@opengeni/config 2.1.0 → 2.1.1-canary.36079201993001

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export declare const DEFAULT_OPENROUTER_MODEL_ID: "openrouter/nvidia/nemotron-3-
 export declare const DEFAULT_MODEL_COST_POLICY_JSON: string;
 export declare const SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS: number;
 export declare const SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 10000;
+export declare const SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS = 120000;
 export declare const SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS: number;
 export declare const GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS = 60000;
 export declare const GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS = 60000;
@@ -143,6 +144,7 @@ declare const SettingsSchema: z.ZodObject<{
         disabled: "disabled";
         stripe: "stripe";
     }>>;
+    verifiedSignupTrialCreditsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     entitlementsMode: z.ZodDefault<z.ZodEnum<{
         managed: "managed";
         none: "none";
@@ -177,6 +179,8 @@ declare const SettingsSchema: z.ZodObject<{
         browser_observe: "browser_observe";
         browser_open: "browser_open";
         browser_publish: "browser_publish";
+        browser_read: "browser_read";
+        browser_screenshot: "browser_screenshot";
         browser_tabs: "browser_tabs";
         capability_authorization_request: "capability_authorization_request";
         capability_catalog_search: "capability_catalog_search";
@@ -192,6 +196,7 @@ declare const SettingsSchema: z.ZodObject<{
         computer_targets: "computer_targets";
         connected_machine_enroll_token: "connected_machine_enroll_token";
         connected_machine_remove: "connected_machine_remove";
+        custom_mcp_setup_request: "custom_mcp_setup_request";
         editable_artifact_apply: "editable_artifact_apply";
         editable_artifact_create: "editable_artifact_create";
         editable_artifact_export: "editable_artifact_export";
@@ -347,6 +352,8 @@ declare const SettingsSchema: z.ZodObject<{
         browser_observe: "browser_observe";
         browser_open: "browser_open";
         browser_publish: "browser_publish";
+        browser_read: "browser_read";
+        browser_screenshot: "browser_screenshot";
         browser_tabs: "browser_tabs";
         capability_authorization_request: "capability_authorization_request";
         capability_catalog_search: "capability_catalog_search";
@@ -362,6 +369,7 @@ declare const SettingsSchema: z.ZodObject<{
         computer_targets: "computer_targets";
         connected_machine_enroll_token: "connected_machine_enroll_token";
         connected_machine_remove: "connected_machine_remove";
+        custom_mcp_setup_request: "custom_mcp_setup_request";
         editable_artifact_apply: "editable_artifact_apply";
         editable_artifact_create: "editable_artifact_create";
         editable_artifact_export: "editable_artifact_export";
@@ -788,6 +796,11 @@ declare const SettingsSchema: z.ZodObject<{
     workspaceControlLockTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     rigSetupTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxWarmRateMicrosPerSecondJson: z.ZodDefault<z.ZodString>;
+    sandboxWarmBillingMode: z.ZodDefault<z.ZodEnum<{
+        credits: "credits";
+        shadow: "shadow";
+        usage_only: "usage_only";
+    }>>;
     sandboxMaxWarmSecondsPerWorkspace: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     sandboxPreparationProfiles: z.ZodDefault<z.ZodString>;
     sandboxEnvAllowlist: z.ZodDefault<z.ZodString>;
@@ -825,6 +838,13 @@ declare const SettingsSchema: z.ZodObject<{
     documentEmbeddingDimensions: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     documentEmbeddingApiKey: z.ZodOptional<z.ZodString>;
     documentEmbeddingBaseUrl: z.ZodOptional<z.ZodString>;
+    documentEmbeddingBillingMode: z.ZodDefault<z.ZodEnum<{
+        credits: "credits";
+        shadow: "shadow";
+        usage_only: "usage_only";
+    }>>;
+    documentEmbeddingCreditsActivatedAt: z.ZodOptional<z.ZodISODateTime>;
+    documentEmbeddingRateMicrosPerMillionBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     documentCurationProvider: z.ZodDefault<z.ZodEnum<{
         heuristic: "heuristic";
         none: "none";
@@ -2705,6 +2725,11 @@ export declare function resolveModelProviderForTurn(settings: Settings, modelId:
  * neither proves readiness nor chooses, decrypts, leases, or exposes an account.
  */
 export declare function resolveTurnExecutionPolicyV1(settings: Settings, input: ResolveTurnExecutionPolicyV1Input): TurnExecutionPolicyV1;
+/** Explicit accepted execution identity matches, but its definition digest differs. */
+export declare class TurnExecutionPolicyDefinitionMismatchError extends Error {
+    readonly code = "turn_execution_policy_definition_mismatch";
+    constructor();
+}
 /**
  * Parse-time validation lives in @opengeni/contracts; this verifier binds a
  * present snapshot to the current executable definition and exact turn row.

package/dist/index.js

@@ -53,6 +53,7 @@ var DEFAULT_MODEL_COST_POLICY_JSON = JSON.stringify({
 });
 var SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS = 60 * 6e4;
 var SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS = 1e4;
+var SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS = 12e4;
 var SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS = SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS - SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS;
 var GOOGLE_DRIVE_PROVIDER_REQUEST_TIMEOUT_MAX_MS = 6e4;
 var GOOGLE_DRIVE_PROVIDER_RETRY_DELAY_MAX_MS = 6e4;
@@ -272,6 +273,9 @@ var SettingsSchema = z.object({
   // variable out to disable it).
   organizationTenancyCanonicalActivationEnabled: EnvBoolean.default(false),
   billingMode: BillingMode.default("disabled"),
+  // Explicit launch gate for the one-time $10 verified self-service signup grant.
+  // A migration or deployment alone must not start issuing live credits.
+  verifiedSignupTrialCreditsEnabled: EnvBoolean.default(false),
   entitlementsMode: EntitlementsMode.default("none"),
   usageLimitsMode: UsageLimitsMode.default("none"),
   staticEntitlementsJson: z.string().default("{}"),
@@ -1012,6 +1016,7 @@ var SettingsSchema = z.object({
   // Shape: { "modal": 5, "runloop": 4, ... }. Backends absent here meter
   // warm-seconds but accrue NO warm_cost / debit (rate 0).
   sandboxWarmRateMicrosPerSecondJson: z.string().default("{}"),
+  sandboxWarmBillingMode: z.enum(["usage_only", "shadow", "credits"]).default("usage_only"),
   // Per-workspace warm cap (cumulative warm-seconds since the start of the UTC
   // month, summed over sandbox.warm_seconds). 0 = unbounded. A workspace over the
   // cap force-drains its VIEWER-ONLY boxes (guarded AND turn_holders=0 — a paying
@@ -1045,6 +1050,13 @@ var SettingsSchema = z.object({
   documentEmbeddingDimensions: z.coerce.number().int().positive().default(3072),
   documentEmbeddingApiKey: z.string().optional(),
   documentEmbeddingBaseUrl: z.string().url().optional(),
+  documentEmbeddingBillingMode: z.enum(["usage_only", "shadow", "credits"]).default("usage_only"),
+  // Explicit commercial cutover. Existing queued revisions remain unpriced;
+  // only jobs created at or after this instant may enter the paid rail.
+  documentEmbeddingCreditsActivatedAt: z.iso.datetime().optional(),
+  // Customer tariff for the exact UTF-8 bytes sent to the embedder. Zero leaves
+  // the paid mode unavailable; no commercial rate is selected by this PR.
+  documentEmbeddingRateMicrosPerMillionBytes: z.coerce.number().int().nonnegative().default(0),
   documentCurationProvider: z.enum(["openai", "heuristic", "none"]).default("openai"),
   documentCurationModel: z.string().min(1).default("gpt-4o-mini"),
   documentCurationApiKey: z.string().optional(),
@@ -2376,6 +2388,7 @@ function getSettings(source = process.env) {
       "OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED"
     ),
     billingMode: optional("OPENGENI_BILLING_MODE"),
+    verifiedSignupTrialCreditsEnabled: optional("OPENGENI_VERIFIED_SIGNUP_TRIAL_CREDITS_ENABLED"),
     entitlementsMode: optional("OPENGENI_ENTITLEMENTS_MODE"),
     usageLimitsMode: optional("OPENGENI_USAGE_LIMITS_MODE"),
     staticEntitlementsJson: optional("OPENGENI_STATIC_ENTITLEMENTS_JSON"),
@@ -2662,6 +2675,7 @@ function getSettings(source = process.env) {
     sandboxWarmRateMicrosPerSecondJson: optional(
       "OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON"
     ),
+    sandboxWarmBillingMode: optional("OPENGENI_SANDBOX_WARM_BILLING_MODE"),
     sandboxMaxWarmSecondsPerWorkspace: optional("OPENGENI_SANDBOX_MAX_WARM_SECONDS_PER_WORKSPACE"),
     sandboxPreparationProfiles: optional("OPENGENI_SANDBOX_PREPARATION_PROFILES"),
     sandboxEnvAllowlist: optional("OPENGENI_SANDBOX_ENV_ALLOWLIST"),
@@ -2691,6 +2705,13 @@ function getSettings(source = process.env) {
     documentEmbeddingDimensions: optional("OPENGENI_DOCUMENT_EMBEDDING_DIMENSIONS"),
     documentEmbeddingApiKey: optional("OPENGENI_DOCUMENT_EMBEDDING_API_KEY"),
     documentEmbeddingBaseUrl: optional("OPENGENI_DOCUMENT_EMBEDDING_BASE_URL"),
+    documentEmbeddingBillingMode: optional("OPENGENI_DOCUMENT_EMBEDDING_BILLING_MODE"),
+    documentEmbeddingCreditsActivatedAt: optional(
+      "OPENGENI_DOCUMENT_EMBEDDING_CREDITS_ACTIVATED_AT"
+    ),
+    documentEmbeddingRateMicrosPerMillionBytes: optional(
+      "OPENGENI_DOCUMENT_EMBEDDING_RATE_MICROS_PER_MILLION_BYTES"
+    ),
     documentCurationProvider: optional("OPENGENI_DOCUMENT_CURATION_PROVIDER"),
     documentCurationModel: optional("OPENGENI_DOCUMENT_CURATION_MODEL"),
     documentCurationApiKey: optional("OPENGENI_DOCUMENT_CURATION_API_KEY"),
@@ -2744,7 +2765,18 @@ function getSettings(source = process.env) {
   const settings = {
     ...parsed,
     sandboxIdleGraceMs: raw.sandboxIdleGraceMs === void 0 && parsed.sandboxBackend === "modal" ? Math.min(9e5, Math.floor(parsed.modalTimeoutSeconds * 1e3 / 2)) : parsed.sandboxIdleGraceMs,
-    sandboxRotationLeadMs: raw.sandboxRotationLeadMs === void 0 && parsed.sandboxBackend === "modal" ? Math.min(36e5, Math.floor(parsed.modalTimeoutSeconds * 1e3 / 2)) : parsed.sandboxRotationLeadMs,
+    sandboxRotationLeadMs: raw.sandboxRotationLeadMs === void 0 && parsed.sandboxBackend === "modal" ? Math.min(
+      36e5,
+      Math.max(
+        Math.floor(parsed.modalTimeoutSeconds * 1e3 / 2),
+        SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS + sandboxArchiveCaptureTimeoutMs({
+          sandboxSnapshotTimeoutMs: Math.max(
+            parsed.sandboxSnapshotTimeoutMs,
+            parsed.sandboxDrainSnapshotTimeoutMs ?? parsed.sandboxSnapshotTimeoutMs
+          )
+        }) + 2 * parsed.sandboxLeaseReaperPeriodMs + 1
+      )
+    ) : parsed.sandboxRotationLeadMs,
     mcpServers: ensureBuiltInMcpServers(parsed)
   };
   validateSettings(settings, source);
@@ -3611,6 +3643,14 @@ function legacyImplicitOpenAiDefinitionVersionFor(model, provider) {
     includeWireProfile: false
   });
 }
+function legacyCodexAstraImplicitCachingDefinitionVersionFor(model, provider) {
+  if (model.id !== "codex/gpt-6-astra" || model.upstreamModelId !== "gpt-6-astra" || provider.id !== CODEX_PROVIDER_ID || provider.kind !== "codex-subscription" || provider.api !== "responses" || provider.wireProfile !== "openai" || canonicalJson(model.capabilities.promptCaching) !== canonicalJson({ upstream: "supported", runnable: true, mode: "implicit" })) {
+    return null;
+  }
+  const { definitionVersion: _definitionVersion, ...modelWithoutVersion } = model;
+  const { promptCaching: _promptCaching, ...capabilities } = model.capabilities;
+  return definitionVersionFor({ ...modelWithoutVersion, capabilities }, provider);
+}
 function builtinProviderId(settings) {
   return settings.openaiProvider === "azure" ? "azure" : "openai";
 }
@@ -4071,6 +4111,13 @@ function resolveTurnExecutionPolicyV1(settings, input) {
     definitionVersion: resolved.model.definitionVersion
   });
 }
+var TurnExecutionPolicyDefinitionMismatchError = class extends Error {
+  code = "turn_execution_policy_definition_mismatch";
+  constructor() {
+    super("Turn execution policy does not match the current provider definition");
+    this.name = "TurnExecutionPolicyDefinitionMismatchError";
+  }
+};
 function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
   const parsed = TurnExecutionPolicyV1.parse(policy);
   const catalogSettings = settingsForTurnExecutionPolicy(settings, parsed.productModelId);
@@ -4093,11 +4140,14 @@ function assertTurnExecutionPolicyMatchesConfigV1(settings, policy, expected) {
     resolved.model,
     resolved.provider
   );
-  const definitionVersionMatches = parsed.definitionVersion === resolved.model.definitionVersion || parsed.definitionVersion === legacyImplicitOpenAiDefinitionVersion;
-  const mismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || !definitionVersionMatches || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
-  if (mismatched) {
+  const definitionVersionMatches = parsed.definitionVersion === resolved.model.definitionVersion || parsed.definitionVersion === legacyImplicitOpenAiDefinitionVersion || parsed.definitionVersion === legacyCodexAstraImplicitCachingDefinitionVersionFor(resolved.model, resolved.provider);
+  const identityMismatched = parsed.providerId !== resolved.provider.id || parsed.upstreamModelId !== resolved.model.upstreamModelId || parsed.wireApi !== resolved.model.api || canonicalJson(parsed.credentialSource) !== canonicalJson(resolved.model.credentialSource) || canonicalJson(parsed.billing) !== canonicalJson(resolved.model.billing);
+  if (identityMismatched) {
     throw new Error("Turn execution policy does not match the current provider definition");
   }
+  if (!definitionVersionMatches) {
+    throw new TurnExecutionPolicyDefinitionMismatchError();
+  }
   return { policy: parsed, provider: resolved.provider, model: resolved.model };
 }
 function configuredModelPricingSchedules(settings) {
@@ -5203,7 +5253,22 @@ function validateSettings(settings, source = process.env) {
   parseExposedPorts(settings.dockerExposedPorts);
   sandboxEnvironmentVariableNames(settings);
   sandboxLifecycleHookIds(settings);
-  parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);
+  const warmRates = parseSandboxWarmRateJson(settings.sandboxWarmRateMicrosPerSecondJson);
+  if (settings.sandboxWarmBillingMode === "credits" && Object.values(warmRates).some((rate) => !Number.isSafeInteger(rate))) {
+    throw new Error(
+      "OPENGENI_SANDBOX_WARM_RATE_MICROS_PER_SECOND_JSON paid rates must be safe integers"
+    );
+  }
+  if (settings.documentEmbeddingBillingMode === "credits" && settings.documentEmbeddingProvider === "openai" && settings.documentEmbeddingRateMicrosPerMillionBytes <= 0) {
+    throw new Error(
+      "OPENGENI_DOCUMENT_EMBEDDING_RATE_MICROS_PER_MILLION_BYTES must be positive when paid OpenAI embedding billing is enabled"
+    );
+  }
+  if (settings.documentEmbeddingBillingMode === "credits" && settings.documentEmbeddingProvider === "openai" && !settings.documentEmbeddingCreditsActivatedAt) {
+    throw new Error(
+      "OPENGENI_DOCUMENT_EMBEDDING_CREDITS_ACTIVATED_AT is required for paid OpenAI embeddings"
+    );
+  }
   if (settings.sandboxBackend === "opensandbox") {
     if (!/@sha256:[0-9a-f]{64}$/i.test(settings.openSandboxImage ?? "")) {
       throw new Error(
@@ -5262,9 +5327,10 @@ function validateSettings(settings, source = process.env) {
       ordinaryCaptureTimeoutMs,
       drainCaptureTimeoutMs
     );
-    if (!(rotationLeadMs > providerDeadlineCaptureTimeoutMs + reaperPeriod)) {
+    const requiredRotationLeadMs = SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS + providerDeadlineCaptureTimeoutMs + 2 * reaperPeriod;
+    if (!(rotationLeadMs > requiredRotationLeadMs)) {
       throw new Error(
-        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the largest durable snapshot or drain capture timeout plus one reaper period (${providerDeadlineCaptureTimeoutMs + reaperPeriod}), including for persisted Modal leases after a default-backend rollout.`
+        `OPENGENI_SANDBOX_ROTATION_LEAD_MS (${rotationLeadMs}) must exceed the legacy command stop grace, largest durable snapshot or drain capture timeout, and two reaper periods (${requiredRotationLeadMs}), including for persisted Modal leases after a default-backend rollout.`
       );
     }
     if (settings.sandboxBackend === "modal") {
@@ -5588,12 +5654,14 @@ export {
   RegistryProviderKind,
   SANDBOX_ARCHIVE_CAPTURE_MAX_TIMEOUT_MS,
   SANDBOX_ARCHIVE_CAPTURE_SETTLEMENT_GRACE_MS,
+  SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS,
   SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
   SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
   SANDBOX_REQUIRED_ENV,
   SANDBOX_SNAPSHOT_MAX_TIMEOUT_MS,
   SUPERGROK_REALTIME_MODEL_ID,
   SocialOAuthClientConfigSchema,
+  TurnExecutionPolicyDefinitionMismatchError,
   VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
   VERCEL_AI_GATEWAY_BASE_URL,
   VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,