@opengeni/config 0.22.0 → 0.22.5-canary.1

package/dist/index.js

@@ -45,6 +45,10 @@ import { createHash } from "crypto";
 import { z } from "zod";
 var envName = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var registryId = /^[A-Za-z0-9_-]+$/;
+var DEFAULT_OPENROUTER_MODEL_ID = "openrouter/nvidia/nemotron-3-super-120b-a12b:free";
+var DEFAULT_MODEL_COST_POLICY_JSON = JSON.stringify({
+  [DEFAULT_OPENROUTER_MODEL_ID]: "free"
+});
 var SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS = 60 * 6e4;
 var SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 1e4;
 var SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS = SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS - SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS;
@@ -511,6 +515,24 @@ var SettingsSchema = z.object({
   // keep subscription model routing while disabling Codex voice input.
   voiceInputCodexExperimentalEnabled: EnvBoolean.default(false),
   modelPricingJson: z.string().default("{}"),
+  // Supported-model membership source. Database mode is resolved by the async
+  // core overlay; getSettings remains synchronous and env-only.
+  modelCatalogSource: z.enum(["code", "database"]).default("code"),
+  // Deployment-owned workspace-facing price policy. This is deliberately
+  // separate from catalog membership and upstream credential ownership.
+  // Shape: { "product/model-id": "free" | "credits" }.
+  modelCostPolicyJson: z.string().default("{}"),
+  // Optional per-product agent guidance. Database mode replaces this with the
+  // singleton document's validated modelNotes map.
+  modelNotesJson: z.string().default("{}"),
+  // Managed OpenRouter credential. The curated model table is injected in
+  // code/catalog-document resolution and never read from host provider JSON.
+  openrouterApiKey: z.string().optional(),
+  // Internal, secret-free catalog overlays populated only by
+  // applyModelCatalogDocument. They intentionally have no OPENGENI_* env
+  // binding so database mode cannot be bypassed with a second source.
+  resolvedGatewayModelsJson: z.string().optional(),
+  resolvedOpenRouterModelsJson: z.string().optional(),
   // Extra (non-built-in) model providers, declared by the host as a JSON
   // provider registry. Each entry carries its own base URL, API key, wire API
   // ("responses" | "chat") and the models it exposes. The models a client may
@@ -651,6 +673,13 @@ var SettingsSchema = z.object({
   // larger timeout—is what lets a session outlive one finite provider box.
   // Knob: OPENGENI_MODAL_TIMEOUT_SECONDS.
   modalTimeoutSeconds: z.coerce.number().int().positive().max(86400).default(86400),
+  // Optional provider reservations for every new Modal sandbox. CPU is measured
+  // in physical cores and may be fractional; memory is measured in MiB. Leave
+  // both unset to preserve Modal's provider defaults. The Agents adapter stores
+  // the resolved values in its session state so snapshot replacement and exact
+  // resume cannot silently change the reservation.
+  modalSandboxCpu: z.coerce.number().positive().optional(),
+  modalSandboxMemoryMiB: z.coerce.number().int().positive().optional(),
   modalTokenId: z.string().optional(),
   modalTokenSecret: z.string().optional(),
   modalEnvironment: z.string().optional(),
@@ -688,8 +717,8 @@ var SettingsSchema = z.object({
   // cell advertises mode "interactive" — the noVNC viewer can drive mouse+keyboard
   // into :0 (x11vnc runs without -viewonly). Turn it OFF for a genuinely read-only
   // deployment: the cell reports mode "read-only" and the client disables the
-  // "Take control" affordance. Independent of computerUseReadOnly (the AGENT
-  // driver); this gates the HUMAN viewer plane.
+  // "Take control" affordance. This gates the HUMAN viewer plane; agent
+  // interaction is authorized through managed ComputerSession tools.
   sandboxDesktopInteractive: EnvBoolean.default(true),
   // REAL PTY terminal toggle (P5.t): gates the ttyd pty-ws plane (7681) the API
   // mints over the SAME tunnel as the desktop. Defaults ON — the interactive
@@ -703,13 +732,7 @@ var SettingsSchema = z.object({
   // down→up restart. Defaults match the proven spike geometry (1280x800).
   streamResolutionWidth: z.coerce.number().int().positive().default(1280),
   streamResolutionHeight: z.coerce.number().int().positive().default(800),
-  // P4.3 computer-use: the agent drives the SAME :0 humans watch (xdotool/XTEST +
-  // scrot). Gated by sandboxDesktopEnabled + a desktop-capable backend in
-  // buildAgentCapabilities; computerUseReadOnly:false is the agent-driver default
-  // (it must click/type — the human viewer plane is the read-only one).
-  computerUseEnabled: EnvBoolean.default(true),
-  computerUseReadOnly: EnvBoolean.default(false),
-  // P4.3 recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.
+  // Recording loop: ffmpeg x11grab of :0 → mp4/webm → @opengeni/storage.
   // recordingMaxBytes caps the in-memory finalize buffer (≤ storage single-PUT);
   // recordingMaxSeconds is the ffmpeg -t hard ceiling (bounds a multi-day turn).
   recordingEnabled: EnvBoolean.default(true),
@@ -1065,6 +1088,10 @@ var SettingsSchema = z.object({
   betterAuthAllowedHosts: z.string().default(""),
   betterAuthCookieDomain: z.string().optional(),
   betterAuthTrustedOrigins: z.string().default(""),
+  managedAuthGoogleClientId: z.string().optional(),
+  managedAuthGoogleClientSecret: z.string().optional(),
+  managedAuthGithubClientId: z.string().optional(),
+  managedAuthGithubClientSecret: z.string().optional(),
   // Rolling browser login-slot compatibility. Repository/deployment default is
   // deliberately legacy; changing to broker is an operator-authorized rollout.
   managedAuthSessionSetMode: z.enum(["legacy", "dual", "broker"]).default("legacy"),
@@ -1357,7 +1384,8 @@ var RegistryProviderKind = z.enum([
   "codex-subscription",
   "xai-subscription",
   "vercel-gateway-managed",
-  "vercel-gateway-workspace"
+  "vercel-gateway-workspace",
+  "openrouter-workspace"
 ]);
 var RegistryModelSchema = z.object({
   id: z.string().min(1),
@@ -1470,6 +1498,285 @@ var RegistryProviderSchema = z.object({
     });
   }
 });
+var OPENGENI_GATEWAY_PROVIDER_ID = "opengeni-gateway";
+var WORKSPACE_GATEWAY_PROVIDER_ID = "workspace-gateway";
+var WORKSPACE_GATEWAY_MODEL_ID_PREFIX = "workspace-gateway/";
+var OPENROUTER_PROVIDER_ID = "openrouter";
+var OPENROUTER_MODEL_ID_PREFIX = "openrouter/";
+var WORKSPACE_OPENROUTER_PROVIDER_ID = "workspace-openrouter";
+var WORKSPACE_OPENROUTER_MODEL_ID_PREFIX = "workspace-openrouter/";
+var OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1";
+var RESERVED_MODEL_PROVIDER_IDS = /* @__PURE__ */ new Set([
+  "openai",
+  "azure",
+  CODEX_PROVIDER_ID,
+  XAI_SUBSCRIPTION_PROVIDER_ID,
+  OPENGENI_GATEWAY_PROVIDER_ID,
+  WORKSPACE_GATEWAY_PROVIDER_ID,
+  OPENROUTER_PROVIDER_ID,
+  WORKSPACE_OPENROUTER_PROVIDER_ID
+]);
+var ModelCostClass = z.enum(["free", "credits"]);
+var ConfiguredModelCostClass = z.enum(["free", "credits", "subscription", "workspace"]);
+var ModelNote = z.string().max(500).refine((value) => !/[\r\n|]/u.test(value), {
+  message: "model notes must not contain newlines or the | field separator"
+});
+function parseModelCostPolicyJson(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(
+      `OPENGENI_MODEL_COST_POLICY_JSON must be valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+  return z.record(z.string().min(1), ModelCostClass).parse(parsed);
+}
+function parseModelNotesJson(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(
+      `OPENGENI_MODEL_NOTES_JSON must be valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+  return z.record(z.string().min(1), ModelNote).parse(parsed);
+}
+function configuredModelNotes(settings) {
+  return parseModelNotesJson(settings.modelNotesJson);
+}
+var GatewayCatalogModel = z.object({
+  productId: z.string().min(1),
+  workspaceProductId: z.string().min(1).startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX),
+  upstreamModelId: z.string().min(1),
+  label: z.string().min(1),
+  shortLabel: z.string().min(1).max(64).optional(),
+  providers: z.array(z.string().min(1)).min(1),
+  implicitCaching: z.boolean().default(false),
+  vision: z.boolean().default(false),
+  inputFileMediaTypes: z.array(z.string().min(1)).default([]),
+  contextWindowTokens: z.number().int().positive().default(1e6),
+  effectiveContextWindowTokens: z.number().int().positive().default(9e5),
+  autoCompactTokenLimit: z.number().int().positive().default(85e4),
+  pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),
+  credentialSource: z.never().optional(),
+  billing: z.never().optional(),
+  apiKey: z.never().optional()
+}).strict();
+var OpenRouterCatalogModel = z.object({
+  upstreamModelId: z.string().min(1).endsWith(":free"),
+  label: z.string().min(1),
+  shortLabel: z.string().min(1).max(64).optional(),
+  aliases: z.array(z.string().min(1)).default([]),
+  capabilities: ModelCapabilitiesV1Schema,
+  contextWindowTokens: z.number().int().positive().optional(),
+  effectiveContextWindowTokens: z.number().int().positive().optional(),
+  autoCompactTokenLimit: z.number().int().positive().optional(),
+  toolOutputTruncationTokens: z.number().int().positive().optional(),
+  credentialSource: z.never().optional(),
+  billing: z.never().optional(),
+  pricing: z.never().optional(),
+  apiKey: z.never().optional()
+}).strict();
+var DeploymentRegistryBaseUrl = z.string().url().superRefine((value, context) => {
+  const url = new URL(value);
+  if (url.username || url.password) {
+    context.addIssue({
+      code: "custom",
+      message: "database catalog provider baseUrl must not contain userinfo"
+    });
+  }
+  if (url.search) {
+    context.addIssue({
+      code: "custom",
+      message: "database catalog provider baseUrl must not contain a query"
+    });
+  }
+  if (url.hash) {
+    context.addIssue({
+      code: "custom",
+      message: "database catalog provider baseUrl must not contain a fragment"
+    });
+  }
+});
+var DeploymentRegistryProviderKind = z.enum(["api-key", "anonymous"]);
+var DeploymentRegistryModelSchema = RegistryModelSchema.safeExtend({
+  pricing: z.never().optional()
+}).strict();
+var DeploymentRegistryProviderSchema = RegistryProviderSchema.safeExtend({
+  kind: DeploymentRegistryProviderKind.default("api-key"),
+  baseUrl: DeploymentRegistryBaseUrl,
+  models: z.array(DeploymentRegistryModelSchema).min(1),
+  apiKey: z.never().optional(),
+  apiKeyEnv: z.never().optional(),
+  defaultHeaders: z.never().optional(),
+  defaultQuery: z.never().optional(),
+  publicDefaultHeaderNames: z.never().optional(),
+  publicDefaultQueryNames: z.never().optional()
+}).strict();
+var DeploymentGatewayCatalogModelSchema = GatewayCatalogModel.safeExtend({
+  pricing: z.never().optional()
+}).strict();
+var ModelCatalogDocument = z.object({
+  schemaVersion: z.literal(1),
+  /** Canonical deployment default. Omission preserves the V1 first-built-in
+   * fallback for existing documents; operators should set this explicitly
+   * when cutting over a registry or connected-subscription default. */
+  defaultModel: z.string().min(1).optional(),
+  builtInModels: z.array(z.string().min(1)).min(1),
+  registryProviders: z.array(DeploymentRegistryProviderSchema).default([]),
+  gatewayModels: z.array(DeploymentGatewayCatalogModelSchema).default([]),
+  openrouterModels: z.array(OpenRouterCatalogModel).default([]),
+  modelNotes: z.record(z.string().min(1), ModelNote).default({}),
+  billing: z.never().optional(),
+  enabled: z.never().optional(),
+  apiKey: z.never().optional(),
+  bands: z.never().optional()
+}).strict().superRefine((document, context) => {
+  const productIds = /* @__PURE__ */ new Set();
+  const providerIds = /* @__PURE__ */ new Set();
+  const gatewayUpstreamIds = /* @__PURE__ */ new Set();
+  const add = (id, path) => {
+    if (/[\u000A\u000D|]/u.test(id)) {
+      context.addIssue({
+        code: "custom",
+        path,
+        message: "catalog product ids must not contain newlines or the | field separator"
+      });
+    }
+    if (productIds.has(id)) {
+      context.addIssue({
+        code: "custom",
+        path,
+        message: `duplicate product id ${id}`
+      });
+    }
+    productIds.add(id);
+  };
+  document.builtInModels.forEach((id, index) => add(id, ["builtInModels", index]));
+  document.registryProviders.forEach((provider, providerIndex) => {
+    if (RESERVED_MODEL_PROVIDER_IDS.has(provider.id)) {
+      context.addIssue({
+        code: "custom",
+        path: ["registryProviders", providerIndex, "id"],
+        message: `provider id ${provider.id} is reserved for a reviewed OpenGeni provider`
+      });
+    }
+    if (providerIds.has(provider.id)) {
+      context.addIssue({
+        code: "custom",
+        path: ["registryProviders", providerIndex, "id"],
+        message: `duplicate provider id ${provider.id}`
+      });
+    }
+    providerIds.add(provider.id);
+    provider.models.forEach(
+      (model, modelIndex) => add(model.id, ["registryProviders", providerIndex, "models", modelIndex, "id"])
+    );
+  });
+  document.gatewayModels.forEach((model, index) => {
+    if (gatewayUpstreamIds.has(model.upstreamModelId)) {
+      context.addIssue({
+        code: "custom",
+        path: ["gatewayModels", index, "upstreamModelId"],
+        message: `duplicate Gateway upstream model id ${model.upstreamModelId}`
+      });
+    }
+    gatewayUpstreamIds.add(model.upstreamModelId);
+    add(model.productId, ["gatewayModels", index, "productId"]);
+    add(model.workspaceProductId, ["gatewayModels", index, "workspaceProductId"]);
+  });
+  document.openrouterModels.forEach(
+    (model, index) => add(`${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`, [
+      "openrouterModels",
+      index,
+      "upstreamModelId"
+    ])
+  );
+  if (document.defaultModel && /[\u000A\u000D|]/u.test(document.defaultModel)) {
+    context.addIssue({
+      code: "custom",
+      path: ["defaultModel"],
+      message: "catalog default model must not contain newlines or the | field separator"
+    });
+  }
+  if (document.defaultModel && !productIds.has(document.defaultModel) && !document.defaultModel.startsWith(CODEX_MODEL_ID_PREFIX) && !document.defaultModel.startsWith(XAI_SUBSCRIPTION_MODEL_ID_PREFIX)) {
+    context.addIssue({
+      code: "custom",
+      path: ["defaultModel"],
+      message: "catalog default model must reference deployment catalog membership or a connected-subscription product"
+    });
+  }
+  for (const productId of Object.keys(document.modelNotes)) {
+    if (!productIds.has(productId)) {
+      context.addIssue({
+        code: "custom",
+        path: ["modelNotes", productId],
+        message: "model note references a product id outside the deployment catalog"
+      });
+    }
+  }
+});
+function parseModelCatalogDocument(value) {
+  return ModelCatalogDocument.parse(value);
+}
+function deploymentRegistryProvidersWithHostCredentials(settings, providers) {
+  const hostProviders = new Map(
+    parseModelProvidersJson(settings.modelProvidersJson).map((provider) => [provider.id, provider])
+  );
+  return providers.map((provider) => {
+    if (provider.kind !== "api-key") return provider;
+    const host = hostProviders.get(provider.id);
+    if (!host || host.kind !== "api-key") {
+      throw new Error(
+        `database model catalog provider ${provider.id} has no matching host-authorized api-key transport`
+      );
+    }
+    const transportIdentity = (candidate) => ({
+      kind: candidate.kind,
+      baseUrl: candidate.baseUrl,
+      api: candidate.api,
+      wireProfile: candidate.wireProfile
+    });
+    if (canonicalJson(transportIdentity(provider)) !== canonicalJson(transportIdentity(host))) {
+      throw new Error(
+        `database model catalog provider ${provider.id} does not match its host-authorized transport`
+      );
+    }
+    return {
+      ...provider,
+      ...host.defaultHeaders === void 0 ? {} : { defaultHeaders: host.defaultHeaders },
+      ...host.defaultQuery === void 0 ? {} : { defaultQuery: host.defaultQuery },
+      ...host.publicDefaultHeaderNames === void 0 ? {} : { publicDefaultHeaderNames: host.publicDefaultHeaderNames },
+      ...host.publicDefaultQueryNames === void 0 ? {} : { publicDefaultQueryNames: host.publicDefaultQueryNames },
+      ...host.apiKey === void 0 ? {} : { apiKey: host.apiKey },
+      ...host.apiKeyEnv === void 0 ? {} : { apiKeyEnv: host.apiKeyEnv }
+    };
+  });
+}
+function applyModelCatalogDocument(settings, rawDocument) {
+  const document = parseModelCatalogDocument(rawDocument);
+  const defaultModel = document.defaultModel ?? document.builtInModels[0];
+  const resolved = {
+    ...settings,
+    openaiModel: defaultModel,
+    // Keep the complete built-in membership, including the default. The worker
+    // replaces openaiModel with the exact turn model; the run-scoped router
+    // needs one stable built-in id in this allow-list so a bare provider model
+    // is not temporarily claimed by OpenAI/Azure during name re-resolution.
+    openaiAllowedModels: document.builtInModels.join(","),
+    modelProvidersJson: JSON.stringify(
+      deploymentRegistryProvidersWithHostCredentials(settings, document.registryProviders)
+    ),
+    resolvedGatewayModelsJson: JSON.stringify(document.gatewayModels),
+    resolvedOpenRouterModelsJson: JSON.stringify(document.openrouterModels),
+    modelNotesJson: JSON.stringify(document.modelNotes)
+  };
+  return resolved;
+}
 var IntegrationOAuthClientConfigSchema = z.object({
   clientId: z.string().min(1),
   clientSecret: z.string().min(1).optional(),
@@ -1477,11 +1784,10 @@ var IntegrationOAuthClientConfigSchema = z.object({
 });
 var VERCEL_AI_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh/v1";
 var VERCEL_AI_GATEWAY_AI_SDK_BASE_URL = "https://ai-gateway.vercel.sh/v4/ai";
-var OPENGENI_GATEWAY_PROVIDER_ID = "opengeni-gateway";
-var WORKSPACE_GATEWAY_PROVIDER_ID = "workspace-gateway";
-var WORKSPACE_GATEWAY_MODEL_ID_PREFIX = "workspace-gateway/";
 var VERCEL_AI_GATEWAY_CONNECTION_DOMAIN = "ai-gateway.vercel.sh";
 var VERCEL_AI_GATEWAY_CONNECTION_ROLE = "vercel_ai_gateway";
+var WORKSPACE_OPENROUTER_CONNECTION_DOMAIN = "openrouter.ai";
+var WORKSPACE_OPENROUTER_CONNECTION_ROLE = "openrouter";
 var CODEX_REALTIME_MODEL_ID = "gpt-live-1-boulder-alpha";
 var SUPERGROK_REALTIME_MODEL_ID = "supergrok/grok-voice-think-fast-2.0";
 var OPENGENI_REALTIME_MODEL_ID_PREFIX = "opengeni-gateway/";
@@ -1540,6 +1846,98 @@ var OPENGENI_GATEWAY_MODELS = {
     implicitCaching: true
   }
 };
+var OPENGENI_OPENROUTER_MODELS = [
+  OpenRouterCatalogModel.parse({
+    upstreamModelId: "nvidia/nemotron-3-super-120b-a12b:free",
+    label: "Nemotron 3 Super 120B",
+    shortLabel: "Nemotron 3 Super",
+    aliases: [],
+    capabilities: {
+      reasoning: {
+        upstream: "supported",
+        // OpenRouter advertises the reasoning controls, but the catalogue does
+        // not publish this model's accepted effort vocabulary. Preserve that
+        // upstream fact without exposing an unverified runnable selector.
+        runnable: false,
+        efforts: [],
+        defaultEffort: null,
+        required: false
+      },
+      functionCalling: { upstream: "supported", runnable: true },
+      structuredOutput: { upstream: "supported", runnable: true },
+      hostedTools: {
+        webSearch: { upstream: "unknown", runnable: false },
+        xSearch: { upstream: "unknown", runnable: false },
+        codeExecution: { upstream: "unknown", runnable: false },
+        imageGeneration: { upstream: "unknown", runnable: false }
+      },
+      inputModalities: ["text"],
+      inputFileMediaTypes: [],
+      outputModalities: ["text"],
+      transports: {
+        sse: { upstream: "supported", runnable: true },
+        responsesWebSocket: { upstream: "unknown", runnable: false },
+        realtimeAudio: { upstream: "unsupported", runnable: false }
+      },
+      latencyModes: [{ id: "standard", upstream: "unknown", runnable: true }]
+    },
+    contextWindowTokens: 262144,
+    effectiveContextWindowTokens: 235929,
+    autoCompactTokenLimit: 22e4
+  })
+];
+function defaultGatewayCatalogModels() {
+  return [
+    {
+      ...OPENGENI_GATEWAY_MODELS.deepseek,
+      vision: false,
+      inputFileMediaTypes: [],
+      contextWindowTokens: 1e6,
+      effectiveContextWindowTokens: 9e5,
+      autoCompactTokenLimit: 85e4
+    },
+    {
+      ...OPENGENI_GATEWAY_MODELS.kimi,
+      vision: true,
+      inputFileMediaTypes: ["application/pdf"],
+      contextWindowTokens: 1e6,
+      effectiveContextWindowTokens: 9e5,
+      autoCompactTokenLimit: 85e4
+    }
+  ].map((model) => GatewayCatalogModel.parse(model));
+}
+function configuredGatewayCatalogModels(settings) {
+  if (settings.resolvedGatewayModelsJson === void 0) {
+    return defaultGatewayCatalogModels();
+  }
+  return z.array(GatewayCatalogModel).parse(JSON.parse(settings.resolvedGatewayModelsJson));
+}
+function configuredGatewayUpstreamModelIds(settings) {
+  return configuredGatewayCatalogModels(settings).map((model) => model.upstreamModelId);
+}
+function configuredGatewayWorkspaceProductModelIds(settings) {
+  return configuredGatewayCatalogModels(settings).map((model) => model.workspaceProductId);
+}
+function configuredModelInputIdentities(settings) {
+  return configuredModels(settings).flatMap((model) => [model.id, ...model.aliases]);
+}
+function configuredOpenRouterCatalogModels(settings) {
+  if (settings.resolvedOpenRouterModelsJson === void 0) {
+    return [...OPENGENI_OPENROUTER_MODELS];
+  }
+  return z.array(OpenRouterCatalogModel).parse(JSON.parse(settings.resolvedOpenRouterModelsJson));
+}
+function configuredOpenRouterUpstreamModelIds(settings) {
+  return configuredOpenRouterCatalogModels(settings).map((model) => model.upstreamModelId);
+}
+function workspaceOpenRouterProductId(modelId) {
+  return `${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${modelId.startsWith(OPENROUTER_MODEL_ID_PREFIX) ? modelId.slice(OPENROUTER_MODEL_ID_PREFIX.length) : modelId}`;
+}
+function configuredOpenRouterWorkspaceProductModelIds(settings) {
+  return configuredOpenRouterCatalogModels(settings).flatMap(
+    (model) => [model.upstreamModelId, ...model.aliases].map(workspaceOpenRouterProductId)
+  );
+}
 var defaultModelPricing = {
   "gpt-5.6-sol": {
     default: {
@@ -1688,11 +2086,14 @@ function objectStorageConfiguredForWorkspaceArchives(settings) {
     }
   }
 }
-function optional(name) {
-  const value = process.env[name];
+function optionalEnvironmentValue(name, source) {
+  const value = source[name];
   return value && value.trim().length > 0 ? value : void 0;
 }
-function getSettings() {
+function getSettings(source = process.env) {
+  const optional = (name) => optionalEnvironmentValue(name, source);
+  const modelCatalogSource = optional("OPENGENI_MODEL_CATALOG_SOURCE");
+  const modelCostPolicyJson = optional("OPENGENI_MODEL_COST_POLICY_JSON") ?? (modelCatalogSource === "database" ? "{}" : DEFAULT_MODEL_COST_POLICY_JSON);
   const raw = {
     serviceName: optional("OPENGENI_SERVICE_NAME"),
     environment: optional("OPENGENI_ENVIRONMENT"),
@@ -1877,6 +2278,10 @@ function getSettings() {
     voiceInputAzureAdToken: optional("OPENGENI_VOICE_INPUT_AZURE_AD_TOKEN"),
     voiceInputCodexExperimentalEnabled: optional("OPENGENI_VOICE_INPUT_CODEX_EXPERIMENTAL"),
     modelPricingJson: optional("OPENGENI_MODEL_PRICING_JSON"),
+    modelCatalogSource,
+    modelCostPolicyJson,
+    modelNotesJson: optional("OPENGENI_MODEL_NOTES_JSON"),
+    openrouterApiKey: optional("OPENGENI_OPENROUTER_API_KEY"),
     modelProvidersJson: optional("OPENGENI_MODEL_PROVIDERS_JSON"),
     codexSubscriptionEnabled: optional("OPENGENI_CODEX_SUBSCRIPTION_ENABLED"),
     supergrokSubscriptionEnabled: optional("OPENGENI_SUPERGROK_SUBSCRIPTION_ENABLED"),
@@ -1915,6 +2320,8 @@ function getSettings() {
     modalImageId: optional("OPENGENI_MODAL_IMAGE_ID"),
     modalImageRegistrySecret: optional("OPENGENI_MODAL_IMAGE_REGISTRY_SECRET"),
     modalTimeoutSeconds: optional("OPENGENI_MODAL_TIMEOUT_SECONDS"),
+    modalSandboxCpu: optional("OPENGENI_MODAL_SANDBOX_CPU"),
+    modalSandboxMemoryMiB: optional("OPENGENI_MODAL_SANDBOX_MEMORY_MIB"),
     modalTokenId: optional("OPENGENI_MODAL_TOKEN_ID"),
     modalTokenSecret: optional("OPENGENI_MODAL_TOKEN_SECRET"),
     modalEnvironment: optional("OPENGENI_MODAL_ENVIRONMENT"),
@@ -1925,8 +2332,6 @@ function getSettings() {
     sandboxTerminalEnabled: optional("OPENGENI_SANDBOX_TERMINAL_ENABLED"),
     streamResolutionWidth: optional("OPENGENI_STREAM_RESOLUTION_WIDTH"),
     streamResolutionHeight: optional("OPENGENI_STREAM_RESOLUTION_HEIGHT"),
-    computerUseEnabled: optional("OPENGENI_COMPUTER_USE_ENABLED"),
-    computerUseReadOnly: optional("OPENGENI_COMPUTER_USE_READONLY"),
     recordingEnabled: optional("OPENGENI_RECORDING_ENABLED"),
     workspaceCaptureEnabled: optional("OPENGENI_WORKSPACE_CAPTURE"),
     recordingDefaultCodec: optional("OPENGENI_RECORDING_DEFAULT_CODEC"),
@@ -2082,6 +2487,10 @@ function getSettings() {
     betterAuthAllowedHosts: optional("OPENGENI_BETTER_AUTH_ALLOWED_HOSTS"),
     betterAuthCookieDomain: optional("OPENGENI_BETTER_AUTH_COOKIE_DOMAIN"),
     betterAuthTrustedOrigins: optional("OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS"),
+    managedAuthGoogleClientId: optional("OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID"),
+    managedAuthGoogleClientSecret: optional("OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET"),
+    managedAuthGithubClientId: optional("OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID"),
+    managedAuthGithubClientSecret: optional("OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET"),
     managedAuthSessionSetMode: optional("OPENGENI_MANAGED_AUTH_SESSION_SET_MODE"),
     resendApiKey: optional("OPENGENI_RESEND_API_KEY"),
     emailFrom: optional("OPENGENI_EMAIL_FROM"),
@@ -2098,7 +2507,7 @@ function getSettings() {
     sandboxRotationLeadMs: raw.sandboxRotationLeadMs === void 0 && parsed.sandboxBackend === "modal" ? Math.min(36e5, Math.floor(parsed.modalTimeoutSeconds * 1e3 / 2)) : parsed.sandboxRotationLeadMs,
     mcpServers: ensureBuiltInMcpServers(parsed)
   };
-  validateSettings(settings);
+  validateSettings(settings, source);
   return settings;
 }
 var LOCAL_FIRST_PARTY_DELEGATION_SECRET = "opengeni-local-first-party-delegation-secret-v1";
@@ -2413,10 +2822,8 @@ function legacyModelCapabilities(settings, input) {
     latencyModes: [{ id: "standard", upstream: "unknown", runnable: true }]
   });
 }
-function gatewayRequestPolicyForUpstreamModel(upstreamModelId) {
-  const model = Object.values(OPENGENI_GATEWAY_MODELS).find(
-    (candidate) => candidate.upstreamModelId === upstreamModelId
-  );
+function gatewayRequestPolicyForUpstreamModel(upstreamModelId, models = defaultGatewayCatalogModels()) {
+  const model = models.find((candidate) => candidate.upstreamModelId === upstreamModelId);
   if (!model) {
     return void 0;
   }
@@ -2447,26 +2854,74 @@ function gatewayModelCapabilities(settings, input) {
     latencyModes: [{ id: "standard", upstream: "supported", runnable: true }]
   });
 }
+function openRouterCustomModelCapabilities(settings) {
+  const legacy = legacyModelCapabilities(settings, {
+    reasoningEffort: false,
+    hostedWebSearch: false
+  });
+  return normalizeCapabilities({
+    ...legacy,
+    functionCalling: { upstream: "supported", runnable: true },
+    inputModalities: ["text"],
+    inputFileMediaTypes: [],
+    transports: {
+      ...legacy.transports,
+      sse: { upstream: "supported", runnable: true }
+    },
+    promptCaching: { upstream: "unsupported", runnable: false, mode: "none" },
+    latencyModes: [{ id: "standard", upstream: "supported", runnable: true }]
+  });
+}
 function gatewayRegistryProvider(settings, input) {
   const workspace = input.kind === "vercel-gateway-workspace";
-  const models = [OPENGENI_GATEWAY_MODELS.deepseek, OPENGENI_GATEWAY_MODELS.kimi].map((model) => {
-    const kimi = model === OPENGENI_GATEWAY_MODELS.kimi;
+  const curated = configuredGatewayCatalogModels(settings);
+  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));
+  const productIds = new Set(
+    parseModelProvidersJson(settings.modelProvidersJson).filter((provider) => provider.id !== WORKSPACE_GATEWAY_PROVIDER_ID).flatMap(
+      (provider) => provider.models.flatMap((model) => [model.id, ...model.aliases ?? []])
+    )
+  );
+  const models = curated.map((model) => {
+    productIds.add(workspace ? model.workspaceProductId : model.productId);
     return {
       id: workspace ? model.workspaceProductId : model.productId,
       upstreamModelId: model.upstreamModelId,
       label: model.label,
-      shortLabel: model.shortLabel,
+      ...model.shortLabel ? { shortLabel: model.shortLabel } : {},
       capabilities: gatewayModelCapabilities(settings, {
         implicitCaching: model.implicitCaching,
-        vision: kimi,
-        inputFileMediaTypes: kimi ? ["application/pdf"] : []
+        vision: model.vision,
+        inputFileMediaTypes: model.inputFileMediaTypes
       }),
-      contextWindowTokens: 1e6,
-      effectiveContextWindowTokens: 9e5,
-      autoCompactTokenLimit: 85e4,
-      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens
+      contextWindowTokens: model.contextWindowTokens,
+      effectiveContextWindowTokens: model.effectiveContextWindowTokens,
+      autoCompactTokenLimit: model.autoCompactTokenLimit,
+      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,
+      ...model.pricing === void 0 ? {} : { pricing: model.pricing }
     };
   });
+  if (workspace) {
+    for (const custom of input.customModels ?? []) {
+      const productId = `${WORKSPACE_GATEWAY_MODEL_ID_PREFIX}${custom.upstreamModelId}`;
+      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;
+      upstreamIds.add(custom.upstreamModelId);
+      productIds.add(productId);
+      models.push({
+        id: productId,
+        upstreamModelId: custom.upstreamModelId,
+        label: custom.label?.trim() || custom.upstreamModelId,
+        capabilities: gatewayModelCapabilities(settings, {
+          implicitCaching: false,
+          vision: false,
+          inputFileMediaTypes: []
+        }),
+        contextWindowTokens: 1e6,
+        effectiveContextWindowTokens: 9e5,
+        autoCompactTokenLimit: 85e4,
+        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens
+      });
+    }
+  }
   return {
     kind: input.kind,
     id: workspace ? WORKSPACE_GATEWAY_PROVIDER_ID : OPENGENI_GATEWAY_PROVIDER_ID,
@@ -2481,47 +2936,138 @@ function gatewayRegistryProvider(settings, input) {
     models
   };
 }
+function openRouterRegistryProvider(settings, input) {
+  const workspace = input.kind === "openrouter-workspace";
+  const curated = configuredOpenRouterCatalogModels(settings);
+  const upstreamIds = new Set(curated.map((model) => model.upstreamModelId));
+  const productIds = new Set(
+    parseModelProvidersJson(settings.modelProvidersJson).filter((provider) => provider.id !== WORKSPACE_OPENROUTER_PROVIDER_ID).flatMap(
+      (provider) => provider.models.flatMap((model) => [model.id, ...model.aliases ?? []])
+    )
+  );
+  const models = curated.map((model) => {
+    const id = workspace ? workspaceOpenRouterProductId(model.upstreamModelId) : `${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`;
+    const aliases = workspace ? model.aliases.map(workspaceOpenRouterProductId) : model.aliases;
+    productIds.add(id);
+    for (const alias of aliases) productIds.add(alias);
+    return {
+      id,
+      upstreamModelId: model.upstreamModelId,
+      aliases,
+      label: model.label,
+      ...model.shortLabel ? { shortLabel: model.shortLabel } : {},
+      capabilities: model.capabilities,
+      ...model.contextWindowTokens === void 0 ? {} : { contextWindowTokens: model.contextWindowTokens },
+      ...model.effectiveContextWindowTokens === void 0 ? {} : { effectiveContextWindowTokens: model.effectiveContextWindowTokens },
+      ...model.autoCompactTokenLimit === void 0 ? {} : { autoCompactTokenLimit: model.autoCompactTokenLimit },
+      toolOutputTruncationTokens: model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens
+    };
+  });
+  if (workspace) {
+    for (const custom of input.customModels ?? []) {
+      const productId = `${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${custom.upstreamModelId}`;
+      if (upstreamIds.has(custom.upstreamModelId) || productIds.has(productId)) continue;
+      upstreamIds.add(custom.upstreamModelId);
+      productIds.add(productId);
+      models.push({
+        id: productId,
+        upstreamModelId: custom.upstreamModelId,
+        aliases: [],
+        label: custom.label?.trim() || custom.upstreamModelId,
+        capabilities: openRouterCustomModelCapabilities(settings),
+        toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens
+      });
+    }
+  }
+  if (models.length === 0) return null;
+  const defaultHeaders = {
+    "x-title": "OpenGeni",
+    ...settings.publicBaseUrl ? { "http-referer": settings.publicBaseUrl } : {}
+  };
+  return {
+    kind: input.kind,
+    id: workspace ? WORKSPACE_OPENROUTER_PROVIDER_ID : OPENROUTER_PROVIDER_ID,
+    label: workspace ? "Your OpenRouter" : "OpenRouter",
+    api: "chat",
+    wireProfile: "openai",
+    baseUrl: OPENROUTER_BASE_URL,
+    ...input.apiKey ? { apiKey: input.apiKey } : {},
+    defaultHeaders,
+    publicDefaultHeaderNames: Object.keys(defaultHeaders),
+    models
+  };
+}
 function configuredRegistryProviders(settings) {
   const providers = parseModelProvidersJson(settings.modelProvidersJson);
-  if (!settings.vercelAiGatewayApiKey) {
-    return providers;
-  }
-  if (providers.some((provider) => provider.id === OPENGENI_GATEWAY_PROVIDER_ID)) {
-    throw new Error(
-      `${OPENGENI_GATEWAY_PROVIDER_ID} is reserved for OPENGENI_VERCEL_AI_GATEWAY_API_KEY`
+  const injected = [...providers];
+  if (settings.vercelAiGatewayApiKey && configuredGatewayCatalogModels(settings).length > 0) {
+    injected.push(
+      gatewayRegistryProvider(settings, {
+        kind: "vercel-gateway-managed",
+        apiKey: settings.vercelAiGatewayApiKey
+      })
     );
   }
-  return [
-    ...providers,
-    gatewayRegistryProvider(settings, {
-      kind: "vercel-gateway-managed",
-      apiKey: settings.vercelAiGatewayApiKey
-    })
-  ];
+  const openrouter = settings.openrouterApiKey ? openRouterRegistryProvider(settings, {
+    kind: "openrouter-managed",
+    apiKey: settings.openrouterApiKey
+  }) : null;
+  if (openrouter) injected.push(openrouter);
+  return injected;
 }
-function withWorkspaceGatewayCatalogProvider(settings) {
+function withWorkspaceGatewayCatalogProvider(settings, customModels = []) {
   const providers = parseModelProvidersJson(settings.modelProvidersJson);
-  if (providers.some((provider) => provider.id === WORKSPACE_GATEWAY_PROVIDER_ID)) {
-    return settings;
-  }
+  const withoutWorkspace = providers.filter(
+    (provider) => provider.id !== WORKSPACE_GATEWAY_PROVIDER_ID
+  );
+  const curatedCount = configuredGatewayCatalogModels(settings).length;
+  if (curatedCount === 0 && customModels.length === 0) return settings;
   return {
     ...settings,
     modelProvidersJson: JSON.stringify([
-      ...providers,
-      gatewayRegistryProvider(settings, { kind: "vercel-gateway-workspace" })
+      ...withoutWorkspace,
+      gatewayRegistryProvider(settings, {
+        kind: "vercel-gateway-workspace",
+        customModels
+      })
     ])
   };
 }
-function withWorkspaceGatewayCredential(settings, apiKey) {
+function withWorkspaceGatewayCredential(settings, apiKey, customModels = []) {
   if (!apiKey.trim()) {
     throw new Error("workspace AI Gateway credential is empty");
   }
-  const catalogSettings = withWorkspaceGatewayCatalogProvider(settings);
+  const catalogSettings = withWorkspaceGatewayCatalogProvider(settings, customModels);
   const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map(
     (provider) => provider.id === WORKSPACE_GATEWAY_PROVIDER_ID ? { ...provider, apiKey } : provider
   );
   return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };
 }
+function withWorkspaceOpenRouterCatalogProvider(settings, customModels = []) {
+  const providers = parseModelProvidersJson(settings.modelProvidersJson);
+  const withoutWorkspace = providers.filter(
+    (provider2) => provider2.id !== WORKSPACE_OPENROUTER_PROVIDER_ID
+  );
+  const provider = openRouterRegistryProvider(settings, {
+    kind: "openrouter-workspace",
+    customModels
+  });
+  if (!provider) return settings;
+  return {
+    ...settings,
+    modelProvidersJson: JSON.stringify([...withoutWorkspace, provider])
+  };
+}
+function withWorkspaceOpenRouterCredential(settings, apiKey, customModels = []) {
+  if (!apiKey.trim()) {
+    throw new Error("workspace OpenRouter credential is empty");
+  }
+  const catalogSettings = withWorkspaceOpenRouterCatalogProvider(settings, customModels);
+  const providers = parseModelProvidersJson(catalogSettings.modelProvidersJson).map(
+    (provider) => provider.id === WORKSPACE_OPENROUTER_PROVIDER_ID ? { ...provider, apiKey } : provider
+  );
+  return { ...catalogSettings, modelProvidersJson: JSON.stringify(providers) };
+}
 var GPT56_FAST_BILLING_MULTIPLIER_BPS = 2e4;
 function productLabelForModelId(modelId) {
   const slug = modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? modelId.slice(CODEX_MODEL_ID_PREFIX.length) : modelId;
@@ -2634,31 +3180,53 @@ function assertLatencyModeRunnable(settings, modelId, latencyMode) {
   }
 }
 function registryCredentialSource(provider) {
-  if (provider.kind === "anonymous") {
-    return { kind: "deployment", mechanism: "none" };
-  }
-  if (provider.kind === "codex-subscription") {
-    return { kind: "connected_subscription", provider: "codex" };
-  }
-  if (provider.kind === "xai-subscription") {
-    return { kind: "connected_subscription", provider: "xai" };
-  }
-  if (provider.kind === "vercel-gateway-workspace") {
-    return { kind: "workspace_connection", mechanism: "api_key" };
+  switch (provider.kind) {
+    case "anonymous":
+      return { kind: "deployment", mechanism: "none" };
+    case "codex-subscription":
+      return { kind: "connected_subscription", provider: "codex" };
+    case "xai-subscription":
+      return { kind: "connected_subscription", provider: "xai" };
+    case "vercel-gateway-workspace":
+    case "openrouter-workspace":
+      return { kind: "workspace_connection", mechanism: "api_key" };
+    case "api-key":
+    case "vercel-gateway-managed":
+    case "openrouter-managed":
+      return { kind: "deployment", mechanism: "api_key" };
+    default: {
+      const _exhaustive = provider.kind;
+      return _exhaustive;
+    }
   }
-  return { kind: "deployment", mechanism: "api_key" };
 }
 function registryBilling(provider) {
-  if (provider.kind === "anonymous") {
-    return { upstreamPayer: "deployment", metering: "external" };
-  }
-  if (provider.kind === "codex-subscription" || provider.kind === "xai-subscription") {
-    return { upstreamPayer: "connected_subscription", metering: "external" };
-  }
-  if (provider.kind === "vercel-gateway-workspace") {
-    return { upstreamPayer: "workspace", metering: "external" };
+  switch (provider.kind) {
+    case "anonymous":
+    case "openrouter-managed":
+      return { upstreamPayer: "deployment", metering: "external" };
+    case "codex-subscription":
+    case "xai-subscription":
+      return { upstreamPayer: "connected_subscription", metering: "external" };
+    case "vercel-gateway-workspace":
+    case "openrouter-workspace":
+      return { upstreamPayer: "workspace", metering: "external" };
+    case "api-key":
+    case "vercel-gateway-managed":
+      return { upstreamPayer: "deployment", metering: "opengeni_credits" };
+    default: {
+      const _exhaustive = provider.kind;
+      return _exhaustive;
+    }
   }
-  return { upstreamPayer: "deployment", metering: "opengeni_credits" };
+}
+function configuredCostForModel(settings, productModelId, credentialSource) {
+  if (credentialSource.kind === "workspace_connection") return "workspace";
+  if (credentialSource.kind === "connected_subscription") return "subscription";
+  return parseModelCostPolicyJson(settings.modelCostPolicyJson)[productModelId] ?? "credits";
+}
+function modelCostClassForConfiguredModel(_settings, model) {
+  return model.cost;
 }
 function builtinCredentialSource(settings) {
   if (settings.openaiProvider === "azure" && !settings.azureOpenaiApiKey) {
@@ -2697,8 +3265,9 @@ function canonicalJson(value) {
   };
   return JSON.stringify(normalize(value));
 }
-function definitionVersionFor(model, provider) {
+function definitionVersionFor(model, provider, options = {}) {
   const requestMetadata = staticRequestMetadataForDigest(provider);
+  const includeWireProfile = options.includeWireProfile ?? true;
   const digestInput = canonicalJson({
     schemaVersion: model.schemaVersion,
     id: model.id,
@@ -2707,7 +3276,7 @@ function definitionVersionFor(model, provider) {
     provider: {
       adapterKind: provider.kind,
       wireApi: provider.api,
-      wireProfile: provider.wireProfile,
+      ...includeWireProfile ? { wireProfile: provider.wireProfile } : {},
       baseUrl: provider.baseUrl ?? null,
       defaultHeaders: requestMetadata.headers,
       defaultQuery: requestMetadata.query
@@ -2716,18 +3285,29 @@ function definitionVersionFor(model, provider) {
     billing: model.billing,
     executionLimits: model.executionLimits,
     capabilities: model.capabilities,
+    // Workspace-facing free/credits classification is a separate live
+    // deployment policy. Operators must drain/fence accepted turns before
+    // changing it; it is intentionally not a second executable-definition
+    // freeze inside TurnExecutionPolicyV1.
     ...model.requestPolicy ? { requestPolicy: model.requestPolicy } : {},
     pricing: model.pricing ?? null
   });
   return `sha256:${createHash("sha256").update("opengeni:model-definition:v1\n", "utf8").update(digestInput, "utf8").digest("hex")}`;
 }
+function legacyImplicitOpenAiDefinitionVersionFor(model, provider) {
+  if (provider.wireProfile !== "openai") return null;
+  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;
+  return definitionVersionFor(modelWithoutVersion, provider, {
+    includeWireProfile: false
+  });
+}
 function builtinProviderId(settings) {
   return settings.openaiProvider === "azure" ? "azure" : "openai";
 }
 function builtinProviderLabel(settings) {
   return settings.openaiProvider === "azure" ? "Azure OpenAI" : "OpenAI";
 }
-function configuredProviders(settings) {
+function configuredProviders(settings, source = process.env) {
   const credentialSource = builtinCredentialSource(settings);
   const builtin = {
     id: builtinProviderId(settings),
@@ -2756,7 +3336,7 @@ function configuredProviders(settings) {
       wireProfile: provider.wireProfile,
       builtin: false,
       baseUrl: provider.baseUrl,
-      apiKey: resolveProviderApiKey(provider),
+      apiKey: resolveProviderApiKey(provider, source),
       defaultQuery: provider.defaultQuery,
       defaultHeaders: provider.defaultHeaders,
       publicDefaultQueryNames: provider.publicDefaultQueryNames,
@@ -2839,8 +3419,14 @@ function withXaiSubscriptionCatalogProvider(settings) {
         { id: "standard", upstream: "supported", runnable: true },
         { id: "fast", upstream: "supported", runnable: true }
       ];
-      capabilities.hostedTools.xSearch = { upstream: "supported", runnable: true };
-      capabilities.hostedTools.imageGeneration = { upstream: "supported", runnable: true };
+      capabilities.hostedTools.xSearch = {
+        upstream: "supported",
+        runnable: true
+      };
+      capabilities.hostedTools.imageGeneration = {
+        upstream: "supported",
+        runnable: true
+      };
       return {
         id: `${XAI_SUBSCRIPTION_MODEL_ID_PREFIX}${slug}`,
         upstreamModelId: slug,
@@ -2856,7 +3442,10 @@ function withXaiSubscriptionCatalogProvider(settings) {
       };
     })
   };
-  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };
+  return {
+    ...settings,
+    modelProvidersJson: JSON.stringify([...providers, provider])
+  };
 }
 function policyProviderIdForModel(settings, modelId) {
   const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);
@@ -2869,6 +3458,9 @@ function policyProviderIdForModel(settings, modelId) {
   if (canonicalModelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
     return WORKSPACE_GATEWAY_PROVIDER_ID;
   }
+  if (canonicalModelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX)) {
+    return WORKSPACE_OPENROUTER_PROVIDER_ID;
+  }
   const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);
   return configured?.providerId ?? builtinProviderId(settings);
 }
@@ -2881,10 +3473,14 @@ function resolvedExecutionLimits(settings, model) {
   };
 }
 function finalizeConfiguredModel(settings, provider, input) {
-  const requestPolicy = provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" ? gatewayRequestPolicyForUpstreamModel(input.upstreamModelId) : void 0;
+  const requestPolicy = provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" ? gatewayRequestPolicyForUpstreamModel(
+    input.upstreamModelId,
+    configuredGatewayCatalogModels(settings)
+  ) : void 0;
   const modelWithoutVersion = {
     schemaVersion: 1,
     ...input,
+    cost: configuredCostForModel(settings, input.id, input.credentialSource),
     ...requestPolicy ? { requestPolicy } : {},
     executionLimits: resolvedExecutionLimits(settings, input)
   };
@@ -2924,10 +3520,10 @@ function assertUniqueModelIdentities(models) {
     }
   }
 }
-function configuredModels(settings) {
+function configuredModels(settings, source = process.env) {
   const builtinId = builtinProviderId(settings);
   const builtinLabel = builtinProviderLabel(settings);
-  const providers = configuredProviders(settings);
+  const providers = configuredProviders(settings, source);
   const providerById = new Map(providers.map((provider) => [provider.id, provider]));
   const pricingSchedules = configuredModelPricingSchedules(settings);
   const parsedRegistry = configuredRegistryProviders(settings);
@@ -3016,7 +3612,10 @@ function configuredModels(settings) {
     }
   }
   assertUniqueModelIdentities(out);
-  return out;
+  const defaultIndex = out.findIndex(
+    (model) => model.id === settings.openaiModel || model.aliases.includes(settings.openaiModel)
+  );
+  return defaultIndex > 0 ? [out[defaultIndex], ...out.slice(0, defaultIndex), ...out.slice(defaultIndex + 1)] : out;
 }
 function canonicalizeConfiguredModelId(settings, modelId) {
   const models = configuredModels(settings);
@@ -3051,10 +3650,26 @@ function settingsForTurnExecutionPolicy(settings, modelId) {
     return withXaiSubscriptionCatalogProvider(settings);
   }
   if (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
+    if (resolveModelProvider(settings, modelId)) {
+      return settings;
+    }
     return withWorkspaceGatewayCatalogProvider(settings);
   }
+  if (modelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX)) {
+    if (resolveModelProvider(settings, modelId)) {
+      return settings;
+    }
+    return withWorkspaceOpenRouterCatalogProvider(settings);
+  }
   return settings;
 }
+function resolveModelProviderForTurn(settings, modelId) {
+  const catalogSettings = settingsForTurnExecutionPolicy(settings, modelId);
+  return resolveModelProvider(
+    catalogSettings,
+    canonicalizeConfiguredModelId(catalogSettings, modelId)
+  );
+}
 function resolveTurnExecutionPolicyV1(settings, input) {
   const catalogSettings = settingsForTurnExecutionPolicy(settings, input.modelId);
   const productModelId = canonicalizeConfiguredModelId(catalogSettings, input.modelId);
@@ -3103,7 +3718,12 @@ function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
   if (!resolved) {
     throw new Error("Turn execution policy model is no longer configured");
   }
-  const mismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || parsed.definitionVersion !== resolved.model.definitionVersion || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
+  const legacyImplicitOpenAiDefinitionVersion = legacyImplicitOpenAiDefinitionVersionFor(
+    resolved.model,
+    resolved.provider
+  );
+  const definitionVersionMatches = parsed.definitionVersion === resolved.model.definitionVersion || parsed.definitionVersion === legacyImplicitOpenAiDefinitionVersion;
+  const mismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || !definitionVersionMatches || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
   if (mismatched) {
     throw new Error("Turn execution policy does not match the current provider definition");
   }
@@ -3240,12 +3860,7 @@ function calculateModelUsageCostBreakdown(settings, model, usage, options) {
 function calculateGatewayReportedCostMicros(settings, model, inferenceCostUsd, options) {
   return calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options).creditCostMicros;
 }
-function calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options) {
-  const schedule = configuredModelPricingSchedules(settings)[model];
-  if (!schedule) {
-    throw new Error(`Missing model pricing for ${model}`);
-  }
-  const pricing = selectModelPricing(schedule, positiveInt(options?.inputTokens));
+function parseGatewayReportedCostDecimal(inferenceCostUsd) {
   const match = /^(0|[1-9]\d*)(?:\.(\d{1,18}))?$/.exec(inferenceCostUsd);
   if (!match) {
     throw new Error("Invalid AI Gateway inference cost");
@@ -3254,16 +3869,35 @@ function calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd
   const decimalDigits = BigInt(`${match[1]}${fraction}`);
   const decimalScale = 10n ** BigInt(fraction.length);
   const providerNumerator = decimalDigits * 1000000n;
-  const providerMicros = (providerNumerator + decimalScale - 1n) / decimalScale;
+  const providerCostMicros = (providerNumerator + decimalScale - 1n) / decimalScale;
+  if (providerCostMicros > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error("AI Gateway inference cost exceeds the supported billing range");
+  }
+  return {
+    providerNumerator,
+    decimalScale,
+    providerCostMicros: Number(providerCostMicros)
+  };
+}
+function calculateGatewayReportedProviderCostMicros(inferenceCostUsd) {
+  return parseGatewayReportedCostDecimal(inferenceCostUsd).providerCostMicros;
+}
+function calculateGatewayReportedCostBreakdown(settings, model, inferenceCostUsd, options) {
+  const schedule = configuredModelPricingSchedules(settings)[model];
+  if (!schedule) {
+    throw new Error(`Missing model pricing for ${model}`);
+  }
+  const pricing = selectModelPricing(schedule, positiveInt(options?.inputTokens));
+  const { providerNumerator, decimalScale, providerCostMicros } = parseGatewayReportedCostDecimal(inferenceCostUsd);
   const marginBps = BigInt(1e4 + (pricing.marginBps ?? 0));
   const numerator = providerNumerator * marginBps;
   const denominator = decimalScale * 10000n;
   const creditMicros = (numerator + denominator - 1n) / denominator;
-  if (providerMicros > BigInt(Number.MAX_SAFE_INTEGER) || creditMicros > BigInt(Number.MAX_SAFE_INTEGER)) {
+  if (creditMicros > BigInt(Number.MAX_SAFE_INTEGER)) {
     throw new Error("AI Gateway inference cost exceeds the supported billing range");
   }
   return {
-    providerCostMicros: Number(providerMicros),
+    providerCostMicros,
     creditCostMicros: Number(creditMicros)
   };
 }
@@ -3843,7 +4477,7 @@ function isDigestPinnedModalDesktopImage(settings) {
   if (settings.modalImageId) return true;
   return typeof settings.modalImageRef === "string" && MODAL_DESKTOP_IMAGE_DIGEST_REF.test(settings.modalImageRef);
 }
-function validateSettings(settings) {
+function validateSettings(settings, source = process.env) {
   temporalConnectionOptions(settings);
   if (settings.goalIdleBackoffMs.some((delayMs) => delayMs > settings.goalIdleBackoffMaxMs)) {
     throw new Error(
@@ -3891,6 +4525,37 @@ function validateSettings(settings) {
       );
     }
   }
+  if (Boolean(settings.managedAuthGoogleClientId) !== Boolean(settings.managedAuthGoogleClientSecret)) {
+    throw new Error(
+      "OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_ID and OPENGENI_MANAGED_AUTH_GOOGLE_CLIENT_SECRET must be configured together"
+    );
+  }
+  if (Boolean(settings.managedAuthGithubClientId) !== Boolean(settings.managedAuthGithubClientSecret)) {
+    throw new Error(
+      "OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_ID and OPENGENI_MANAGED_AUTH_GITHUB_CLIENT_SECRET must be configured together"
+    );
+  }
+  const managedSocialAuthConfigured = Boolean(
+    settings.managedAuthGoogleClientId || settings.managedAuthGithubClientId
+  );
+  if (managedSocialAuthConfigured) {
+    if (settings.productAccessMode !== "managed") {
+      throw new Error(
+        "Managed Google/GitHub authentication requires OPENGENI_PRODUCT_ACCESS_MODE=managed"
+      );
+    }
+    const publicOrigin = canonicalPublicOrigin(settings.publicBaseUrl);
+    if (!publicOrigin) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must be a credential-free HTTP(S) origin when managed social authentication is configured"
+      );
+    }
+    if (!publicOrigin.startsWith("https://") && !["local", "test"].includes(settings.environment)) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when managed social authentication is configured outside local/test"
+      );
+    }
+  }
   environmentsEncryptionKeyBytes(settings);
   if (settings.integrationsEnabled) {
     if (settings.productAccessMode === "managed" && !settings.publicBaseUrl) {
@@ -3947,11 +4612,6 @@ function validateSettings(settings) {
         "OPENGENI_INTEGRATIONS_ENABLED=true is required when personal GitHub OAuth is enabled"
       );
     }
-    if (settings.productAccessMode !== "managed") {
-      throw new Error(
-        "OPENGENI_GITHUB_PERSONAL_OAUTH_ENABLED=true requires OPENGENI_PRODUCT_ACCESS_MODE=managed"
-      );
-    }
     if (!settings.githubPersonalOauthClientId || !settings.githubPersonalOauthClientSecret) {
       throw new Error(
         "personal GitHub OAuth requires OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_ID and OPENGENI_GITHUB_PERSONAL_OAUTH_CLIENT_SECRET"
@@ -4086,15 +4746,6 @@ function validateSettings(settings) {
   if (settings.productAccessMode !== "managed" && settings.billingMode === "stripe") {
     throw new Error("OPENGENI_BILLING_MODE=stripe requires OPENGENI_PRODUCT_ACCESS_MODE=managed");
   }
-  if (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed") {
-    const pricing = configuredModelPricing(settings);
-    const missing = configuredAllowedModels(settings).filter((model) => !pricing[model]);
-    if (missing.length > 0) {
-      throw new Error(
-        `Missing model pricing for managed billing model(s): ${missing.join(", ")}. Set OPENGENI_MODEL_PRICING_JSON.`
-      );
-    }
-  }
   if (settings.usageLimitsMode === "static") {
     const limits = configuredStaticUsageLimits(settings);
     if (Object.keys(limits).length === 0) {
@@ -4294,15 +4945,29 @@ function validateSettings(settings) {
       "[opengeni] OPENGENI_SANDBOX_DESKTOP_ENABLED=true but neither OPENGENI_STREAM_TOKEN_SECRET nor OPENGENI_DELEGATION_SECRET is set: the desktop pixel plane will GRACEFULLY DEGRADE (DesktopStream.transport=null \u2014 no scoped stream tokens can be minted). Set OPENGENI_STREAM_TOKEN_SECRET to enable the live desktop stream."
     );
   }
+  if (settings.modelCatalogSource === "code") {
+    validateModelCatalogSettings(settings, source);
+  } else {
+    parseModelCostPolicyJson(settings.modelCostPolicyJson);
+  }
+}
+function validateModelCatalogSettings(settings, source = process.env) {
+  const costPolicy = parseModelCostPolicyJson(settings.modelCostPolicyJson);
+  const notes = parseModelNotesJson(settings.modelNotesJson);
   const registryProviders = parseModelProvidersJson(settings.modelProvidersJson);
   const builtinId = builtinProviderId(settings);
   const providerIds = /* @__PURE__ */ new Set();
   for (const provider of registryProviders) {
-    if (provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" || provider.kind === "xai-subscription") {
+    if (provider.kind === "vercel-gateway-managed" || provider.kind === "vercel-gateway-workspace" || provider.kind === "openrouter-workspace" || provider.kind === "xai-subscription") {
       throw new Error(
         `OPENGENI_MODEL_PROVIDERS_JSON provider kind ${provider.kind} is reserved for a reviewed OpenGeni credential broker`
       );
     }
+    if (RESERVED_MODEL_PROVIDER_IDS.has(provider.id)) {
+      throw new Error(
+        `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} is reserved for a reviewed OpenGeni provider`
+      );
+    }
     if (provider.id === builtinId) {
       throw new Error(
         `OPENGENI_MODEL_PROVIDERS_JSON provider id ${provider.id} collides with the built-in provider id`
@@ -4314,13 +4979,66 @@ function validateSettings(settings) {
       );
     }
     providerIds.add(provider.id);
-    if (provider.kind !== "codex-subscription" && provider.kind !== "anonymous" && !resolveProviderApiKey(provider)) {
+    if (provider.kind !== "codex-subscription" && provider.kind !== "anonymous" && !resolveProviderApiKey(provider, source)) {
       throw new Error(
         `OPENGENI_MODEL_PROVIDERS_JSON provider ${provider.id} requires a resolvable API key (set apiKey or apiKeyEnv)`
       );
     }
   }
-  configuredModels(settings);
+  const models = configuredModels(settings, source);
+  const defaultCatalogSettings = settingsForTurnExecutionPolicy(settings, settings.openaiModel);
+  const defaultCatalogModels = defaultCatalogSettings === settings ? models : configuredModels(defaultCatalogSettings, source);
+  if (models.length === 0 && defaultCatalogModels.length === 0) {
+    throw new Error("The resolved model catalog contains no executable models");
+  }
+  const defaultModelId = canonicalizeConfiguredModelId(
+    defaultCatalogSettings,
+    settings.openaiModel
+  );
+  if (!defaultCatalogModels.some((model) => model.id === defaultModelId)) {
+    throw new Error(
+      `The default model ${settings.openaiModel} is not executable in the resolved model catalog`
+    );
+  }
+  const deploymentProductIds = new Set(
+    models.filter((model) => model.credentialSource.kind === "deployment").map((model) => model.id)
+  );
+  const noteProductIds = new Set(models.map((model) => model.id));
+  for (const model of configuredGatewayCatalogModels(settings)) {
+    deploymentProductIds.add(model.productId);
+    noteProductIds.add(model.productId);
+    noteProductIds.add(model.workspaceProductId);
+  }
+  for (const model of configuredOpenRouterCatalogModels(settings)) {
+    const productId = `${OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`;
+    deploymentProductIds.add(productId);
+    noteProductIds.add(productId);
+    noteProductIds.add(`${WORKSPACE_OPENROUTER_MODEL_ID_PREFIX}${model.upstreamModelId}`);
+  }
+  if (settings.modelCatalogSource === "code") {
+    for (const productId of Object.keys(costPolicy)) {
+      if (!deploymentProductIds.has(productId)) {
+        throw new Error(
+          `OPENGENI_MODEL_COST_POLICY_JSON references unknown deployment model ${productId}`
+        );
+      }
+    }
+  }
+  for (const productId of Object.keys(notes)) {
+    if (!noteProductIds.has(productId)) {
+      throw new Error(`OPENGENI_MODEL_NOTES_JSON references unknown catalog model ${productId}`);
+    }
+  }
+  if (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed") {
+    const pricing = configuredModelPricing(settings);
+    const missing = models.filter((model) => model.cost === "credits" && !pricing[model.id]).map((model) => model.id);
+    if (missing.length > 0) {
+      throw new Error(
+        `Missing model pricing for managed billing model(s): ${missing.join(", ")}. Set OPENGENI_MODEL_PRICING_JSON.`
+      );
+    }
+  }
+  return models;
 }
 function resolveStreamTokenSecret(settings) {
   const explicit = settings.streamTokenSecret?.trim();
@@ -4410,19 +5128,30 @@ export {
   CODEX_REALTIME_MODEL_ID,
   CapabilityStateV1Schema,
   CapabilitySupportV1,
+  ConfiguredModelCostClass,
   DEFAULT_AGENT_INSTRUCTIONS,
   DEFAULT_GOAL_IDLE_BACKOFF_MAX_MS,
   DEFAULT_GOAL_IDLE_BACKOFF_MS,
+  DEFAULT_MODEL_COST_POLICY_JSON,
+  DEFAULT_OPENROUTER_MODEL_ID,
   GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS,
   GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS,
+  GatewayCatalogModel,
   IntegrationOAuthClientConfigSchema,
   McpServerConnectionRefSchema,
   ModelCapabilitiesV1Schema,
+  ModelCatalogDocument,
+  ModelCostClass,
   ModelProviderApi,
   ModelProviderWireProfile,
   OPENGENI_GATEWAY_MODELS,
   OPENGENI_GATEWAY_PROVIDER_ID,
+  OPENGENI_OPENROUTER_MODELS,
   OPENGENI_REALTIME_MODEL_ID_PREFIX,
+  OPENROUTER_BASE_URL,
+  OPENROUTER_MODEL_ID_PREFIX,
+  OPENROUTER_PROVIDER_ID,
+  OpenRouterCatalogModel,
   RegistryProviderKind,
   SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS,
   SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS,
@@ -4438,14 +5167,20 @@ export {
   VERCEL_AI_GATEWAY_CONNECTION_ROLE,
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   WORKSPACE_GATEWAY_PROVIDER_ID,
+  WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
+  WORKSPACE_OPENROUTER_CONNECTION_ROLE,
+  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
+  WORKSPACE_OPENROUTER_PROVIDER_ID,
   WORKSPACE_REALTIME_MODEL_ID_PREFIX,
   XAI_SUBSCRIPTION_MODEL_ID_PREFIX2 as XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
   allowedFirstPartyMcpToolsForSession,
   applyGitAuthPointerEnvironment,
+  applyModelCatalogDocument,
   assertTurnExecutionPolicyMatchesConfigV1,
   builtinProviderId,
   calculateGatewayReportedCostBreakdown,
   calculateGatewayReportedCostMicros,
+  calculateGatewayReportedProviderCostMicros,
   calculateModelUsageCostBreakdown,
   calculateModelUsageCostMicros,
   calculateVideoGenerationCreditCostMicros,
@@ -4457,10 +5192,16 @@ export {
   configuredAllowedModels,
   configuredAllowedReasoningEfforts,
   configuredEntitlements,
+  configuredGatewayUpstreamModelIds,
+  configuredGatewayWorkspaceProductModelIds,
   configuredGoogleDriveSyncLimits,
+  configuredModelInputIdentities,
+  configuredModelNotes,
   configuredModelPricing,
   configuredModelPricingSchedules,
   configuredModels,
+  configuredOpenRouterUpstreamModelIds,
+  configuredOpenRouterWorkspaceProductModelIds,
   configuredProviders,
   configuredStaticUsageLimits,
   contextInputBudgetTokens,
@@ -4481,9 +5222,13 @@ export {
   hasGitHubRepositorySelection,
   isDirectOpenAiApiBaseUrl,
   isUsableVoiceInputSecret,
+  modelCostClassForConfiguredModel,
   parseExposedPorts,
   parseIntegrationsOauthClientsJson,
   parseMcpServers,
+  parseModelCatalogDocument,
+  parseModelCostPolicyJson,
+  parseModelNotesJson,
   parseModelPricingJson,
   parseModelProvidersJson,
   parseSandboxWarmRateJson,
@@ -4500,6 +5245,7 @@ export {
   resolveFirstPartyDelegationSecret,
   resolveFirstPartyMcpToolPolicy,
   resolveModelProvider,
+  resolveModelProviderForTurn,
   resolveNatsCalloutConfig,
   resolveNatsControlPlaneAuth,
   resolveProviderApiKey,
@@ -4523,10 +5269,13 @@ export {
   startupRetryOptions,
   streamTokenDegraded,
   temporalConnectionOptions,
+  validateModelCatalogSettings,
   voiceInputDeploymentConfigured,
   withCodexCatalogProvider,
   withWorkspaceGatewayCatalogProvider,
   withWorkspaceGatewayCredential,
+  withWorkspaceOpenRouterCatalogProvider,
+  withWorkspaceOpenRouterCredential,
   withXaiSubscriptionCatalogProvider
 };
 //# sourceMappingURL=index.js.map