@opengeni/db 3.6.0 → 3.7.4-canary.0

package/src/session-tool-call-settlement.ts

@@ -19,9 +19,16 @@ export function historyCallId(item: Record<string, unknown>): string | null {
     item.providerData && typeof item.providerData === "object" && !Array.isArray(item.providerData)
       ? (item.providerData as Record<string, unknown>)
       : null;
-  const value =
-    item.callId ?? item.call_id ?? providerData?.callId ?? providerData?.call_id ?? item.id;
-  return typeof value === "string" && value.length > 0 ? value : null;
+  // Native tool-search `id` is the provider item id, not the call correlation
+  // id. Validate direct and provider identities before the item-id fallback.
+  const value = [
+    item.callId,
+    item.call_id,
+    providerData?.callId,
+    providerData?.call_id,
+    item.id,
+  ].find((candidate): candidate is string => typeof candidate === "string" && candidate.length > 0);
+  return value ?? null;
 }
 
 export function historyItemType(item: Record<string, unknown>): string | null {
@@ -68,13 +75,33 @@ export function interruptedToolCallResult(input: {
   }
   if (input.callType === "computer_call") return null;
   if (input.callType === "tool_search_call") {
+    const providerData =
+      input.callItem.providerData &&
+      typeof input.callItem.providerData === "object" &&
+      !Array.isArray(input.callItem.providerData)
+        ? (input.callItem.providerData as Record<string, unknown>)
+        : null;
+    const execution =
+      input.callItem.execution === "client" || input.callItem.execution === "server"
+        ? input.callItem.execution
+        : providerData?.execution === "client" || providerData?.execution === "server"
+          ? providerData.execution
+          : null;
+    const providerIdentity =
+      typeof providerData?.call_id === "string" || typeof providerData?.callId === "string";
     const snakeId = typeof input.callItem.call_id === "string";
     return {
       type: "tool_search_output",
-      ...(snakeId ? { call_id: input.callId } : { callId: input.callId }),
-      ...(input.callItem.execution === "client" || input.callItem.execution === "server"
-        ? { execution: input.callItem.execution }
-        : {}),
+      ...(providerIdentity
+        ? {
+            providerData: {
+              call_id: input.callId,
+              ...(execution ? { execution } : {}),
+            },
+          }
+        : snakeId
+          ? { call_id: input.callId, ...(execution ? { execution } : {}) }
+          : { callId: input.callId, ...(execution ? { execution } : {}) }),
       status: "incomplete",
       tools: [],
     };

package/src/user-resource-authority.ts

@@ -301,6 +301,62 @@ export async function issueSelfUserResourceGrant(
   });
 }
 
+export async function issueSelfLocalConnectionUseGrant(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authorityId: string;
+    context: "user_private" | "workspace_shared";
+    workspaceSharedAcknowledged: boolean;
+  },
+): Promise<UserResourceAuthorityGrant> {
+  return await withOwnerContext(db, input, async (scopedDb) => {
+    const [row] = await rawRows<
+      Omit<UserResourceAuthorityGrant, "delegation"> & {
+        organizationId: string;
+        authorityGeneration: number;
+      }
+    >(
+      scopedDb,
+      sql`
+        select grant_id as "grantId", organization_id as "organizationId",
+          authority_generation::int as "authorityGeneration",
+          target_workspace_id as "targetWorkspaceId",
+          target_session_id as "targetSessionId", action, grant_mode as mode,
+          grant_context as context, authority_epoch::int as "authorityEpoch",
+          grant_generation::int as generation, grant_status as status,
+          expires_at::text as "expiresAt"
+        from issue_self_local_connection_use_grant(
+          ${input.accountId}::uuid, ${input.authorityId}::uuid,
+          ${input.workspaceId}::uuid, ${input.context},
+          ${input.workspaceSharedAcknowledged}
+        )
+      `,
+    );
+    if (!row) throw new Error("local connection grant was not returned");
+    const { organizationId, authorityGeneration, ...grant } = row;
+    return {
+      ...grant,
+      expiresAt: rfc3339(grant.expiresAt),
+      delegation: {
+        authorityId: input.authorityId,
+        grantId: grant.grantId,
+        organizationId,
+        workspaceId: grant.targetWorkspaceId,
+        sessionId: grant.targetSessionId,
+        action: grant.action,
+        mode: grant.mode,
+        context: grant.context,
+        authorityEpoch: grant.authorityEpoch,
+        authorityGeneration,
+        grantGeneration: grant.generation,
+      },
+    };
+  });
+}
+
 export async function revokeSelfUserResourceGrant(
   db: Database,
   input: { accountId: string; workspaceId: string; subjectId: string; grantId: string },

package/src/xai-subscription.ts

@@ -472,20 +472,72 @@ export async function workspaceXaiSubscriptionActive(
     workspaceId,
     subjectId,
   });
-  const [accounts, rotation] = await Promise.all([
-    listXaiSubscriptionAccountsMetadata(db, { workspaceId, subjectId }),
-    getXaiRotationSettings(db, { workspaceId, subjectId, authoritySnapshot }),
-  ]);
-  const activeCredentialId = rotation?.activeCredentialId ?? null;
-  const now = new Date();
-  const eligible = (account: XaiSubscriptionAccountMetadata) =>
-    account.status === "active" &&
-    account.allocatorEnabled &&
-    (!account.exhaustedUntil || account.exhaustedUntil <= now);
-  if (rotation?.rotationEnabled !== false) {
-    return accounts.some(eligible);
-  }
-  return accounts.some((account) => account.id === activeCredentialId && eligible(account));
+  return await workspaceXaiSubscriptionActiveForAuthority(db, settings, {
+    workspaceId,
+    subjectId,
+    authoritySnapshot,
+  });
+}
+
+/** Metadata-only readiness for the exact provider-account authority frozen on a turn. */
+export async function workspaceXaiSubscriptionActiveForAuthority(
+  db: Database,
+  settings: { readonly supergrokSubscriptionEnabled: boolean },
+  input: {
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+  },
+): Promise<boolean> {
+  if (!settings.supergrokSubscriptionEnabled) return false;
+  const snapshot = XaiProviderAccountAuthoritySnapshotV1.parse(input.authoritySnapshot);
+  return await withWorkspaceSubjectRls(db, input.workspaceId, input.subjectId, async (scopedDb) => {
+    const ownerMembershipId = await resolveXaiPoolOwnerMembershipId(scopedDb, {
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      authoritySnapshot: snapshot,
+    });
+    const ownerPredicate =
+      ownerMembershipId === null
+        ? isNull(schema.xaiSubscriptionCredentials.ownerOrganizationMembershipId)
+        : eq(schema.xaiSubscriptionCredentials.ownerOrganizationMembershipId, ownerMembershipId);
+    const [accounts, rotation] = await Promise.all([
+      scopedDb
+        .select(xaiCredentialMetadataColumns)
+        .from(schema.xaiSubscriptionCredentials)
+        .where(
+          and(
+            eq(schema.xaiSubscriptionCredentials.workspaceId, input.workspaceId),
+            eq(schema.xaiSubscriptionCredentials.authorityScope, snapshot.scope),
+            ownerPredicate,
+          ),
+        ),
+      scopedDb
+        .select()
+        .from(schema.xaiRotationSettings)
+        .where(
+          and(
+            eq(schema.xaiRotationSettings.workspaceId, input.workspaceId),
+            eq(schema.xaiRotationSettings.authorityScope, snapshot.scope),
+            ownerMembershipId === null
+              ? isNull(schema.xaiRotationSettings.ownerOrganizationMembershipId)
+              : eq(schema.xaiRotationSettings.ownerOrganizationMembershipId, ownerMembershipId),
+          ),
+        )
+        .limit(1)
+        .then((rows) => rows[0] ?? null),
+    ]);
+    const activeCredentialId = rotation?.activeCredentialId ?? null;
+    const now = new Date();
+    const eligible = (account: XaiCredentialMetadataRow) =>
+      account.status === "active" &&
+      account.allocatorEnabled &&
+      (!account.exhaustedUntil || account.exhaustedUntil <= now);
+    if (rotation?.rotationEnabled !== false) {
+      return accounts.some(eligible);
+    }
+    return accounts.some((account) => account.id === activeCredentialId && eligible(account));
+  });
 }
 
 export async function getXaiSubscriptionAccountMetadata(