@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/workspaces.ts

@@ -1,3 +1,18 @@
+import { AZURE_LIVE_MODEL_ID } from "../azure-live";
+import {
+  createRealtimeVoiceBilling,
+  deploymentRealtimeVoice,
+  realtimeVoiceOfferProblem,
+} from "@opengeni/core";
+import { withDirectModelProviders, workspaceModelCompactionPolicy } from "@opengeni/config";
+import { listConnectionsMetadata } from "@opengeni/db";
+import {
+  workspaceProviderApiKeyConnectionMetadataFromConnections,
+  listWorkspaceProviderCustomModelsByKind,
+  getOrganizationModelProviderCatalogForWorkspace,
+  type WorkspaceCustomModelProviderKind,
+} from "@opengeni/db";
+import { CLAUDE_CONNECTION_KINDS, type ClaudeConnectionCatalog } from "@opengeni/config";
 import { SessionControlConflictError, WorkspacePauseTimerInputError } from "@opengeni/db";
 import { updateWorkspaceSettingsWithToolDefaults } from "@opengeni/db/workspace-tool-defaults";
 import { WorkspacePauseTimerRequest } from "@opengeni/contracts";
@@ -17,6 +32,7 @@ import {
   DeleteWorkspaceGatewayCustomModelRequest,
   DeleteWorkspaceOpenRouterCustomModelRequest,
   UpdateWorkspaceModelPolicyRequest,
+  WorkspaceModelPolicyResponse,
   UpdateWorkspaceRequest,
   UpdateWorkspaceSettingsRequest,
   WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
@@ -25,6 +41,9 @@ import {
   WorkspaceGatewayCustomModelsResponse,
   WorkspaceOpenRouterCustomModel,
   WorkspaceOpenRouterCustomModelsResponse,
+  WorkspaceOpperCustomModelsResponse,
+  CreateWorkspaceOpperCustomModelRequest,
+  DeleteWorkspaceOpperCustomModelRequest,
   WorkspaceRealtimeModelCatalogResponse,
   WorkspaceInferenceControlRequest,
   Workspace,
@@ -36,13 +55,20 @@ import {
   type WorkspaceMemberCandidate,
   type WorkspaceMember as WorkspaceMemberValue,
 } from "@opengeni/contracts";
+import { loadWorkspaceCodexCatalogReadiness } from "@opengeni/core";
 import {
   allWorkspacePermissions,
+  getBillingBalance,
+  spendableCreditMicros,
   createWorkspace,
   ensureWorkspaceByExternalIdentity,
   findWorkspaceByExternalIdentity,
   getManagedUserProfilesByIds,
+  getWorkspace,
   getWorkspaceModelPolicy,
+  getWorkspaceModelPolicyLayers,
+  getOrganizationModelDefaults,
+  deleteWorkspaceModelPolicy,
   grantWorkspaceAccess,
   listWorkspaceMembers,
   listWorkspaceMemberManagementCandidates,
@@ -67,18 +93,21 @@ import {
   updateWorkspace,
   upsertWorkspaceMemberAsWorkspaceManager,
   upsertWorkspaceModelPolicy,
-  workspaceCodexSubscriptionActive,
+  readCodexCutoverDisposition,
+  listSubscriptionCoreCodexOperationCandidates,
   workspaceControlRequestLockTimeoutMs,
-  workspaceXaiSubscriptionActive,
   workspaceVercelAiGatewayConnectionActive,
-  workspaceOpenRouterConnectionActive,
-  organizationModelProviderConnectionActiveForWorkspace,
-  listOrganizationModelProviderCustomModelsForWorkspace,
   WorkspaceGatewayCustomModelHistoryLimitError,
   WorkspaceOpenRouterCustomModelHistoryLimitError,
   WorkspaceExternalIdentityConflictError,
   WorkspaceGatewayCustomModelLimitError,
   WorkspaceOpenRouterCustomModelLimitError,
+  WorkspaceOpperCustomModelLimitError,
+  WorkspaceOpperCustomModelHistoryLimitError,
+  listWorkspaceProviderCustomModels,
+  createWorkspaceProviderCustomModel,
+  deleteWorkspaceProviderCustomModel,
+  replayWorkspaceProviderCustomModelCreate,
   WorkspaceLimitExceededError,
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
@@ -87,14 +116,26 @@ import { HTTPException } from "hono/http-exception";
 import {
   getManagedAuthRequestActorEpoch,
   accountScopedApiKeyWorkspaceAuthority,
+  organizationWorkspaceInScope,
   hasPermission,
   requireAccessContext,
+  requireApiKeyDelegationContext,
+  requireExplicitPermissionDelegation,
+  isDeveloperSetupApiKeyContext,
   listExternalActorWorkspaces,
   addExternalWorkspaceMemberForRequest,
   requireAccessGrant,
+  requireWorkspaceMemberManagementAuthority,
   requireWorkspaceSettingsGrant,
   requireFreshAccessGrant,
   resolveWorkspaceCatalogSettings,
+  creditsDefaultSessionModel,
+  loadCoreRoutedXaiCatalogReadiness,
+  loadWorkspaceClaudeSubscriptionReadiness,
+  loadCoreRoutedClaudeCatalogReadiness,
+  withCoreRoutedXaiRestriction,
+  resolveDefaultSessionModelForSelections,
+  resolveWorkspaceModelSelection,
 } from "@opengeni/core";
 import { requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
@@ -107,7 +148,7 @@ import {
 import { boundedLimit } from "../http/common";
 import { ApiHttpError } from "../http/api-error";
 import { browserSseDeliveryOptions, sseWorkspaceControlStream } from "../http/sse";
-import { buildWorkspaceModelCatalog } from "../model-catalog";
+import { projectWorkspaceModelCatalog } from "../model-catalog";
 import { deleteWorkspaceForRequest } from "../workspace-deletion";
 import {
   AI_GATEWAY_REALTIME_MODELS,
@@ -120,10 +161,17 @@ import {
   configuredModelInputIdentities,
   configuredOpenRouterUpstreamModelIds,
   configuredOpenRouterWorkspaceProductModelIds,
+  configuredOpperUpstreamModelIds,
+  configuredOpperWorkspaceProductModelIds,
+  WORKSPACE_OPPER_MODEL_ID_PREFIX,
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
+  sandboxImageAllowlist,
   type Settings,
 } from "@opengeni/config";
+import { AddExternalWorkspaceMemberRequest } from "@opengeni/contracts/external-identities";
+import { parseRequestBody, parseRequestJson, readRequestJson } from "../http/request-body";
+import { workspaceXaiOperationAvailable } from "../xai-subscription-core";
 
 export function canonicalWorkspacePolicyModelIds(
   settings: Settings,
@@ -193,6 +241,14 @@ export function workspaceMembersResponse(members: readonly WorkspaceMemberProjec
   });
 }
 
+export function workspaceUpdateRequestsSettings(value: unknown): boolean {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    Object.prototype.hasOwnProperty.call(value, "settings")
+  );
+}
+
 export function workspaceUpdateRequestsAccountTransfer(value: unknown): boolean {
   return (
     typeof value === "object" &&
@@ -201,35 +257,90 @@ export function workspaceUpdateRequestsAccountTransfer(value: unknown): boolean
   );
 }
 
+/**
+ * Owning organization for `PUT /v1/workspaces/external`. An organization API
+ * key can only ever create workspaces in its own organization, so an omitted
+ * `accountId` resolves to that organization. Every other caller - notably a
+ * human who may belong to several organizations - must name it explicitly;
+ * guessing a default there could create the workspace in the wrong tenant.
+ */
+export function externalWorkspaceAccountId(
+  context: AccessContext,
+  requested: string | undefined,
+): string {
+  if (requested !== undefined) return requested;
+  const organizationKey = accountScopedApiKeyWorkspaceAuthority(context);
+  if (organizationKey) return organizationKey.accountId;
+  throw new ApiHttpError(400, {
+    code: "validation_failed",
+    message:
+      "Invalid request body: accountId: required - pass the id of the organization that will own the workspace (only an organization API key may omit it).",
+    retryable: false,
+    details: {
+      code: "invalid_request_body",
+      issues: [{ path: "accountId", message: "Required" }],
+      omittedIssueCount: 0,
+    },
+  });
+}
+
+/**
+ * Codex Live readiness: the legacy active subscription without a cutover
+ * row; on the shared core, any shared connection that could serve a
+ * realtime operation here; never ready during maintenance.
+ */
+async function workspaceCodexRealtimeReady(
+  routeDeps: ApiRouteDeps,
+  grant: { accountId: string; subjectId: string },
+  workspaceId: string,
+): Promise<boolean> {
+  const disposition = await readCodexCutoverDisposition(routeDeps.db, grant.accountId, workspaceId);
+  if (disposition === "maintenance" || !routeDeps.settings.codexSubscriptionEnabled) return false;
+  const candidates = await listSubscriptionCoreCodexOperationCandidates(routeDeps.db, {
+    kind: "workspace",
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId,
+  });
+  return candidates.length > 0;
+}
+
 export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/external-members", async (c) => {
+    // Validate at the HTTP boundary so a malformed body is a 400, not a raw
+    // schema error from the application layer.
+    const body = await readRequestJson(c);
+    parseRequestBody(AddExternalWorkspaceMemberRequest, body);
     return c.json(
-      await addExternalWorkspaceMemberForRequest(
-        c,
-        deps,
-        c.req.param("workspaceId"),
-        await c.req.json(),
-      ),
+      await addExternalWorkspaceMemberForRequest(c, deps, c.req.param("workspaceId"), body),
     );
   });
   app.get("/v1/access/me", async (c) => {
     return c.json(await requireAccessContext(c, deps));
   });
 
+  app.get("/v1/workspaces/:workspaceId/access/grant", async (c) => {
+    // Inventory may be empty for an external actor. Resolve the selected
+    // workspace through the canonical membership/key-ceiling boundary.
+    const grant = await requireAccessGrant(c, deps, c.req.param("workspaceId"));
+    c.header("cache-control", "private, no-store");
+    return c.json(grant);
+  });
+
   app.get("/v1/workspaces", async (c) => {
     const context = await requireAccessContext(c, deps);
     const externalWorkspaces = await listExternalActorWorkspaces(context, deps);
     if (externalWorkspaces !== null)
       return c.json(externalWorkspaces.map((workspace) => Workspace.parse(workspace)));
     const accountScopedAuthority = accountScopedApiKeyWorkspaceAuthority(context);
-    if (
-      accountScopedAuthority &&
-      hasPermission(accountScopedAuthority.permissions, "workspace:read")
-    ) {
+    if (accountScopedAuthority) {
+      if (!hasPermission(accountScopedAuthority.permissions, "workspace:read")) return c.json([]);
       return c.json(
-        (await listSharedWorkspacesForAccount(deps.db, accountScopedAuthority.accountId)).map(
-          (workspace) => Workspace.parse(workspace),
-        ),
+        (await listSharedWorkspacesForAccount(deps.db, accountScopedAuthority.accountId))
+          .filter((workspace) =>
+            organizationWorkspaceInScope(accountScopedAuthority.workspaceScope, workspace.id),
+          )
+          .map((workspace) => Workspace.parse(workspace)),
       );
     }
     const readableWorkspaceIds = [
@@ -254,8 +365,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.put("/v1/workspaces/external", async (c) => {
     const context = await requireAccessContext(c, deps);
-    const payload = EnsureWorkspaceRequest.parse(await c.req.json());
-    requireAccountPermission(context, payload.accountId, "workspace:create");
+    const request = await parseRequestJson(c, EnsureWorkspaceRequest);
+    const accountId = externalWorkspaceAccountId(context, request.accountId);
+    const payload = { ...request, accountId };
+    requireAccountPermission(context, accountId, "workspace:create");
     try {
       const existing = await findWorkspaceByExternalIdentity(deps.db, {
         accountId: payload.accountId,
@@ -266,6 +379,9 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         if (existing.accountId !== payload.accountId || existing.kind !== "shared") {
           throw new WorkspaceExternalIdentityConflictError();
         }
+        const authority = accountScopedApiKeyWorkspaceAuthority(context);
+        if (authority && !organizationWorkspaceInScope(authority.workspaceScope, existing.id))
+          throw new HTTPException(403, { message: "workspace is outside organization key scope" });
         return c.json(
           EnsureWorkspaceResponse.parse({
             workspace: existing,
@@ -292,6 +408,13 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         maxWorkspacesPerAccount: workspaceLimit(deps),
       });
       const response = EnsureWorkspaceResponse.parse(result);
+      const authority = accountScopedApiKeyWorkspaceAuthority(context);
+      if (
+        !result.created &&
+        authority &&
+        !organizationWorkspaceInScope(authority.workspaceScope, result.workspace.id)
+      )
+        throw new HTTPException(403, { message: "workspace is outside organization key scope" });
       return result.created ? c.json(response, 201) : c.json(response);
     } catch (error) {
       if (error instanceof WorkspaceExternalIdentityConflictError) {
@@ -308,7 +431,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces", async (c) => {
     const context = await requireAccessContext(c, deps);
-    const payload = CreateWorkspaceRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateWorkspaceRequest);
     const accountId = payload.accountId ?? context.defaultAccountId;
     if (!accountId) {
       throw new HTTPException(409, {
@@ -335,14 +458,21 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
           : {}),
         maxWorkspacesPerAccount: workspaceLimit(deps),
       });
-      await grantWorkspaceAccess(deps.db, {
-        accountId,
-        workspaceId: workspace.id,
-        subjectId: context.subjectId,
-        role: "owner",
-        permissions: allWorkspacePermissions,
-        ...(context.subjectLabel ? { subjectLabel: context.subjectLabel } : {}),
-      });
+      // Setup keys already have canonical same-organization workspace access.
+      // Do not widen that ceiling with an all-permissions creator membership.
+      if (
+        !isDeveloperSetupApiKeyContext(context) &&
+        accountScopedApiKeyWorkspaceAuthority(context)?.permissionMode !== "explicit"
+      ) {
+        await grantWorkspaceAccess(deps.db, {
+          accountId,
+          workspaceId: workspace.id,
+          subjectId: context.subjectId,
+          role: "owner",
+          permissions: allWorkspacePermissions,
+          ...(context.subjectLabel ? { subjectLabel: context.subjectLabel } : {}),
+        });
+      }
       return c.json(Workspace.parse(workspace), 201);
     } catch (error) {
       if (error instanceof WorkspaceLimitExceededError) {
@@ -361,7 +491,25 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.patch("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const body = await c.req.json();
+    const body = await readRequestJson(c);
+    if (workspaceUpdateRequestsSettings(body)) {
+      throw new ApiHttpError(400, {
+        code: "validation_failed",
+        message:
+          "Invalid request body: settings: workspace settings are not accepted here; send them to PATCH /v1/workspaces/:workspaceId/settings (SDK: updateWorkspaceSettings).",
+        retryable: false,
+        details: {
+          code: "invalid_request_body",
+          issues: [
+            {
+              path: "settings",
+              message: "Use PATCH /v1/workspaces/:workspaceId/settings",
+            },
+          ],
+          omittedIssueCount: 0,
+        },
+      });
+    }
     if (workspaceUpdateRequestsAccountTransfer(body)) {
       throw new ApiHttpError(409, {
         code: "conflict",
@@ -372,7 +520,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         details: { code: "workspace_transfer_unsupported" },
       });
     }
-    const payload = UpdateWorkspaceRequest.parse(body);
+    const payload = parseRequestBody(UpdateWorkspaceRequest, body);
     const workspace = await updateWorkspace(deps.db, workspaceId, {
       ...(payload.name !== undefined ? { name: payload.name.trim() } : {}),
       ...(payload.slug !== undefined ? { slug: payload.slug?.trim() || null } : {}),
@@ -396,6 +544,13 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "invalid workspace settings patch",
       });
     }
+    const requestedImage = parsed.data.defaultSandboxImage;
+    if (requestedImage && !sandboxImageAllowlist(deps.settings).includes(requestedImage)) {
+      throw new HTTPException(422, {
+        message:
+          "defaultSandboxImage must be one of the images in this deployment's OPENGENI_SANDBOX_IMAGE_ALLOWLIST",
+      });
+    }
     // Request-scoped: bound the exclusive control-prefix wait so a busy
     // workspace yields the retryable 503 instead of parking this request.
     try {
@@ -427,77 +582,188 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/model-catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const resolvedCatalog = await deps.resolveCatalogSettings();
+    const providerKinds: WorkspaceCustomModelProviderKind[] = [
+      "vercel_gateway",
+      "openrouter",
+      "opper",
+      ...CLAUDE_CONNECTION_KINDS.filter(
+        (kind) =>
+          kind !== "claude_subscription" || resolvedCatalog.settings.claudeSubscriptionEnabled,
+      ),
+    ];
+    // Claude by its provider route: the shared core's projection (readiness
+    // and both Claude model restrictions) once it has cut over, else legacy.
+    const claudeCore = loadCoreRoutedClaudeCatalogReadiness(deps.db, resolvedCatalog.settings, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+    });
     const [
-      connectionModelRestrictions,
-      resolvedCatalog,
+      currentConnectionModelRestrictions,
       policy,
-      codexSubscriptionActive,
-      xaiSubscriptionActive,
-      workspaceGatewayConnectionActive,
-      workspaceGatewayCustomModels,
-      openRouterConnectionActive,
-      workspaceOpenRouterCustomModels,
-      organizationGatewayConnectionActive,
-      organizationOpenRouterConnectionActive,
-      organizationGatewayCustomModels,
-      organizationOpenRouterCustomModels,
+      codexCatalog,
+      xaiCatalog,
+      claudePool,
+      workspaceConnections,
+      workspaceCustomModels,
+      organizationProviders,
+      workspace,
     ] = await Promise.all([
-      getWorkspaceConnectionModelRestrictions(deps.db, workspaceId, grant.subjectId),
-      deps.resolveCatalogSettings(),
+      claudeCore.then((core) =>
+        getWorkspaceConnectionModelRestrictions(
+          deps.db,
+          workspaceId,
+          grant.subjectId,
+          undefined,
+          core?.restrictions,
+        ),
+      ),
       getWorkspaceModelPolicy(deps.db, workspaceId),
-      workspaceCodexSubscriptionActive(deps.db, deps.settings, workspaceId),
-      workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
-      workspaceVercelAiGatewayConnectionActive(deps.db, workspaceId),
-      listWorkspaceGatewayCustomModels(deps.db, {
-        accountId: grant.accountId,
-        workspaceId,
-      }),
-      workspaceOpenRouterConnectionActive(deps.db, workspaceId),
-      listWorkspaceOpenRouterCustomModels(deps.db, {
-        accountId: grant.accountId,
-        workspaceId,
-      }),
-      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
-        accountId: grant.accountId,
-        workspaceId,
-        providerKind: "vercel_gateway",
-      }),
-      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
+      // By the organization's Codex cutover row: legacy without one, the
+      // shared core for the caller when enabled, not ready while disabled.
+      loadWorkspaceCodexCatalogReadiness(
+        deps.db,
+        resolvedCatalog.settings,
+        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+        { activeSettings: deps.settings },
+      ),
+      // SuperGrok runs only on the shared core: its projection, or not
+      // ready on any other route.
+      loadCoreRoutedXaiCatalogReadiness(deps.db, deps.settings, {
         accountId: grant.accountId,
         workspaceId,
-        providerKind: "openrouter",
-      }),
-      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
+        subjectId: grant.subjectId,
+      }).then(async (core) => ({
+        core,
+        active: core?.ready ?? false,
+      })),
+      // The route read above decides for both Claude readers (read once).
+      claudeCore.then(
+        async (core) =>
+          await loadWorkspaceClaudeSubscriptionReadiness(
+            deps.db,
+            resolvedCatalog.settings,
+            { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
+            core,
+          ),
+      ),
+      listConnectionsMetadata(deps.db, workspaceId, null),
+      listWorkspaceProviderCustomModelsByKind(deps.db, {
         accountId: grant.accountId,
         workspaceId,
-        providerKind: "vercel_gateway",
+        providerKinds,
       }),
-      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
+      getOrganizationModelProviderCatalogForWorkspace(deps.db, {
         accountId: grant.accountId,
         workspaceId,
-        providerKind: "openrouter",
+        providerKinds,
       }),
+      getWorkspace(deps.db, workspaceId),
     ]);
-    c.header("cache-control", "private, no-store");
-    return c.json(
-      WorkspaceModelCatalogResponse.parse(
-        buildWorkspaceModelCatalog({
-          connectionModelRestrictions,
-          settings: resolvedCatalog.settings,
-          policy,
-          codexSubscriptionActive,
-          xaiSubscriptionActive,
-          workspaceGatewayConnectionActive,
-          workspaceGatewayCustomModels,
-          workspaceOpenRouterConnectionActive: openRouterConnectionActive,
-          workspaceOpenRouterCustomModels,
-          organizationGatewayConnectionActive,
-          organizationOpenRouterConnectionActive,
-          organizationGatewayCustomModels,
-          organizationOpenRouterCustomModels,
-        }),
-      ),
+    const xaiSubscriptionActive = xaiCatalog.active;
+    const connectionModelRestrictions = xaiCatalog.core
+      ? withCoreRoutedXaiRestriction(currentConnectionModelRestrictions, xaiCatalog.core)
+      : currentConnectionModelRestrictions;
+    const organizationDefaults = await getOrganizationModelDefaults(deps.db, grant.accountId);
+    const claudeConnections: ClaudeConnectionCatalog = {};
+    const workspaceClaudeConnections: ClaudeConnectionCatalog = {};
+    const workspaceConnectionActive = (kind: WorkspaceCustomModelProviderKind) =>
+      workspaceProviderApiKeyConnectionMetadataFromConnections(workspaceConnections, kind) !== null;
+    for (const kind of CLAUDE_CONNECTION_KINDS) {
+      if (kind === "claude_subscription" && !resolvedCatalog.settings.claudeSubscriptionEnabled)
+        continue;
+      claudeConnections[kind] = {
+        active:
+          kind === "claude_subscription"
+            ? claudePool.organization
+            : organizationProviders[kind].active,
+        models: organizationProviders[kind].models,
+      };
+      workspaceClaudeConnections[kind] = {
+        active:
+          kind === "claude_subscription" ? claudePool.workspace : workspaceConnectionActive(kind),
+        models: workspaceCustomModels[kind],
+      };
+    }
+    const workspaceCatalogSettings = withDirectModelProviders(
+      resolvedCatalog.settings,
+      workspaceConnections,
     );
+    const selections = resolveWorkspaceModelSelection({
+      claudeConnections,
+      workspaceClaudeConnections,
+      connectionModelRestrictions,
+      settings: workspaceCatalogSettings,
+      policy,
+      observations: codexCatalog.observations,
+      codexSubscriptionActive: codexCatalog.active,
+      xaiSubscriptionActive,
+      workspaceGatewayConnectionActive: workspaceConnectionActive("vercel_gateway"),
+      workspaceGatewayCustomModels: workspaceCustomModels.vercel_gateway,
+      workspaceOpenRouterConnectionActive: workspaceConnectionActive("openrouter"),
+      workspaceOpenRouterCustomModels: workspaceCustomModels.openrouter,
+      organizationGatewayConnectionActive: organizationProviders.vercel_gateway.active,
+      organizationOpenRouterConnectionActive: organizationProviders.openrouter.active,
+      organizationGatewayCustomModels: organizationProviders.vercel_gateway.models,
+      organizationOpenRouterCustomModels: organizationProviders.openrouter.models,
+      workspaceOpperConnectionActive: workspaceConnectionActive("opper"),
+      workspaceOpperCustomModels: workspaceCustomModels.opper,
+      organizationOpperConnectionActive: organizationProviders.opper.active,
+      organizationOpperCustomModels: organizationProviders.opper.models,
+    });
+    // The same precedence the server applies when a new chat, API create, or
+    // scheduled occurrence names no model; published so pickers show it.
+    const workspaceSettings = workspace?.settings ?? {};
+    const creditBalance =
+      deps.settings.billingMode === "stripe"
+        ? await getBillingBalance(deps.db, grant.accountId)
+        : undefined;
+    const defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
+      settings: workspaceCatalogSettings,
+      accountId: grant.accountId,
+      workspaceSettings,
+      selections,
+      organizationDefaults,
+    });
+    const catalog = projectWorkspaceModelCatalog(selections, {
+      defaultSelection,
+      creditsSelection: creditsDefaultSessionModel({
+        settings: workspaceCatalogSettings,
+        selections,
+        workspaceSettings,
+        organizationDefaults,
+      }),
+    });
+    for (const model of catalog.models) {
+      model.compactionPolicy = workspaceModelCompactionPolicy(
+        workspaceCatalogSettings,
+        {
+          id: model.id,
+          contextWindowTokens:
+            model.executionLimits?.contextWindowTokens ?? model.contextWindowTokens,
+          effectiveContextWindowTokens:
+            model.executionLimits?.effectiveContextWindowTokens ?? undefined,
+          autoCompactTokenLimit: model.executionLimits?.autoCompactTokenLimit ?? undefined,
+        },
+        workspaceSettings,
+        organizationDefaults,
+      );
+    }
+    if (creditBalance) {
+      for (const model of catalog.models) {
+        if (model.cost !== "credits") continue;
+        model.creditFunding = creditBalance.promotionalCredits?.some(
+          (credit) => credit.remainingMicros > 0 && credit.eligibleModelIds.includes(model.id),
+        )
+          ? "promotional"
+          : spendableCreditMicros(creditBalance, model.id) > 0
+            ? "general"
+            : "unavailable";
+      }
+    }
+    c.header("cache-control", "private, no-store");
+    return c.json(WorkspaceModelCatalogResponse.parse(catalog));
   });
 
   app.get("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
@@ -776,12 +1042,157 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.body(null, 204);
   });
 
+  app.get("/v1/workspaces/:workspaceId/opper-custom-models", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const models = await listWorkspaceProviderCustomModels(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      providerKind: "opper",
+    });
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      WorkspaceOpperCustomModelsResponse.parse({
+        models: models.map(projectWorkspaceOpenRouterCustomModel),
+      }),
+    );
+  });
+
+  app.post("/v1/workspaces/:workspaceId/opper-custom-models", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
+    const parsed = CreateWorkspaceOpperCustomModelRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "invalid Opper custom model" });
+    }
+    const requestHash = workspaceCustomModelRequestHash({
+      action: "create",
+      upstreamModelId: parsed.data.upstreamModelId,
+      label: parsed.data.label ?? null,
+    });
+    const replay = await replayWorkspaceProviderCustomModelCreate(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      providerKind: "opper",
+      operationId: parsed.data.operationId,
+      requestHash,
+    });
+    if (replay.outcome === "conflict") {
+      throw new HTTPException(409, {
+        message: "Opper custom model operation conflicts with current state",
+      });
+    }
+    if (replay.outcome === "success") {
+      return c.json(projectWorkspaceOpenRouterCustomModel(replay.model), 201);
+    }
+    const catalog = await deps.resolveCatalogSettings();
+    if (configuredOpperUpstreamModelIds(catalog.settings).includes(parsed.data.upstreamModelId)) {
+      throw new HTTPException(422, {
+        message: "Opper model is already included in the deployment catalog",
+      });
+    }
+    const customProductId = `${WORKSPACE_OPPER_MODEL_ID_PREFIX}${parsed.data.upstreamModelId}`;
+    const deploymentProductIds = new Set([
+      ...configuredModelInputIdentities(catalog.settings),
+      ...configuredOpperWorkspaceProductModelIds(catalog.settings),
+    ]);
+    if (deploymentProductIds.has(customProductId)) {
+      throw new HTTPException(422, {
+        message: "Opper model product id conflicts with the deployment catalog",
+      });
+    }
+    try {
+      const model = await createWorkspaceProviderCustomModel(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        providerKind: "opper",
+        upstreamModelId: parsed.data.upstreamModelId,
+        label: parsed.data.label ?? null,
+        operationId: parsed.data.operationId,
+        requestHash,
+        createdBySubjectId: grant.subjectId,
+      });
+      if (!model || model.retiredAt) {
+        throw new HTTPException(409, {
+          message: "Opper custom model operation conflicts with current state",
+        });
+      }
+      return c.json(projectWorkspaceOpenRouterCustomModel(model), 201);
+    } catch (error) {
+      if (
+        error instanceof WorkspaceOpperCustomModelLimitError ||
+        error instanceof WorkspaceOpperCustomModelHistoryLimitError
+      ) {
+        throw new HTTPException(422, { message: error.message });
+      }
+      if (nestedPostgresSqlState(error) === "23505") {
+        throw new HTTPException(422, {
+          message: "Opper custom model already exists",
+        });
+      }
+      throw error;
+    }
+  });
+
+  app.delete("/v1/workspaces/:workspaceId/opper-custom-models/:customModelId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
+    const customModelId = c.req.param("customModelId");
+    if (
+      !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+        customModelId,
+      )
+    ) {
+      throw new HTTPException(422, {
+        message: "invalid Opper custom model id",
+      });
+    }
+    const parsed = DeleteWorkspaceOpperCustomModelRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, {
+        message: "invalid Opper custom model deletion",
+      });
+    }
+    const removed = await deleteWorkspaceProviderCustomModel(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      providerKind: "opper",
+      customModelId,
+      expectedVersion: parsed.data.expectedVersion,
+      operationId: parsed.data.operationId,
+      requestHash: workspaceCustomModelRequestHash({
+        action: "delete",
+        customModelId,
+        expectedVersion: parsed.data.expectedVersion,
+      }),
+    });
+    if (removed.outcome === "not_found") {
+      throw new HTTPException(404, {
+        message: "Opper custom model not found",
+      });
+    }
+    if (removed.outcome === "conflict") {
+      throw new HTTPException(409, {
+        message: "Opper custom model changed; reload and retry",
+      });
+    }
+    return c.body(null, 204);
+  });
+
   app.get("/v1/workspaces/:workspaceId/realtime-model-catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     const [codexConnected, supergrokConnected, workspaceGatewayConnected] = await Promise.all([
-      workspaceCodexSubscriptionActive(deps.db, deps.settings, workspaceId),
-      workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
+      workspaceCodexRealtimeReady(deps, grant, workspaceId),
+      workspaceXaiOperationAvailable(deps.db, deps.settings, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+      }),
       workspaceVercelAiGatewayConnectionActive(deps.db, workspaceId),
     ]);
     const availability = (
@@ -793,16 +1204,62 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         : { available: false, unavailableReason: credentialReason };
     };
     const gatewayModels = Object.values(AI_GATEWAY_REALTIME_MODELS);
-    const models = [
-      ...gatewayModels.map((model, index) => ({
+    // Deployment-funded voice is listed only when this deployment can offer
+    // it (configured, and priced while credits are enforced). Hosted GPT Live
+    // replaces the managed Gateway choices when configured.
+    const managedCandidates = [
+      {
+        id: AZURE_LIVE_MODEL_ID,
+        label: "GPT Live 1",
+        description: "Realtime voice with session delegation",
+      },
+      ...gatewayModels.map((model) => ({
         id: model.managedModelId,
         label: model.label,
-        provider: "OpenGeni" as const,
         description: model.description,
-        ...availability(
-          Boolean(deps.settings.vercelAiGatewayApiKey),
-          "OpenGeni Gateway voice is not configured",
-        ),
+      })),
+    ]
+      .filter((model) => {
+        const voice = deploymentRealtimeVoice(deps.settings, model.id);
+        return voice !== null && realtimeVoiceOfferProblem(deps.settings, voice) === null;
+      })
+      .filter((model, _index, offered) =>
+        offered.some((candidate) => candidate.id === AZURE_LIVE_MODEL_ID)
+          ? model.id === AZURE_LIVE_MODEL_ID
+          : true,
+      );
+    const realtimeVoiceBilling = createRealtimeVoiceBilling({
+      db: deps.db,
+      settings: deps.settings,
+    });
+    const [creditStanding, creditsDisabled] =
+      managedCandidates.length > 0
+        ? await Promise.all([
+            realtimeVoiceBilling.creditStanding(grant.accountId),
+            realtimeVoiceBilling.creditsDisabled(workspaceId),
+          ])
+        : (["none", false] as const);
+    const hasCredits = creditStanding === "spendable";
+    const models = [
+      ...managedCandidates.map((model, index) => ({
+        ...model,
+        provider: "OpenGeni" as const,
+        ...(creditsDisabled
+          ? {
+              available: false,
+              unavailableReason: "Opengeni credits are turned off in this workspace",
+              unavailableCode: "credits_disabled",
+            }
+          : hasCredits
+            ? { available: true, unavailableReason: null, unavailableCode: null }
+            : {
+                available: false,
+                unavailableReason:
+                  creditStanding === "promotional_only"
+                    ? "Promotional credits don't cover live voice. Add credits to use it."
+                    : "Add Opengeni credits to use live voice",
+                unavailableCode: "insufficient_credits",
+              }),
         recommended: index === 0,
       })),
       {
@@ -834,35 +1291,42 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(WorkspaceRealtimeModelCatalogResponse.parse({ models }));
   });
 
+  // The policy the workspace runs with and where it comes from: its own
+  // saved policy, else its organization's default, else no restriction.
   app.get("/v1/workspaces/:workspaceId/model-policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const policy = await getWorkspaceModelPolicy(deps.db, workspaceId);
-    return c.json({
-      allowedProviders: policy?.allowedProviders ?? null,
-      allowedModels: policy?.allowedModels ?? null,
-    });
+    return c.json(await workspaceModelPolicyResponse(deps, workspaceId));
+  });
+
+  // Remove the workspace's own policy so it follows the organization default.
+  app.delete("/v1/workspaces/:workspaceId/model-policy", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
+    await deleteWorkspaceModelPolicy(deps.db, { accountId: grant.accountId, workspaceId });
+    return c.json(await workspaceModelPolicyResponse(deps, workspaceId));
   });
 
   // Full replace (PUT, not merge): null/omitted = unrestricted for that
-  // dimension; an empty array is a valid explicit total block. Settings access
+  // dimension; an empty array is a valid explicit total block. The credit
+  // switch is a workspace setting and never changes here. Settings access
   // admits workspace administrators and the verified Personal owner, without
   // widening membership or API-key delegation authority.
   app.put("/v1/workspaces/:workspaceId/model-policy", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireWorkspaceSettingsGrant(c, deps, workspaceId);
-    const payload = UpdateWorkspaceModelPolicyRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, UpdateWorkspaceModelPolicyRequest);
     const catalog = await resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
       accountId: grant.accountId,
       workspaceId,
     });
-    const policy = await upsertWorkspaceModelPolicy(deps.db, {
+    await upsertWorkspaceModelPolicy(deps.db, {
       accountId: grant.accountId,
       workspaceId,
       allowedProviders: payload.allowedProviders ?? null,
       allowedModels: canonicalWorkspacePolicyModelIds(catalog.settings, payload.allowedModels),
     });
-    return c.json(policy);
+    return c.json(await workspaceModelPolicyResponse(deps, workspaceId));
   });
 
   app.post("/v1/workspaces/:workspaceId/pause-timer", async (c) => {
@@ -968,10 +1432,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.put("/v1/workspaces/:workspaceId/default-rig", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
-    const payload = SetWorkspaceDefaultRigRequest.parse(await c.req.json());
+    const grant = await requireAccessGrant(c, deps, workspaceId, "rigs:manage");
+    const payload = await parseRequestJson(c, SetWorkspaceDefaultRigRequest);
     if (payload.rigId) {
-      const rig = await getRig(deps.db, workspaceId, payload.rigId);
+      const rig = await getRig(deps.db, grant, payload.rigId);
       if (!rig) {
         throw new HTTPException(422, {
           message: `unknown rigId: ${payload.rigId}`,
@@ -996,14 +1460,19 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/members", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    await requireWorkspaceMemberManagementAuthority(c, deps, workspaceId, "workspace:read");
     const members = await listWorkspacePeople(deps, workspaceId);
     return c.json(workspaceMembersResponse(members));
   });
 
   app.get("/v1/workspaces/:workspaceId/member-candidates", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "members:manage");
+    const { grant } = await requireWorkspaceMemberManagementAuthority(
+      c,
+      deps,
+      workspaceId,
+      "members:manage",
+    );
     try {
       return c.json(
         ListWorkspaceMemberCandidatesResponse.parse({
@@ -1021,8 +1490,15 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/members", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "members:manage");
-    const payload = AddWorkspaceMemberRequest.parse(await c.req.json());
+    const { grant } = await requireWorkspaceMemberManagementAuthority(
+      c,
+      deps,
+      workspaceId,
+      "members:manage",
+    );
+    const payload = await parseRequestJson(c, AddWorkspaceMemberRequest);
+    requireApiKeyDelegationContext(await requireAccessContext(c, deps), payload.permissions);
+    requireExplicitPermissionDelegation(grant, payload.permissions);
     let candidates: WorkspaceMemberCandidate[];
     try {
       candidates = await listWorkspaceMemberManagementCandidates(deps.db, {
@@ -1072,9 +1548,16 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.patch("/v1/workspaces/:workspaceId/members/:subjectId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "members:manage");
+    const { grant } = await requireWorkspaceMemberManagementAuthority(
+      c,
+      deps,
+      workspaceId,
+      "members:manage",
+    );
     const subjectId = decodeURIComponent(c.req.param("subjectId"));
-    const payload = UpdateWorkspaceMemberRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, UpdateWorkspaceMemberRequest);
+    requireApiKeyDelegationContext(await requireAccessContext(c, deps), payload.permissions);
+    requireExplicitPermissionDelegation(grant, payload.permissions);
     const existing = await listWorkspacePeople(deps, workspaceId);
     const current = existing.find((member) => member.subjectId === subjectId);
     if (!current) {
@@ -1110,7 +1593,12 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.delete("/v1/workspaces/:workspaceId/members/:subjectId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "members:manage");
+    const { grant, organizationAdministrator } = await requireWorkspaceMemberManagementAuthority(
+      c,
+      deps,
+      workspaceId,
+      "members:manage",
+    );
     const subjectId = decodeURIComponent(c.req.param("subjectId"));
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     // Never remove yourself, and never remove the last administering member.
@@ -1125,11 +1613,31 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
       workspaceId,
       actorSubjectId: grant.subjectId,
       targetSubjectId: subjectId,
+      // An organization owner/admin acting without their own workspace grant
+      // proves that authority through the organization capability instead.
+      ...(organizationAdministrator
+        ? { requireOrganizationSharedWorkspaceAdministration: true }
+        : {}),
     });
     return c.body(null, 204);
   });
 }
 
+async function workspaceModelPolicyResponse(
+  deps: ApiRouteDeps,
+  workspaceId: string,
+): Promise<WorkspaceModelPolicyResponse> {
+  const layers = await getWorkspaceModelPolicyLayers(deps.db, workspaceId);
+  const effective = layers.workspace ?? layers.organization;
+  return WorkspaceModelPolicyResponse.parse({
+    allowedProviders: effective?.allowedProviders ?? null,
+    allowedModels: effective?.allowedModels ?? null,
+    source: layers.workspace ? "workspace" : layers.organization ? "organization" : "none",
+    organization: layers.organization,
+    allowCreditModels: layers.allowCreditModels,
+  });
+}
+
 function workspaceLimit(deps: ApiRouteDeps): number | null {
   if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
     return null;