@opengeni/core 1.3.0 → 1.4.0

package/dist/domain/connector-tool-permissions.d.ts

@@ -28,7 +28,7 @@ export declare function connectorToolGroup(tool: ListedTool): "read" | "write" |
 export declare function unpinnedConnectorToolPermissionAccount<T extends ConnectionMetadata>(ref: McpServerConnectionRef, visible: T[], subjectId: string): T | null;
 export declare function connectorToolPermissionReference(ref: McpServerConnectionRef, connectionId: string): McpServerConnectionRef;
 /** Use the same adapter-owned identities as execution for reviewed local catalogs. */
-export declare function reviewedConnectorToolCatalog(server: Pick<Settings["mcpServers"][number], "url" | "connectionRef" | "allowedTools">, grantedScopes: readonly string[]): ListedTool[] | null;
+export declare function reviewedConnectorToolCatalog(server: Pick<Settings["mcpServers"][number], "url" | "connectionRef" | "allowedTools">, grantedScopes: readonly string[], deployment: Pick<Settings, "gmailWatchTopicName">): ListedTool[] | null;
 /** Collect discovery pages without changing the caller's connection or authority. */
 export declare function collectConnectorToolPages(client: Pick<Client, "listTools">, deadline: AbortSignal): Promise<ListedTool[]>;
 export declare function getConnectorToolPermissions(input: Input): Promise<ConnectorToolPermissionsResponse>;

package/dist/domain/knowledge-messages.d.ts

@@ -17,7 +17,7 @@ export declare function retainKnowledgeMessage(db: Database, context: KnowledgeC
     messageId?: never;
     reused?: never;
 } | {
-    reason?: never;
+    readonly reason?: never;
     retained: boolean;
     entryId: string;
     revisionId: string;
@@ -32,7 +32,7 @@ export declare function retainKnowledgeMessage(db: Database, context: KnowledgeC
     outcome: "archived" | "pending" | "published" | "rejected";
     reviewBatchId: string | null;
     replayed: boolean;
-    reason?: never;
+    readonly reason?: never;
     reused?: never;
     retained: boolean;
     messageId: string;

package/dist/domain/realtime-voice-billing.d.ts

@@ -0,0 +1,81 @@
+import { type RealtimeVoicePricing, type Settings } from "@opengeni/config";
+import type { SessionRealtimeModel } from "@opengeni/contracts";
+import { type CreditDebitAttribution, type Database } from "@opengeni/db";
+import { TranscriptionBillingRefusedError } from "../transcription.js";
+/** Credit debit type and usage source for deployment-funded live voice. */
+export declare const REALTIME_VOICE_DEBIT_TYPE = "voice_realtime_debit";
+export declare const REALTIME_VOICE_SOURCE_TYPE = "voice_realtime";
+export type DeploymentRealtimeVoice = {
+    provider: "azure-live" | "ai-gateway";
+    /** Credentials exist and this deployment offers the model. */
+    configured: boolean;
+    pricing: RealtimeVoicePricing | null;
+};
+/**
+ * Live-voice models the deployment pays the provider for. Connected Codex,
+ * SuperGrok, and a workspace's own Gateway key are paid by the workspace and
+ * return null. (The catalog lists hosted GPT Live instead of the managed
+ * Gateway choices when both are configured; both remain priced and gated.)
+ */
+export declare function deploymentRealtimeVoice(settings: Settings, model: SessionRealtimeModel | string): DeploymentRealtimeVoice | null;
+export type RealtimeVoiceUnavailableCode = "not_configured" | "pricing_unconfigured";
+/** The deployment cannot offer this live-voice model at all (not a credit refusal). */
+export declare class RealtimeVoiceUnavailableError extends Error {
+    readonly code: RealtimeVoiceUnavailableCode;
+    readonly name = "RealtimeVoiceUnavailableError";
+    constructor(code: RealtimeVoiceUnavailableCode, message: string);
+}
+/** Static offer check: configured, and priced whenever credits are enforced. */
+export declare function realtimeVoiceOfferProblem(settings: Settings, voice: DeploymentRealtimeVoice): RealtimeVoiceUnavailableError | null;
+export declare const REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE = "Live voice needs Opengeni credits. Add credits to continue.";
+export type RealtimeVoiceSettlement = {
+    /** Credits debited by this settlement call (0 on replay). */
+    debitedMicros: number;
+    /** Why the live call must stop now, when it must. */
+    stop: TranscriptionBillingRefusedError | RealtimeVoiceUnavailableError | null;
+};
+/**
+ * Credit admission and time metering for deployment-funded live voice.
+ *
+ * Admission mirrors voice-input admission (same refusal codes and HTTP
+ * shape): spendable general credits must be positive, the workspace/member
+ * allowance must not be exhausted, and the static monthly cost cap applies.
+ * Metering bills every started minute of each issued provider connection,
+ * measured only from server-observed facts (connection claim time, owner
+ * heartbeats, owner-proven end). Each (connection, minute) is one idempotent
+ * usage receipt plus one post-use debit.
+ */
+export declare function createRealtimeVoiceBilling(deps: {
+    db: Database;
+    settings: Settings;
+}): {
+    /**
+     * Throws RealtimeVoiceUnavailableError when the deployment cannot offer
+     * the model and TranscriptionBillingRefusedError for a credit refusal.
+     * Workspace-funded models are always admitted here.
+     */
+    admit(input: {
+        accountId: string;
+        workspaceId: string;
+        model: SessionRealtimeModel;
+        attribution: CreditDebitAttribution;
+        now?: Date;
+    }): Promise<void>;
+    /** Spendable credits are positive (always true when credits are not enforced). */
+    hasSpendableCredits(accountId: string): Promise<boolean>;
+    /**
+     * Settle every started minute observed so far for one live-voice mode and
+     * report whether the call must stop. Safe to call repeatedly and
+     * concurrently: receipts and debits are idempotent per (connection, minute).
+     */
+    settle(input: {
+        workspaceId: string;
+        sessionId: string;
+        realtimeId: string;
+        /** Authenticated caller; its attribution applies only when it owns the call. */
+        callerSubjectId: string;
+        attribution: CreditDebitAttribution;
+        now?: Date;
+    }): Promise<RealtimeVoiceSettlement>;
+};
+export type RealtimeVoiceBilling = ReturnType<typeof createRealtimeVoiceBilling>;

package/dist/domain/scheduled-task-access.d.ts

@@ -10,7 +10,7 @@
  * ordinary owner update path, so a refresh never widens beyond what the calling
  * person could grant with an edit. See docs/scheduled-task-access.md.
  */
-import { type Settings } from "@opengeni/config";
+import { type Settings, type FirstPartyMcpToolPolicySettings } from "@opengeni/config";
 import { type AccessGrant, type ConnectionMetadata, type FirstPartyMcpToolName, type McpConnectionAccountSelection, type Permission, type RefreshScheduledTaskAccessRequest, type ScheduledTask, type ScheduledTaskAccessAttention, type ScheduledTaskAccessConnector, type ScheduledTaskPolicyDrift, type ScheduledTaskRun, type ScheduledTaskRunAccessFailure, type SessionAuthorizationPort, type SessionAuthorizationSurface, type ToolRef } from "@opengeni/contracts";
 import { type Database, type ScheduledTaskCreatorPolicy } from "@opengeni/db";
 import { type AccessGrantAuthorization } from "../access/index.js";
@@ -88,7 +88,7 @@ export type FirstPartyToolPermissionRequirements = (tools: readonly FirstPartyMc
  */
 export declare function planScheduledTaskOpenGeniTools(input: {
     creatorPolicy: Pick<ScheduledTaskCreatorPolicy, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null;
-    settings: Pick<Settings, "defaultFirstPartyMcpTools" | "allowedFirstPartyMcpTools">;
+    settings: FirstPartyMcpToolPolicySettings;
     grantPermissions: readonly Permission[];
     grantPermissionMode?: AccessGrant["permissionMode"];
     permissionsRequiredByTools: FirstPartyToolPermissionRequirements;

package/dist/domain/scheduled-tasks.d.ts

@@ -1,4 +1,4 @@
-import { type Settings } from "@opengeni/config";
+import { type FirstPartyMcpToolPolicySettings, type Settings } from "@opengeni/config";
 import type { AccessGrant, ScheduledTask, ScheduledTaskAgentConfig, Session, ToolRef, SessionAuthorizationPort, SessionAuthorizationSurface, CreateScheduledTaskRequest as CreateScheduledTaskPayload, UpdateScheduledTaskRequest as UpdateScheduledTaskPayload } from "@opengeni/contracts";
 import { type KnowledgeContext, type Database, type ScheduledTaskCreatorPolicy, type SessionCommandActor, type TemporalScheduleCleanupClaim, type UpdateScheduledTaskInput } from "@opengeni/db";
 import { type AccessGrantAuthorization } from "../access/index.js";
@@ -195,4 +195,4 @@ export declare function manualScheduledTaskTriggerUsageKey(workspaceId: string,
  * provider, or treats ambient worker credentials as responder capability.
  * Mutable rig/variable-set metadata is revalidated again at dispatch.
  */
-export declare function validateIncidentTelemetryPreflightSelection(settings: Pick<Settings, "allowedFirstPartyMcpTools" | "defaultFirstPartyMcpTools">, agentConfig: ScheduledTaskAgentConfig): void;
+export declare function validateIncidentTelemetryPreflightSelection(settings: FirstPartyMcpToolPolicySettings, agentConfig: ScheduledTaskAgentConfig): void;

package/dist/domain/session-connection-accounts.d.ts

@@ -1,5 +1,5 @@
 import type { AccessGrant } from "@opengeni/contracts";
-import type { Settings } from "@opengeni/config";
+import { type Settings } from "@opengeni/config";
 import { type Database } from "@opengeni/db";
 /** Freeze the authenticated request's eligible accounts before starting voice.
  * The resulting lease snapshot, not a later participant or ambient connection,

package/dist/domain/session-tool-policy.d.ts

@@ -106,10 +106,10 @@ export declare function sessionEffectiveToolProjectionInput(session: Session & {
     mcpServerIds: string[];
     productServerIds: ReadonlySet<string>;
     environment: AgentToolEnvironment;
-    runtimeToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
-    hostedToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
-    sandboxToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
-    routerToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_search" | "write_stdin" | "x_search")[];
+    runtimeToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
+    hostedToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
+    sandboxToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
+    routerToolNames: ("apply_patch" | "code_search" | "exec_command" | "generate_image" | "generate_video" | "get_video_generation_capabilities" | "image_generation" | "knowledge_source_fetch" | "knowledge_source_read" | "list_models" | "operation_read" | "refresh_credentials" | "repository_skill_read" | "request_human_input" | "skill_checkout" | "skill_install" | "skill_publish" | "skill_read" | "skill_remove" | "skill_save" | "skill_search" | "tool_invoke" | "tool_list" | "tool_search" | "view_image" | "web_fetch" | "web_search" | "write_stdin" | "x_search")[];
     upfrontToolNames: Set<string>;
     mediaAttachment: AgentMediaAttachment | {
         readonly image: null;

package/dist/domain/voice-input-billing.d.ts

@@ -0,0 +1,76 @@
+import { type Settings, type VoiceInputPricing, type VoiceInputUsage } from "@opengeni/config";
+import { type Database } from "@opengeni/db";
+import { type TranscriptionBilling, type TranscriptionBillingContext } from "../transcription.js";
+/** Credit debit type and usage source for deployment-funded voice input. */
+export declare const VOICE_INPUT_DEBIT_TYPE = "voice_transcription_debit";
+export declare const VOICE_INPUT_SOURCE_TYPE = "voice_transcription";
+/** How the billed quantity was measured; recorded on the ledger entry. */
+export type VoiceInputBillingBasis = "provider_tokens" | "provider_duration" | "server_duration" | "reconciled_receipt";
+/**
+ * Pick the billed measurement. Provider usage wins when this deployment can
+ * price it (token usage with token rates, or a reported duration). Otherwise
+ * the duration the server measured from WAV bytes it produced bills. Every
+ * deployment-funded call carries that server duration, so an unpriced usage
+ * shape never leaves a call unbillable. A client-reported duration is never a
+ * billing input.
+ */
+export declare function voiceInputBillableUsage(input: {
+    pricing: VoiceInputPricing;
+    usage: VoiceInputUsage | null;
+    trustedDurationSeconds?: number | undefined;
+}): {
+    usage: VoiceInputUsage;
+    basis: VoiceInputBillingBasis;
+};
+/**
+ * Same admission shape as knowledge-search and session admission: general
+ * (not model-promotional) credits must be positive, the workspace/member
+ * allowance must not be exhausted, and a static monthly cost cap applies.
+ * Admission is a read, not a reservation; settlement is post-use and may take
+ * an account below zero by at most the concurrent in-flight calls.
+ */
+export declare function createVoiceInputBilling(deps: {
+    db: Database;
+    settings: Settings;
+    /** Reconciliation is best-effort at admission; failures are reported here. */
+    onReconcileError?: (error: unknown, scope: {
+        accountId: string;
+        workspaceId: string;
+    }) => void;
+    /** Minimum spacing of admission-time reconciliation per workspace (default 5 min). */
+    reconcileIntervalMilliseconds?: number;
+}): TranscriptionBilling;
+/**
+ * Two commits, in order: the `model.cost` usage receipt (Insights spend,
+ * monthly cost cap, member-allowance attribution), then the post-use credit
+ * debit. The receipt is the first-writer authority for the amount and the
+ * durable record of the charge: if the debit commit fails, the receipt stays
+ * and {@link reconcileUnsettledVoiceInputCharges} applies the same debit (same
+ * idempotency key) on the workspace's next admission. A retried unit settles
+ * exactly once at the originally recorded price.
+ */
+export declare function settleVoiceInputUsage(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    providerId: string;
+    model: string;
+    billing: TranscriptionBillingContext;
+    usage: VoiceInputUsage;
+    basis: VoiceInputBillingBasis;
+    providerCostMicros: number;
+    creditCostMicros: number;
+}): Promise<{
+    creditCostMicros: number;
+}>;
+/**
+ * Apply the debit for every voice usage receipt in this workspace whose debit
+ * never committed. Idempotent with the inline settlement (same key), bounded
+ * per call, and safe to run concurrently.
+ */
+export declare function reconcileUnsettledVoiceInputCharges(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    minAgeMilliseconds?: number;
+}): Promise<{
+    reconciled: number;
+}>;

package/dist/domain/web-search-billing.d.ts

@@ -0,0 +1,45 @@
+import type { Settings } from "@opengeni/config";
+import { type Database } from "@opengeni/db";
+/** Credit ledger type and usage source for deployment-funded web search calls. */
+export declare const WEB_SEARCH_DEBIT_TYPE = "web_search_debit";
+export declare const WEB_SEARCH_SOURCE_TYPE = "web_search";
+/** Same rule as other deployment-funded resources: Stripe or managed limits. */
+export declare function webSearchCreditBillingActive(settings: Pick<Settings, "billingMode" | "usageLimitsMode">): boolean;
+/** Exact attempt that called the tool. Every charge is attributed to its turn. */
+export type WebSearchCallScope = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+};
+export type WebSearchCallCost = {
+    /** Model tool-call or Codemode operation identity, unique within the attempt. */
+    operationId: string;
+    operation: "search" | "fetch";
+    provider: string;
+    providerMicros: number;
+    creditMicros: number;
+    marginBps: number;
+    basis: "provider_reported" | "configured_price" | "list_price";
+};
+export declare class WebSearchBillingRefusedError extends Error {
+    readonly code: "insufficient_credits" | "allowance_exhausted";
+    constructor(code: "insufficient_credits" | "allowance_exhausted", message: string);
+}
+/**
+ * Admission and post-use settlement for paid web search, matching paid
+ * Knowledge queries and voice input: admission reads general credits and the
+ * workspace/member allowance (a read, not a reservation); settlement records a
+ * durable usage receipt and the idempotent debit in one transaction. Calls
+ * that cost nothing (free providers, or billing inactive) are never refused.
+ */
+export declare function createWebSearchBilling(deps: {
+    db: Database;
+    settings: Settings;
+}): {
+    active: boolean;
+    admit(scope: WebSearchCallScope, expectedProviderMicros: number): Promise<void>;
+    settle(scope: WebSearchCallScope, cost: WebSearchCallCost): Promise<void>;
+};
+export type WebSearchBilling = ReturnType<typeof createWebSearchBilling>;

package/dist/goal-admission.d.ts

@@ -102,6 +102,7 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         delegationSecret?: string | undefined;
         defaultFirstPartyMcpTools?: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[] | undefined;
         allowedFirstPartyMcpTools?: ("artifacts_archive" | "artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_prepare_upload" | "artifacts_publish" | "artifacts_restore" | "artifacts_rollback" | "atlassian_get" | "atlassian_search" | "atlassian_sources_list" | "browser_act" | "browser_auth" | "browser_clipboard" | "browser_debug" | "browser_download_save" | "browser_downloads" | "browser_identity" | "browser_lifecycle" | "browser_observe" | "browser_open" | "browser_publish" | "browser_read" | "browser_screenshot" | "browser_tabs" | "capability_authorization_request" | "capability_catalog_search" | "command_read" | "command_wait" | "company_profile_confirm" | "company_profile_propose" | "computer_act" | "computer_clipboard" | "computer_lifecycle" | "computer_observe" | "computer_open" | "computer_targets" | "connected_machine_enroll_token" | "connected_machine_remove" | "custom_mcp_setup_request" | "editable_artifact_apply" | "editable_artifact_create" | "editable_artifact_export" | "editable_artifact_export_status" | "editable_artifact_get" | "editable_artifact_import" | "editable_artifact_inspect" | "editable_artifact_list" | "environment_list" | "environment_set_variable" | "fiken_bank_accounts_list" | "fiken_companies_list" | "fiken_contact_create" | "fiken_contacts_list" | "fiken_invoice_draft_create" | "fiken_invoice_get" | "fiken_invoices_list" | "fiken_products_list" | "fiken_purchases_list" | "fiken_sales_list" | "github_connect_link" | "github_repositories_list" | "goal_complete" | "goal_pause" | "goal_progress" | "goal_resume" | "goal_set" | "goal_update" | "instruction_policy_get" | "instruction_policy_propose" | "instruction_policy_save" | "interaction_discover" | "interaction_request_human" | "knowledge_archive" | "knowledge_browse" | "knowledge_correct" | "knowledge_get" | "knowledge_prepare_save" | "knowledge_propose" | "knowledge_retain_file" | "knowledge_retain_message" | "knowledge_save" | "knowledge_search" | "memory_correct" | "memory_save" | "memory_search" | "preference_propose" | "preference_registry_get" | "preference_registry_summary" | "project_create" | "project_delete" | "project_get" | "project_list" | "project_reorder" | "project_update" | "reddit_accounts_list" | "reddit_mentions_live" | "reddit_post_reply" | "reddit_posts_sync" | "reddit_search_live" | "reddit_thread_fetch" | "remember" | "remember_confirm" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_file_publish" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_human_input_respond" | "session_pause" | "session_resume" | "session_send_message" | "session_set_model" | "session_set_project" | "session_steer" | "session_wait" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_prepare_message" | "slack_bot_search" | "slack_bot_send_prepared_message" | "slack_bot_thread_replies" | "slack_bot_upload_file" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "task_note_archive" | "task_note_promote_instruction_policy" | "task_note_promote_knowledge" | "task_note_promote_preference" | "task_note_replace" | "task_note_save" | "task_notes_list" | "variable_set_get_variable" | "variable_set_list" | "variable_set_set_variable" | "wait_for_input" | "work_claim_release" | "work_claim_upsert" | "x_accounts_list" | "x_mentions_live" | "x_post_reply" | "x_posts_sync" | "x_search_live" | "x_thread_fetch")[] | undefined;
+        artifactMaterializerDeployed: boolean;
         streamTokenSecret?: string | undefined;
         streamControlEnabled: boolean;
         workDiscoveryEnabled: boolean;
@@ -201,6 +202,20 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         voiceInputAzureApiVersion?: string | undefined;
         voiceInputAzureApiKey?: string | undefined;
         voiceInputAzureAdToken?: string | undefined;
+        azureLiveEndpoint?: string | undefined;
+        azureLiveApiKey?: string | undefined;
+        azureLiveDeployment: string;
+        azureLiveVoice: string;
+        azureLivePricingJson?: string | undefined;
+        aiGatewayRealtimePricingJson?: string | undefined;
+        voiceInputMaiEndpoint?: string | undefined;
+        voiceInputMaiApiKey?: string | undefined;
+        voiceInputMaiApiVersion: string;
+        voiceInputMaiPricingJson?: string | undefined;
+        voiceInputMaiModel: string;
+        voiceInputAzureModel?: string | undefined;
+        voiceInputOpenaiPricingJson?: string | undefined;
+        voiceInputAzurePricingJson?: string | undefined;
         voiceInputCodexExperimentalEnabled: boolean;
         modelPricingJson: string;
         modelCatalogSource: "code" | "database";
@@ -231,6 +246,15 @@ export declare function resolveGoalModelAdmission(db: Database, settings: Settin
         openaiReasoningEncryptedContent: boolean;
         openaiMaxRetries: number;
         webSearchEnabled: boolean;
+        webSearchProvider?: string | undefined;
+        webSearchApiKey?: string | undefined;
+        webSearchBaseUrl?: string | undefined;
+        webFetchProvider?: string | undefined;
+        webFetchApiKey?: string | undefined;
+        webFetchBaseUrl?: string | undefined;
+        webSearchProviderMode?: string | undefined;
+        webSearchPricingJson?: string | undefined;
+        webSearchRequestTimeoutMs: number;
         jevApiKey?: string | undefined;
         jevBaseUrl: string;
         jevModel: string;

package/dist/index.d.ts

@@ -7,6 +7,9 @@ export * from "./domain/session-connection-accounts.js";
 export * from "./domain/organization-integration-catalog.js";
 export * from "./domain/knowledge.js";
 export * from "./domain/knowledge-search.js";
+export * from "./domain/voice-input-billing.js";
+export * from "./domain/web-search-billing.js";
+export * from "./domain/realtime-voice-billing.js";
 export * from "./dependencies.js";
 export * from "./workflow-wake-contract.js";
 export * from "./user-presence.js";