@opengeni/core 0.21.2 → 0.24.1

package/src/domain/skill-imports.ts

@@ -0,0 +1,350 @@
+import { createHash } from "node:crypto";
+import type { SkillImportPreview, SkillImportSource } from "@opengeni/contracts";
+import {
+  buildPortableSkillArtifact,
+  PORTABLE_SKILL_MAX_FILES,
+  PORTABLE_SKILL_MAX_TOTAL_BYTES,
+  type SkillLibraryFile,
+} from "@opengeni/runtime/skill-library";
+import { HTTPException } from "hono/http-exception";
+
+export type GitHubSkillTreeEntry = Readonly<{
+  path: string;
+  type: "blob" | "tree" | "commit";
+  mode: string;
+  sha: string;
+  size: number | null;
+}>;
+
+export type GitHubSkillSourceClient = Readonly<{
+  resolveCommit(owner: string, repository: string, ref: string): Promise<string>;
+  listTree(
+    owner: string,
+    repository: string,
+    commit: string,
+  ): Promise<readonly GitHubSkillTreeEntry[]>;
+  readBlob(owner: string, repository: string, sha: string): Promise<Uint8Array>;
+}>;
+
+export type ResolvedSkillImport = Readonly<{
+  preview: SkillImportPreview;
+  files: readonly SkillLibraryFile[];
+}>;
+
+type ParsedSkillSource = Readonly<{
+  source: SkillImportSource;
+  owner: string;
+  repository: string;
+  ref: string;
+  requestedPath: string | null;
+  skillSlug: string | null;
+  inputUrl: string;
+}>;
+
+const githubSegment = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,98}[A-Za-z0-9])?$/u;
+const gitCommit = /^[0-9a-f]{40,64}$/u;
+const maxConcurrentBlobReads = 8;
+
+export async function resolveSkillImport(
+  rawUrl: string,
+  client: GitHubSkillSourceClient,
+): Promise<ResolvedSkillImport> {
+  const parsed = parseSkillSource(rawUrl);
+  const sourceCommit = await client.resolveCommit(parsed.owner, parsed.repository, parsed.ref);
+  if (!gitCommit.test(sourceCommit)) {
+    throw new HTTPException(422, { message: "GitHub returned an invalid source commit" });
+  }
+  const tree = await client.listTree(parsed.owner, parsed.repository, sourceCommit);
+  const sourcePath = selectSkillRoot(parsed, tree);
+  const entries = skillFilesUnderRoot(tree, sourcePath);
+  const declaredBytes = entries.reduce((sum, entry) => sum + (entry.size ?? 0), 0);
+  if (entries.length > PORTABLE_SKILL_MAX_FILES) {
+    throw new HTTPException(422, {
+      message: `Skill contains more than ${PORTABLE_SKILL_MAX_FILES} files`,
+    });
+  }
+  if (declaredBytes > PORTABLE_SKILL_MAX_TOTAL_BYTES) {
+    throw new HTTPException(422, {
+      message: `Skill exceeds ${PORTABLE_SKILL_MAX_TOTAL_BYTES} bytes`,
+    });
+  }
+  const files = await mapConcurrent(entries, maxConcurrentBlobReads, async (entry) => {
+    let content: string;
+    try {
+      content = new TextDecoder("utf-8", { fatal: true }).decode(
+        await client.readBlob(parsed.owner, parsed.repository, entry.sha),
+      );
+    } catch {
+      throw new HTTPException(422, {
+        message: `Skill file is not valid UTF-8 text: ${relativeSkillPath(entry.path, sourcePath)}`,
+      });
+    }
+    return { path: relativeSkillPath(entry.path, sourcePath), content };
+  });
+  let artifact;
+  try {
+    artifact = buildPortableSkillArtifact(files);
+  } catch (error) {
+    throw new HTTPException(422, {
+      message: error instanceof Error ? error.message : "Skill artifact is invalid",
+    });
+  }
+  const repositoryUrl = `https://github.com/${parsed.owner}/${parsed.repository}`;
+  const sourceUrl =
+    sourcePath === "."
+      ? `${repositoryUrl}/tree/${sourceCommit}`
+      : `${repositoryUrl}/tree/${sourceCommit}/${encodeGitHubPath(sourcePath)}`;
+  const warnings: string[] = [];
+  if (!artifact.files.some((file) => /(^|\/)licen[cs]e(?:\.|$)/iu.test(file.path))) {
+    warnings.push("No license file was found inside the selected Skill folder.");
+  }
+  const executableFiles = artifact.files.filter((file) => /(^|\/)scripts?\//u.test(file.path));
+  if (executableFiles.length > 0) {
+    warnings.push(
+      `${executableFiles.length} script file${executableFiles.length === 1 ? "" : "s"} will be available to the agent only after installation.`,
+    );
+  }
+  return {
+    preview: {
+      source: parsed.source,
+      sourceUrl,
+      repositoryUrl,
+      owner: parsed.owner,
+      repository: parsed.repository,
+      sourcePath,
+      sourceCommit,
+      name: artifact.name,
+      description: artifact.description,
+      contentSha256: artifact.contentSha256,
+      totalBytes: artifact.totalBytes,
+      files: artifact.files.map((file) => {
+        const bytes = new TextEncoder().encode(file.content);
+        return {
+          path: file.path,
+          byteSize: bytes.byteLength,
+          contentSha256: sha256Hex(bytes),
+        };
+      }),
+      warnings,
+      installed: false,
+      installationVersion: null,
+    },
+    files: artifact.files,
+  };
+}
+
+export function portableSkillPluginKey(
+  source: Pick<SkillImportPreview, "owner" | "repository" | "sourcePath">,
+): string {
+  return `skill/${source.owner}/${source.repository}/${source.sourcePath}`.toLowerCase();
+}
+
+export function portableSkillCapabilityId(
+  source: Pick<SkillImportPreview, "name" | "owner" | "repository" | "sourcePath">,
+): string {
+  const identity = portableSkillPluginKey(source);
+  const suffix = createHash("sha256").update(identity).digest("hex").slice(0, 12);
+  return `skill:${source.name.toLowerCase()}-${suffix}`;
+}
+
+export function parseSkillSource(rawUrl: string): ParsedSkillSource {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new HTTPException(422, { message: "Enter a valid GitHub or skills.sh URL" });
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.hash) {
+    throw new HTTPException(422, {
+      message: "Skill imports require a credential-free HTTPS URL without a fragment",
+    });
+  }
+  const segments = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
+  if (url.hostname === "skills.sh" || url.hostname === "www.skills.sh") {
+    if (segments.length !== 3) {
+      throw new HTTPException(422, {
+        message: "A skills.sh URL must identify one owner, repository, and Skill",
+      });
+    }
+    const [owner, repository, skillSlug] = segments;
+    assertGitHubRepository(owner!, repository!);
+    if (!skillSlug || !githubSegment.test(skillSlug)) {
+      throw new HTTPException(422, { message: "The skills.sh Skill name is invalid" });
+    }
+    return {
+      source: "skills_sh",
+      owner: owner!,
+      repository: stripGitSuffix(repository!),
+      ref: "HEAD",
+      requestedPath: null,
+      skillSlug,
+      inputUrl: url.toString(),
+    };
+  }
+  if (url.hostname !== "github.com" && url.hostname !== "www.github.com") {
+    throw new HTTPException(422, {
+      message: "Only github.com and skills.sh imports are supported",
+    });
+  }
+  if (segments.length < 2) {
+    throw new HTTPException(422, { message: "A GitHub URL must identify a repository" });
+  }
+  const owner = segments[0]!;
+  const repository = stripGitSuffix(segments[1]!);
+  assertGitHubRepository(owner, repository);
+  if (segments.length === 2) {
+    return {
+      source: "github",
+      owner,
+      repository,
+      ref: "HEAD",
+      requestedPath: null,
+      skillSlug: null,
+      inputUrl: url.toString(),
+    };
+  }
+  const mode = segments[2];
+  if (mode !== "tree" && mode !== "blob") {
+    throw new HTTPException(422, {
+      message: "Use a GitHub repository, tree, folder, or SKILL.md URL",
+    });
+  }
+  const ref = segments[3];
+  if (!ref) throw new HTTPException(422, { message: "The GitHub URL is missing a revision" });
+  const pathSegments = segments.slice(4);
+  if (pathSegments.length === 0) {
+    throw new HTTPException(422, { message: "The GitHub URL is missing a Skill folder" });
+  }
+  const requestedPath = normalizeGitHubPath(
+    mode === "blob" && pathSegments.at(-1)?.toLowerCase() === "skill.md"
+      ? pathSegments.slice(0, -1)
+      : pathSegments,
+  );
+  return {
+    source: "github",
+    owner,
+    repository,
+    ref,
+    requestedPath,
+    skillSlug: null,
+    inputUrl: url.toString(),
+  };
+}
+
+function selectSkillRoot(source: ParsedSkillSource, tree: readonly GitHubSkillTreeEntry[]): string {
+  const skillFiles = tree
+    .filter(
+      (entry) =>
+        entry.type === "blob" &&
+        entry.mode !== "120000" &&
+        (entry.path === "SKILL.md" || entry.path.endsWith("/SKILL.md")),
+    )
+    .map((entry) => entry.path.slice(0, -"/SKILL.md".length) || ".")
+    .sort();
+  if (source.requestedPath) {
+    const root = source.requestedPath;
+    if (!skillFiles.includes(root)) {
+      throw new HTTPException(422, {
+        message: `No top-level SKILL.md was found in ${root}`,
+      });
+    }
+    return root;
+  }
+  const candidates = source.skillSlug
+    ? skillFiles.filter((path) => path.split("/").at(-1) === source.skillSlug)
+    : skillFiles;
+  if (candidates.length === 0) {
+    throw new HTTPException(422, { message: "No Skill folder with SKILL.md was found" });
+  }
+  if (candidates.length > 1) {
+    throw new HTTPException(422, {
+      message: "This source contains multiple Skills; paste the exact GitHub folder URL",
+    });
+  }
+  return candidates[0]!;
+}
+
+function skillFilesUnderRoot(
+  tree: readonly GitHubSkillTreeEntry[],
+  root: string,
+): GitHubSkillTreeEntry[] {
+  const prefix = root === "." ? "" : `${root}/`;
+  const inside = tree.filter((entry) => entry.path.startsWith(prefix));
+  const unsupported = inside.find(
+    (entry) => entry.type === "commit" || (entry.type === "blob" && entry.mode === "120000"),
+  );
+  if (unsupported) {
+    throw new HTTPException(422, {
+      message: `Skill folders may not contain symbolic links or submodules (${unsupported.path})`,
+    });
+  }
+  const files = inside
+    .filter((entry) => entry.type === "blob")
+    .sort((left, right) => left.path.localeCompare(right.path));
+  if (files.length === 0) {
+    throw new HTTPException(422, { message: "The selected Skill folder is empty" });
+  }
+  return files;
+}
+
+function relativeSkillPath(path: string, root: string): string {
+  return root === "." ? path : path.slice(root.length + 1);
+}
+
+function normalizeGitHubPath(segments: readonly string[]): string {
+  if (
+    segments.length === 0 ||
+    segments.some(
+      (segment) =>
+        segment.length === 0 ||
+        segment === "." ||
+        segment === ".." ||
+        segment.includes("\\") ||
+        /[\u0000-\u001f\u007f]/u.test(segment),
+    )
+  ) {
+    throw new HTTPException(422, { message: "The GitHub Skill path is invalid" });
+  }
+  return segments.join("/");
+}
+
+function encodeGitHubPath(path: string): string {
+  return path
+    .split("/")
+    .map((segment) => encodeURIComponent(segment))
+    .join("/");
+}
+
+function stripGitSuffix(value: string): string {
+  return value.replace(/\.git$/iu, "");
+}
+
+function assertGitHubRepository(owner: string, repository: string): void {
+  if (!githubSegment.test(owner) || !githubSegment.test(stripGitSuffix(repository))) {
+    throw new HTTPException(422, { message: "The GitHub owner or repository name is invalid" });
+  }
+}
+
+async function mapConcurrent<Input, Output>(
+  values: readonly Input[],
+  concurrency: number,
+  map: (value: Input) => Promise<Output>,
+): Promise<Output[]> {
+  const output = new Array<Output>(values.length);
+  let next = 0;
+  await Promise.all(
+    Array.from({ length: Math.min(concurrency, values.length) }, async () => {
+      for (;;) {
+        const index = next;
+        next += 1;
+        if (index >= values.length) return;
+        output[index] = await map(values[index]!);
+      }
+    }),
+  );
+  return output;
+}
+
+function sha256Hex(bytes: Uint8Array): string {
+  return createHash("sha256").update(bytes).digest("hex");
+}

package/src/domain/slack-publication-secret-safety.ts

@@ -0,0 +1,42 @@
+export const SLACK_PUBLICATION_CREDENTIAL_OMISSION = "[credential omitted]";
+
+const CREDENTIAL_PATTERNS = [
+  /-----BEGIN(?: [A-Z0-9]+)* PRIVATE KEY-----[\s\S]*?(?:-----END(?: [A-Z0-9]+)* PRIVATE KEY-----|$)/gi,
+  /\b(?:github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,})/g,
+  /\b(?:sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,})/g,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}/g,
+  /\bAIza[0-9A-Za-z_-]{20,}/g,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+] as const;
+
+const BEARER_CREDENTIAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi;
+const CREDENTIAL_ASSIGNMENT_PATTERN =
+  /(^|[\s,;([])((?:api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|passwd|secret|token))\s*[:=]\s*(?:"[^"]{8,}"|'[^']{8,}'|[^\s,;\])}]{8,})/gi;
+const CREDENTIAL_URL_PATTERN = /\b([a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)[^@\s/]+@/gi;
+
+/**
+ * Deterministic, sink-local protection for text that is about to be persisted
+ * as a Slack publication projection or rendered to Slack. It intentionally
+ * does not scan or mutate canonical Memory, durable-learning receipts, model
+ * context, history, events, or any other internal OpenGeni content path.
+ */
+export function sanitizeSlackPublicationText(value: string): string {
+  let sanitized = value;
+  for (const pattern of CREDENTIAL_PATTERNS) {
+    sanitized = sanitized.replace(pattern, SLACK_PUBLICATION_CREDENTIAL_OMISSION);
+  }
+  sanitized = sanitized.replace(
+    BEARER_CREDENTIAL_PATTERN,
+    `Bearer ${SLACK_PUBLICATION_CREDENTIAL_OMISSION}`,
+  );
+  sanitized = sanitized.replace(
+    CREDENTIAL_ASSIGNMENT_PATTERN,
+    (_match, prefix: string, name: string) =>
+      `${prefix}${name}=${SLACK_PUBLICATION_CREDENTIAL_OMISSION}`,
+  );
+  return sanitized.replace(
+    CREDENTIAL_URL_PATTERN,
+    (_match, prefix: string) => `${prefix}${SLACK_PUBLICATION_CREDENTIAL_OMISSION}@`,
+  );
+}

package/src/domain/timeline-annotations.ts

@@ -0,0 +1,204 @@
+import {
+  DraftTimelineAnnotations,
+  SubmittedTimelineAnnotations,
+  numberTimelineAnnotations,
+  type DraftTimelineAnnotation,
+  type SessionEvent,
+  type SubmittedTimelineAnnotation,
+  type TimelineAnnotation,
+} from "@opengeni/contracts";
+import { getSessionEvent, type Database } from "@opengeni/db";
+import { HTTPException } from "hono/http-exception";
+
+const SOURCE_CONTEXT_BYTES = 160;
+const ANSI_SEQUENCE = new RegExp("\\u001B\\[[0-?]*[ -/]*[@-~]", "g");
+
+type AnnotationValidationOptions = {
+  requireNotes: boolean;
+};
+
+function invalidAnnotationSource(): never {
+  throw new HTTPException(422, { message: "Invalid timeline annotation source" });
+}
+
+function safeJson(value: unknown): string {
+  try {
+    return JSON.stringify(value) ?? "";
+  } catch {
+    return String(value ?? "");
+  }
+}
+
+function firstMcpText(value: unknown): string | null {
+  if (!Array.isArray(value)) return null;
+  for (const part of value) {
+    if (
+      part !== null &&
+      typeof part === "object" &&
+      (part as { type?: unknown }).type === "text" &&
+      typeof (part as { text?: unknown }).text === "string"
+    ) {
+      return (part as { text: string }).text;
+    }
+  }
+  return null;
+}
+
+function normalizedToolOutput(value: unknown, depth = 0): string {
+  if (depth > 8 || value === null || value === undefined)
+    return value == null ? "" : safeJson(value);
+  if (typeof value === "string") return value;
+  if (typeof value !== "object" || Array.isArray(value)) return safeJson(value);
+  const record = value as Record<string, unknown>;
+  if (record.type === "text" && typeof record.text === "string") return record.text;
+  const contentText = firstMcpText(record.content);
+  if (contentText !== null) return contentText;
+  if ("structuredContent" in record) {
+    return contentText ?? normalizedToolOutput(record.structuredContent, depth + 1);
+  }
+  if ("result" in record) return normalizedToolOutput(record.result, depth + 1);
+  return safeJson(value);
+}
+
+function stripExecBanner(text: string): string {
+  const marker = text.indexOf("\nOutput:\n");
+  if (marker >= 0) return text.slice(marker + "\nOutput:\n".length);
+  return text.startsWith("Output:\n") ? text.slice("Output:\n".length) : text;
+}
+
+export function timelineAnnotationSourceText(event: SessionEvent): string | null {
+  if (!event.payload || typeof event.payload !== "object" || Array.isArray(event.payload)) {
+    return null;
+  }
+  const payload = event.payload as Record<string, unknown>;
+  if (event.type === "user.message" || event.type === "agent.message.completed") {
+    return typeof payload.text === "string" ? payload.text : null;
+  }
+  if (event.type !== "agent.toolCall.output") return null;
+  const output = Object.prototype.hasOwnProperty.call(payload, "output")
+    ? payload.output
+    : payload.preview;
+  const text = stripExecBanner(normalizedToolOutput(output)).replace(ANSI_SEQUENCE, "");
+  return text.length > 0 ? text : null;
+}
+
+function utf8Prefix(value: string, maxBytes: number): string {
+  let output = "";
+  let bytes = 0;
+  for (const character of value) {
+    const next = new TextEncoder().encode(character).byteLength;
+    if (bytes + next > maxBytes) break;
+    output += character;
+    bytes += next;
+  }
+  return output;
+}
+
+function utf8Suffix(value: string, maxBytes: number): string {
+  let output = "";
+  let bytes = 0;
+  for (const character of [...value].reverse()) {
+    const next = new TextEncoder().encode(character).byteLength;
+    if (bytes + next > maxBytes) break;
+    output = character + output;
+    bytes += next;
+  }
+  return output;
+}
+
+function candidateOffsets(sourceText: string, quote: string): number[] {
+  const matches: number[] = [];
+  let cursor = 0;
+  while (cursor <= sourceText.length - quote.length) {
+    const index = sourceText.indexOf(quote, cursor);
+    if (index < 0) break;
+    matches.push(index);
+    cursor = index + 1;
+  }
+  return matches;
+}
+
+function resolveQuoteOffset(sourceText: string, annotation: DraftTimelineAnnotation): number {
+  const { source, quote } = annotation;
+  if (
+    source.endOffset - source.startOffset === quote.length &&
+    sourceText.slice(source.startOffset, source.endOffset) === quote
+  ) {
+    return source.startOffset;
+  }
+  const matches = candidateOffsets(sourceText, quote);
+  if (matches.length === 1) return matches[0]!;
+  const contextual = matches.filter((start) => {
+    const before = sourceText.slice(Math.max(0, start - source.contextBefore.length), start);
+    const after = sourceText.slice(
+      start + quote.length,
+      start + quote.length + source.contextAfter.length,
+    );
+    return before === source.contextBefore && after === source.contextAfter;
+  });
+  if (contextual.length === 1) return contextual[0]!;
+  return invalidAnnotationSource();
+}
+
+async function validateTimelineAnnotations(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  annotations: readonly DraftTimelineAnnotation[],
+  options: AnnotationValidationOptions,
+): Promise<DraftTimelineAnnotation[]> {
+  const parsed = options.requireNotes
+    ? SubmittedTimelineAnnotations.parse(annotations)
+    : DraftTimelineAnnotations.parse(annotations);
+  const validated: DraftTimelineAnnotation[] = [];
+  for (const annotation of parsed) {
+    const event = await getSessionEvent(db, workspaceId, annotation.source.eventId);
+    if (
+      !event ||
+      event.sessionId !== sessionId ||
+      event.type !== annotation.source.eventType ||
+      event.sequence !== annotation.source.sequence ||
+      (event.turnId ?? null) !== annotation.source.turnId
+    ) {
+      invalidAnnotationSource();
+    }
+    const sourceText = timelineAnnotationSourceText(event);
+    if (sourceText === null) invalidAnnotationSource();
+    const startOffset = resolveQuoteOffset(sourceText, annotation);
+    const endOffset = startOffset + annotation.quote.length;
+    validated.push({
+      ...annotation,
+      source: {
+        ...annotation.source,
+        startOffset,
+        endOffset,
+        contextBefore: utf8Suffix(sourceText.slice(0, startOffset), SOURCE_CONTEXT_BYTES),
+        contextAfter: utf8Prefix(sourceText.slice(endOffset), SOURCE_CONTEXT_BYTES),
+      },
+    });
+  }
+  return validated;
+}
+
+export async function validateDraftTimelineAnnotations(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  annotations: readonly DraftTimelineAnnotation[],
+): Promise<DraftTimelineAnnotation[]> {
+  return await validateTimelineAnnotations(db, workspaceId, sessionId, annotations, {
+    requireNotes: false,
+  });
+}
+
+export async function validateSubmittedTimelineAnnotations(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  annotations: readonly SubmittedTimelineAnnotation[],
+): Promise<TimelineAnnotation[]> {
+  const validated = await validateTimelineAnnotations(db, workspaceId, sessionId, annotations, {
+    requireNotes: true,
+  });
+  return numberTimelineAnnotations(validated as SubmittedTimelineAnnotation[]);
+}

package/src/domain/video-generation-capabilities.ts

@@ -0,0 +1,69 @@
+import {
+  SEEDANCE_2_5_MODEL_ID,
+  VideoGenerationCapabilities,
+  VideoGenerationPolicy,
+  type VideoGenerationModelCapability,
+  type VideoGenerationPolicy as VideoGenerationPolicyType,
+} from "@opengeni/contracts";
+import { videoGenerationCapabilityRevision } from "./video-generation";
+
+/** Reviewed executable catalog. Dynamic workspace policy never mutates tool schemas. */
+export const VIDEO_GENERATION_MODEL_CATALOG: readonly VideoGenerationModelCapability[] =
+  Object.freeze([
+    Object.freeze({
+      modelId: SEEDANCE_2_5_MODEL_ID,
+      label: "Seedance 2.5",
+      providerLabel: "Vercel AI Gateway",
+      sourceModes: Object.freeze([
+        "text",
+        "first_frame",
+        "first_and_last_frames",
+        "image_reference",
+        "video_reference",
+      ]),
+      resolutions: Object.freeze(["480p", "720p"]),
+      aspectRatios: Object.freeze(["16:9", "4:3", "1:1", "3:4", "9:16", "21:9", "adaptive"]),
+      duration: Object.freeze({ minSeconds: 4, maxSeconds: 30, stepSeconds: 1 }),
+      supportsAudio: true,
+    }) as VideoGenerationModelCapability,
+  ]);
+
+export function defaultVideoGenerationPolicy(): VideoGenerationPolicyType {
+  return VideoGenerationPolicy.parse({
+    schemaVersion: 1,
+    revision: 0,
+    fundingSource: "workspace_gateway",
+    enabledModelIds: [],
+    defaultModelId: null,
+  });
+}
+
+export function videoGenerationCapabilitiesForPolicy(input: {
+  policy: VideoGenerationPolicyType;
+  credentialVersion: number;
+}): VideoGenerationCapabilities {
+  const policy = VideoGenerationPolicy.parse(input.policy);
+  const enabled = new Set(policy.enabledModelIds);
+  const models = VIDEO_GENERATION_MODEL_CATALOG.filter((model) => enabled.has(model.modelId));
+  if (models.length === 0 || policy.defaultModelId === null) {
+    throw new Error("Video generation is disabled for this workspace");
+  }
+  return VideoGenerationCapabilities.parse({
+    schemaVersion: 1,
+    capabilityRevision: videoGenerationCapabilityRevision({
+      policyRevision: policy.revision,
+      fundingSource: policy.fundingSource,
+      credentialVersion: input.credentialVersion,
+      modelIds: models.map((model) => model.modelId),
+    }),
+    defaultModelId: policy.defaultModelId,
+    models,
+  });
+}
+
+export function assertKnownVideoGenerationModelIds(modelIds: readonly string[]): void {
+  const known = new Set(VIDEO_GENERATION_MODEL_CATALOG.map((model) => model.modelId));
+  for (const modelId of modelIds) {
+    if (!known.has(modelId)) throw new Error(`Unknown video generation model: ${modelId}`);
+  }
+}