@opengeni/db 1.3.0 → 1.4.2

package/src/session-realtime-billing.ts

@@ -0,0 +1,135 @@
+import { and, eq, inArray, isNotNull } from "drizzle-orm";
+
+import type { SessionRealtimeEndReason, SessionRealtimeModel } from "@opengeni/contracts";
+import { withRlsContext, withWorkspaceRls, type Database } from "./database";
+import * as schema from "./schema";
+
+/** One provider connection of a live-voice mode, bounded by server observation. */
+export type SessionRealtimeBillableConnection = {
+  id: string;
+  startedAt: Date;
+  observedUntil: Date;
+};
+
+export type SessionRealtimeBillingFacts = {
+  accountId: string;
+  workspaceId: string;
+  sessionId: string;
+  realtimeId: string;
+  model: SessionRealtimeModel;
+  ownerSubjectId: string;
+  state: "active" | "ended";
+  connections: SessionRealtimeBillableConnection[];
+};
+
+/**
+ * The last instant the server itself observed the voice owner alive. An
+ * explicit owner-proven end is observed at `endedAt`; an expired lease only up
+ * to its last heartbeat (late lazy settlement never extends the bill); an
+ * active mode up to `now`, bounded by its lease.
+ */
+export function sessionRealtimeObservedUntil(
+  mode: {
+    state: string;
+    endReason: string | null;
+    endedAt: Date | null;
+    lastHeartbeatAt: Date;
+    leaseExpiresAt: Date;
+  },
+  now: Date,
+): Date {
+  if (mode.state === "ended") {
+    const reason = mode.endReason as SessionRealtimeEndReason | null;
+    if (reason !== "lease_expired" && mode.endedAt) return mode.endedAt;
+    return mode.lastHeartbeatAt;
+  }
+  return new Date(Math.min(now.getTime(), mode.leaseExpiresAt.getTime()));
+}
+
+/**
+ * Server-observed lifetime of every provider connection that was actually
+ * issued (an SDP answer or a minted client secret was returned). Failed or
+ * never-completed negotiations issued nothing billable.
+ */
+export async function loadSessionRealtimeBillingFacts(
+  db: Database,
+  input: { workspaceId: string; sessionId: string; realtimeId: string; now?: Date },
+): Promise<SessionRealtimeBillingFacts | null> {
+  const now = input.now ?? new Date();
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const [mode] = await scopedDb
+      .select()
+      .from(schema.sessionRealtimeModes)
+      .where(
+        and(
+          eq(schema.sessionRealtimeModes.workspaceId, input.workspaceId),
+          eq(schema.sessionRealtimeModes.sessionId, input.sessionId),
+          eq(schema.sessionRealtimeModes.id, input.realtimeId),
+        ),
+      )
+      .limit(1);
+    if (!mode) return null;
+    const observedUntil = sessionRealtimeObservedUntil(mode, now);
+    const rows = await scopedDb
+      .select({
+        id: schema.sessionRealtimeConnections.id,
+        createdAt: schema.sessionRealtimeConnections.createdAt,
+        closedAt: schema.sessionRealtimeConnections.closedAt,
+      })
+      .from(schema.sessionRealtimeConnections)
+      .where(
+        and(
+          eq(schema.sessionRealtimeConnections.realtimeId, mode.id),
+          isNotNull(schema.sessionRealtimeConnections.sdpAnswer),
+        ),
+      );
+    return {
+      accountId: mode.accountId,
+      workspaceId: mode.workspaceId,
+      sessionId: mode.sessionId,
+      realtimeId: mode.id,
+      model: mode.model as SessionRealtimeModel,
+      ownerSubjectId: mode.ownerSubjectId,
+      state: mode.state as "active" | "ended",
+      connections: rows
+        .map((row) => {
+          const closed = row.closedAt ?? observedUntil;
+          return {
+            id: row.id,
+            startedAt: row.createdAt,
+            observedUntil: new Date(
+              Math.max(
+                row.createdAt.getTime(),
+                Math.min(closed.getTime(), observedUntil.getTime()),
+              ),
+            ),
+          };
+        })
+        .sort((left, right) => left.startedAt.getTime() - right.startedAt.getTime()),
+    };
+  });
+}
+
+/** Which of these usage idempotency keys are already recorded for the account. */
+export async function existingUsageEventIdempotencyKeys(
+  db: Database,
+  input: { accountId: string; workspaceId: string; keys: readonly string[] },
+): Promise<Set<string>> {
+  if (input.keys.length === 0) return new Set();
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb
+        .select({ key: schema.usageEvents.idempotencyKey })
+        .from(schema.usageEvents)
+        .where(
+          and(
+            eq(schema.usageEvents.accountId, input.accountId),
+            inArray(schema.usageEvents.idempotencyKey, [...input.keys]),
+          ),
+        );
+      return new Set(rows.map((row) => row.key));
+    },
+  );
+}

package/src/session-realtime-ledger.ts

@@ -1176,10 +1176,15 @@ async function admitRealtimeDelegationInTransaction(
     delegationItemId: incoming.delegationItemId!,
     ledgerEntryId: entryId,
   };
-  const inputTranscript = incoming.payload?.inputTranscript;
-  if (typeof inputTranscript !== "string" || inputTranscript.trim().length === 0) {
-    throw new Error("Realtime delegation input transcript is required");
-  }
+  // Some providers (Azure Live) delegate without echoing the user's words. The
+  // work instructions in `incoming.text` still carry the transcript delta, so a
+  // missing echo only changes the display label; it must never fail the sync
+  // batch, which the browser would retry forever.
+  const rawInputTranscript = incoming.payload?.inputTranscript;
+  const inputTranscript =
+    typeof rawInputTranscript === "string" && rawInputTranscript.trim().length > 0
+      ? rawInputTranscript
+      : "Voice request";
   const admitted = await submitHumanPromptInTransaction(db, {
     accountId,
     workspaceId: input.workspaceId,

package/src/session-realtime.ts

@@ -88,13 +88,22 @@ export type RenewSessionRealtimeInput = {
   expectedVersion: number;
   now?: Date;
   leaseMs?: number;
+  /**
+   * False keeps the current lease unchanged (owner still proven). Used when a
+   * deployment-funded call ran out of credits: the client drains and ends
+   * inside the remaining lease, and an ignoring client lapses on its own.
+   */
+  extendLease?: boolean;
 };
 
-export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs"> & {
+export type EndSessionRealtimeInput = Omit<RenewSessionRealtimeInput, "leaseMs" | "extendLease"> & {
   reason: Extract<SessionRealtimeEndReason, "user_stop" | "browser_unload">;
 };
 
-export type AssertSessionRealtimeOwnerInput = Omit<RenewSessionRealtimeInput, "leaseMs">;
+export type AssertSessionRealtimeOwnerInput = Omit<
+  RenewSessionRealtimeInput,
+  "leaseMs" | "extendLease"
+>;
 
 export type SessionRealtimeMutationResult = {
   mode: SessionRealtimeMode;
@@ -594,6 +603,15 @@ export async function renewSessionRealtimeInTransaction(
       expired: true,
     };
   }
+  if (input.extendLease === false) {
+    return {
+      mode: mapRealtimeMode(row),
+      replay: false,
+      eventIds: [],
+      workflowWakeRevision: null,
+      expired: false,
+    };
+  }
   const [renewed] = await db
     .update(schema.sessionRealtimeModes)
     .set({

package/src/tool-action-reviews.ts

@@ -1,6 +1,10 @@
 import { and, desc, eq } from "drizzle-orm";
+import { parseVerifiedAttemptToolCatalog } from "@opengeni/codemode";
 import {
+  McpConnectionAccountBindings,
   ToolActionReview,
+  toolReviewContextFromSchema,
+  type ToolReviewContext,
   toolReviewAction,
   toolReviewDetails,
   toolReviewFields,
@@ -11,6 +15,7 @@ import { type Database, withRlsContext } from "./database";
 import * as schema from "./schema";
 import { connectorActionFingerprint } from "./connector-action-fingerprint";
 import { fromPostgresLosslessJson } from "./lossless-json";
+import { legacyToolActionReview } from "./legacy-tool-action-reviews";
 
 type ReviewScope = {
   accountId: string;
@@ -65,10 +70,17 @@ async function reviewSnapshot(db: Database, input: ReviewScope) {
         .orderBy(desc(schema.agentRunStates.stateVersion))
         .limit(32);
       for (const state of states) {
-        const pending = fromPostgresLosslessJson(
-          state.pendingApprovals,
-          state.pendingApprovalsCodecVersion,
-        );
+        // Recovery is best effort: one unreadable state must not hide the
+        // decision. Unrecovered arguments leave decline as the only response.
+        let pending: unknown;
+        try {
+          pending = fromPostgresLosslessJson(
+            state.pendingApprovals,
+            state.pendingApprovalsCodecVersion,
+          );
+        } catch {
+          continue;
+        }
         if (!Array.isArray(pending)) continue;
         for (const value of pending) {
           if (!value || typeof value !== "object") continue;
@@ -86,34 +98,109 @@ async function reviewSnapshot(db: Database, input: ReviewScope) {
               continue;
             }
           }
-          if (
-            connectorActionFingerprint({ ...record.request, arguments: args }) !==
-            record.request.actionFingerprint
-          )
+          let fingerprint: string;
+          try {
+            fingerprint = connectorActionFingerprint({ ...record.request, arguments: args });
+          } catch {
             continue;
+          }
+          if (fingerprint !== record.request.actionFingerprint) continue;
           record.request.reviewArguments = JSON.stringify(args);
           break;
         }
         if (record.request.reviewArguments !== null) break;
       }
+      // Recovered bytes predate the saved review context, so the context that
+      // hides schema-protected fields must be proven from the immutable catalog of
+      // the attempt that created the request. Without that proof the arguments
+      // stay hidden and decline remains the only response.
+      if (record.request.reviewArguments !== null && record.request.reviewContext === null) {
+        const context = await catalogReviewContext(scoped, input, record);
+        if (context) record.request.reviewContext = context;
+        else record.request.reviewArguments = null;
+      }
     }
     return record;
   });
 }
 
+async function catalogReviewContext(
+  scoped: Database,
+  input: ReviewScope,
+  record: {
+    request: typeof schema.connectorActionRequests.$inferSelect;
+    turn: typeof schema.sessionTurns.$inferSelect;
+  },
+): Promise<ToolReviewContext | null> {
+  try {
+    const { request, turn } = record;
+    const [stored] = await scoped
+      .select({ catalog: schema.sessionAttemptToolCatalogs.catalog })
+      .from(schema.sessionAttemptToolCatalogs)
+      .where(
+        and(
+          eq(schema.sessionAttemptToolCatalogs.accountId, input.accountId),
+          eq(schema.sessionAttemptToolCatalogs.workspaceId, input.workspaceId),
+          eq(schema.sessionAttemptToolCatalogs.sessionId, input.sessionId),
+          eq(schema.sessionAttemptToolCatalogs.turnId, request.turnId),
+          eq(schema.sessionAttemptToolCatalogs.attemptId, request.creationAttemptId),
+          eq(
+            schema.sessionAttemptToolCatalogs.executionGeneration,
+            request.creationExecutionGeneration,
+          ),
+        ),
+      )
+      .limit(1);
+    if (!stored) return null;
+    const entries = parseVerifiedAttemptToolCatalog(stored.catalog).entries.filter(
+      (item) =>
+        item.identity.serverId === request.serverId && item.identity.toolName === request.toolName,
+    );
+    if (entries.length !== 1) return null;
+    const entry = entries[0]!;
+    const bindings = McpConnectionAccountBindings.safeParse(turn.mcpAccountBindings);
+    const binding = bindings.success
+      ? bindings.data.find((item) => item.serverId === request.serverId)
+      : undefined;
+    return toolReviewContextFromSchema(entry.inputSchema, {
+      kind:
+        entry.source === "mcp" && binding?.providerDomain === "gmailmcp.googleapis.com"
+          ? "gmail"
+          : "generic",
+      ...(entry.title ? { title: entry.title } : {}),
+      ...(binding?.accountLabel ? { accountLabel: binding.accountLabel } : {}),
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Older approvals have no saved review. Their presentation is best effort: any
+ * failure to rebuild it answers "no saved review", and clients then fall back to
+ * the approval's own arguments instead of hiding the decision.
+ */
+async function presentableLegacyReview(db: Database, input: ReviewScope) {
+  try {
+    return await legacyToolActionReview(db, input);
+  } catch {
+    return null;
+  }
+}
+
 /** The HTTP/core caller must independently authorize this session. RLS remains active here. */
 export async function getToolActionReview(
   db: Database,
   input: ReviewScope,
 ): Promise<ToolActionReview | null> {
   const record = await reviewSnapshot(db, input);
-  if (!record) return null;
+  if (!record) return (await presentableLegacyReview(db, input))?.review ?? null;
   const { request, operation, turn } = record;
   let status: ToolReviewStatus =
     request.status === "uncertain"
       ? "unknown"
       : request.status === "blocked"
-        ? "revoked"
+        ? "blocked"
         : request.status;
   if (operation?.state === "outcome_unknown") status = "unknown";
   else if (operation?.state === "cancelled")
@@ -131,8 +218,10 @@ export async function getToolActionReview(
     ["pending", "approved"].includes(status)
   )
     status = "cancelled";
-  const available =
-    status === "pending" && turn.status === "requires_action" && request.reviewArguments !== null;
+  // A person can always decline a waiting action. Approving needs the exact saved
+  // arguments; when an older request's arguments cannot be recovered, decline is
+  // the only safe decision and keeps the session from staying stuck.
+  const waiting = status === "pending" && turn.status === "requires_action";
   const args = request.reviewArguments;
   const context = request.reviewContext ?? undefined;
   const parsed = decodeReviewArguments(args);
@@ -157,14 +246,22 @@ export async function getToolActionReview(
       : {}),
     ...toolReviewFields(args, context),
     reason:
-      request.policySource === "explicit"
-        ? "Your permission setting for this action is Ask."
-        : request.policySource === "ambiguous"
-          ? "Overlapping permission settings require a review."
-          : "This action asks for approval by default.",
+      status === "blocked"
+        ? request.policySource === "explicit"
+          ? "Your permission settings block this action."
+          : request.policySource === "ambiguous"
+            ? "Two permission settings conflict, so this action is blocked."
+            : "This action is blocked by default."
+        : request.policySource === "explicit"
+          ? "This action is set to Ask first."
+          : "This action asks first by default.",
     createdAt: request.createdAt.toISOString(),
     updatedAt: (operation?.updatedAt ?? request.updatedAt).toISOString(),
-    availableActions: available ? ["approve", "reject"] : [],
+    availableActions: waiting
+      ? request.reviewArguments !== null
+        ? ["approve", "reject"]
+        : ["reject"]
+      : [],
     detailsAvailable: args !== null,
   });
 }
@@ -174,6 +271,20 @@ export async function getToolReviewDetailsPage(
   input: ReviewScope & { actionDigest: string; path: string; offset: number },
 ) {
   const record = await reviewSnapshot(db, input);
+  if (!record) {
+    const legacy = await presentableLegacyReview(db, input);
+    if (!legacy?.proven || legacy.review.actionDigest !== input.actionDigest) return null;
+    try {
+      return {
+        version: 1 as const,
+        id: input.approvalId,
+        actionDigest: input.actionDigest,
+        ...toolReviewDetails(legacy.args, legacy.context, input.path, input.offset),
+      };
+    } catch {
+      return null;
+    }
+  }
   if (
     !record ||
     record.request.actionFingerprint !== input.actionDigest ||

package/src/transcription-recordings.ts

@@ -1087,7 +1087,9 @@ export function assembleTranscriptionSegments(
           ).trim(),
     )
     .filter(Boolean)
-    .join("\n\n");
+    // Segments are fixed-length time cuts, not paragraphs: a boundary usually
+    // falls mid-sentence, so a long dictation must read as one continuous text.
+    .join(" ");
   const seen = new Set<string>();
   const combinedLanguages: string[] = [];
   for (const segment of ordered) {

package/src/voice-transcription-settlement.ts

@@ -0,0 +1,94 @@
+import { sql } from "drizzle-orm";
+import { CreditDebitAttribution } from "./credit-debit-attribution";
+import type { Database } from "./database";
+import { rawRows, withRlsContext } from "./database";
+
+/** Usage source and credit debit type of deployment-funded voice transcription. */
+export const VOICE_TRANSCRIPTION_SOURCE_TYPE = "voice_transcription";
+export const VOICE_TRANSCRIPTION_DEBIT_TYPE = "voice_transcription_debit";
+
+/**
+ * Idempotency keys for one settled voice-transcription unit. Both derive from
+ * the workspace and the server-built unit id only, so an inline settlement, its
+ * in-process retry, and a later reconciliation converge on the same rows.
+ */
+export function voiceTranscriptionSettlementKeys(input: {
+  workspaceId: string;
+  sourceId: string;
+}): { usageIdempotencyKey: string; debitIdempotencyKey: string } {
+  return {
+    usageIdempotencyKey: `voice.transcription_cost:${input.sourceId}`,
+    debitIdempotencyKey: `credit:${VOICE_TRANSCRIPTION_DEBIT_TYPE}:voice_input:${input.workspaceId}:${input.sourceId}`,
+  };
+}
+
+export type UnsettledVoiceTranscriptionCharge = {
+  sourceId: string;
+  amountMicros: number;
+  attribution: CreditDebitAttribution;
+};
+
+/**
+ * Voice usage receipts in one workspace whose credit debit never committed
+ * (the debit transaction failed after the receipt was durable). Bounded and
+ * ordered oldest first; `minAgeMilliseconds` leaves an in-flight inline
+ * settlement to finish with its full ledger metadata first. The scan walks the
+ * workspace's `model.cost` index range, so the window is short (3 days) and
+ * the statement is capped at 2 s; a timeout only defers reconciliation.
+ */
+export async function listUnsettledVoiceTranscriptionCharges(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    limit?: number;
+    minAgeMilliseconds?: number;
+  },
+): Promise<UnsettledVoiceTranscriptionCharge[]> {
+  const limit = Math.max(1, Math.min(input.limit ?? 20, 100));
+  const minAgeSeconds = Math.max(0, Math.floor((input.minAgeMilliseconds ?? 60_000) / 1_000));
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await scopedDb.execute(sql`select set_config('statement_timeout', '2000ms', true)`);
+      const rows = await rawRows<{
+        source_id: string;
+        quantity: string | number;
+        attribution: unknown;
+      }>(
+        scopedDb,
+        sql`
+          select usage_row.source_resource_id as source_id,
+            usage_row.quantity,
+            usage_row.initiator_context -> 'creditDebitAttribution' as attribution
+          from usage_events usage_row
+          where usage_row.account_id = ${input.accountId}::uuid
+            and usage_row.workspace_id = ${input.workspaceId}::uuid
+            and usage_row.event_type = 'model.cost'
+            and usage_row.source_resource_type = ${VOICE_TRANSCRIPTION_SOURCE_TYPE}
+            and usage_row.source_resource_id is not null
+            and usage_row.quantity > 0
+            and usage_row.idempotency_key = 'voice.transcription_cost:' || usage_row.source_resource_id
+            and usage_row.occurred_at >= now() - interval '3 days'
+            and usage_row.occurred_at <= now() - make_interval(secs => ${minAgeSeconds})
+            and not exists (
+              select 1 from credit_ledger_entries ledger
+              where ledger.idempotency_key = ${`credit:${VOICE_TRANSCRIPTION_DEBIT_TYPE}:voice_input:`}
+                || usage_row.workspace_id::text || ':' || usage_row.source_resource_id
+            )
+          order by usage_row.occurred_at asc
+          limit ${limit}
+        `,
+      );
+      return rows.map((row) => {
+        const attribution = CreditDebitAttribution.safeParse(row.attribution);
+        return {
+          sourceId: row.source_id,
+          amountMicros: Number(row.quantity),
+          attribution: attribution.success ? attribution.data : { kind: "unknown" as const },
+        };
+      });
+    },
+  );
+}