@opengeni/core 1.4.0 → 1.4.2

package/dist/application/modal-native-live-declaration-join.d.ts

@@ -0,0 +1,37 @@
+import type { Settings } from "@opengeni/config";
+import { ModalNativePreparationDeclarationV2 } from "@opengeni/contracts/modal-native-proof-v2";
+import { type Database, type ModalNativeLiveOriginProjection, type ModalNativeLiveOriginResult } from "@opengeni/db";
+import { type NativeOriginalConfigurationSample } from "./modal-native-original-configuration.js";
+type JoinSettings = Pick<Settings, "delegationSecret" | "modalTokenId" | "modalTokenSecret" | "modalEnvironment" | "environmentsEncryptionKey">;
+/** Sensitive request-local data only. Do not publish/log/cache across commit.
+ * The sample contains immutable credential strings which disposal cannot erase.
+ * This result has no native-I/O, replay, custody or effect authority. */
+export type NativeLiveDeclarationJoin = Readonly<{
+    requestId: string;
+    declaration: ModalNativePreparationDeclarationV2;
+    projection: ModalNativeLiveOriginProjection;
+    configuration: NativeOriginalConfigurationSample;
+}>;
+export type NativeLiveDeclarationJoinResult = {
+    kind: "joined_data";
+    data: NativeLiveDeclarationJoin;
+} | {
+    kind: "off";
+} | {
+    kind: "refused";
+} | Exclude<ModalNativeLiveOriginResult, {
+    kind: "live";
+}>;
+/** Own bytes BEFORE either verifying or parsing. After the blocking SQL join,
+ * re-read the explicit CURRENT deployment root/profile and reverify current
+ * expiry over those SAME owned bytes. A historical MAC witness is insufficient.
+ * No tenant/subject GUC change, general access-token resolver, provider await,
+ * fallback, registration or error-to-success conversion occurs here.
+ *
+ * Input execution/human fields are signed CORRELATION, not caller authority:
+ * compare them to the exact DB-derived accepted original projection. This does
+ * NOT independently prove that the canonical worker produced the request.
+ * Enter an existing scoped transaction before any tenancy/control/row lock;
+ * consume the result in that transaction and dispose its sample afterward. */
+export declare function lockNativeLiveDeclarationJoinTx(scopedTx: Database, settings: JoinSettings, envelope: string, inputBody: Uint8Array): Promise<NativeLiveDeclarationJoinResult>;
+export {};

package/dist/application/modal-native-original-configuration.d.ts

@@ -0,0 +1,79 @@
+import type { Settings } from "@opengeni/config";
+import { ModalNativePreparationDeclarationV2 } from "@opengeni/contracts/modal-native-proof-v2";
+declare const SUBKEY_DOMAIN = "opengeni:modal-native:configuration-equality:subkey:v2";
+declare const MESSAGE_DOMAIN = "opengeni:modal-native:configuration-equality:framed:v2\0";
+type ConfigurationSettings = Pick<Settings, "modalTokenId" | "modalTokenSecret" | "modalEnvironment" | "environmentsEncryptionKey">;
+export type NativeOriginalConfigurationSnapshot = Readonly<{
+    serverUrl: string;
+    tokenId: string;
+    tokenSecret: string;
+    environment: string;
+}>;
+declare function readProfile(environment: string): Readonly<{
+    protocol: "modal-direct-original-read-grpc-v1";
+    version: 1;
+    sourceGitBlob: "7599f5b80cf111a25f78f427cfb2616d7e24b36c";
+    serverUrl: "https://api.modal.com:443";
+    serverSelection: "host-pinned-modal-0.9-default";
+    credentialSelection: "explicit-deployment-settings-pair-only";
+    environmentSelection: "explicit-own-settings-no-default";
+    environment: string;
+    environmentTransmittedByCpReads: false;
+    namespaceSelection: "unbound-until-authenticated-once-capture";
+    modalProjectionVersion: "0.9.0";
+    grpcJsVersion: "1.14.4";
+    protobufJsVersion: "7.6.5";
+    rpcPrefix: "/modal.client.ModalClient/";
+    methods: readonly ["AuthTokenGet", "WorkspaceNameLookup", "TaskGetCommandRouterAccess"];
+    authHeaders: {
+        readonly clientType: "8";
+        readonly clientVersion: "1.0.0";
+        readonly libmodalVersion: "modal-js/0.9.0";
+    };
+    tlsPolicy: "explicit-node-tls-rootCertificates-v1";
+    tlsRootsSha256: string;
+    retries: 0;
+    nativeChainDeadlineMs: 30000;
+    maxWireBytes: 1048576;
+}>;
+type PrivateDescription = Readonly<{
+    protocol: "opengeni-modal-native-configuration-equality";
+    version: 2;
+    purpose: "original-native-custody-proof";
+    configurationCaptureRef: ModalNativePreparationDeclarationV2["configurationCaptureRef"];
+    proofGrantRef: ModalNativePreparationDeclarationV2["proofGrantRef"];
+    declarationJson: string;
+    declarationSha256: string;
+    profile: ReturnType<typeof readProfile>;
+    keySelection: "existing-environments-encryption-root-current-only";
+    algorithm: "hmac-sha256";
+    subkeyDomain: typeof SUBKEY_DOMAIN;
+    messageDomain: typeof MESSAGE_DOMAIN;
+}>;
+/** Sensitive PRIVATE storage draft, not proof that any row or grant committed. */
+export type NativeOriginalConfigurationDraftV2 = Readonly<{
+    description: PrivateDescription;
+    equality: Uint8Array;
+}>;
+declare const sampleBrand: unique symbol;
+export type NativeOriginalConfigurationSample = Readonly<{
+    [sampleBrand]: true;
+}>;
+/** Samples ONLY explicit own settings, without environment/profile/SDK lookup.
+ * A parsed declaration merely supplies correlation. Genuine known app/image
+ * provenance and same-transaction host/grant/admission checks remain external.
+ */
+export declare function sampleNativeOriginalConfiguration(settings: ConfigurationSettings, declarationBytes: Uint8Array): NativeOriginalConfigurationSample | null;
+/** Private draft extraction for protected storage only; never a status DTO. */
+export declare function privateNativeOriginalConfigurationDraft(sample: NativeOriginalConfigurationSample): NativeOriginalConfigurationDraftV2 | null;
+/** Same sampled strings for a future authenticated native caller; NOT a grant. */
+export declare function nativeOriginalConfigurationSnapshot(sample: NativeOriginalConfigurationSample): NativeOriginalConfigurationSnapshot | null;
+/** PRIVATE equality check only. No public oracle, grant renewal or key fallback.
+ * Restart reconstruction still requires an authenticated protected original row.
+ */
+export declare function currentNativeOriginalConfigurationMatches(sample: NativeOriginalConfigurationSample, settings: ConfigurationSettings): boolean;
+/** Wipes owned mutable copies, not JS immutable strings or native I/O/custody.
+ * A future owning native caller must join its real callbacks separately.
+ */
+export declare function disposeNativeOriginalConfigurationSample(sample: NativeOriginalConfigurationSample): void;
+export {};

package/dist/domain/capabilities.d.ts

@@ -8,6 +8,7 @@ export declare function buildCapabilityCatalog(input: {
     settings: Settings;
     subjectId?: string | null;
 }): Promise<CapabilityCatalogResponse>;
+export declare function applyOperatorOAuthClientRequirement(item: CapabilityCatalogItem, configured: (issuer: string) => boolean): CapabilityCatalogItem;
 export declare function createCatalogItem(input: {
     db: Database;
     accountId: string;

package/dist/domain/knowledge-messages.d.ts

@@ -17,7 +17,7 @@ export declare function retainKnowledgeMessage(db: Database, context: KnowledgeC
     messageId?: never;
     reused?: never;
 } | {
-    readonly reason?: never;
+    reason?: never;
     retained: boolean;
     entryId: string;
     revisionId: string;
@@ -32,7 +32,7 @@ export declare function retainKnowledgeMessage(db: Database, context: KnowledgeC
     outcome: "archived" | "pending" | "published" | "rejected";
     reviewBatchId: string | null;
     replayed: boolean;
-    readonly reason?: never;
+    reason?: never;
     reused?: never;
     retained: boolean;
     messageId: string;

package/dist/domain/realtime-voice-billing.d.ts

@@ -11,12 +11,6 @@ export type DeploymentRealtimeVoice = {
     configured: boolean;
     pricing: RealtimeVoicePricing | null;
 };
-/**
- * Live-voice models the deployment pays the provider for. Connected Codex,
- * SuperGrok, and a workspace's own Gateway key are paid by the workspace and
- * return null. (The catalog lists hosted GPT Live instead of the managed
- * Gateway choices when both are configured; both remain priced and gated.)
- */
 export declare function deploymentRealtimeVoice(settings: Settings, model: SessionRealtimeModel | string): DeploymentRealtimeVoice | null;
 export type RealtimeVoiceUnavailableCode = "not_configured" | "pricing_unconfigured";
 /** The deployment cannot offer this live-voice model at all (not a credit refusal). */
@@ -28,6 +22,24 @@ export declare class RealtimeVoiceUnavailableError extends Error {
 /** Static offer check: configured, and priced whenever credits are enforced. */
 export declare function realtimeVoiceOfferProblem(settings: Settings, voice: DeploymentRealtimeVoice): RealtimeVoiceUnavailableError | null;
 export declare const REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE = "Live voice needs Opengeni credits. Add credits to continue.";
+/**
+ * Credits voice can spend (general and signup credits), only model-scoped
+ * promotional credits, or neither.
+ */
+export type VoiceCreditStanding = "spendable" | "promotional_only" | "none";
+/** `balance` must be the voice-spendable balance (see {@link VOICE_CREDIT_USAGE}). */
+export declare function voiceCreditStanding(balance: {
+    balanceMicros: number;
+    promotionalCredits?: readonly {
+        remainingMicros: number;
+    }[] | undefined;
+}): VoiceCreditStanding;
+/**
+ * Insufficient-credit copy for voice. Signup credits pay for voice like
+ * general credits; other promotional credits are scoped to chat models, so an
+ * account holding only those must not be told it has nothing.
+ */
+export declare function voiceInsufficientCreditsMessage(feature: "Live voice" | "Voice input", standing: VoiceCreditStanding): string;
 export type RealtimeVoiceSettlement = {
     /** Credits debited by this settlement call (0 on replay). */
     debitedMicros: number;
@@ -38,7 +50,7 @@ export type RealtimeVoiceSettlement = {
  * Credit admission and time metering for deployment-funded live voice.
  *
  * Admission mirrors voice-input admission (same refusal codes and HTTP
- * shape): spendable general credits must be positive, the workspace/member
+ * shape): voice-spendable credits (general plus signup) must be positive, the workspace/member
  * allowance must not be exhausted, and the static monthly cost cap applies.
  * Metering bills every started minute of each issued provider connection,
  * measured only from server-observed facts (connection claim time, owner
@@ -63,6 +75,8 @@ export declare function createRealtimeVoiceBilling(deps: {
     }): Promise<void>;
     /** Spendable credits are positive (always true when credits are not enforced). */
     hasSpendableCredits(accountId: string): Promise<boolean>;
+    /** Credit standing for live voice ("spendable" when credits are not enforced). */
+    creditStanding(accountId: string): Promise<VoiceCreditStanding>;
     /**
      * Settle every started minute observed so far for one live-voice mode and
      * report whether the call must stop. Safe to call repeatedly and

package/dist/domain/session-start-timing.d.ts

@@ -1,5 +1,5 @@
 import { type Observability } from "@opengeni/observability";
-type SessionStartPhase = "workspace_read" | "model_catalog_initial" | "default_model" | "model_catalog_effective" | "capability_settings" | "initiator_freeze" | "allowance" | "shell_insert" | "initialize" | "event_fanout" | "workflow_wake" | "session_reload";
+type SessionStartPhase = "workspace_read" | "idempotent_replay" | "model_catalog_initial" | "default_model" | "model_catalog_effective" | "capability_settings" | "resource_validation" | "rig_binding" | "model_admission" | "connection_freeze" | "initiator_freeze" | "allowance" | "shell_insert" | "initialize" | "event_fanout" | "workflow_wake" | "session_reload";
 export type SessionStartObservability = Pick<Observability, "startSpan">;
 /** Content-free child spans around existing work; export is never joined and
  * diagnostic failures cannot alter the lifecycle or its exact error. */

package/dist/domain/session-tool-policy.d.ts

@@ -1,6 +1,6 @@
 import { type Settings } from "@opengeni/config";
 import { type AgentToolEnvironment, type AgentMediaAttachment, type Session, type SessionTurn, type SessionEffectiveToolPolicy, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
-import { type Database } from "@opengeni/db";
+import { requireWorkspace, type Database } from "@opengeni/db";
 export type ResolvedSessionToolPolicy = {
     toolRefs: ToolRef[];
     effectivePolicy: SessionEffectiveToolPolicy;
@@ -35,7 +35,9 @@ export declare function resolveTurnToolPolicy(input: Omit<SessionToolPolicyInput
     turn: Pick<SessionTurn, "tools" | "metadata">;
 }): ResolvedSessionToolPolicy;
 /** Resolve availability and defaults from the same subject-scoped registry read. */
-export declare function workspaceSessionToolPolicyContext(db: Database, workspaceId: string, settings: Settings, subjectId?: string): Promise<{
+export declare function workspaceSessionToolPolicyContext(db: Database, workspaceId: string, settings: Settings, subjectId?: string, 
+/** An in-flight read of this exact workspace a caller already started. */
+workspaceRead?: ReturnType<typeof requireWorkspace>): Promise<{
     workspaceServerIds: string[];
     workspaceDefaultServerIds: string[];
 }>;
@@ -73,7 +75,9 @@ export declare function workspaceSessionEffectiveToolsContext(deps: {
     db: Database;
     settings: Settings;
     objectStorage?: unknown;
-}, workspaceId: string, subjectId: string, sessions: readonly Session[]): Promise<SessionEffectiveToolsContext>;
+}, workspaceId: string, subjectId: string, sessions: readonly Session[], 
+/** An in-flight read of this exact workspace a caller already started. */
+workspaceRead?: ReturnType<typeof requireWorkspace>): Promise<SessionEffectiveToolsContext>;
 /** The server can prove attachment policy, not successful future provider calls. */
 export declare function sessionEffectiveToolProjectionInput(session: Session & {
     agent: NonNullable<Session["agent"]>;

package/dist/domain/voice-input-billing.d.ts

@@ -23,8 +23,9 @@ export declare function voiceInputBillableUsage(input: {
     basis: VoiceInputBillingBasis;
 };
 /**
- * Same admission shape as knowledge-search and session admission: general
- * (not model-promotional) credits must be positive, the workspace/member
+ * Same admission shape as knowledge-search and session admission:
+ * voice-spendable credits (general plus signup, not model-scoped promotional
+ * credits) must be positive, the workspace/member
  * allowance must not be exhausted, and a static monthly cost cap applies.
  * Admission is a read, not a reservation; settlement is post-use and may take
  * an account below zero by at most the concurrent in-flight calls.