@opengeni/config 0.6.2 → 0.6.9

package/dist/index.js

@@ -7,10 +7,22 @@ import {
   ProductAccessMode,
   ReasoningEffort,
   SandboxBackend,
+  SessionMcpApprovalPolicy,
   StaticUsageLimits,
+  TurnExecutionPolicyV1,
   UsageLimitsMode
 } from "@opengeni/contracts";
-import { CODEX_MODEL_ID_PREFIX, CODEX_PROVIDER_ID } from "@opengeni/codex/constants";
+import { CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS } from "@opengeni/codex";
+import {
+  CODEX_FALLBACK_MODEL_SLUGS,
+  CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,
+  CODEX_MODEL_CONTEXT_WINDOW_TOKENS,
+  CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
+  CODEX_MODEL_ID_PREFIX,
+  CODEX_PROVIDER_BASE_URL,
+  CODEX_PROVIDER_ID
+} from "@opengeni/codex/constants";
+import { createHash } from "crypto";
 import { z } from "zod";
 var envName = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var registryId = /^[A-Za-z0-9_-]+$/;
@@ -175,6 +187,9 @@ var SettingsSchema = z.object({
   // holder of stream:control gets 403 until this flips. Keeps stream:control a
   // declared-but-inert permission so later hardening is a flag flip.
   streamControlEnabled: EnvBoolean.default(false),
+  // Existing-session explicit tool replacement is gated until every API and
+  // worker instance understands durable tools_provided provenance.
+  sessionTurnToolReplacementEnabled: EnvBoolean.default(false),
   toolspaceEnabled: EnvBoolean.default(false),
   toolspaceMaxCallsPerTurn: z.coerce.number().int().positive().default(200),
   // Optional release-coherent bootstrap hint for custom rigs/connected machines
@@ -470,6 +485,15 @@ var SettingsSchema = z.object({
   // EnvBoolean (NOT z.coerce.boolean(), which would coerce "false" -> true and
   // turn the flag ON the moment anyone set the env var to disable it).
   sandboxOwnershipEnabled: EnvBoolean.default(false),
+  // --- standalone rig-verifier ownership rollout flag, default OFF ---
+  // Rig verification creates a throwaway provider sandbox outside the normal
+  // session-turn path. When enabled, that sandbox must first acquire the same
+  // durable lease lifecycle used by session boxes so the global orphan sweep
+  // recognizes its exact provider instance. Keep this separate from the general
+  // sandboxOwnershipEnabled rollout: every reaper worker must understand verifier
+  // leases before dispatch is enabled. When false the verifier fails closed before
+  // provider create; it never falls back to the legacy unowned path.
+  rigVerificationLeaseOwnershipEnabled: EnvBoolean.default(false),
   // --- lazy sandbox provisioning rollout flag, default OFF ---
   // Only effective when sandboxOwnershipEnabled is ALSO on (lazy provisioning is a
   // property of the owned path — the SDK never creates/resumes an injected session,
@@ -687,14 +711,8 @@ var SettingsSchema = z.object({
       allowedTools: z.array(z.string().min(1)).optional(),
       timeoutMs: z.number().int().positive().optional(),
       cacheToolsList: z.boolean().default(false),
-      /**
-       * Human-approval policy for this server's tools, overlaid per-run from a
-       * session MCP server row (never from OPENGENI_MCP_SERVERS). `true` = all
-       * tools require approval; a string[] = only the listed UNPREFIXED tool
-       * names do; absent = auto-run (the historical default). Enforced in the
-       * runtime by attaching `needsApproval` to the matching MCP tools.
-       */
-      requireApproval: z.union([z.boolean(), z.array(z.string().min(1))]).optional(),
+      /** Runtime approval policy, overlaid from an attempt-frozen session snapshot. */
+      requireApproval: SessionMcpApprovalPolicy.optional(),
       /**
        * Extra request headers sent to this MCP server (credential injection
        * for workspace-enabled capability MCPs). Populated at runtime from
@@ -712,11 +730,130 @@ var ModelPricingSchema = z.object({
   outputMicrosPerMillionTokens: z.number().int().nonnegative(),
   marginBps: z.number().int().min(0).max(1e5).optional()
 });
+var ModelPricingScheduleSchema = z.object({
+  default: ModelPricingSchema,
+  inputTokenTiers: z.array(
+    z.object({
+      minimumInputTokens: z.number().int().nonnegative(),
+      pricing: ModelPricingSchema
+    })
+  ).optional()
+}).superRefine((schedule, ctx) => {
+  let previous = -1;
+  for (const [index, tier] of (schedule.inputTokenTiers ?? []).entries()) {
+    if (tier.minimumInputTokens <= previous) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["inputTokenTiers", index, "minimumInputTokens"],
+        message: "input-token tier thresholds must be strictly increasing"
+      });
+    }
+    previous = tier.minimumInputTokens;
+  }
+});
+var CapabilitySupportV1 = z.enum(["supported", "unsupported", "unknown"]);
+var CapabilityStateV1Schema = z.object({
+  upstream: CapabilitySupportV1,
+  runnable: z.boolean()
+}).superRefine((state, ctx) => {
+  if (state.upstream === "unsupported" && state.runnable) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["runnable"],
+      message: "an upstream-unsupported capability cannot be runnable"
+    });
+  }
+});
+var ModelModalityV1 = z.enum(["text", "image", "audio"]);
+var ModelLatencyModeV1 = z.enum(["standard", "priority", "fast"]);
+var ModelCapabilitiesV1Schema = z.object({
+  reasoning: CapabilityStateV1Schema.extend({
+    efforts: z.array(ReasoningEffort),
+    defaultEffort: ReasoningEffort.nullable(),
+    required: z.boolean()
+  }),
+  functionCalling: CapabilityStateV1Schema,
+  structuredOutput: CapabilityStateV1Schema,
+  hostedTools: z.object({
+    webSearch: CapabilityStateV1Schema,
+    xSearch: CapabilityStateV1Schema,
+    codeExecution: CapabilityStateV1Schema
+  }),
+  inputModalities: z.array(ModelModalityV1).min(1),
+  outputModalities: z.array(ModelModalityV1).min(1),
+  transports: z.object({
+    sse: CapabilityStateV1Schema,
+    responsesWebSocket: CapabilityStateV1Schema,
+    realtimeAudio: CapabilityStateV1Schema
+  }),
+  latencyModes: z.array(
+    z.object({
+      id: ModelLatencyModeV1,
+      upstream: CapabilitySupportV1,
+      runnable: z.boolean(),
+      billingMultiplierBps: z.number().int().positive().optional()
+    })
+  ).min(1)
+}).superRefine((capabilities, ctx) => {
+  const efforts = new Set(capabilities.reasoning.efforts);
+  if (efforts.size !== capabilities.reasoning.efforts.length) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["reasoning", "efforts"],
+      message: "reasoning efforts must be unique"
+    });
+  }
+  if (capabilities.reasoning.defaultEffort !== null && !efforts.has(capabilities.reasoning.defaultEffort)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["reasoning", "defaultEffort"],
+      message: "the default reasoning effort must be one of the supported efforts"
+    });
+  }
+  if (capabilities.reasoning.runnable && capabilities.reasoning.efforts.length === 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["reasoning", "efforts"],
+      message: "a runnable reasoning capability must declare at least one effort"
+    });
+  }
+  for (const field of ["inputModalities", "outputModalities"]) {
+    if (new Set(capabilities[field]).size !== capabilities[field].length) {
+      ctx.addIssue({
+        code: "custom",
+        path: [field],
+        message: `${field} must be unique`
+      });
+    }
+  }
+  const latencyIds = /* @__PURE__ */ new Set();
+  for (const [index, mode] of capabilities.latencyModes.entries()) {
+    if (latencyIds.has(mode.id)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["latencyModes", index, "id"],
+        message: "latency mode ids must be unique"
+      });
+    }
+    latencyIds.add(mode.id);
+    if (mode.upstream === "unsupported" && mode.runnable) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["latencyModes", index, "runnable"],
+        message: "an upstream-unsupported latency mode cannot be runnable"
+      });
+    }
+  }
+});
 var ModelProviderApi = z.enum(["responses", "chat"]);
 var RegistryProviderKind = z.enum(["api-key", "codex-subscription"]);
 var RegistryModelSchema = z.object({
   id: z.string().min(1),
-  // model id sent to the provider, e.g. "accounts/fireworks/models/glm-5p2"
+  // canonical OpenGeni product id
+  upstreamModelId: z.string().min(1).optional(),
+  // exact provider slug; defaults to id
+  aliases: z.array(z.string().min(1)).optional(),
+  // accepted input only; never sent upstream
   label: z.string().min(1).optional(),
   // display name; defaults to id
   contextWindowTokens: z.number().int().positive().optional(),
@@ -726,10 +863,30 @@ var RegistryModelSchema = z.object({
   // the same 1.2x serialization allowance as Codex when materializing output.
   toolOutputTruncationTokens: z.number().int().positive().optional(),
   reasoningEffort: z.boolean().optional(),
-  // model accepts a reasoning-effort control
+  // legacy compatibility input/projection
   hostedWebSearch: z.boolean().optional(),
-  // provider executes the hosted web_search tool for this model
-  pricing: ModelPricingSchema.optional()
+  // legacy compatibility input/projection
+  capabilities: ModelCapabilitiesV1Schema.optional(),
+  pricing: z.union([ModelPricingSchema, ModelPricingScheduleSchema]).optional(),
+  // Reserved normalized contracts are derived by OpenGeni in V1. Generic
+  // registry JSON must not opt itself into workspace BYOK or reattribute cost.
+  credentialSource: z.never().optional(),
+  billing: z.never().optional()
+}).superRefine((model, ctx) => {
+  if (model.capabilities && model.reasoningEffort !== void 0 && model.reasoningEffort !== model.capabilities.reasoning.runnable) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["reasoningEffort"],
+      message: "legacy reasoningEffort must agree with capabilities.reasoning.runnable"
+    });
+  }
+  if (model.capabilities && model.hostedWebSearch !== void 0 && model.hostedWebSearch !== model.capabilities.hostedTools.webSearch.runnable) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["hostedWebSearch"],
+      message: "legacy hostedWebSearch must agree with capabilities.hostedTools.webSearch.runnable"
+    });
+  }
 });
 var RegistryProviderSchema = z.object({
   kind: RegistryProviderKind.default("api-key"),
@@ -745,6 +902,12 @@ var RegistryProviderSchema = z.object({
   // ... OR name of the env var holding the key (preferred)
   defaultQuery: z.record(z.string(), z.string()).optional(),
   defaultHeaders: z.record(z.string(), z.string()).optional(),
+  publicDefaultQueryNames: z.array(z.string().min(1)).optional(),
+  publicDefaultHeaderNames: z.array(z.string().min(1)).optional(),
+  // V1 derives these from provider kind. Workspace BYOK is deliberately not a
+  // registry switch and requires a separately reviewed encrypted broker.
+  credentialSource: z.never().optional(),
+  billing: z.never().optional(),
   models: z.array(RegistryModelSchema).min(1)
 });
 var IntegrationOAuthClientConfigSchema = z.object({
@@ -909,6 +1072,7 @@ function getSettings() {
     delegationSecret: optional("OPENGENI_DELEGATION_SECRET"),
     streamTokenSecret: optional("OPENGENI_STREAM_TOKEN_SECRET"),
     streamControlEnabled: optional("OPENGENI_STREAM_CONTROL_ENABLED"),
+    sessionTurnToolReplacementEnabled: optional("OPENGENI_SESSION_TURN_TOOL_REPLACEMENT_ENABLED"),
     toolspaceEnabled: optional("OPENGENI_TOOLSPACE_ENABLED"),
     toolspaceMaxCallsPerTurn: optional("OPENGENI_TOOLSPACE_MAX_CALLS_PER_TURN"),
     ogtoolPackageSpec: optional("OPENGENI_OGTOOL_PACKAGE_SPEC"),
@@ -1025,6 +1189,9 @@ function getSettings() {
     vercelTeamId: optional("OPENGENI_VERCEL_TEAM_ID"),
     vercelRuntime: optional("OPENGENI_VERCEL_RUNTIME"),
     sandboxOwnershipEnabled: optional("OPENGENI_SANDBOX_OWNERSHIP_ENABLED"),
+    rigVerificationLeaseOwnershipEnabled: optional(
+      "OPENGENI_RIG_VERIFICATION_LEASE_OWNERSHIP_ENABLED"
+    ),
     sandboxLazyProvisionEnabled: optional("OPENGENI_SANDBOX_LAZY_PROVISION"),
     sandboxSelfhostedEnabled: optional("OPENGENI_SANDBOX_SELFHOSTED_ENABLED"),
     agentOpStreamEnabled: optional("OPENGENI_AGENT_OP_STREAM_ENABLED"),
@@ -1136,6 +1303,287 @@ function resolveProviderApiKey(provider, source = process.env) {
   }
   return void 0;
 }
+var HTTP_FIELD_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var CREDENTIAL_LIKE_NAME_PARTS = /* @__PURE__ */ new Set([
+  "apikey",
+  "auth",
+  "authorization",
+  "bearer",
+  "credential",
+  "cookie",
+  "key",
+  "password",
+  "secret",
+  "session",
+  "signature",
+  "token"
+]);
+var REASONING_EFFORT_ORDER = new Map(
+  ReasoningEffort.options.map((effort, index) => [effort, index])
+);
+var MODALITY_ORDER = new Map(["text", "image", "audio"].map((value, index) => [value, index]));
+var LATENCY_MODE_ORDER = new Map(
+  ["standard", "priority", "fast"].map((value, index) => [value, index])
+);
+function normalizeRegistryBaseUrl(value, providerId) {
+  const url = new URL(value);
+  if (url.username || url.password) {
+    throw new Error(`provider ${providerId} baseUrl must not contain userinfo`);
+  }
+  if (url.search) {
+    throw new Error(
+      `provider ${providerId} baseUrl must not contain a query; move query entries to defaultQuery`
+    );
+  }
+  if (url.hash) {
+    throw new Error(`provider ${providerId} baseUrl must not contain a fragment`);
+  }
+  return url.toString();
+}
+function isCredentialLikeMetadataName(name) {
+  return name.toLowerCase().split(/[-_.]/u).some((part) => CREDENTIAL_LIKE_NAME_PARTS.has(part));
+}
+function normalizeHeaderMap(providerId, headers) {
+  if (!headers) {
+    return void 0;
+  }
+  const normalized = {};
+  const rawByNormalized = /* @__PURE__ */ new Map();
+  for (const [rawName, value] of Object.entries(headers)) {
+    if (!HTTP_FIELD_NAME.test(rawName)) {
+      throw new Error(
+        `provider ${providerId} defaultHeaders contains invalid HTTP field name ${JSON.stringify(rawName)}`
+      );
+    }
+    const name = rawName.toLowerCase();
+    const previous = rawByNormalized.get(name);
+    if (previous !== void 0) {
+      throw new Error(
+        `provider ${providerId} defaultHeaders names ${JSON.stringify(previous)} and ${JSON.stringify(rawName)} collide after lowercase normalization`
+      );
+    }
+    if (name === "authorization") {
+      throw new Error(
+        `provider ${providerId} defaultHeaders must not override SDK-managed Authorization`
+      );
+    }
+    rawByNormalized.set(name, rawName);
+    normalized[name] = value;
+  }
+  return normalized;
+}
+function normalizePublicHeaderNames(providerId, names, headers) {
+  if (!names) {
+    return void 0;
+  }
+  const normalized = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawName of names) {
+    if (!HTTP_FIELD_NAME.test(rawName)) {
+      throw new Error(
+        `provider ${providerId} publicDefaultHeaderNames contains invalid HTTP field name ${JSON.stringify(rawName)}`
+      );
+    }
+    const name = rawName.toLowerCase();
+    if (seen.has(name)) {
+      throw new Error(
+        `provider ${providerId} publicDefaultHeaderNames contains duplicate normalized name ${JSON.stringify(name)}`
+      );
+    }
+    if (!(name in (headers ?? {}))) {
+      throw new Error(
+        `provider ${providerId} publicDefaultHeaderNames declares absent defaultHeaders entry ${JSON.stringify(name)}`
+      );
+    }
+    if (isCredentialLikeMetadataName(name)) {
+      throw new Error(
+        `provider ${providerId} publicDefaultHeaderNames cannot classify credential-like name ${JSON.stringify(name)} as public`
+      );
+    }
+    seen.add(name);
+    normalized.push(name);
+  }
+  return normalized;
+}
+function normalizeQueryMap(providerId, query) {
+  if (!query) {
+    return void 0;
+  }
+  for (const name of Object.keys(query)) {
+    if (!name) {
+      throw new Error(`provider ${providerId} defaultQuery contains an empty name`);
+    }
+  }
+  return { ...query };
+}
+function normalizePublicQueryNames(providerId, names, query) {
+  if (!names) {
+    return void 0;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    if (seen.has(name)) {
+      throw new Error(
+        `provider ${providerId} publicDefaultQueryNames contains duplicate name ${JSON.stringify(name)}`
+      );
+    }
+    if (!(name in (query ?? {}))) {
+      throw new Error(
+        `provider ${providerId} publicDefaultQueryNames declares absent defaultQuery entry ${JSON.stringify(name)}`
+      );
+    }
+    if (isCredentialLikeMetadataName(name)) {
+      throw new Error(
+        `provider ${providerId} publicDefaultQueryNames cannot classify credential-like name ${JSON.stringify(name)} as public`
+      );
+    }
+    seen.add(name);
+  }
+  return [...names];
+}
+function normalizeRegistryProvider(provider) {
+  const defaultHeaders = normalizeHeaderMap(provider.id, provider.defaultHeaders);
+  const defaultQuery = normalizeQueryMap(provider.id, provider.defaultQuery);
+  return {
+    ...provider,
+    baseUrl: normalizeRegistryBaseUrl(provider.baseUrl, provider.id),
+    ...defaultHeaders === void 0 ? {} : { defaultHeaders },
+    ...defaultQuery === void 0 ? {} : { defaultQuery },
+    ...provider.publicDefaultHeaderNames === void 0 ? {} : {
+      publicDefaultHeaderNames: normalizePublicHeaderNames(
+        provider.id,
+        provider.publicDefaultHeaderNames,
+        defaultHeaders
+      )
+    },
+    ...provider.publicDefaultQueryNames === void 0 ? {} : {
+      publicDefaultQueryNames: normalizePublicQueryNames(
+        provider.id,
+        provider.publicDefaultQueryNames,
+        defaultQuery
+      )
+    }
+  };
+}
+function normalizeModelPricingSchedule(pricing) {
+  return "default" in pricing ? pricing : { default: pricing };
+}
+function normalizeCapabilities(capabilities) {
+  const parsed = ModelCapabilitiesV1Schema.parse(capabilities);
+  return {
+    ...parsed,
+    reasoning: {
+      ...parsed.reasoning,
+      efforts: [...parsed.reasoning.efforts].sort(
+        (left, right) => (REASONING_EFFORT_ORDER.get(left) ?? 0) - (REASONING_EFFORT_ORDER.get(right) ?? 0)
+      )
+    },
+    inputModalities: [...parsed.inputModalities].sort(
+      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0)
+    ),
+    outputModalities: [...parsed.outputModalities].sort(
+      (left, right) => (MODALITY_ORDER.get(left) ?? 0) - (MODALITY_ORDER.get(right) ?? 0)
+    ),
+    latencyModes: [...parsed.latencyModes].sort(
+      (left, right) => (LATENCY_MODE_ORDER.get(left.id) ?? 0) - (LATENCY_MODE_ORDER.get(right.id) ?? 0)
+    )
+  };
+}
+function legacyModelCapabilities(settings, input) {
+  const reasoningEfforts = input.reasoningEffort ? configuredAllowedReasoningEfforts(settings) : [];
+  return normalizeCapabilities({
+    reasoning: {
+      upstream: input.reasoningEffort ? "supported" : "unknown",
+      runnable: input.reasoningEffort,
+      efforts: reasoningEfforts,
+      defaultEffort: input.reasoningEffort ? settings.openaiReasoningEffort : null,
+      required: false
+    },
+    functionCalling: { upstream: "unknown", runnable: true },
+    structuredOutput: { upstream: "unknown", runnable: false },
+    hostedTools: {
+      webSearch: {
+        upstream: input.hostedWebSearch ? "supported" : "unknown",
+        runnable: input.hostedWebSearch
+      },
+      xSearch: { upstream: "unknown", runnable: false },
+      codeExecution: { upstream: "unknown", runnable: false }
+    },
+    inputModalities: ["text"],
+    outputModalities: ["text"],
+    transports: {
+      sse: { upstream: "unknown", runnable: true },
+      responsesWebSocket: { upstream: "unknown", runnable: false },
+      realtimeAudio: { upstream: "unknown", runnable: false }
+    },
+    latencyModes: [{ id: "standard", upstream: "unknown", runnable: true }]
+  });
+}
+function registryCredentialSource(provider) {
+  return provider.kind === "codex-subscription" ? { kind: "connected_subscription", provider: "codex" } : { kind: "deployment", mechanism: "api_key" };
+}
+function registryBilling(provider) {
+  return provider.kind === "codex-subscription" ? { upstreamPayer: "connected_subscription", metering: "external" } : { upstreamPayer: "deployment", metering: "opengeni_credits" };
+}
+function builtinCredentialSource(settings) {
+  if (settings.openaiProvider === "azure" && !settings.azureOpenaiApiKey) {
+    return { kind: "deployment", mechanism: "azure_ad_bearer" };
+  }
+  return { kind: "deployment", mechanism: "api_key" };
+}
+function staticRequestMetadataForDigest(provider) {
+  const publicHeaders = new Set(provider.publicDefaultHeaderNames ?? []);
+  const publicQuery = new Set(provider.publicDefaultQueryNames ?? []);
+  return {
+    headers: Object.entries(provider.defaultHeaders ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(
+      ([name, value]) => publicHeaders.has(name) ? { name, classification: "public", value } : { name, classification: "secret" }
+    ),
+    query: Object.entries(provider.defaultQuery ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(
+      ([name, value]) => publicQuery.has(name) ? { name, classification: "public", value } : { name, classification: "secret" }
+    )
+  };
+}
+function canonicalJson(value) {
+  const normalize = (input) => {
+    if (Array.isArray(input)) {
+      return input.map((entry) => normalize(entry));
+    }
+    if (input && typeof input === "object") {
+      const out = {};
+      for (const key of Object.keys(input).sort()) {
+        const child = input[key];
+        if (child !== void 0) {
+          out[key] = normalize(child);
+        }
+      }
+      return out;
+    }
+    return input;
+  };
+  return JSON.stringify(normalize(value));
+}
+function definitionVersionFor(model, provider) {
+  const requestMetadata = staticRequestMetadataForDigest(provider);
+  const digestInput = canonicalJson({
+    schemaVersion: model.schemaVersion,
+    id: model.id,
+    providerId: model.providerId,
+    deployment: model.deployment,
+    provider: {
+      adapterKind: provider.kind,
+      wireApi: provider.api,
+      baseUrl: provider.baseUrl ?? null,
+      defaultHeaders: requestMetadata.headers,
+      defaultQuery: requestMetadata.query
+    },
+    credentialSource: model.credentialSource,
+    billing: model.billing,
+    executionLimits: model.executionLimits,
+    capabilities: model.capabilities,
+    pricing: model.pricing ?? null
+  });
+  return `sha256:${createHash("sha256").update("opengeni:model-definition:v1\n", "utf8").update(digestInput, "utf8").digest("hex")}`;
+}
 function builtinProviderId(settings) {
   return settings.openaiProvider === "azure" ? "azure" : "openai";
 }
@@ -1143,18 +1591,22 @@ function builtinProviderLabel(settings) {
   return settings.openaiProvider === "azure" ? "Azure OpenAI" : "OpenAI";
 }
 function configuredProviders(settings) {
+  const credentialSource = builtinCredentialSource(settings);
   const builtin = {
     id: builtinProviderId(settings),
     label: builtinProviderLabel(settings),
     kind: "api-key",
     api: "responses",
-    builtin: true
+    builtin: true,
+    credentialSource,
+    billing: { upstreamPayer: "deployment", metering: "opengeni_credits" }
   };
   if (settings.openaiProvider === "azure") {
-    builtin.baseUrl = settings.azureOpenaiBaseUrl ?? settings.azureOpenaiEndpoint;
+    const baseUrl = settings.azureOpenaiBaseUrl ?? settings.azureOpenaiEndpoint;
+    builtin.baseUrl = baseUrl ? normalizeRegistryBaseUrl(baseUrl, builtin.id) : void 0;
     builtin.apiKey = settings.azureOpenaiApiKey ?? settings.azureOpenaiAdToken;
   } else {
-    builtin.baseUrl = settings.openaiBaseUrl;
+    builtin.baseUrl = settings.openaiBaseUrl ? normalizeRegistryBaseUrl(settings.openaiBaseUrl, builtin.id) : void 0;
     builtin.apiKey = settings.openaiApiKey;
   }
   const registry = parseModelProvidersJson(settings.modelProvidersJson).map(
@@ -1167,73 +1619,195 @@ function configuredProviders(settings) {
       baseUrl: provider.baseUrl,
       apiKey: resolveProviderApiKey(provider),
       defaultQuery: provider.defaultQuery,
-      defaultHeaders: provider.defaultHeaders
+      defaultHeaders: provider.defaultHeaders,
+      publicDefaultQueryNames: provider.publicDefaultQueryNames,
+      publicDefaultHeaderNames: provider.publicDefaultHeaderNames,
+      credentialSource: registryCredentialSource(provider),
+      billing: registryBilling(provider)
     })
   );
   return [builtin, ...registry];
 }
+function withCodexCatalogProvider(settings) {
+  const providers = parseModelProvidersJson(settings.modelProvidersJson);
+  if (providers.some((provider2) => provider2.id === CODEX_PROVIDER_ID)) {
+    return settings;
+  }
+  const provider = {
+    kind: "codex-subscription",
+    id: CODEX_PROVIDER_ID,
+    label: "Codex (ChatGPT subscription)",
+    api: "responses",
+    baseUrl: CODEX_PROVIDER_BASE_URL,
+    models: CODEX_FALLBACK_MODEL_SLUGS.map((slug) => ({
+      id: `${CODEX_MODEL_ID_PREFIX}${slug}`,
+      upstreamModelId: slug,
+      label: slug,
+      reasoningEffort: true,
+      contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,
+      effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
+      autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,
+      toolOutputTruncationTokens: CODEX_MODEL_TOOL_OUTPUT_TRUNCATION_TOKENS
+    }))
+  };
+  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };
+}
 function policyProviderIdForModel(settings, modelId) {
-  if (modelId.startsWith(CODEX_MODEL_ID_PREFIX)) {
+  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);
+  if (canonicalModelId.startsWith(CODEX_MODEL_ID_PREFIX)) {
     return CODEX_PROVIDER_ID;
   }
-  const configured = configuredModels(settings).find((model) => model.id === modelId);
+  const configured = configuredModels(settings).find((model) => model.id === canonicalModelId);
   return configured?.providerId ?? builtinProviderId(settings);
 }
+function resolvedExecutionLimits(settings, model) {
+  return {
+    contextWindowTokens: model.contextWindowTokens ?? settings.contextWindowTokens,
+    effectiveContextWindowTokens: model.effectiveContextWindowTokens ?? settings.contextEffectiveWindowTokens ?? null,
+    autoCompactTokenLimit: model.autoCompactTokenLimit ?? settings.contextAutoCompactThresholdTokens ?? null,
+    toolOutputTruncationTokens: model.toolOutputTruncationTokens ?? settings.modelToolOutputTruncationTokens ?? null
+  };
+}
+function finalizeConfiguredModel(settings, provider, input) {
+  const modelWithoutVersion = {
+    schemaVersion: 1,
+    ...input,
+    executionLimits: resolvedExecutionLimits(settings, input)
+  };
+  return {
+    ...modelWithoutVersion,
+    definitionVersion: definitionVersionFor(modelWithoutVersion, provider)
+  };
+}
+function assertUniqueModelIdentities(models) {
+  const canonicalOwners = /* @__PURE__ */ new Map();
+  for (const model of models) {
+    const previous = canonicalOwners.get(model.id);
+    if (previous !== void 0) {
+      throw new Error(
+        `OPENGENI_MODEL_PROVIDERS_JSON model id ${JSON.stringify(model.id)} is declared by both ${previous} and ${model.providerId}`
+      );
+    }
+    canonicalOwners.set(model.id, model.providerId);
+  }
+  const acceptedInputs = new Map(canonicalOwners);
+  for (const model of models) {
+    const ownAliases = /* @__PURE__ */ new Set();
+    for (const alias of model.aliases) {
+      if (ownAliases.has(alias)) {
+        throw new Error(
+          `OPENGENI_MODEL_PROVIDERS_JSON model ${JSON.stringify(model.id)} contains duplicate alias ${JSON.stringify(alias)}`
+        );
+      }
+      ownAliases.add(alias);
+      const previous = acceptedInputs.get(alias);
+      if (previous !== void 0) {
+        throw new Error(
+          `OPENGENI_MODEL_PROVIDERS_JSON alias ${JSON.stringify(alias)} for model ${JSON.stringify(model.id)} collides with model/provider ${previous}`
+        );
+      }
+      acceptedInputs.set(alias, model.id);
+    }
+  }
+}
 function configuredModels(settings) {
   const builtinId = builtinProviderId(settings);
   const builtinLabel = builtinProviderLabel(settings);
+  const providers = configuredProviders(settings);
+  const providerById = new Map(providers.map((provider) => [provider.id, provider]));
+  const pricingSchedules = configuredModelPricingSchedules(settings);
+  const parsedRegistry = parseModelProvidersJson(settings.modelProvidersJson);
   const registryOwnedIds = new Set(
-    parseModelProvidersJson(settings.modelProvidersJson).flatMap(
-      (provider) => provider.models.map((model) => model.id)
-    )
+    parsedRegistry.flatMap((provider) => provider.models.map((model) => model.id))
   );
-  const isRegistryNamespaced = (id) => id.startsWith(CODEX_MODEL_ID_PREFIX) || id.includes("/") && registryOwnedIds.has(id);
+  const registryAliases = new Set(
+    parsedRegistry.flatMap((provider) => provider.models.flatMap((model) => model.aliases ?? []))
+  );
+  const isRegistryNamespaced = (id) => id.startsWith(CODEX_MODEL_ID_PREFIX) || registryAliases.has(id) || id.includes("/") && registryOwnedIds.has(id);
+  const builtinProvider = providerById.get(builtinId);
+  if (!builtinProvider) {
+    throw new Error(`Built-in model provider ${builtinId} is not configured`);
+  }
   const out = uniqueValues([
     settings.openaiModel,
     ...splitCsv(settings.openaiAllowedModels)
-  ]).filter((id) => !isRegistryNamespaced(id)).map((id) => ({
-    id,
-    label: id,
-    providerId: builtinId,
-    providerLabel: builtinLabel,
-    api: "responses",
-    contextWindowTokens: settings.contextWindowTokens,
-    toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,
-    reasoningEffort: true,
-    hostedWebSearch: settings.webSearchEnabled
-  }));
-  for (const provider of parseModelProvidersJson(settings.modelProvidersJson)) {
+  ]).filter((id) => !isRegistryNamespaced(id)).map((id) => {
+    const capabilities = legacyModelCapabilities(settings, {
+      reasoningEffort: true,
+      hostedWebSearch: settings.webSearchEnabled
+    });
+    return finalizeConfiguredModel(settings, builtinProvider, {
+      id,
+      aliases: [],
+      label: id,
+      providerId: builtinId,
+      providerLabel: builtinLabel,
+      api: "responses",
+      upstreamModelId: id,
+      deployment: { upstreamModelId: id, wireApi: "responses" },
+      credentialSource: builtinProvider.credentialSource,
+      billing: builtinProvider.billing,
+      capabilities,
+      ...pricingSchedules[id] === void 0 ? {} : { pricing: pricingSchedules[id] },
+      contextWindowTokens: settings.contextWindowTokens,
+      toolOutputTruncationTokens: settings.modelToolOutputTruncationTokens,
+      reasoningEffort: capabilities.reasoning.runnable,
+      hostedWebSearch: capabilities.hostedTools.webSearch.runnable
+    });
+  });
+  for (const provider of parsedRegistry) {
     const providerLabel = provider.label ?? provider.id;
+    const resolvedProvider = providerById.get(provider.id);
+    if (!resolvedProvider) {
+      throw new Error(`Registry model provider ${provider.id} is not configured`);
+    }
     for (const model of provider.models) {
-      out.push({
-        id: model.id,
-        label: model.label ?? model.id,
-        providerId: provider.id,
-        providerLabel,
-        api: provider.api,
-        ...model.contextWindowTokens === void 0 ? {} : { contextWindowTokens: model.contextWindowTokens },
-        ...model.effectiveContextWindowTokens === void 0 ? {} : { effectiveContextWindowTokens: model.effectiveContextWindowTokens },
-        ...model.autoCompactTokenLimit === void 0 ? {} : { autoCompactTokenLimit: model.autoCompactTokenLimit },
-        ...model.toolOutputTruncationTokens === void 0 ? {} : { toolOutputTruncationTokens: model.toolOutputTruncationTokens },
+      const capabilities = model.capabilities ? normalizeCapabilities(model.capabilities) : legacyModelCapabilities(settings, {
         reasoningEffort: model.reasoningEffort ?? false,
         hostedWebSearch: model.hostedWebSearch ?? false
       });
+      const upstreamModelId = model.upstreamModelId ?? model.id;
+      out.push(
+        finalizeConfiguredModel(settings, resolvedProvider, {
+          id: model.id,
+          aliases: [...model.aliases ?? []],
+          label: model.label ?? model.id,
+          providerId: provider.id,
+          providerLabel,
+          api: provider.api,
+          upstreamModelId,
+          deployment: { upstreamModelId, wireApi: provider.api },
+          credentialSource: resolvedProvider.credentialSource,
+          billing: resolvedProvider.billing,
+          capabilities,
+          ...pricingSchedules[model.id] === void 0 ? {} : { pricing: pricingSchedules[model.id] },
+          ...model.contextWindowTokens === void 0 ? {} : { contextWindowTokens: model.contextWindowTokens },
+          ...model.effectiveContextWindowTokens === void 0 ? {} : { effectiveContextWindowTokens: model.effectiveContextWindowTokens },
+          ...model.autoCompactTokenLimit === void 0 ? {} : { autoCompactTokenLimit: model.autoCompactTokenLimit },
+          ...model.toolOutputTruncationTokens === void 0 ? {} : { toolOutputTruncationTokens: model.toolOutputTruncationTokens },
+          reasoningEffort: capabilities.reasoning.runnable,
+          hostedWebSearch: capabilities.hostedTools.webSearch.runnable
+        })
+      );
     }
   }
-  const seen = /* @__PURE__ */ new Set();
-  return out.filter((model) => {
-    if (seen.has(model.id)) {
-      return false;
-    }
-    seen.add(model.id);
-    return true;
-  });
+  assertUniqueModelIdentities(out);
+  return out;
+}
+function canonicalizeConfiguredModelId(settings, modelId) {
+  const models = configuredModels(settings);
+  const canonical = models.find((model) => model.id === modelId);
+  if (canonical) {
+    return canonical.id;
+  }
+  return models.find((model) => model.aliases.includes(modelId))?.id ?? modelId;
 }
 function configuredAllowedModels(settings) {
   return configuredModels(settings).map((model) => model.id);
 }
 function resolveModelProvider(settings, modelId) {
-  const model = configuredModels(settings).find((candidate) => candidate.id === modelId);
+  const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);
+  const model = configuredModels(settings).find((candidate) => candidate.id === canonicalModelId);
   if (!model) {
     return void 0;
   }
@@ -1245,22 +1819,97 @@ function resolveModelProvider(settings, modelId) {
   }
   return { provider, model };
 }
-function configuredModelPricing(settings) {
+function settingsForTurnExecutionPolicy(settings, modelId) {
+  return settings.codexSubscriptionEnabled && modelId.startsWith(CODEX_MODEL_ID_PREFIX) ? withCodexCatalogProvider(settings) : settings;
+}
+function resolveTurnExecutionPolicyV1(settings, input) {
+  const catalogSettings = settingsForTurnExecutionPolicy(settings, input.modelId);
+  const productModelId = canonicalizeConfiguredModelId(catalogSettings, input.modelId);
+  const resolved = resolveModelProvider(catalogSettings, productModelId);
+  if (!resolved) {
+    throw new Error("Turn execution policy model is not present in the configured catalog");
+  }
+  if (input.requestedModelId !== null && canonicalizeConfiguredModelId(catalogSettings, input.requestedModelId) !== productModelId) {
+    throw new Error("Turn execution policy requested model does not canonicalize to its product");
+  }
+  return TurnExecutionPolicyV1.parse({
+    schemaVersion: 1,
+    productModelId,
+    requestedModelId: input.requestedModelId,
+    modelSource: input.modelSource,
+    reasoningEffort: input.reasoningEffort,
+    reasoningSource: input.reasoningSource,
+    providerId: resolved.provider.id,
+    upstreamModelId: resolved.model.upstreamModelId,
+    wireApi: resolved.model.api,
+    credentialSource: resolved.model.credentialSource,
+    billing: resolved.model.billing,
+    definitionVersion: resolved.model.definitionVersion
+  });
+}
+function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
+  const parsed = TurnExecutionPolicyV1.parse(policy);
+  const catalogSettings = settingsForTurnExecutionPolicy(settings, parsed.productModelId);
+  const canonicalExpectedModel = canonicalizeConfiguredModelId(catalogSettings, expected.modelId);
+  if (parsed.productModelId !== canonicalExpectedModel || parsed.reasoningEffort !== expected.reasoningEffort) {
+    throw new Error("Turn execution policy does not match the accepted turn model/reasoning");
+  }
+  if (parsed.requestedModelId !== null && canonicalizeConfiguredModelId(catalogSettings, parsed.requestedModelId) !== parsed.productModelId) {
+    throw new Error("Turn execution policy requested model does not match its product model");
+  }
+  const resolved = resolveModelProvider(catalogSettings, parsed.productModelId);
+  if (!resolved) {
+    throw new Error("Turn execution policy model is no longer configured");
+  }
+  const mismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || parsed.definitionVersion !== resolved.model.definitionVersion || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
+  if (mismatched) {
+    throw new Error("Turn execution policy does not match the current provider definition");
+  }
+  return { policy: parsed, provider: resolved.provider, model: resolved.model };
+}
+function configuredModelPricingSchedules(settings) {
+  const defaults = Object.fromEntries(
+    Object.entries(defaultModelPricing).map(([model, pricing]) => [model, { default: pricing }])
+  );
   const registry = {};
   for (const provider of parseModelProvidersJson(settings.modelProvidersJson)) {
     for (const model of provider.models) {
       if (model.pricing) {
-        registry[model.id] = model.pricing;
+        registry[model.id] = normalizeModelPricingSchedule(model.pricing);
       }
     }
   }
-  const configured = parseModelPricingJson(settings.modelPricingJson);
+  const configured = Object.fromEntries(
+    Object.entries(parseModelPricingJson(settings.modelPricingJson)).map(([model, pricing]) => [
+      model,
+      { default: pricing }
+    ])
+  );
   return {
-    ...defaultModelPricing,
+    ...defaults,
     ...registry,
     ...configured
   };
 }
+function configuredModelPricing(settings) {
+  return Object.fromEntries(
+    Object.entries(configuredModelPricingSchedules(settings)).map(([model, schedule]) => [
+      model,
+      schedule.default
+    ])
+  );
+}
+function selectModelPricing(schedule, inputTokens) {
+  const normalizedInputTokens = Math.max(0, Math.floor(inputTokens));
+  let selected = schedule.default;
+  for (const tier of schedule.inputTokenTiers ?? []) {
+    if (normalizedInputTokens < tier.minimumInputTokens) {
+      break;
+    }
+    selected = tier.pricing;
+  }
+  return selected;
+}
 function contextInputBudgetTokens(settings) {
   if (settings.contextEffectiveWindowTokens !== void 0) {
     return Math.min(settings.contextWindowTokens, settings.contextEffectiveWindowTokens);
@@ -1303,14 +1952,25 @@ function configuredEntitlements(settings) {
   };
 }
 function calculateModelUsageCostMicros(settings, model, usage) {
-  const pricing = configuredModelPricing(settings)[model];
-  if (!pricing) {
+  const schedule = configuredModelPricingSchedules(settings)[model];
+  if (!schedule) {
     throw new Error(`Missing model pricing for ${model}`);
   }
   const entries = usage.requestUsageEntries && usage.requestUsageEntries.length > 0 ? usage.requestUsageEntries : [usage];
-  const rawCost = entries.reduce((sum, entry) => sum + calculateEntryCostMicros(pricing, entry), 0);
-  const marginBps = pricing.marginBps ?? 0;
-  return Math.ceil(rawCost * (1e4 + marginBps) / 1e4);
+  const rawCostByPricing = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const pricing = selectModelPricing(schedule, positiveInt(entry.inputTokens));
+    rawCostByPricing.set(
+      pricing,
+      (rawCostByPricing.get(pricing) ?? 0) + calculateEntryCostMicros(pricing, entry)
+    );
+  }
+  let total = 0;
+  for (const [pricing, rawCost] of rawCostByPricing) {
+    const marginBps = pricing.marginBps ?? 0;
+    total += Math.ceil(rawCost * (1e4 + marginBps) / 1e4);
+  }
+  return total;
 }
 function configuredAllowedReasoningEfforts(settings) {
   return uniqueValues([
@@ -1634,7 +2294,14 @@ function parseModelProvidersJson(raw) {
         `OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${result.error.message}`
       );
     }
-    return result.data;
+    try {
+      return normalizeRegistryProvider(result.data);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`OPENGENI_MODEL_PROVIDERS_JSON provider[${index}] is invalid: ${message}`, {
+        cause: error
+      });
+    }
   });
 }
 function parseIntegrationsOauthClientsJson(raw) {
@@ -2040,6 +2707,7 @@ function validateSettings(settings) {
       );
     }
   }
+  configuredModels(settings);
 }
 function resolveStreamTokenSecret(settings) {
   const explicit = settings.streamTokenSecret?.trim();
@@ -2125,21 +2793,27 @@ function delay(ms) {
 }
 export {
   AGENT_INSTRUCTIONS_CORE_PLACEHOLDER,
+  CapabilityStateV1Schema,
+  CapabilitySupportV1,
   DEFAULT_AGENT_INSTRUCTIONS,
   IntegrationOAuthClientConfigSchema,
   McpServerConnectionRefSchema,
+  ModelCapabilitiesV1Schema,
   ModelProviderApi,
   RegistryProviderKind,
   SANDBOX_REQUIRED_ENV,
   applyGitAuthPointerEnvironment,
+  assertTurnExecutionPolicyMatchesConfigV1,
   builtinProviderId,
   calculateModelUsageCostMicros,
+  canonicalizeConfiguredModelId,
   collectGitIdentityEnvironment,
   collectSandboxEnvironment,
   configuredAllowedModels,
   configuredAllowedReasoningEfforts,
   configuredEntitlements,
   configuredModelPricing,
+  configuredModelPricingSchedules,
   configuredModels,
   configuredProviders,
   configuredStaticUsageLimits,
@@ -2170,15 +2844,18 @@ export {
   resolveProviderApiKey,
   resolveRelayTokenSecret,
   resolveStreamTokenSecret,
+  resolveTurnExecutionPolicyV1,
   retryStartupDependency,
   sandboxEnvironmentVariableNames,
   sandboxLifecycleHookIds,
   sandboxPreparationProfiles,
   sandboxWarmRateMicrosPerSecond,
+  selectModelPricing,
   settingsWithResolvedModelContext,
   stableSandboxEnvironmentForRun,
   startupRetryOptions,
   streamTokenDegraded,
-  temporalConnectionOptions
+  temporalConnectionOptions,
+  withCodexCatalogProvider
 };
 //# sourceMappingURL=index.js.map