
-  return rows.map((row) => {
+  for (const row of rows) {
     if (
       row.kind !== "direct" &&
       row.kind !== "plugin" &&
@@ -287,8 +366,11 @@ async function loadIntegrationFacetBindingOwners(
     ) {
       throw new Error(`Unknown Integration instance owner kind: ${row.kind}`);
     }
-    return { kind: row.kind, id: row.id, removable: row.removable };
-  });
+    ownersByBindingId
+      .get(row.bindingId)
+      ?.push({ kind: row.kind, id: row.id, removable: row.removable });
+  }
+  return ownersByBindingId;
 }
 
 export async function removeIntegrationFacetBindingOwner(