@opengeni/db 3.7.4 → 3.8.2-canary.0

package/dist/schema.js

@@ -62,6 +62,7 @@ import {
   connectorActionPolicies,
   connectorActionRequests,
   creditLedgerEntries,
+  deploymentModelCatalog,
   deviceEnrollmentRequests,
   deviceEnrollmentStatusValues,
   documentBases,
@@ -169,6 +170,9 @@ import {
   organizationMembershipLifecycleEvents,
   organizationMembershipOperationReceipts,
   organizationMemberships,
+  organizationModelProviderConnectionOperations,
+  organizationModelProviderConnections,
+  organizationModelProviderCustomModels,
   organizationPrivateSessionSettingEvents,
   organizationPrivateSessionSettings,
   organizationProfileEvents,
@@ -310,6 +314,7 @@ import {
   workspaceCaptures,
   workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
+  workspaceGatewayCustomModels,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,
   workspaceInstructionPolicyDeactivationEvents,
@@ -337,7 +342,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-O56DM5GZ.js";
+} from "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -403,6 +408,7 @@ export {
   connectorActionPolicies,
   connectorActionRequests,
   creditLedgerEntries,
+  deploymentModelCatalog,
   deviceEnrollmentRequests,
   deviceEnrollmentStatusValues,
   documentBases,
@@ -510,6 +516,9 @@ export {
   organizationMembershipLifecycleEvents,
   organizationMembershipOperationReceipts,
   organizationMemberships,
+  organizationModelProviderConnectionOperations,
+  organizationModelProviderConnections,
+  organizationModelProviderCustomModels,
   organizationPrivateSessionSettingEvents,
   organizationPrivateSessionSettings,
   organizationProfileEvents,
@@ -651,6 +660,7 @@ export {
   workspaceCaptures,
   workspaceCodexSubscriptionPreferences,
   workspaceControlEvents,
+  workspaceGatewayCustomModels,
   workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents,
   workspaceInstructionPolicyDeactivationEvents,

package/dist/session-background-commands.js

@@ -12,9 +12,9 @@ import {
   settleClaimedConnectedMachineBackgroundCommand,
   settleConnectedMachineSessionBackgroundCommand,
   settleSessionBackgroundCommandForRetainedProcess
-} from "./chunk-S3TDDCS2.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-CITYUGMW.js";
+import "./chunk-HZV7O6JR.js";
+import "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   backgroundCommandActivityForSessions,

package/dist/session-control.d.ts

@@ -429,6 +429,40 @@ export declare function evaluateSessionControl(db: Database, workspaceId: string
     lock?: WorkspaceControlLockMode;
     workspaceControl?: WorkspaceControlRow | undefined;
 }): Promise<EffectiveSessionControl>;
+export type SessionPromptCommandAction = "prompt.send" | "prompt.steer";
+/**
+ * Prompt operation keys are actor-scoped across target sessions and across the
+ * Send/Steer action pair. The advisory lock closes the gap left by the legacy
+ * action/target-specific unique index without changing old receipt identities.
+ */
+export declare function reserveSessionPromptCommandReceipt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    actor: SessionCommandActor;
+    action: SessionPromptCommandAction;
+    targetSessionId: string;
+    operationKey: string;
+    canonicalRequestHash: string;
+    boundaryRequestHash: string;
+}): Promise<{
+    receipt: SessionCommandReceiptRow;
+    replay: boolean;
+}>;
+/** Serialize one actor-scoped prompt operation before replay or reservation. */
+export declare function lockSessionPromptCommandOperation(db: Database, input: {
+    workspaceId: string;
+    actor: SessionCommandActor;
+    operationKey: string;
+}): Promise<void>;
+/** Return only a fully committed exact prompt receipt with the new boundary fingerprint. */
+export declare function getCompletedSessionPromptCommandReceipt(db: Database, input: {
+    workspaceId: string;
+    actor: SessionCommandActor;
+    action: SessionPromptCommandAction;
+    targetSessionId: string;
+    operationKey: string;
+    boundaryRequestHash: string;
+}): Promise<SessionCommandReceiptRow | null>;
 export declare function reserveSessionCommandReceipt(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -439,6 +473,7 @@ export declare function reserveSessionCommandReceipt(db: Database, input: {
     operationKey: string;
     canonicalRequestHash: string;
     identityScope?: "actor" | "goal_operation";
+    initialResult?: Record<string, unknown>;
 }): Promise<{
     receipt: SessionCommandReceiptRow;
     replay: boolean;

package/dist/session-queue-commands.d.ts

@@ -53,6 +53,18 @@ export type SubmitHumanPromptResult = {
     workspaceControlEventId: string | null;
     replay: boolean;
 };
+export declare function replaySubmittedHumanPromptFromBoundaryReceipt(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    actor: SessionCommandActor;
+    operationKey: string;
+    delivery: "send" | "steer";
+    boundaryRequestHash: string;
+    expectedDraftRevision?: number | null;
+    /** Wait for an overlapping same-key transaction before checking committed replay truth. */
+    serializeOperation?: boolean;
+}): Promise<SubmitHumanPromptResult | null>;
 export type AgentInternalUpdateCommandResult = {
     receipt: SessionCommandReceiptRow;
     updateId: string;
@@ -179,6 +191,8 @@ export declare function submitHumanPromptInTransaction(db: SessionActivityDataba
     subjectLabel?: string;
     actor: SessionCommandActor;
     operationKey: string;
+    /** Stable parsed boundary-request identity used before mutable enrichment. */
+    boundaryRequestHash?: string;
     delivery: "send" | "steer";
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
@@ -213,6 +227,9 @@ export declare function submitHumanPromptInTransaction(db: SessionActivityDataba
         id: string;
         headersEncrypted: Record<string, string>;
     }>;
+    /** Trusted database-only admission seam. It runs only after a completed
+     * operation replay has been ruled out; throwing rolls the prompt back. */
+    beforeFreshPromptCommit?: (tx: Database) => Promise<void>;
     /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
     controlLockTimeoutMs?: number;
 }): Promise<SubmitHumanPromptResult>;

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-5NNCGFQY.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-RLQVPOVR.js";
+import "./chunk-HZV7O6JR.js";
+import "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-SZAWDXQC.js";
-import "./chunk-F6PBS6WE.js";
-import "./chunk-O56DM5GZ.js";
+} from "./chunk-5S4BQAHX.js";
+import "./chunk-HZV7O6JR.js";
+import "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/dist/xai-subscription.d.ts

@@ -97,6 +97,14 @@ export declare function listXaiSubscriptionAccountsMetadata(db: Database, input:
 export declare function workspaceXaiSubscriptionActive(db: Database, settings: {
     readonly supergrokSubscriptionEnabled: boolean;
 }, workspaceId: string, subjectId: string): Promise<boolean>;
+/** Metadata-only readiness for the exact provider-account authority frozen on a turn. */
+export declare function workspaceXaiSubscriptionActiveForAuthority(db: Database, settings: {
+    readonly supergrokSubscriptionEnabled: boolean;
+}, input: {
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+}): Promise<boolean>;
 export declare function getXaiSubscriptionAccountMetadata(db: Database, input: {
     workspaceId: string;
     subjectId: string;

package/drizzle/0387_bound_host_export_session_payloads.sql

@@ -0,0 +1,165 @@
+-- deployment-mode: rolling
+-- Host export is an optional bounded projection. Canonical session_events keeps
+-- the complete lossless payload; an oversized projection must never roll back
+-- the source event or a later lifecycle transaction that closes pending work.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.enqueue_host_session_event_export()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_enabled boolean;
+      v_initiator jsonb;
+      v_context jsonb := '{}'::jsonb;
+      v_origin text;
+      v_source_payload_bytes integer;
+      v_export_payload jsonb;
+      v_export_payload_codec_version smallint;
+      v_payload_bytes integer;
+    BEGIN
+      IF NEW.type IN (
+        'agent.message.delta', 'agent.reasoning.delta',
+        'sandbox.command.output.delta', 'terminal.pty.output.delta'
+      ) THEN
+        RETURN NEW;
+      END IF;
+
+      SELECT c.session_events_enabled INTO v_enabled
+      FROM %1$I.host_export_config c WHERE c.id = 1
+      FOR SHARE;
+      IF coalesce(v_enabled, false) = false THEN
+        RETURN NEW;
+      END IF;
+
+      IF NEW.turn_id IS NOT NULL THEN
+        SELECT
+          CASE WHEN octet_length(t.initiator_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', t.initiator_kind,
+              'subjectId', t.initiator_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+                THEN left(t.initiator_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+              THEN left(t.initiator_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'backfill') = 'boolean'
+              THEN t.initiator_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(t.initiator_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          t.source
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.session_turns t
+        WHERE t.workspace_id = NEW.workspace_id AND t.id = NEW.turn_id;
+      ELSIF NEW.type = 'session.created' THEN
+        SELECT
+          CASE WHEN octet_length(s.created_by_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', s.created_by_kind,
+              'subjectId', s.created_by_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+                THEN left(s.created_by_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+              THEN left(s.created_by_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'backfill') = 'boolean'
+              THEN s.created_by_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(s.created_by_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          NULL
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.sessions s
+        WHERE s.workspace_id = NEW.workspace_id AND s.id = NEW.session_id;
+      END IF;
+
+      v_source_payload_bytes := octet_length(NEW.payload::text);
+      v_export_payload := NEW.payload;
+      v_export_payload_codec_version := NEW.payload_codec_version;
+      IF v_source_payload_bytes > 65536 THEN
+        v_export_payload := jsonb_build_object(
+          '_hostExport', jsonb_build_object(
+            'payloadMode', 'summary',
+            'payloadTruncated', true,
+            'originalBytes', v_source_payload_bytes,
+            'sourceEventId', NEW.id,
+            'fullPayload', 'retained in canonical session event'
+          ),
+          'preview', '[host-export payload omitted at bounded projection boundary]'
+        );
+        -- The projection is literal PostgreSQL JSON, not an application-codec
+        -- envelope. Preserve codec truth only when the original payload is kept.
+        v_export_payload_codec_version := NULL;
+      END IF;
+
+      v_payload_bytes := octet_length(v_export_payload::text)
+        + octet_length(NEW.type)
+        + coalesce(octet_length(NEW.client_event_id), 0)
+        + coalesce(octet_length(NEW.turn_association), 0)
+        + coalesce(octet_length(NEW.duplicate_reason), 0)
+        + octet_length(coalesce(v_initiator, 'null'::jsonb)::text)
+        + octet_length(v_context::text)
+        + 768;
+      INSERT INTO %1$I.host_export_outbox (
+        export_kind, source_id, account_id, workspace_id, session_id,
+        turn_id, turn_generation, turn_attempt_id, session_sequence,
+        client_event_id, turn_association, duplicate_of_event_id, duplicate_reason,
+        event_type, idempotency_key, initiator, initiator_context, origin,
+        payload, payload_codec_version, envelope_bytes, occurred_at,
+        source_recorded_at, enqueued_at
+      ) VALUES (
+        'session_event', NEW.id, NEW.account_id, NEW.workspace_id, NEW.session_id,
+        NEW.turn_id, NEW.turn_generation, NEW.turn_attempt_id, NEW.sequence,
+        NEW.client_event_id, NEW.turn_association, NEW.duplicate_of_event_id,
+        NEW.duplicate_reason,
+        NEW.type, 'session_event:' || NEW.id::text, v_initiator,
+        coalesce(v_context, '{}'::jsonb), v_origin, v_export_payload,
+        v_export_payload_codec_version, greatest(1, v_payload_bytes), NEW.occurred_at,
+        NEW.created_at, clock_timestamp()
+      )
+      ON CONFLICT (export_kind, source_id) DO NOTHING;
+      RETURN NEW;
+    END $function$;
+  $create$, target_schema);
+END
+$migration$;
+
+COMMENT ON COLUMN host_export_outbox.payload IS
+  'Immutable bounded host projection. Canonical session_events retains the complete payload; oversized host projections carry an explicit content-free truncation receipt.';
+COMMENT ON COLUMN host_export_outbox.payload_codec_version IS
+  'Codec truth for the stored host projection. NULL means literal SQL JSON, including oversized-payload projections; 1 means the original application-coded payload was retained exactly.';