@opengeni/config 0.7.1 → 0.7.7

package/dist/index.d.ts

@@ -64,6 +64,7 @@ declare const SettingsSchema: z.ZodObject<{
         force: "force";
         scoped: "scoped";
     }>>;
+    runtimeDatabaseRole: z.ZodDefault<z.ZodString>;
     natsUrl: z.ZodDefault<z.ZodString>;
     temporalHost: z.ZodDefault<z.ZodString>;
     temporalNamespace: z.ZodDefault<z.ZodString>;
@@ -77,6 +78,13 @@ declare const SettingsSchema: z.ZodObject<{
     startupDependencyRetryAttempts: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     startupDependencyRetryInitialDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     startupDependencyRetryMaxDelayMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    turnWorkerConcurrencyMode: z.ZodDefault<z.ZodEnum<{
+        fixed: "fixed";
+        "resource-based": "resource-based";
+    }>>;
+    turnWorkerMaxConcurrentTurns: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    turnWorkerTargetCpuUsage: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    turnWorkerTargetMemoryUsage: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     observabilityStructuredLogs: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     observabilityMetricsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     observabilityOtlpEndpoint: z.ZodOptional<z.ZodString>;
@@ -147,6 +155,7 @@ declare const SettingsSchema: z.ZodObject<{
     modelPricingJson: z.ZodDefault<z.ZodString>;
     modelProvidersJson: z.ZodDefault<z.ZodString>;
     codexSubscriptionEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    codexConnectedAppsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexProductSku: z.ZodOptional<z.ZodString>;
     codexToolSearchEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     codexCredentialLeasingEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
@@ -330,6 +339,14 @@ declare const SettingsSchema: z.ZodObject<{
     documentEmbeddingDimensions: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     documentEmbeddingApiKey: z.ZodOptional<z.ZodString>;
     documentEmbeddingBaseUrl: z.ZodOptional<z.ZodString>;
+    documentCurationProvider: z.ZodDefault<z.ZodEnum<{
+        none: "none";
+        openai: "openai";
+        heuristic: "heuristic";
+    }>>;
+    documentCurationModel: z.ZodDefault<z.ZodString>;
+    documentCurationApiKey: z.ZodOptional<z.ZodString>;
+    documentCurationBaseUrl: z.ZodOptional<z.ZodString>;
     gitAuthorName: z.ZodOptional<z.ZodString>;
     gitAuthorEmail: z.ZodOptional<z.ZodString>;
     gitCommitterName: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -149,6 +149,10 @@ var SettingsSchema = z.object({
   // non-owner `opengeni_app` role. "scoped" = the embedded owner-role path (the
   // GUC is still emitted defensively, so the query path is identical).
   rlsStrategy: z.enum(["force", "scoped"]).default("force"),
+  // Exact PostgreSQL login identity required by the standalone FORCE-RLS
+  // startup/readiness assertion. Embedded `scoped` hosts own their role model
+  // and are deliberately not constrained to this name.
+  runtimeDatabaseRole: z.string().min(1).default("opengeni_app"),
   natsUrl: z.string().default("nats://127.0.0.1:4222"),
   temporalHost: z.string().default("127.0.0.1:7233"),
   temporalNamespace: z.string().default("default"),
@@ -162,6 +166,10 @@ var SettingsSchema = z.object({
   startupDependencyRetryAttempts: z.coerce.number().int().positive().default(30),
   startupDependencyRetryInitialDelayMs: z.coerce.number().int().positive().default(1e3),
   startupDependencyRetryMaxDelayMs: z.coerce.number().int().positive().default(5e3),
+  turnWorkerConcurrencyMode: z.enum(["fixed", "resource-based"]).default("fixed"),
+  turnWorkerMaxConcurrentTurns: z.coerce.number().int().positive().max(2e3).default(16),
+  turnWorkerTargetCpuUsage: z.coerce.number().positive().max(1).default(0.8),
+  turnWorkerTargetMemoryUsage: z.coerce.number().positive().max(0.8).default(0.75),
   observabilityStructuredLogs: EnvBoolean.default(false),
   observabilityMetricsEnabled: EnvBoolean.default(true),
   observabilityOtlpEndpoint: z.string().url().optional(),
@@ -279,13 +287,19 @@ var SettingsSchema = z.object({
   // provider whose models route through the ChatGPT backend (@opengeni/codex).
   codexSubscriptionEnabled: EnvBoolean.default(false),
   // OPENGENI_CODEX_SUBSCRIPTION_ENABLED
+  // Expose the connected apps attached to a Codex subscription through the
+  // synthetic codex_apps MCP server. Independent from subscription routing so
+  // operators can use Codex models without exposing ChatGPT connectors.
+  codexConnectedAppsEnabled: EnvBoolean.default(false),
+  // OPENGENI_CODEX_CONNECTED_APPS_ENABLED
   codexProductSku: z.string().optional(),
   // OPENGENI_CODEX_PRODUCT_SKU (X-OpenAI-Product-Sku, apps only)
-  // Progressive connector disclosure (Codex-CLI-style tool_search): on a codex
-  // turn, flag the ~217 codex_apps connector tools `defer_loading:true` (dropping
-  // their schemas from model context) and add one client-executed tool_search
-  // tool that BM25-discloses only the matching connectors. Default OFF — a codex
-  // turn is byte-for-byte unchanged until enabled. OPENGENI_CODEX_TOOL_SEARCH_ENABLED
+  // Progressive MCP disclosure (Codex-CLI-style tool_search): on a codex turn,
+  // flag non-mandatory selected MCP tools `defer_loading:true` (dropping their
+  // schemas from model context) and add one client-executed tool_search tool
+  // that BM25-discloses bounded matches. The mandatory OpenGeni tools stay
+  // eager. Default OFF — a codex turn is byte-for-byte unchanged until enabled.
+  // OPENGENI_CODEX_TOOL_SEARCH_ENABLED
   codexToolSearchEnabled: EnvBoolean.default(false),
   // credential allocator atomic, workspace-local credential allocation. Default OFF is a
   // deliberate rolling-deploy fence: migrate + roll every worker first, then
@@ -697,6 +711,10 @@ var SettingsSchema = z.object({
   documentEmbeddingDimensions: z.coerce.number().int().positive().default(3072),
   documentEmbeddingApiKey: z.string().optional(),
   documentEmbeddingBaseUrl: z.string().url().optional(),
+  documentCurationProvider: z.enum(["openai", "heuristic", "none"]).default("openai"),
+  documentCurationModel: z.string().min(1).default("gpt-4o-mini"),
+  documentCurationApiKey: z.string().optional(),
+  documentCurationBaseUrl: z.string().url().optional(),
   gitAuthorName: z.string().optional(),
   gitAuthorEmail: z.string().optional(),
   gitCommitterName: z.string().optional(),
@@ -1056,6 +1074,7 @@ function getSettings() {
     databaseUrl: optional("OPENGENI_DATABASE_URL"),
     dbSchema: optional("OPENGENI_DB_SCHEMA"),
     rlsStrategy: optional("OPENGENI_RLS_STRATEGY"),
+    runtimeDatabaseRole: optional("OPENGENI_RUNTIME_DATABASE_ROLE"),
     natsUrl: optional("OPENGENI_NATS_URL"),
     temporalHost: optional("OPENGENI_TEMPORAL_HOST"),
     temporalNamespace: optional("OPENGENI_TEMPORAL_NAMESPACE"),
@@ -1073,6 +1092,10 @@ function getSettings() {
       "OPENGENI_STARTUP_DEPENDENCY_RETRY_INITIAL_DELAY_MS"
     ),
     startupDependencyRetryMaxDelayMs: optional("OPENGENI_STARTUP_DEPENDENCY_RETRY_MAX_DELAY_MS"),
+    turnWorkerConcurrencyMode: optional("OPENGENI_TURN_WORKER_CONCURRENCY_MODE"),
+    turnWorkerMaxConcurrentTurns: optional("OPENGENI_TURN_WORKER_MAX_CONCURRENT_TURNS"),
+    turnWorkerTargetCpuUsage: optional("OPENGENI_TURN_WORKER_TARGET_CPU_USAGE"),
+    turnWorkerTargetMemoryUsage: optional("OPENGENI_TURN_WORKER_TARGET_MEMORY_USAGE"),
     observabilityStructuredLogs: optional("OPENGENI_OBSERVABILITY_STRUCTURED_LOGS"),
     observabilityMetricsEnabled: optional("OPENGENI_OBSERVABILITY_METRICS_ENABLED"),
     observabilityOtlpEndpoint: optional("OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT") ?? optional("OTEL_EXPORTER_OTLP_ENDPOINT"),
@@ -1127,6 +1150,7 @@ function getSettings() {
     modelPricingJson: optional("OPENGENI_MODEL_PRICING_JSON"),
     modelProvidersJson: optional("OPENGENI_MODEL_PROVIDERS_JSON"),
     codexSubscriptionEnabled: optional("OPENGENI_CODEX_SUBSCRIPTION_ENABLED"),
+    codexConnectedAppsEnabled: optional("OPENGENI_CODEX_CONNECTED_APPS_ENABLED"),
     codexToolSearchEnabled: optional("OPENGENI_CODEX_TOOL_SEARCH_ENABLED"),
     codexCredentialLeasingEnabled: optional("OPENGENI_CODEX_CREDENTIAL_LEASING_ENABLED"),
     codexFleetPolicyShadowEnabled: optional("OPENGENI_CODEX_FLEET_POLICY_SHADOW_ENABLED"),
@@ -1267,6 +1291,10 @@ function getSettings() {
     documentEmbeddingDimensions: optional("OPENGENI_DOCUMENT_EMBEDDING_DIMENSIONS"),
     documentEmbeddingApiKey: optional("OPENGENI_DOCUMENT_EMBEDDING_API_KEY"),
     documentEmbeddingBaseUrl: optional("OPENGENI_DOCUMENT_EMBEDDING_BASE_URL"),
+    documentCurationProvider: optional("OPENGENI_DOCUMENT_CURATION_PROVIDER"),
+    documentCurationModel: optional("OPENGENI_DOCUMENT_CURATION_MODEL"),
+    documentCurationApiKey: optional("OPENGENI_DOCUMENT_CURATION_API_KEY"),
+    documentCurationBaseUrl: optional("OPENGENI_DOCUMENT_CURATION_BASE_URL"),
     gitAuthorName: optional("OPENGENI_GIT_AUTHOR_NAME"),
     gitAuthorEmail: optional("OPENGENI_GIT_AUTHOR_EMAIL"),
     gitCommitterName: optional("OPENGENI_GIT_COMMITTER_NAME"),
@@ -1663,6 +1691,11 @@ function withCodexCatalogProvider(settings) {
       upstreamModelId: slug,
       label: slug,
       reasoningEffort: true,
+      // The ChatGPT/Codex Responses backend accepts the native web_search
+      // hosted tool (unlike hosted apply_patch/computer transports). Declaring
+      // this here makes provider resolution truthful; the worker still applies
+      // the durable session/turn policy gate before attaching it.
+      hostedWebSearch: true,
       contextWindowTokens: CODEX_MODEL_CONTEXT_WINDOW_TOKENS,
       effectiveContextWindowTokens: CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS,
       autoCompactTokenLimit: CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT,