@opengeni/contracts 2.9.2 → 2.11.1-canary.0

package/src/index.ts

@@ -2106,7 +2106,7 @@ export const HistoricalMemoryPromptMode = z.enum(["legacy_standing", "retrieval_
 export type HistoricalMemoryPromptMode = z.infer<typeof HistoricalMemoryPromptMode>;
 
 // Validates the KNOWN keys of workspaces.settings; passthrough keeps unknown
-// (future) keys rather than stripping them. memoryEnabled defaults off and the
+// (future) keys rather than stripping them. memoryEnabled defaults on and the
 // Memory V1 prompt mode is always retrieval-only composition;
 // voiceInput defaults to enabled when the deployment has a provider.
 export const WorkspaceSettingsSchema = z
@@ -2143,10 +2143,12 @@ export const WorkspaceSettingsSchema = z
   .passthrough();
 export type WorkspaceSettings = z.infer<typeof WorkspaceSettingsSchema>;
 
-// Resolve the effective memoryEnabled flag from a raw settings bag (default off).
-export function resolveWorkspaceMemoryEnabled(settings: unknown): boolean {
-  const parsed = WorkspaceSettingsSchema.safeParse(settings ?? {});
-  return parsed.success ? parsed.data.memoryEnabled === true : false;
+// Resolve the effective memoryEnabled flag from a raw settings bag. Omission
+// defaults on; malformed settings still fail closed so invalid state cannot
+// unexpectedly enable durable retention.
+export function resolveWorkspaceMemoryEnabled(settings?: unknown): boolean {
+  const parsed = WorkspaceSettingsSchema.safeParse(settings === undefined ? {} : settings);
+  return parsed.success ? parsed.data.memoryEnabled !== false : false;
 }
 
 /** Explicit defaults for new chats/schedules, or null for deployment defaults. */
@@ -2300,6 +2302,127 @@ export const UpdateWorkspaceModelPolicyRequest = z.object({
 });
 export type UpdateWorkspaceModelPolicyRequest = z.infer<typeof UpdateWorkspaceModelPolicyRequest>;
 
+export const WORKSPACE_GATEWAY_CUSTOM_MODEL_UPSTREAM_ID_MAX_LENGTH = 238;
+
+export const CreateWorkspaceGatewayCustomModelRequest = z
+  .object({
+    operationId: z.string().uuid(),
+    upstreamModelId: z
+      .string()
+      .max(WORKSPACE_GATEWAY_CUSTOM_MODEL_UPSTREAM_ID_MAX_LENGTH)
+      .regex(/^[!-{}-~]+$/),
+    label: z
+      .string()
+      .min(1)
+      .max(128)
+      .refine((value) => new TextEncoder().encode(value).byteLength <= 128, {
+        message: "label must be at most 128 UTF-8 bytes",
+      })
+      .refine((value) => !/[\r\n|]/u.test(value), {
+        message: "label must not contain newlines or the | field separator",
+      })
+      .optional(),
+  })
+  .strict();
+export type CreateWorkspaceGatewayCustomModelRequest = z.infer<
+  typeof CreateWorkspaceGatewayCustomModelRequest
+>;
+
+export const DeleteWorkspaceGatewayCustomModelRequest = z
+  .object({
+    expectedVersion: z.number().int().positive(),
+    operationId: z.string().uuid(),
+  })
+  .strict();
+export type DeleteWorkspaceGatewayCustomModelRequest = z.infer<
+  typeof DeleteWorkspaceGatewayCustomModelRequest
+>;
+
+export const WorkspaceGatewayCustomModel = z.object({
+  id: z.string().uuid(),
+  upstreamModelId: z.string(),
+  label: z.string().nullable(),
+  version: z.number().int().positive(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+});
+export type WorkspaceGatewayCustomModel = z.infer<typeof WorkspaceGatewayCustomModel>;
+
+export const WorkspaceGatewayCustomModelsResponse = z.object({
+  models: z.array(WorkspaceGatewayCustomModel),
+});
+export type WorkspaceGatewayCustomModelsResponse = z.infer<
+  typeof WorkspaceGatewayCustomModelsResponse
+>;
+
+export const CreateWorkspaceOpenRouterCustomModelRequest = CreateWorkspaceGatewayCustomModelRequest;
+export type CreateWorkspaceOpenRouterCustomModelRequest = z.infer<
+  typeof CreateWorkspaceOpenRouterCustomModelRequest
+>;
+
+export const DeleteWorkspaceOpenRouterCustomModelRequest = DeleteWorkspaceGatewayCustomModelRequest;
+export type DeleteWorkspaceOpenRouterCustomModelRequest = z.infer<
+  typeof DeleteWorkspaceOpenRouterCustomModelRequest
+>;
+
+export const WorkspaceOpenRouterCustomModel = WorkspaceGatewayCustomModel;
+export type WorkspaceOpenRouterCustomModel = z.infer<typeof WorkspaceOpenRouterCustomModel>;
+
+export const WorkspaceOpenRouterCustomModelsResponse = z.object({
+  models: z.array(WorkspaceOpenRouterCustomModel),
+});
+export type WorkspaceOpenRouterCustomModelsResponse = z.infer<
+  typeof WorkspaceOpenRouterCustomModelsResponse
+>;
+
+export const CreateOrganizationProviderCustomModelRequest =
+  CreateWorkspaceGatewayCustomModelRequest;
+export type CreateOrganizationProviderCustomModelRequest = z.infer<
+  typeof CreateOrganizationProviderCustomModelRequest
+>;
+export const DeleteOrganizationProviderCustomModelRequest =
+  DeleteWorkspaceGatewayCustomModelRequest;
+export type DeleteOrganizationProviderCustomModelRequest = z.infer<
+  typeof DeleteOrganizationProviderCustomModelRequest
+>;
+export const OrganizationProviderCustomModel = WorkspaceGatewayCustomModel;
+export type OrganizationProviderCustomModel = z.infer<typeof OrganizationProviderCustomModel>;
+export const OrganizationProviderCustomModelsResponse = z.object({
+  models: z.array(OrganizationProviderCustomModel),
+});
+export type OrganizationProviderCustomModelsResponse = z.infer<
+  typeof OrganizationProviderCustomModelsResponse
+>;
+
+export const OrganizationModelProviderKind = z.enum(["vercel_gateway", "openrouter"]);
+export type OrganizationModelProviderKind = z.infer<typeof OrganizationModelProviderKind>;
+export const OrganizationModelProviderConnectionResponse = z.object({
+  providerKind: OrganizationModelProviderKind,
+  status: z.enum(["active", "revoked"]),
+  version: z.number().int().positive(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+});
+export type OrganizationModelProviderConnectionResponse = z.infer<
+  typeof OrganizationModelProviderConnectionResponse
+>;
+export const UpsertOrganizationModelProviderConnectionRequest = z
+  .object({
+    operationId: z.string().uuid(),
+    expectedVersion: z.number().int().nonnegative().optional(),
+    apiKey: z.string().trim().min(1).max(8192),
+  })
+  .strict();
+export type UpsertOrganizationModelProviderConnectionRequest = z.infer<
+  typeof UpsertOrganizationModelProviderConnectionRequest
+>;
+export const RevokeOrganizationModelProviderConnectionRequest = z
+  .object({ operationId: z.string().uuid(), expectedVersion: z.number().int().positive() })
+  .strict();
+export type RevokeOrganizationModelProviderConnectionRequest = z.infer<
+  typeof RevokeOrganizationModelProviderConnectionRequest
+>;
+
 const turnInitiatorIdentityFields = {
   subjectId: z.string().min(1),
   /** Immutable display snapshot; never an authorization input. */
@@ -3252,6 +3375,9 @@ export const InsightsModelUsageRow = z.object({
   /** Hypothetical provider-rate USD; never an OpenGeni charge. */
   estimatedProviderUsd: z.number().nonnegative(),
   estimatedProviderCostKnownCalls: z.number().int().nonnegative(),
+  /** OpenGeni credit price at the captured rate, whether or not credits paid for the call. */
+  equivalentCreditUsd: z.number().nonnegative(),
+  equivalentCreditCostKnownCalls: z.number().int().nonnegative(),
 });
 export type InsightsModelUsageRow = z.infer<typeof InsightsModelUsageRow>;
 
@@ -3262,6 +3388,9 @@ export const InsightsSeriesPoint = z.object({
   /** UTC hour/day-bucketed hypothetical provider-rate USD for calls with captured pricing. */
   estimatedProviderUsd: z.number().nonnegative(),
   estimatedProviderCostKnownCalls: z.number().int().nonnegative(),
+  /** UTC hour/day-bucketed equivalent OpenGeni credit price for calls with captured pricing. */
+  equivalentCreditUsd: z.number().nonnegative(),
+  equivalentCreditCostKnownCalls: z.number().int().nonnegative(),
   warmSeconds: z.number().nonnegative(),
   inputTokens: z.number().nonnegative(),
   outputTokens: z.number().nonnegative(),
@@ -3296,6 +3425,8 @@ export const InsightsSpendDriver = z.object({
   creditUsd: z.number().nonnegative(),
   estimatedProviderUsd: z.number().nonnegative(),
   estimatedProviderCostKnownCalls: z.number().int().nonnegative(),
+  equivalentCreditUsd: z.number().nonnegative(),
+  equivalentCreditCostKnownCalls: z.number().int().nonnegative(),
   tokens: z.number().nonnegative(),
   cacheHitPct: z.number().int().min(0).max(100),
   pctOfCreditUsd: z.number().int().min(0).max(100),
@@ -3348,6 +3479,8 @@ export const InsightsScheduleRow = z.object({
   creditUsd: z.number().nonnegative().nullable(),
   estimatedProviderUsd: z.number().nonnegative().nullable(),
   estimatedProviderCostKnownCalls: z.number().int().nonnegative().nullable(),
+  equivalentCreditUsd: z.number().nonnegative().nullable(),
+  equivalentCreditCostKnownCalls: z.number().int().nonnegative().nullable(),
   tokens: z.number().nonnegative().nullable(),
   cacheHitPct: z.number().int().min(0).max(100).nullable(),
   billing: InsightsBillingPath.nullable(),
@@ -3375,6 +3508,8 @@ export const InsightsModelCallRow = z.object({
   creditUsd: z.number().nonnegative(),
   /** Hypothetical provider-rate USD; null when historical pricing is unavailable. */
   estimatedProviderUsd: z.number().nonnegative().nullable(),
+  /** Equivalent OpenGeni credit price; null when historical pricing is unavailable. */
+  equivalentCreditUsd: z.number().nonnegative().nullable(),
   pricingSource: InsightsPricingSource.nullable(),
 });
 export type InsightsModelCallRow = z.infer<typeof InsightsModelCallRow>;
@@ -3423,6 +3558,11 @@ export const WorkspaceInsightsSnapshot = z.object({
   priorEstimatedProviderUsd: z.number().nonnegative(),
   estimatedProviderCostKnownCalls: z.number().int().nonnegative(),
   priorEstimatedProviderCostKnownCalls: z.number().int().nonnegative(),
+  /** Equivalent OpenGeni credit price across calls whose historical price was captured. */
+  equivalentCreditUsd: z.number().nonnegative(),
+  priorEquivalentCreditUsd: z.number().nonnegative(),
+  equivalentCreditCostKnownCalls: z.number().int().nonnegative(),
+  priorEquivalentCreditCostKnownCalls: z.number().int().nonnegative(),
   modelCalls: z.number().int().nonnegative(),
   priorInputTokens: z.number().nonnegative(),
   priorTotalTokens: z.number().nonnegative(),
@@ -3847,6 +3987,8 @@ export const McpServerConnectionRef = z
   .object({
     /** Opaque host or standalone connection identifier. */
     connectionId: z.string().min(1).optional(),
+    /** Host-owned credential authority; omission keeps OpenGeni's native connection authority. */
+    authoritySource: z.literal("host").optional(),
     /** Stable provider family (for example github, gitlab, or azure_devops). */
     provider: z.string().min(1).max(128).optional(),
     /** Provider host or tenant domain. */
@@ -3861,6 +4003,13 @@ export const McpServerConnectionRef = z
   })
   .strict()
   .superRefine((reference, context) => {
+    if (reference.authoritySource === "host" && !reference.connectionId) {
+      context.addIssue({
+        code: "custom",
+        message: "host authority requires connectionId",
+        path: ["connectionId"],
+      });
+    }
     if (!reference.selectedResources) return;
     if (!reference.connectionId) {
       context.addIssue({
@@ -4237,6 +4386,14 @@ export type GitHubUserInstallationAccess = GitHubInstallationSummary & {
   repositories: GitHubUserRepositoryAccess[];
 };
 
+export type GitHubAppRepositoryBranchPage = {
+  installationId: number;
+  repositoryId: number;
+  defaultBranch: string;
+  branches: string[];
+  nextPage: number | null;
+};
+
 export type GitHubAppApiPort = {
   /**
    * Exchange one fresh GitHub user-authorization code and prove current
@@ -4268,6 +4425,18 @@ export type GitHubAppApiPort = {
     installationId: number;
   }) => Promise<GitHubInstallationSummary | null>;
   listRepositories?: (input: { installationIds?: number[] }) => Promise<GitHubRepository[]>;
+  /**
+   * List one bounded page of branch suggestions for one exact repository.
+   * Implementations must keep the provider credential server-side and scope
+   * it to exactly `repositoryId`; the caller separately rechecks the durable
+   * workspace binding immediately before and after this provider request.
+   */
+  listRepositoryBranches?: (input: {
+    installationId: number;
+    repositoryId: number;
+    page: number;
+    limit: number;
+  }) => Promise<GitHubAppRepositoryBranchPage>;
 };
 
 export const BillingBalance = z.object({
@@ -8787,6 +8956,10 @@ export const ScheduledTaskRunAcceptedExecution = /* @__PURE__ */ z
     resolvedModel: z.string().min(1),
     resolvedReasoningEffort: ReasoningEffort,
     resolvedLatencyMode: LatencyMode,
+    /** Secret-safe TurnExecutionPolicyV1 accepted with this occurrence. Kept
+     * structurally open here because the canonical policy schema is declared
+     * later in this package; consumers must parse it with TurnExecutionPolicyV1. */
+    turnExecutionPolicy: z.unknown().optional(),
     resolvedSandboxBackend: SandboxBackend,
     resolvedSandboxOs: SandboxOs,
     resolvedTools: z.array(ToolRef).max(SCHEDULED_TASK_TOOL_MAX_COUNT),
@@ -9554,6 +9727,12 @@ export const CapabilityPackSkill = z
         message: "skill name must be a single path segment of letters, digits, '.', '_' or '-'",
       }),
     description: z.string().min(1).max(2048).optional(),
+    // Workspace-managed Skills are available to every session in the
+    // workspace. Session-selected Skills remain installed and inspectable, but
+    // enter model context only when their immutable definition is attached to
+    // a session explicitly. This is the hard contamination boundary for Packs
+    // that guide implementation agents rather than customer-facing agents.
+    activationMode: z.enum(["workspace_managed", "session_selected"]).optional(),
     files: z.array(CapabilityPackSkillFile).min(1).max(64),
   })
   .superRefine((skill, ctx) => {
@@ -9581,8 +9760,11 @@ export type CapabilityPackSkill = z.infer<typeof CapabilityPackSkill>;
 // Inline skill content fixed onto one session at creation. It intentionally
 // uses the exact same validated directory shape as a pack skill, but has a
 // different semantic owner and lifecycle. Session readers can inspect it; it
-// is configuration, never a secret store.
-export const SessionSkill = CapabilityPackSkill;
+// is configuration, never a secret store. Pack activation policy is consumed
+// at admission and cannot become part of the session-owned artifact.
+export const SessionSkill = CapabilityPackSkill.transform(
+  ({ activationMode: _activationMode, ...skill }) => skill,
+);
 export type SessionSkill = z.infer<typeof SessionSkill>;
 
 export const SessionSkills = z
@@ -10490,6 +10672,15 @@ function compareDescending(left: number | string, right: number | string): numbe
 export const ConnectionCredentialBundle = z.record(z.string(), z.unknown());
 export type ConnectionCredentialBundle = z.infer<typeof ConnectionCredentialBundle>;
 
+export const VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY =
+  "vercelAiGatewayCredentialOperationId" as const;
+export const VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY =
+  "vercelAiGatewayCredentialOperationDigest" as const;
+export const OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY =
+  "openRouterCredentialOperationId" as const;
+export const OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY =
+  "openRouterCredentialOperationDigest" as const;
+
 export const CreateConnectionRequest = z.object({
   providerDomain: z.string().min(1),
   kind: ConnectionKind,
@@ -10500,6 +10691,7 @@ export const CreateConnectionRequest = z.object({
   grantedScopes: z.array(z.string().min(1)).default([]),
   expiresAt: z.string().datetime({ offset: true }).nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).default({}),
+  operationId: z.string().uuid().optional(),
 });
 export type CreateConnectionRequest = z.infer<typeof CreateConnectionRequest>;
 
@@ -10555,6 +10747,8 @@ export const UpdateConnectionRequest = z.object({
   grantedScopes: z.array(z.string().min(1)).optional(),
   expiresAt: z.string().datetime({ offset: true }).nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).optional(),
+  expectedVersion: z.number().int().positive().optional(),
+  operationId: z.string().uuid().optional(),
 });
 export type UpdateConnectionRequest = z.infer<typeof UpdateConnectionRequest>;
 
@@ -10750,11 +10944,14 @@ export const CapabilityCatalogItem = z.object({
   /** @deprecated Compatibility explanation paired with enabled. */
   enabledReason: z.string().nullable().default(null),
   // The non-secret connection binding stored with an enabled installation.
-  // Workspace refs retain an exact row id. Subject refs deliberately omit it:
-  // each caller resolves their own visible row by provider/kind at runtime.
+  // Native workspace refs retain an exact row id. Native subject refs omit it
+  // so each caller resolves their own row. The first-party catalog projects a
+  // host-owned installation as null for old-browser safety; the schema remains
+  // tolerant of additive host projections from embedding-specific catalogs.
   connectionRef: z
     .object({
       connectionId: z.string().min(1).optional(),
+      authoritySource: z.literal("host").optional(),
       providerDomain: z.string().min(1),
       kind: z.string().min(1),
       subjectScope: z.enum(["workspace", "subject"]).optional(),
@@ -12317,44 +12514,81 @@ export function resolveSessionEventTypeFilters(input: ResolveSessionEventTypeFil
   return { includeTypes: [...included], excludeTypes: [...excluded] };
 }
 
-export const ToolAuthNeededPayload = z.object({
-  serverId: z.string().min(1),
-  toolName: z.string().min(1).nullable().optional(),
-  providerDomain: z.string().min(1),
-  provider: z.string().min(1).max(128).optional(),
-  // Embedded hosts may use an opaque connection identity; never assume an
-  // OpenGeni UUID on the public event wire.
-  connectionId: z.string().min(1).nullable().optional(),
-  reason: z.enum([
-    "missing_connection",
-    "expired",
-    "insufficient_scope",
-    "refresh_failed",
-    "personal_authority_unavailable",
-    "unsupported_auth",
-    "resource_scope_unavailable",
-  ]),
-  scopes: z.array(z.string().min(1)).optional(),
-  resource: z.string().min(1).optional(),
-  selectedResources: McpConnectionResourceScopes.optional(),
-  authorizationUrl: z.string().url().optional(),
-  subjectId: z.string().min(1).nullable().optional(),
-  // A catalog recommendation is still a tool-level authorization condition:
-  // the agent may describe and request it, but only the authenticated host UI
-  // can start setup. Keeping this nested and optional preserves the established
-  // auth-needed event for ordinary failed MCP calls.
-  capability: z
-    .object({
-      id: z.string().min(1).max(512),
-      name: z.string().min(1).max(256),
-      kind: CapabilityKind,
-      source: CapabilitySource,
-      action: z.enum(["connect", "add_credentials", "enable"]),
-      rationale: z.string().min(1).max(2000),
-      requiredVariables: z.array(VariableSetVariableName).max(64).default([]),
-    })
-    .optional(),
-});
+export const ToolAuthNeededReason = z.enum([
+  "missing_connection",
+  "expired",
+  "insufficient_scope",
+  "refresh_failed",
+  "personal_authority_unavailable",
+  "unsupported_auth",
+  "resource_scope_unavailable",
+]);
+export type ToolAuthNeededReason = z.infer<typeof ToolAuthNeededReason>;
+
+export const ToolAuthNeededPayload = z
+  .object({
+    serverId: z.string().min(1),
+    toolName: z.string().min(1).nullable().optional(),
+    providerDomain: z.string().min(1),
+    provider: z.string().min(1).max(128).optional(),
+    // Embedded hosts may use an opaque connection identity; never assume an
+    // OpenGeni UUID on the public event wire.
+    connectionId: z.string().min(1).nullable().optional(),
+    /** The failed binding is owned by the embedding host, not OpenGeni's connection broker. */
+    authoritySource: z.literal("host").optional(),
+    /**
+     * Legacy-compatible reason. Host-owned event writers pin this to
+     * unsupported_auth so a pre-host-authority browser cannot launch native
+     * OAuth for the opaque id.
+     */
+    reason: ToolAuthNeededReason,
+    /** Exact host recovery reason consumed by host-aware clients. */
+    hostReason: ToolAuthNeededReason.optional(),
+    scopes: z.array(z.string().min(1)).optional(),
+    resource: z.string().min(1).optional(),
+    selectedResources: McpConnectionResourceScopes.optional(),
+    authorizationUrl: z.string().url().optional(),
+    subjectId: z.string().min(1).nullable().optional(),
+    // A catalog recommendation is still a tool-level authorization condition:
+    // the agent may describe and request it, but only the authenticated host UI
+    // can start setup. Keeping this nested and optional preserves the established
+    // auth-needed event for ordinary failed MCP calls.
+    capability: z
+      .object({
+        id: z.string().min(1).max(512),
+        name: z.string().min(1).max(256),
+        kind: CapabilityKind,
+        source: CapabilitySource,
+        action: z.enum(["connect", "add_credentials", "enable"]),
+        rationale: z.string().min(1).max(2000),
+        requiredVariables: z.array(VariableSetVariableName).max(64).default([]),
+      })
+      .optional(),
+  })
+  .superRefine((payload, context) => {
+    if (payload.authoritySource === "host") {
+      if (payload.reason !== "unsupported_auth") {
+        context.addIssue({
+          code: "custom",
+          message: "host auth-needed events require the legacy-safe unsupported_auth reason",
+          path: ["reason"],
+        });
+      }
+      if (!payload.hostReason) {
+        context.addIssue({
+          code: "custom",
+          message: "host auth-needed events require hostReason",
+          path: ["hostReason"],
+        });
+      }
+    } else if (payload.hostReason) {
+      context.addIssue({
+        code: "custom",
+        message: "hostReason is reserved for host-owned auth-needed events",
+        path: ["hostReason"],
+      });
+    }
+  });
 export type ToolAuthNeededPayload = z.infer<typeof ToolAuthNeededPayload>;
 
 /** A host-owned non-tool credential needed by the active run. */
@@ -13123,6 +13357,8 @@ export const SessionEvent = z.object({
   workspaceId: z.string().uuid(),
   sessionId: z.string().uuid(),
   sequence: z.number().int().positive(),
+  /** Server-owned durable high-water mark for a synthetic compact event. */
+  coveredThrough: z.number().int().positive().optional(),
   type: SessionEventType,
   payload: z.unknown().default({}),
   occurredAt: z.string(),
@@ -13712,6 +13948,15 @@ export function boundSessionEvent(
   const turnGeneration = canonicalSessionEventGeneration(source.turnGeneration);
   const turnAttemptId = canonicalOptionalSessionEventUuid(source.turnAttemptId);
   const duplicateOfEventId = canonicalOptionalSessionEventUuid(source.duplicateOfEventId);
+  const rawCoveredThrough = source.coveredThrough.readable
+    ? source.coveredThrough.value
+    : undefined;
+  const coveredThrough =
+    typeof rawCoveredThrough === "number" &&
+    Number.isSafeInteger(rawCoveredThrough) &&
+    rawCoveredThrough >= sequence
+      ? rawCoveredThrough
+      : undefined;
   const envelopeFields = [
     sessionEventCustomSerializerProjection(event),
     sessionEventAdditionalTopLevelFieldProjection(event),
@@ -13747,6 +13992,14 @@ export function boundSessionEvent(
           source.duplicateReason.readable,
         )
       : null,
+    !source.coveredThrough.readable || rawCoveredThrough !== coveredThrough
+      ? sessionEventEnvelopeFieldProjection(
+          "coveredThrough",
+          rawCoveredThrough,
+          coveredThrough,
+          source.coveredThrough.readable,
+        )
+      : null,
     ...sessionEventCanonicalFieldProjections(source, {
       id,
       workspaceId,
@@ -13789,6 +14042,7 @@ export function boundSessionEvent(
     workspaceId,
     sessionId,
     sequence,
+    ...(coveredThrough === undefined ? {} : { coveredThrough }),
     type: typeIsSafe ? (rawType as SessionEvent["type"]) : "session.event.envelope_omitted",
     payload,
     occurredAt,
@@ -13809,6 +14063,7 @@ export function boundSessionEvent(
     workspaceId,
     sessionId,
     sequence,
+    ...(coveredThrough === undefined ? {} : { coveredThrough }),
     type: "session.event.envelope_omitted",
     payload: boundSessionEventPayload(
       {
@@ -13907,6 +14162,7 @@ const SESSION_EVENT_OWN_DATA_FIELDS = [
   "workspaceId",
   "sessionId",
   "sequence",
+  "coveredThrough",
   "type",
   "payload",
   "occurredAt",
@@ -14155,6 +14411,17 @@ export const CreateSessionRequest = withVariableSetIdAlias(
     // Inline skills are fixed onto the session. Child omission inherits the
     // trusted parent's selection; an explicit array, including [], wins.
     skills: SessionSkills.default([]),
+    // Immutable workspace Skill identities to copy onto this session at
+    // creation. This is the explicit opt-in path for session-selected Pack
+    // Skills: installation alone never exposes them to model context. Child
+    // omission still inherits the parent's already-materialized session Skills.
+    installedSkillIds: z
+      .array(z.string().min(1).max(512))
+      .max(32)
+      .refine((ids) => new Set(ids).size === ids.length, {
+        message: "installed Skill identities must be unique",
+      })
+      .optional(),
     // The same child omission rule applies to selected MCP tool refs. Top-level
     // omission still applies workspace-default capability MCP tools; explicit []
     // suppresses those defaults (the first-party OpenGeni server remains added).
@@ -15534,6 +15801,12 @@ export const ModelCredentialSourceV1 =
           mechanism: z.literal("api_key"),
         })
         .strict(),
+      z
+        .object({
+          kind: z.literal("organization_connection"),
+          mechanism: z.literal("api_key"),
+        })
+        .strict(),
     ]),
   );
 export type ModelCredentialSourceV1 = z.infer<typeof ModelCredentialSourceV1>;
@@ -15552,13 +15825,23 @@ export const ModelBillingAttributionV1 =
   /* @__PURE__ */ defineModelContractSchema(() =>
     z
       .object({
-        upstreamPayer: z.enum(["deployment", "workspace", "connected_subscription"]),
+        upstreamPayer: z.enum([
+          "deployment",
+          "workspace",
+          "organization",
+          "connected_subscription",
+        ]),
         metering: z.enum(["opengeni_credits", "external"]),
       })
       .strict(),
   );
 export type ModelBillingAttributionV1 = z.infer<typeof ModelBillingAttributionV1>;
 
+export const ModelCostClassV1 = /* @__PURE__ */ defineModelContractSchema(() =>
+  z.enum(["free", "credits", "subscription", "workspace", "organization"]),
+);
+export type ModelCostClassV1 = z.infer<typeof ModelCostClassV1>;
+
 export const TURN_EXECUTION_POLICY_METADATA_KEY = "turnExecutionPolicyV1" as const;
 
 export const TurnExecutionModelSourceV1 =
@@ -15709,6 +15992,7 @@ export const ModelPricingV1 = /* @__PURE__ */ defineModelContractSchema(() =>
   z.object({
     inputMicrosPerMillionTokens: z.number().int().nonnegative(),
     cachedInputMicrosPerMillionTokens: z.number().int().nonnegative().optional(),
+    cacheWriteMicrosPerMillionTokens: z.number().int().nonnegative().optional(),
     outputMicrosPerMillionTokens: z.number().int().nonnegative(),
     marginBps: z.number().int().min(0).max(100_000).optional(),
   }),
@@ -15746,7 +16030,9 @@ export const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>
     provider: z.string(), // provider id
     providerLabel: z.string(),
     api: z.enum(["responses", "chat"]),
-    source: z.enum(["opengeni", "codex", "supergrok", "workspace_gateway"]).optional(),
+    source: z
+      .enum(["opengeni", "codex", "supergrok", "workspace_gateway", "openrouter"])
+      .optional(),
     contextWindowTokens: z.number().int().positive().optional(),
     // Additive normalized definition metadata. Optional so older server payloads
     // remain parseable; current servers project the complete V1 set.
@@ -15768,6 +16054,7 @@ export const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>
       .optional(),
     credentialSource: ModelCredentialSourceV1.optional(),
     billing: ModelBillingAttributionV1.optional(),
+    cost: ModelCostClassV1.optional(),
     capabilities: ModelCapabilitiesV1.optional(),
     pricing: ModelPricingScheduleV1.optional(),
     definitionVersion: z