@opengeni/core 1.0.2 → 1.2.0

package/dist/index.js

@@ -4826,7 +4826,7 @@ function withDeveloperSetupCredentialRestriction(policy, source) {
 import {
   CLAUDE_CONNECTION_KINDS as CLAUDE_CONNECTION_KINDS3,
   claudeProviderId as claudeProviderId2,
-  canonicalizeConfiguredModelId as canonicalizeConfiguredModelId2,
+  canonicalizeConfiguredModelId as canonicalizeConfiguredModelId3,
   configuredAllowedModels,
   withCodexCatalogProvider as withCodexCatalogProvider3,
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX as ORGANIZATION_GATEWAY_MODEL_ID_PREFIX2,
@@ -4856,6 +4856,7 @@ import {
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY as OPENGENI_SLACK_BOT_SESSION_METADATA_KEY2,
   SessionSkills,
   resolveBundledSkillSelection,
+  bundledSkillSelectionForAgentConfig as bundledSkillSelectionForAgentConfig2,
   SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext as ServiceTurnInitiatorContext2,
@@ -4922,7 +4923,6 @@ import {
   SessionToolPolicyVersionConflictError,
   SessionCreateIdempotencyConflictError,
   PersonalResourceAttachmentAcceptanceError,
-  sessionTenancyProductActivated as sessionTenancyProductActivated2,
   workspaceControlRequestLockTimeoutMs,
   WorkspaceControlBusyError
 } from "@opengeni/db";
@@ -5088,6 +5088,7 @@ function prepareExternalLinkTaskAdmission(authorization, actor) {
 // src/billing/limits.ts
 import {
   configuredStaticUsageLimits,
+  canonicalizeConfiguredModelId,
   resolveModelProviderForTurn
 } from "@opengeni/config";
 import {
@@ -5096,7 +5097,7 @@ import {
   countActiveOrganizationApiKeysForAccount,
   countScheduledTasksForWorkspace,
   countWorkspacesForAccount,
-  getBillingBalance,
+  getSpendableCreditBalance,
   isCodexBilledTurn,
   recordUsageEvent,
   sumUsageQuantity
@@ -5177,11 +5178,19 @@ async function checkCreditBalance(deps, input, externallyBilled) {
   if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
     return { allowed: true };
   }
-  const balance = await getBillingBalance(deps.db, input.accountId);
+  const balance = await getSpendableCreditBalance(
+    deps.db,
+    input.accountId,
+    input.model ? canonicalizeConfiguredModelId(deps.settings, input.model) : void 0
+  );
   if (balance.balanceMicros > 0) {
     return { allowed: true };
   }
-  return { allowed: false, code: "insufficient_credits", message: "insufficient Opengeni credits" };
+  return {
+    allowed: false,
+    code: "insufficient_credits",
+    message: input.model ? "No credits available for this model. Choose a model covered by your promotional credits or add credits." : "No general credits available. Promotional credits cover eligible models only."
+  };
 }
 async function checkStaticCaps(deps, input, funding) {
   const limits = configuredStaticUsageLimits(deps.settings);
@@ -7213,7 +7222,7 @@ function resolveWorkspaceModelSelection(input) {
 
 // src/default-session-model.ts
 import {
-  canonicalizeConfiguredModelId,
+  canonicalizeConfiguredModelId as canonicalizeConfiguredModelId2,
   CLAUDE_CONNECTION_KINDS as CLAUDE_CONNECTION_KINDS2
 } from "@opengeni/config";
 import {
@@ -7235,7 +7244,8 @@ import {
   workspaceCodexSubscriptionActive,
   workspaceOpenRouterConnectionActive,
   workspaceVercelAiGatewayConnectionActive,
-  organizationHoldsCredits,
+  getBillingBalance,
+  spendableCreditMicros,
   workspaceXaiSubscriptionActive,
   workspaceXaiSubscriptionActiveForAuthority,
   XaiAuthorityPoolInactiveError,
@@ -7371,9 +7381,12 @@ function findSelection(selections, modelId) {
   return selections.find((selection) => selection.model.id === modelId) ?? selections.find((selection) => selection.model.aliases.includes(modelId));
 }
 function creditsCandidate(input) {
+  const selections = input.creditBalance ? input.selections.filter(
+    (selection) => spendableCreditMicros(input.creditBalance, selection.model.id) > 0
+  ) : input.selections;
   const fallbackEffort = input.settings.openaiReasoningEffort;
-  const deployment = findSelection(input.selections, input.settings.openaiModel);
-  const configured = findSelection(input.selections, input.settings.creditsDefaultModel);
+  const deployment = findSelection(selections, input.settings.openaiModel);
+  const configured = findSelection(selections, input.settings.creditsDefaultModel);
   if (deployment?.availability.selectable && deployment.model.cost === "credits") {
     if (configured?.model.id !== deployment.model.id) return null;
     return {
@@ -7397,7 +7410,7 @@ function creditsCandidate(input) {
       source: "credits"
     };
   }
-  const first = input.selections.find(
+  const first = selections.find(
     (selection) => selection.availability.selectable && selection.model.cost === "credits"
   );
   return first ? {
@@ -7446,7 +7459,7 @@ function selectDefaultSessionModel(input) {
     reasoningEffort: defaultReasoningEffortForConfiguredModel(fallback.model, fallbackEffort),
     source: "deployment"
   } : {
-    model: canonicalizeConfiguredModelId(input.settings, input.settings.openaiModel),
+    model: canonicalizeConfiguredModelId2(input.settings, input.settings.openaiModel),
     reasoningEffort: fallbackEffort,
     source: "deployment"
   };
@@ -7457,7 +7470,8 @@ function creditsDefaultSessionModel(input) {
     settings: input.settings,
     selections: input.selections,
     workspaceDefaults: resolveWorkspaceSessionDefaults(input.workspaceSettings),
-    creditsAvailable: true
+    creditsAvailable: true,
+    ...input.creditBalance ? { creditBalance: input.creditBalance } : {}
   });
 }
 async function resolveDefaultSessionModelForSelections(db, input) {
@@ -7467,10 +7481,13 @@ async function resolveDefaultSessionModelForSelections(db, input) {
     workspaceDefaults: resolveWorkspaceSessionDefaults(input.workspaceSettings)
   };
   const withoutCredits = selectDefaultSessionModel({ ...decision, creditsAvailable: false });
-  if (withoutCredits.source !== "deployment" || input.settings.billingMode !== "stripe" || creditsCandidate(decision) === null) {
+  if (withoutCredits.source !== "deployment" || input.settings.billingMode !== "stripe" || !input.selections.some(
+    (selection) => selection.availability.selectable && selection.model.cost === "credits"
+  )) {
     return withoutCredits;
   }
-  return await organizationHoldsCredits(db, input.accountId) ? selectDefaultSessionModel({ ...decision, creditsAvailable: true }) : withoutCredits;
+  const creditBalance = await getBillingBalance(db, input.accountId);
+  return selectDefaultSessionModel({ ...decision, creditsAvailable: true, creditBalance });
 }
 async function connectionRestrictionsAndXaiReadiness(db, settings, context) {
   const { workspaceId, subjectId, xaiAuthoritySnapshot } = context;
@@ -7788,6 +7805,7 @@ import {
 import {
   AGENT_SKILL_MANAGE_TOOL_NAMES,
   AUTOMATIC_SESSION_TITLE_FALLBACK,
+  bundledSkillSelectionForAgentConfig,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   FIRST_PARTY_IN_PROCESS_TOOL_NAMES,
   SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
@@ -8023,13 +8041,17 @@ async function workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectI
 }
 function sessionHasSkills(session, context) {
   if (context.hasWorkspaceSkills || session.skills.length > 0) return true;
-  if (session.bundledSkillIds === void 0) return true;
+  const bundledSkillIds = bundledSkillSelectionForAgentConfig(
+    session.bundledSkillIds,
+    session.agent
+  );
+  if (bundledSkillIds === void 0) return true;
   const tools = new Set(
     resolveAgentToolFamilies(session.agent).firstPartyTools(
       allowedFirstPartyMcpToolsForSession2(context.settings, session.firstPartyMcpTools)
     )
   );
-  return session.bundledSkillIds.some((id) => {
+  return bundledSkillIds.some((id) => {
     if ([
       "builtin:opengeni-documents",
       "builtin:opengeni-spreadsheets",
@@ -8078,7 +8100,7 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
     ) && session.sandboxOs !== "windows" ? ["code_search"] : []
   ] : [];
   const needsTitle = session.titleSource !== "user" && (!session.title?.trim() || session.title.trim() === AUTOMATIC_SESSION_TITLE_FALLBACK);
-  const firstPartyMcpTools = context && toolRefs.some((ref) => ref.id === "opengeni") ? resolveAgentToolFamilies(session.agent).firstPartyTools(
+  const firstPartyMcpTools = context && toolRefs.some((ref) => ref.id === "opengeni") ? resolveAgentToolFamilies(session.agent, { sandboxAttached: sandboxAvailable }).firstPartyTools(
     allowedFirstPartyMcpToolsForSession2(context.settings, session.firstPartyMcpTools)
   ).filter((name) => name !== "set_session_title" || !needsTitle) : [];
   const interactionNames = new Set(FIRST_PARTY_IN_PROCESS_TOOL_NAMES);
@@ -8101,7 +8123,9 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
       ].includes(name);
       if (permissionAllowed(readOnly ? "sessions:read" : "sessions:control") && (name !== "browser_download_save" || permissionAllowed("files:upload"))) {
         firstPartyModelNames.set(name, `interaction__${name}`);
-        if (!firstPartyMcpTools.includes(name) && resolveAgentToolFamilies(session.agent).allowsFirstPartyTool(name) && session.firstPartyMcpTools.includes(name))
+        if (!firstPartyMcpTools.includes(name) && resolveAgentToolFamilies(session.agent, {
+          sandboxAttached: sandboxAvailable
+        }).allowsFirstPartyTool(name) && session.firstPartyMcpTools.includes(name))
           firstPartyMcpTools.push(name);
       }
     }
@@ -8132,7 +8156,8 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
     webSearch: hostedToolNames.includes("web_search"),
     humanInput: context?.humanInputEnabled ?? false,
     media: media.toolsKnown ? media.hosted.length + media.runtime.length > 0 : void 0,
-    routerInHistory: context?.routerInHistory === true || context?.routerHistorySessionIds?.has(session.id) === true
+    routerInHistory: context?.routerInHistory === true || context?.routerHistorySessionIds?.has(session.id) === true,
+    ...context ? { sandboxAttached: sandboxAvailable } : {}
   };
   const families = resolveAgentToolFamilies(session.agent, environment);
   environment.hasDeferredTools = toolRefs.some(
@@ -8538,10 +8563,8 @@ import {
   isRetryableDatabaseTransportFailure,
   nestedPostgresSqlState as nestedPostgresSqlState3,
   replayAppliedSessionFork,
-  sessionTenancyProductActivated,
   SessionTenancyAccessError,
   SessionTenancyInvalidRequestError,
-  SessionTenancyNotActivatedError,
   transitionSessionVisibility
 } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
@@ -8605,9 +8628,6 @@ async function requireManagedHumanPrivateSessionCreate(deps, authorization, work
 async function requireSessionTenancyMutationGate(deps, authorization, workspaceId, permissions) {
   requireVerifiedOwningUser(authorization, workspaceId);
   for (const permission of permissions) requirePermission(authorization.grant, permission);
-  if (!await sessionTenancyProductActivated(deps.db, workspaceId)) {
-    throw new SessionTenancyNotActivatedError();
-  }
 }
 async function publishExactCommittedEvent(deps, input) {
   if (input.eventId === null && input.eventSequence === null) return;
@@ -8879,11 +8899,6 @@ async function requireAtomicPersonalResourceAttachment(deps, authorization, work
       cause: error
     });
   }
-  if (!await sessionTenancyProductActivated2(deps.db, workspaceId)) {
-    throw new HTTPException17(409, {
-      message: "Session tenancy is not activated for this organization."
-    });
-  }
   if (existingSession && intent.expectedAuthorityEpoch === void 0) {
     throw new HTTPException17(422, {
       message: "Personal-resource attachment requires expectedAuthorityEpoch."
@@ -9248,6 +9263,13 @@ function automaticTitleForAgentChildCreate(presentation, goal, initialMessage) {
   return null;
 }
 async function createAndStartSessionWithOutcome(input) {
+  const frozenBundledSkillIds = bundledSkillSelectionForAgentConfig2(
+    input.bundledSkillIds,
+    input.agentConfig
+  );
+  if (frozenBundledSkillIds !== input.bundledSkillIds) {
+    input = { ...input, bundledSkillIds: frozenBundledSkillIds };
+  }
   const sessionMetadata = metadataWithTurnExecutionPolicyV1(
     {
       ...input.metadata,
@@ -9631,7 +9653,7 @@ function canonicalConfiguredModel(settings, model) {
   if (model === null || model === void 0) {
     return model;
   }
-  const canonicalModel = canonicalizeConfiguredModelId2(settings, model);
+  const canonicalModel = canonicalizeConfiguredModelId3(settings, model);
   if (canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX) && settings.resolvedCodexModelsJson !== void 0) {
     if (settings.codexSubscriptionEnabled && configuredAllowedModels(withCodexCatalogProvider3(settings)).includes(canonicalModel)) {
       return canonicalModel;
@@ -10253,6 +10275,7 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   if (agentResolution.instructions !== void 0) {
     payload.instructions = agentResolution.instructions;
   }
+  bundledSkillIds = bundledSkillSelectionForAgentConfig2(bundledSkillIds, agentConfig);
   const parentCallingTurn = parentSession && creationInitiator.actor ? await getSessionTurnForAttempt3(
     db,
     workspaceId,
@@ -12391,7 +12414,7 @@ import {
   applyCreditDebitAfterUse,
   checkWorkspaceAllowance as checkWorkspaceAllowance2,
   creditDebitAttributionForTurn,
-  getBillingBalance as getBillingBalance2,
+  getSpendableCreditBalance as getSpendableCreditBalance2,
   listKnowledgeEntries,
   recordUsageEvent as recordUsageEvent2,
   sumUsageQuantity as sumUsageQuantity2,
@@ -12521,7 +12544,7 @@ async function searchKnowledgeEntries(db, context, input, embedder, settings) {
     context.accountId,
     context.workspaceId,
     async (lockedDb) => {
-      const balance = await getBillingBalance2(lockedDb, context.accountId);
+      const balance = await getSpendableCreditBalance2(lockedDb, context.accountId);
       if (balance.balanceMicros <= 0)
         return keywordFallback(lockedDb, new KnowledgeVectorFundingError(), "awaiting_funding");
       const attribution = billingActor.kind === "agent" ? await creditDebitAttributionForTurn(lockedDb, {
@@ -12751,6 +12774,220 @@ function filenameForMimeType(mimeType) {
   }
 }
 
+// src/goal-admission.ts
+import {
+  isModelAvailableForNewSelection as isModelAvailableForNewSelection2,
+  policyProviderIdForModel as policyProviderIdForModel2,
+  resolveModelProvider,
+  runnableLatencyModesForModel,
+  withCodexCatalogProvider as withCodexCatalogProvider4,
+  withXaiSubscriptionCatalogProvider as withXaiSubscriptionCatalogProvider2
+} from "@opengeni/config";
+import {
+  evaluateWorkspaceModelPolicy as evaluateWorkspaceModelPolicy3
+} from "@opengeni/contracts";
+import { isCodexBilledModel as isCodexBilledModel2 } from "@opengeni/codex";
+import { getWorkspaceModelPolicy as getWorkspaceModelPolicy3 } from "@opengeni/db";
+
+// src/billing/agent-run-admission.ts
+import {
+  canonicalizeConfiguredModelId as canonicalizeConfiguredModelId4,
+  configuredStaticUsageLimits as configuredStaticUsageLimits2
+} from "@opengeni/config";
+import {
+  checkWorkspaceAllowance as checkWorkspaceAllowance3,
+  getSpendableCreditBalance as getSpendableCreditBalance3,
+  isCodexBilledTurn as isCodexBilledTurn2,
+  sumUsageQuantity as sumUsageQuantity3
+} from "@opengeni/db";
+async function agentRunAdmissionDenial(services, input) {
+  const codexBilled = await isCodexBilledTurn2({
+    db: services.db,
+    settings: services.settings,
+    workspaceId: input.workspaceId,
+    model: input.model
+  });
+  const externallyBilled = modelFundingForAdmission(
+    services.settings,
+    input.model,
+    codexBilled
+  ).fundedWithoutCredits;
+  if (!externallyBilled && (services.settings.billingMode === "stripe" || services.settings.usageLimitsMode === "managed")) {
+    if (services.entitlements) {
+      const decision = await services.entitlements.admitRun({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        action: "agent_run:create",
+        quantity: input.requestedAgentRuns
+      });
+      if (!decision.allowed) return "insufficient_credits";
+    } else {
+      const balance = await getSpendableCreditBalance3(
+        services.db,
+        input.accountId,
+        canonicalizeConfiguredModelId4(services.settings, input.model)
+      );
+      if (balance.balanceMicros <= 0) return "insufficient_credits";
+    }
+  }
+  if (!externallyBilled) {
+    const refusal = await checkWorkspaceAllowance3(services.db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.initiatingHumanSubjectId ?? null
+    });
+    if (refusal) return refusal.code;
+  }
+  if (services.settings.usageLimitsMode !== "static" && services.settings.usageLimitsMode !== "managed") {
+    return null;
+  }
+  const limits = configuredStaticUsageLimits2(services.settings);
+  if (!externallyBilled && limits.maxMonthlyCostMicrosPerAccount) {
+    const used = await sumUsageQuantity3(services.db, {
+      accountId: input.accountId,
+      eventType: "model.cost",
+      since: startOfUtcMonth2()
+    });
+    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
+      return "monthly_model_cost_limit";
+    }
+  }
+  if (limits.maxMonthlyAgentRunsPerWorkspace) {
+    const used = await sumUsageQuantity3(services.db, {
+      workspaceId: input.workspaceId,
+      eventType: "agent_run.created",
+      since: startOfUtcMonth2()
+    });
+    if (used + input.requestedAgentRuns > limits.maxMonthlyAgentRunsPerWorkspace) {
+      return "monthly_agent_run_limit";
+    }
+  }
+  return null;
+}
+function startOfUtcMonth2() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+
+// src/goal-admission.ts
+function goalContinuationModelDecision(input) {
+  const catalogSettings = input.settings.supergrokSubscriptionEnabled ? withXaiSubscriptionCatalogProvider2(
+    input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider4(input.settings) : input.settings
+  ) : input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider4(input.settings) : input.settings;
+  const model = input.inheritedModel;
+  if (!resolveModelProvider(catalogSettings, model)) {
+    return {
+      model,
+      blocked: "The selected model is unavailable. Choose an available model before resuming.",
+      pausedReason: "model_unavailable"
+    };
+  }
+  if (!isModelAvailableForNewSelection2(catalogSettings, model)) {
+    return {
+      model,
+      blocked: "The selected model has been retired. Choose an available model before resuming.",
+      pausedReason: "model_unavailable"
+    };
+  }
+  if (input.workspaceModelPolicy !== null && !evaluateWorkspaceModelPolicy3(input.workspaceModelPolicy, {
+    providerId: policyProviderIdForModel2(catalogSettings, model),
+    modelId: model
+  }).allowed) {
+    return {
+      model,
+      blocked: "Workspace policy blocks the selected model. Choose an allowed model before resuming.",
+      pausedReason: "model_policy"
+    };
+  }
+  if (input.codexCompactionMode === "remote_v2" && !isCodexBilledModel2(model)) {
+    return {
+      model,
+      blocked: "This conversation requires a Codex model. Choose a Codex model before resuming.",
+      pausedReason: "model_policy"
+    };
+  }
+  if (!runnableLatencyModesForModel(catalogSettings, model).includes(input.latencyMode ?? "standard")) {
+    return {
+      model,
+      blocked: "The selected model does not support this conversation's latency mode. Choose a supported mode or model before resuming.",
+      pausedReason: "model_policy"
+    };
+  }
+  return { model, blocked: null };
+}
+async function resolveGoalModelAdmission(db, settings, input) {
+  const catalog = await resolveWorkspaceCatalogSettings(db, settings, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    retainedProductModelId: input.model
+  });
+  const workspaceModelPolicy = await getWorkspaceModelPolicy3(db, input.workspaceId);
+  return {
+    settings: catalog.settings,
+    ...goalContinuationModelDecision({
+      settings: catalog.settings,
+      workspaceModelPolicy,
+      inheritedModel: input.model,
+      ...input.codexCompactionMode ? { codexCompactionMode: input.codexCompactionMode } : {},
+      ...input.latencyMode ? { latencyMode: input.latencyMode } : {}
+    })
+  };
+}
+async function goalRunBudgetBlocked(services, input) {
+  const denial = await agentRunAdmissionDenial(services, { ...input, requestedAgentRuns: 1 });
+  if (denial === null) return null;
+  const blocks = {
+    insufficient_credits: services.entitlements ? {
+      pausedReason: "usage_policy",
+      message: "The application's usage policy blocks another run. Resume when it allows."
+    } : {
+      pausedReason: "credits",
+      message: "Insufficient Opengeni credits. Add credits before resuming."
+    },
+    allowance_exhausted: {
+      pausedReason: "allowance",
+      message: "Opengeni usage allowance exhausted. Resume when your allowance is available."
+    },
+    monthly_model_cost_limit: {
+      pausedReason: "budget",
+      message: "Monthly model spending limit reached. Resume when the spending limit allows."
+    },
+    monthly_agent_run_limit: {
+      pausedReason: "usage_limit",
+      message: "Monthly agent run limit reached. Resume when the run limit allows."
+    }
+  };
+  return blocks[denial];
+}
+var GoalResumeBlockedError = class extends Error {
+  constructor(pausedReason, message) {
+    super(message);
+    this.pausedReason = pausedReason;
+    this.name = "GoalResumeBlockedError";
+  }
+};
+async function assertGoalResumeAllowed(services, session, causalTurn) {
+  const decision = await resolveGoalModelAdmission(
+    services.db,
+    services.catalogSourceSettings ?? services.settings,
+    session
+  );
+  if (decision.blocked) {
+    throw new GoalResumeBlockedError(decision.pausedReason, decision.blocked);
+  }
+  const block = await goalRunBudgetBlocked(
+    { ...services, settings: decision.settings },
+    {
+      accountId: session.accountId,
+      workspaceId: session.workspaceId,
+      model: decision.model,
+      // Resuming does not lend the clicking user's allowance or credentials.
+      initiatingHumanSubjectId: causalTurn?.initiatingHumanSubjectId ?? null
+    }
+  );
+  if (block) throw new GoalResumeBlockedError(block.pausedReason, block.message);
+}
+
 // src/application/external-workspace-members.ts
 import { HTTPException as HTTPException18 } from "hono/http-exception";
 import {
@@ -17695,7 +17932,7 @@ function orderScheduledTaskAccessAttention(items) {
 }
 
 // src/domain/insights.ts
-import { configuredStaticUsageLimits as configuredStaticUsageLimits2 } from "@opengeni/config";
+import { configuredStaticUsageLimits as configuredStaticUsageLimits3 } from "@opengeni/config";
 import {
   WorkspaceInsightsSnapshot
 } from "@opengeni/contracts";
@@ -17826,7 +18063,7 @@ function cacheHitPct(cached2, input) {
 function startOfUtcDay(date) {
   return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
 }
-function startOfUtcMonth2(date) {
+function startOfUtcMonth3(date) {
   return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));
 }
 function startOfUtcYear(date) {
@@ -17855,7 +18092,7 @@ function resolveRangeWindow(range, now) {
       cacheSeriesLabel = "Cache hit % / UTC day";
       break;
     case "month":
-      since = startOfUtcMonth2(now);
+      since = startOfUtcMonth3(now);
       rangeLabel = "This month (UTC)";
       priorLabel = "Prior equal window";
       seriesLabel = "Credit $ / UTC day";
@@ -17986,7 +18223,7 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
         until: window.until,
         priorSince: window.priorSince,
         priorUntil: window.priorUntil,
-        monthSince: startOfUtcMonth2(now),
+        monthSince: startOfUtcMonth3(now),
         granularity: input.range === "today" ? "hour" : "day",
         warmGroupLimit: 24
       })
@@ -18229,7 +18466,7 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
       billing: fact ? billingPathOf(fact.billingPath) : null
     };
   });
-  const limits = configuredStaticUsageLimits2(settings);
+  const limits = configuredStaticUsageLimits3(settings);
   const floor = floorRows.filter((row) => {
     if (!model) return true;
     return row.model === model;
@@ -20178,7 +20415,7 @@ import {
   withWorkspaceSubjectRls as withWorkspaceSubjectRls6
 } from "@opengeni/db";
 import { HTTPException as HTTPException29 } from "hono/http-exception";
-import { canonicalizeConfiguredModelId as canonicalizeConfiguredModelId3 } from "@opengeni/config";
+import { canonicalizeConfiguredModelId as canonicalizeConfiguredModelId5 } from "@opengeni/config";
 function hasOwn(value, key) {
   return typeof value === "object" && value !== null && Object.hasOwn(value, key);
 }
@@ -20203,7 +20440,7 @@ function mapNewSessionDraft(row) {
 }
 function draftModelProvided(settings, draft) {
   if (draft.modelProvided !== void 0) return draft.modelProvided;
-  return !(canonicalizeConfiguredModelId3(settings, draft.model) === canonicalizeConfiguredModelId3(settings, settings.openaiModel) && draft.reasoningEffort === settings.openaiReasoningEffort && draft.latencyMode === "standard");
+  return !(canonicalizeConfiguredModelId5(settings, draft.model) === canonicalizeConfiguredModelId5(settings, settings.openaiModel) && draft.reasoningEffort === settings.openaiReasoningEffort && draft.latencyMode === "standard");
 }
 async function actorDefaultModel(deps, grant, workspaceId) {
   return await resolveDefaultSessionModel(deps.db, deps.settings, {
@@ -20477,7 +20714,7 @@ async function submitComposerDraftForRequest(deps, grant, workspaceId, sessionId
 import { DraftTimelineAnnotations as DraftTimelineAnnotations3 } from "@opengeni/contracts";
 import { HTTPException as HTTPException30 } from "hono/http-exception";
 import {
-  checkWorkspaceAllowance as checkWorkspaceAllowance3,
+  checkWorkspaceAllowance as checkWorkspaceAllowance4,
   deleteSessionQueueItemInTransaction,
   editQueuedTurnInTransaction,
   getComposerDraftInTransaction as getComposerDraftInTransaction2,
@@ -20486,7 +20723,7 @@ import {
   getWorkspaceControlEvent as getWorkspaceControlEvent2,
   getSessionQueueSnapshot,
   frozenInitiatorForCommandActor as frozenInitiatorForCommandActor2,
-  isCodexBilledTurn as isCodexBilledTurn2,
+  isCodexBilledTurn as isCodexBilledTurn3,
   moveQueuedTurnInTransaction,
   mutateSessionControlInTransaction,
   mutateWorkspaceControlInTransaction,
@@ -20564,7 +20801,7 @@ async function assertFreshAgentCommandAllowance(tx, deps, context, targetSession
       workspaceId: context.workspaceId,
       retainedProductModelId: target.model
     });
-    const codexBilled = await isCodexBilledTurn2({
+    const codexBilled = await isCodexBilledTurn3({
       db: tx,
       settings,
       workspaceId: context.workspaceId,
@@ -20575,7 +20812,7 @@ async function assertFreshAgentCommandAllowance(tx, deps, context, targetSession
     }
   }
   const frozen = await frozenInitiatorForCommandActor2(tx, context.workspaceId, agentActor(context));
-  const refusal = await checkWorkspaceAllowance3(tx, {
+  const refusal = await checkWorkspaceAllowance4(tx, {
     accountId: target.accountId,
     workspaceId: context.workspaceId,
     subjectId: initiatingHumanForAllowance(frozen)
@@ -21432,9 +21669,7 @@ async function consentManagedHumanSandboxRecovery(deps, authorization, workspace
 import {
   issueSelfUserResourceGrant,
   listSelfUserResourceAuthorities,
-  revokeSelfUserResourceGrant,
-  sessionTenancyProductActivated as sessionTenancyProductActivated3,
-  SessionTenancyNotActivatedError as SessionTenancyNotActivatedError2
+  revokeSelfUserResourceGrant
 } from "@opengeni/db";
 var LIST_PERMISSIONS = {
   connection: ["connections:read"],
@@ -21452,9 +21687,6 @@ var ISSUE_PERMISSIONS = {
 };
 async function requireOwnerProductGate(deps, authorization, workspaceId, permissions) {
   requireOwnerAuthority(authorization, workspaceId, permissions);
-  if (!await sessionTenancyProductActivated3(deps.db, workspaceId)) {
-    throw new SessionTenancyNotActivatedError2();
-  }
 }
 function requireOwnerAuthority(authorization, workspaceId, permissions) {
   if (!authorization.canonicalLocalHumanSession) {
@@ -21466,9 +21698,6 @@ function requireOwnerAuthority(authorization, workspaceId, permissions) {
 }
 async function listManagedHumanUserResourceAuthorities(deps, authorization, workspaceId, input) {
   requireOwnerAuthority(authorization, workspaceId, LIST_PERMISSIONS[input.resourceKind]);
-  if (!await sessionTenancyProductActivated3(deps.db, workspaceId)) {
-    return { authorities: [], nextCursor: null };
-  }
   return await listSelfUserResourceAuthorities(deps.db, {
     accountId: authorization.grant.accountId,
     workspaceId,
@@ -22195,6 +22424,7 @@ export {
   EditableArtifactStaleBaseError,
   EditableArtifactUndoTargetError,
   GITHUB_ACTION_POLICY_GROUP_TOOL_NAMES,
+  GoalResumeBlockedError,
   InMemoryEditableArtifactLiveTicketStore,
   InMemoryEditableArtifactStableIdFactory,
   InMemoryEditableArtifactStore,
@@ -22266,6 +22496,7 @@ export {
   agentAccessListScopeForViewer,
   agentAccessPermitsCrossTreeAccess,
   agentConfigParentFor,
+  agentRunAdmissionDenial,
   apiIntegrationsMatchingDelegations,
   appendArchivedSessionEventsForRequest,
   appendRigSetupCommand,
@@ -22285,6 +22516,7 @@ export {
   assertConversationDeliveryOutcome,
   assertConversationInboundEnvelope,
   assertConversationProviderReceipt,
+  assertGoalResumeAllowed,
   assertIsoTimestamp,
   assertKnownVideoGenerationModelIds,
   assertManagedUserAdmission,
@@ -22438,6 +22670,8 @@ export {
   getManagedSession,
   getWorkspaceInsights,
   githubAppActionPolicyActor,
+  goalContinuationModelDecision,
+  goalRunBudgetBlocked,
   googleDrivePublicationDelegationFromVisibleConnections,
   governedLearningEvidenceIsSlackDerived,
   governedLearningSlackImportance,
@@ -22642,6 +22876,7 @@ export {
   resolveFikenDefaultCompanySlug,
   resolveFirstPartyMcpToolsForCreate,
   resolveGitHubRepositoryBindings,
+  resolveGoalModelAdmission,
   resolveMemberSubjectId,
   resolveRigProviderImageForRun,
   resolveRigProviderImageSelection,