@opengeni/db 3.7.4 → 3.8.2-canary.0

package/src/session-control.ts

@@ -1884,6 +1884,174 @@ async function findCommandReceipt(
   return rows[0] ?? null;
 }
 
+export type SessionPromptCommandAction = "prompt.send" | "prompt.steer";
+
+async function findPromptCommandReceipts(
+  db: Database,
+  input: {
+    workspaceId: string;
+    actor: SessionCommandActor;
+    operationKey: string;
+    lock?: "none" | "update";
+  },
+): Promise<SessionCommandReceiptRow[]> {
+  const actorSubjectId = input.actor.type === "agent_attempt" ? null : input.actor.subjectId;
+  const actorAttemptId = input.actor.type === "agent_attempt" ? input.actor.attemptId : null;
+  const query = db
+    .select()
+    .from(schema.sessionCommandReceipts)
+    .where(
+      and(
+        eq(schema.sessionCommandReceipts.workspaceId, input.workspaceId),
+        eq(schema.sessionCommandReceipts.actorType, input.actor.type),
+        sql`${schema.sessionCommandReceipts.actorSubjectId} is not distinct from ${actorSubjectId}`,
+        sql`${schema.sessionCommandReceipts.actorAttemptId} is not distinct from ${actorAttemptId}::uuid`,
+        inArray(schema.sessionCommandReceipts.action, ["prompt.send", "prompt.steer"]),
+        eq(schema.sessionCommandReceipts.operationKey, input.operationKey),
+      ),
+    );
+  const rows = input.lock === "update" ? await query.for("update") : await query;
+  return rows;
+}
+
+function fingerprintedPromptCommandReceipt(
+  receipts: readonly SessionCommandReceiptRow[],
+): SessionCommandReceiptRow | null {
+  const fingerprinted = receipts.filter(
+    (receipt) => typeof receipt.result.boundaryRequestHash === "string",
+  );
+  if (fingerprinted.length > 1) {
+    throw new SessionControlInvariantError(
+      "Prompt operation key resolved to multiple fingerprinted receipts",
+    );
+  }
+  return fingerprinted[0] ?? null;
+}
+
+function assertPromptCommandReceiptIdentity(
+  receipt: SessionCommandReceiptRow,
+  input: {
+    action: SessionPromptCommandAction;
+    targetSessionId: string;
+    boundaryRequestHash: string;
+  },
+): void {
+  if (
+    receipt.action !== input.action ||
+    receipt.targetSessionId !== input.targetSessionId ||
+    receipt.targetTurnId !== null ||
+    (typeof receipt.result.boundaryRequestHash === "string" &&
+      receipt.result.boundaryRequestHash !== input.boundaryRequestHash)
+  ) {
+    throw new SessionCommandIdempotencyError();
+  }
+}
+
+/**
+ * Prompt operation keys are actor-scoped across target sessions and across the
+ * Send/Steer action pair. The advisory lock closes the gap left by the legacy
+ * action/target-specific unique index without changing old receipt identities.
+ */
+export async function reserveSessionPromptCommandReceipt(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    actor: SessionCommandActor;
+    action: SessionPromptCommandAction;
+    targetSessionId: string;
+    operationKey: string;
+    canonicalRequestHash: string;
+    boundaryRequestHash: string;
+  },
+): Promise<{ receipt: SessionCommandReceiptRow; replay: boolean }> {
+  await lockSessionPromptCommandOperation(db, input);
+  const existingReceipts = await findPromptCommandReceipts(db, {
+    workspaceId: input.workspaceId,
+    actor: input.actor,
+    operationKey: input.operationKey,
+    lock: "update",
+  });
+  const fingerprinted = fingerprintedPromptCommandReceipt(existingReceipts);
+  if (fingerprinted) {
+    assertPromptCommandReceiptIdentity(fingerprinted, input);
+    return { receipt: fingerprinted, replay: true };
+  }
+  const legacyExact = existingReceipts.find(
+    (receipt) =>
+      receipt.action === input.action &&
+      receipt.targetSessionId === input.targetSessionId &&
+      receipt.targetTurnId === null,
+  );
+  if (legacyExact) {
+    if (legacyExact.canonicalRequestHash !== input.canonicalRequestHash) {
+      throw new SessionCommandIdempotencyError();
+    }
+    return { receipt: legacyExact, replay: true };
+  }
+  return await reserveSessionCommandReceipt(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    actor: input.actor,
+    action: input.action,
+    targetSessionId: input.targetSessionId,
+    targetTurnId: null,
+    operationKey: input.operationKey,
+    canonicalRequestHash: input.canonicalRequestHash,
+    ...(existingReceipts.length === 0
+      ? { initialResult: { boundaryRequestHash: input.boundaryRequestHash } }
+      : {}),
+  });
+}
+
+/** Serialize one actor-scoped prompt operation before replay or reservation. */
+export async function lockSessionPromptCommandOperation(
+  db: Database,
+  input: {
+    workspaceId: string;
+    actor: SessionCommandActor;
+    operationKey: string;
+  },
+): Promise<void> {
+  const actorIdentity =
+    input.actor.type === "agent_attempt"
+      ? `attempt:${input.actor.attemptId}`
+      : `${input.actor.type}:${input.actor.subjectId}`;
+  await db.execute(
+    sql`select pg_advisory_xact_lock(hashtextextended(${`session-prompt:${input.workspaceId}:${actorIdentity}:${input.operationKey}`}, 0))`,
+  );
+}
+
+/** Return only a fully committed exact prompt receipt with the new boundary fingerprint. */
+export async function getCompletedSessionPromptCommandReceipt(
+  db: Database,
+  input: {
+    workspaceId: string;
+    actor: SessionCommandActor;
+    action: SessionPromptCommandAction;
+    targetSessionId: string;
+    operationKey: string;
+    boundaryRequestHash: string;
+  },
+): Promise<SessionCommandReceiptRow | null> {
+  const receipt = fingerprintedPromptCommandReceipt(
+    await findPromptCommandReceipts(db, {
+      workspaceId: input.workspaceId,
+      actor: input.actor,
+      operationKey: input.operationKey,
+    }),
+  );
+  if (!receipt) return null;
+  assertPromptCommandReceiptIdentity(receipt, input);
+  if (
+    typeof receipt.result.boundaryRequestHash !== "string" ||
+    receipt.appliedQueueVersion === null
+  ) {
+    return null;
+  }
+  return receipt;
+}
+
 export async function reserveSessionCommandReceipt(
   db: Database,
   input: {
@@ -1896,6 +2064,7 @@ export async function reserveSessionCommandReceipt(
     operationKey: string;
     canonicalRequestHash: string;
     identityScope?: "actor" | "goal_operation";
+    initialResult?: Record<string, unknown>;
   },
 ): Promise<{ receipt: SessionCommandReceiptRow; replay: boolean }> {
   if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
@@ -1926,6 +2095,7 @@ export async function reserveSessionCommandReceipt(
       targetTurnId: input.targetTurnId,
       operationKey: input.operationKey,
       canonicalRequestHash: input.canonicalRequestHash,
+      result: input.initialResult ?? {},
     })
     .onConflictDoNothing()
     .returning();

package/src/session-queue-commands.ts

@@ -44,10 +44,13 @@ import {
   canonicalSessionCommandHash,
   evaluateSessionControl,
   lockSessionEventWriteRows,
+  lockSessionPromptCommandOperation,
   lockWorkspaceInferenceControl,
   lockWorkspaceInferenceControlForAdmission,
+  getCompletedSessionPromptCommandReceipt,
   registerInternalUpdateWakeInTransaction,
   reserveSessionCommandReceipt,
+  reserveSessionPromptCommandReceipt,
   registerSessionWorkflowWakeInTransaction,
   type SessionCommandActor,
   type SessionCommandReceiptRow,
@@ -210,6 +213,122 @@ function mapSubmittedPromptTurn(row: typeof schema.sessionTurns.$inferSelect): S
   };
 }
 
+async function loadSubmittedHumanPromptReplay(
+  db: Database,
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    delivery: "send" | "steer";
+    expectedDraftRevision?: number | null;
+    receipt: SessionCommandReceiptRow;
+  },
+): Promise<SubmitHumanPromptResult> {
+  const turnId = String(input.receipt.result.turnId ?? "");
+  const acceptedEventId = String(input.receipt.result.acceptedEventId ?? "");
+  const eventIds = Array.isArray(input.receipt.result.eventIds)
+    ? input.receipt.result.eventIds.filter((id): id is string => typeof id === "string")
+    : [];
+  const wakeRevision = Number(input.receipt.result.wakeRevision ?? 0);
+  if (!turnId || !acceptedEventId || wakeRevision < 1) {
+    throw new SessionControlInvariantError("Replayed prompt receipt is incomplete");
+  }
+  const replayEvents = await db
+    .select()
+    .from(schema.sessionEvents)
+    .where(
+      and(
+        eq(schema.sessionEvents.workspaceId, input.workspaceId),
+        eq(schema.sessionEvents.sessionId, input.sessionId),
+        inArray(schema.sessionEvents.id, eventIds),
+      ),
+    )
+    .orderBy(asc(schema.sessionEvents.sequence));
+  const [replayTurn] = await db
+    .select()
+    .from(schema.sessionTurns)
+    .where(
+      and(
+        eq(schema.sessionTurns.workspaceId, input.workspaceId),
+        eq(schema.sessionTurns.sessionId, input.sessionId),
+        eq(schema.sessionTurns.id, turnId),
+      ),
+    )
+    .limit(1);
+  const events = replayEvents.map(mapSubmittedPromptEvent);
+  const accepted = events.find((event) => event.id === acceptedEventId);
+  if (!accepted || !replayTurn || events.length !== eventIds.length) {
+    throw new SessionControlInvariantError("Replayed prompt rows are incomplete");
+  }
+  const replayDraft =
+    input.expectedDraftRevision === null || input.expectedDraftRevision === undefined
+      ? null
+      : await getComposerDraftInTransaction(db, {
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          subjectId: input.subjectId,
+        });
+  return {
+    receipt: input.receipt,
+    routing:
+      input.receipt.result.routing === "accepted_for_execution" ||
+      input.receipt.result.routing === "queued_for_execution" ||
+      input.receipt.result.routing === "accepted_for_steering"
+        ? input.receipt.result.routing
+        : input.delivery === "steer"
+          ? "accepted_for_steering"
+          : // Pre-routing receipts cannot reconstruct admission-time activity
+            // or Pause truth. Queue is the only conservative placement; a
+            // later turn.started event moves it into chat without duplication.
+            "queued_for_execution",
+    queueVersion: Number(input.receipt.appliedQueueVersion),
+    accepted,
+    events,
+    turn: mapSubmittedPromptTurn(replayTurn),
+    draft: replayDraft,
+    acceptedEventId,
+    eventIds,
+    turnId,
+    wakeRevision,
+    interruptionCount: Number(input.receipt.result.interruptionCount ?? 0),
+    workspaceControlEventId:
+      typeof input.receipt.result.workspaceControlEventId === "string"
+        ? input.receipt.result.workspaceControlEventId
+        : null,
+    replay: true,
+  };
+}
+
+export async function replaySubmittedHumanPromptFromBoundaryReceipt(
+  db: Database,
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    actor: SessionCommandActor;
+    operationKey: string;
+    delivery: "send" | "steer";
+    boundaryRequestHash: string;
+    expectedDraftRevision?: number | null;
+    /** Wait for an overlapping same-key transaction before checking committed replay truth. */
+    serializeOperation?: boolean;
+  },
+): Promise<SubmitHumanPromptResult | null> {
+  if (input.serializeOperation) {
+    await lockSessionPromptCommandOperation(db, input);
+  }
+  const receipt = await getCompletedSessionPromptCommandReceipt(db, {
+    workspaceId: input.workspaceId,
+    actor: input.actor,
+    action: input.delivery === "steer" ? "prompt.steer" : "prompt.send",
+    targetSessionId: input.sessionId,
+    operationKey: input.operationKey,
+    boundaryRequestHash: input.boundaryRequestHash,
+  });
+  if (!receipt) return null;
+  return await loadSubmittedHumanPromptReplay(db, { ...input, receipt });
+}
+
 export type AgentInternalUpdateCommandResult = {
   receipt: SessionCommandReceiptRow;
   updateId: string;
@@ -1608,6 +1727,8 @@ export async function submitHumanPromptInTransaction(
     subjectLabel?: string;
     actor: SessionCommandActor;
     operationKey: string;
+    /** Stable parsed boundary-request identity used before mutable enrichment. */
+    boundaryRequestHash?: string;
     delivery: "send" | "steer";
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
@@ -1642,6 +1763,9 @@ export async function submitHumanPromptInTransaction(
       id: string;
       headersEncrypted: Record<string, string>;
     }>;
+    /** Trusted database-only admission seam. It runs only after a completed
+     * operation replay has been ruled out; throwing rolls the prompt back. */
+    beforeFreshPromptCommit?: (tx: Database) => Promise<void>;
     /** Request-scoped callers bound the control prefix wait; lifecycle callers omit it. */
     controlLockTimeoutMs?: number;
   },
@@ -1708,91 +1832,41 @@ export async function submitHumanPromptInTransaction(
         }
       : {}),
   });
-  const reserved = await reserveSessionCommandReceipt(db, {
-    accountId: input.accountId,
-    workspaceId: input.workspaceId,
-    actor: input.actor,
-    action: input.delivery === "steer" ? "prompt.steer" : "prompt.send",
-    targetSessionId: input.sessionId,
-    targetTurnId: null,
-    operationKey: input.operationKey,
-    canonicalRequestHash: requestHash,
-  });
+  const action = input.delivery === "steer" ? "prompt.steer" : "prompt.send";
+  const reserved = input.boundaryRequestHash
+    ? await reserveSessionPromptCommandReceipt(db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        actor: input.actor,
+        action,
+        targetSessionId: input.sessionId,
+        operationKey: input.operationKey,
+        canonicalRequestHash: requestHash,
+        boundaryRequestHash: input.boundaryRequestHash,
+      })
+    : await reserveSessionCommandReceipt(db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        actor: input.actor,
+        action,
+        targetSessionId: input.sessionId,
+        targetTurnId: null,
+        operationKey: input.operationKey,
+        canonicalRequestHash: requestHash,
+      });
   if (reserved.replay && reserved.receipt.appliedQueueVersion !== null) {
-    const turnId = String(reserved.receipt.result.turnId ?? "");
-    const acceptedEventId = String(reserved.receipt.result.acceptedEventId ?? "");
-    const eventIds = Array.isArray(reserved.receipt.result.eventIds)
-      ? reserved.receipt.result.eventIds.filter((id): id is string => typeof id === "string")
-      : [];
-    const wakeRevision = Number(reserved.receipt.result.wakeRevision ?? 0);
-    if (!turnId || !acceptedEventId || wakeRevision < 1) {
-      throw new SessionControlInvariantError("Replayed prompt receipt is incomplete");
-    }
-    const replayEvents = await db
-      .select()
-      .from(schema.sessionEvents)
-      .where(
-        and(
-          eq(schema.sessionEvents.workspaceId, input.workspaceId),
-          eq(schema.sessionEvents.sessionId, input.sessionId),
-          inArray(schema.sessionEvents.id, eventIds),
-        ),
-      )
-      .orderBy(asc(schema.sessionEvents.sequence));
-    const [replayTurn] = await db
-      .select()
-      .from(schema.sessionTurns)
-      .where(
-        and(
-          eq(schema.sessionTurns.workspaceId, input.workspaceId),
-          eq(schema.sessionTurns.sessionId, input.sessionId),
-          eq(schema.sessionTurns.id, turnId),
-        ),
-      )
-      .limit(1);
-    const events = replayEvents.map(mapSubmittedPromptEvent);
-    const accepted = events.find((event) => event.id === acceptedEventId);
-    if (!accepted || !replayTurn || events.length !== eventIds.length) {
-      throw new SessionControlInvariantError("Replayed prompt rows are incomplete");
-    }
-    const replayDraft =
-      input.expectedDraftRevision === null || input.expectedDraftRevision === undefined
-        ? null
-        : await getComposerDraftInTransaction(db, {
-            workspaceId: input.workspaceId,
-            sessionId: input.sessionId,
-            subjectId: input.subjectId,
-          });
-    return {
+    return await loadSubmittedHumanPromptReplay(db, {
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      subjectId: input.subjectId,
+      delivery: input.delivery,
+      ...(input.expectedDraftRevision !== undefined
+        ? { expectedDraftRevision: input.expectedDraftRevision }
+        : {}),
       receipt: reserved.receipt,
-      routing:
-        reserved.receipt.result.routing === "accepted_for_execution" ||
-        reserved.receipt.result.routing === "queued_for_execution" ||
-        reserved.receipt.result.routing === "accepted_for_steering"
-          ? reserved.receipt.result.routing
-          : input.delivery === "steer"
-            ? "accepted_for_steering"
-            : // Pre-routing receipts cannot reconstruct admission-time activity
-              // or Pause truth. Queue is the only conservative placement; a
-              // later turn.started event moves it into chat without duplication.
-              "queued_for_execution",
-      queueVersion: Number(reserved.receipt.appliedQueueVersion),
-      accepted,
-      events,
-      turn: mapSubmittedPromptTurn(replayTurn),
-      draft: replayDraft,
-      acceptedEventId,
-      eventIds,
-      turnId,
-      wakeRevision,
-      interruptionCount: Number(reserved.receipt.result.interruptionCount ?? 0),
-      workspaceControlEventId:
-        typeof reserved.receipt.result.workspaceControlEventId === "string"
-          ? reserved.receipt.result.workspaceControlEventId
-          : null,
-      replay: true,
-    };
+    });
   }
+  await input.beforeFreshPromptCommit?.(db);
 
   const before = await evaluateSessionControl(db, input.workspaceId, input.sessionId, {
     workspaceControl,
@@ -2434,6 +2508,7 @@ export async function submitHumanPromptInTransaction(
     turnVersion: turn.version,
     ...(nextDraft ? { draftRevision: nextDraft.revision } : {}),
     result: {
+      ...(input.boundaryRequestHash ? { boundaryRequestHash: input.boundaryRequestHash } : {}),
       turnId,
       acceptedEventId,
       eventIds,

package/src/xai-subscription.ts

@@ -472,20 +472,72 @@ export async function workspaceXaiSubscriptionActive(
     workspaceId,
     subjectId,
   });
-  const [accounts, rotation] = await Promise.all([
-    listXaiSubscriptionAccountsMetadata(db, { workspaceId, subjectId }),
-    getXaiRotationSettings(db, { workspaceId, subjectId, authoritySnapshot }),
-  ]);
-  const activeCredentialId = rotation?.activeCredentialId ?? null;
-  const now = new Date();
-  const eligible = (account: XaiSubscriptionAccountMetadata) =>
-    account.status === "active" &&
-    account.allocatorEnabled &&
-    (!account.exhaustedUntil || account.exhaustedUntil <= now);
-  if (rotation?.rotationEnabled !== false) {
-    return accounts.some(eligible);
-  }
-  return accounts.some((account) => account.id === activeCredentialId && eligible(account));
+  return await workspaceXaiSubscriptionActiveForAuthority(db, settings, {
+    workspaceId,
+    subjectId,
+    authoritySnapshot,
+  });
+}
+
+/** Metadata-only readiness for the exact provider-account authority frozen on a turn. */
+export async function workspaceXaiSubscriptionActiveForAuthority(
+  db: Database,
+  settings: { readonly supergrokSubscriptionEnabled: boolean },
+  input: {
+    workspaceId: string;
+    subjectId: string;
+    authoritySnapshot: XaiAuthoritySnapshot;
+  },
+): Promise<boolean> {
+  if (!settings.supergrokSubscriptionEnabled) return false;
+  const snapshot = XaiProviderAccountAuthoritySnapshotV1.parse(input.authoritySnapshot);
+  return await withWorkspaceSubjectRls(db, input.workspaceId, input.subjectId, async (scopedDb) => {
+    const ownerMembershipId = await resolveXaiPoolOwnerMembershipId(scopedDb, {
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      authoritySnapshot: snapshot,
+    });
+    const ownerPredicate =
+      ownerMembershipId === null
+        ? isNull(schema.xaiSubscriptionCredentials.ownerOrganizationMembershipId)
+        : eq(schema.xaiSubscriptionCredentials.ownerOrganizationMembershipId, ownerMembershipId);
+    const [accounts, rotation] = await Promise.all([
+      scopedDb
+        .select(xaiCredentialMetadataColumns)
+        .from(schema.xaiSubscriptionCredentials)
+        .where(
+          and(
+            eq(schema.xaiSubscriptionCredentials.workspaceId, input.workspaceId),
+            eq(schema.xaiSubscriptionCredentials.authorityScope, snapshot.scope),
+            ownerPredicate,
+          ),
+        ),
+      scopedDb
+        .select()
+        .from(schema.xaiRotationSettings)
+        .where(
+          and(
+            eq(schema.xaiRotationSettings.workspaceId, input.workspaceId),
+            eq(schema.xaiRotationSettings.authorityScope, snapshot.scope),
+            ownerMembershipId === null
+              ? isNull(schema.xaiRotationSettings.ownerOrganizationMembershipId)
+              : eq(schema.xaiRotationSettings.ownerOrganizationMembershipId, ownerMembershipId),
+          ),
+        )
+        .limit(1)
+        .then((rows) => rows[0] ?? null),
+    ]);
+    const activeCredentialId = rotation?.activeCredentialId ?? null;
+    const now = new Date();
+    const eligible = (account: XaiCredentialMetadataRow) =>
+      account.status === "active" &&
+      account.allocatorEnabled &&
+      (!account.exhaustedUntil || account.exhaustedUntil <= now);
+    if (rotation?.rotationEnabled !== false) {
+      return accounts.some(eligible);
+    }
+    return accounts.some((account) => account.id === activeCredentialId && eligible(account));
+  });
 }
 
 export async function getXaiSubscriptionAccountMetadata(