@opengeni/core 1.4.0 → 1.4.4

package/src/default-session-model.ts

@@ -22,15 +22,11 @@ import {
   getWorkspace,
   getWorkspaceConnectionModelRestrictions,
   getWorkspaceModelPolicy,
-  getWorkspaceProviderApiKeyConnectionMetadata,
-  listWorkspaceProviderCustomModels,
-  listOrganizationModelProviderCustomModelsForWorkspace,
-  listWorkspaceGatewayCustomModels,
-  listWorkspaceOpenRouterCustomModels,
-  organizationModelProviderConnectionActiveForWorkspace,
+  getOrganizationModelProviderCatalogForWorkspace,
+  listConnectionsMetadata,
+  listWorkspaceProviderCustomModelsByKind,
   workspaceCodexSubscriptionActive,
-  workspaceOpenRouterConnectionActive,
-  workspaceVercelAiGatewayConnectionActive,
+  workspaceProviderApiKeyConnectionMetadataFromConnections,
   getBillingBalance,
   spendableCreditMicros,
   workspaceXaiSubscriptionActive,
@@ -41,6 +37,7 @@ import {
   workspaceClaudeSubscriptionActiveForAuthority,
   type ConnectionModelRestrictions,
   type Database,
+  type WorkspaceCustomModelProviderKind,
 } from "@opengeni/db";
 import {
   isWorkspaceModelAdmissible,
@@ -422,82 +419,43 @@ export async function loadWorkspaceModelSelectionInput(
   options: { observeAvailability?: boolean } = {},
 ): Promise<WorkspaceModelSelectionInput> {
   const { accountId, workspaceId } = context;
-  const restrictionsRead = (async () =>
-    connectionRestrictionsAndXaiReadiness(db, settings, context))();
-  const claudePoolRead = (async () =>
-    loadWorkspaceClaudeSubscriptionReadiness(db, settings, context))();
+  // The exact provider set the catalog route reads. A disabled Claude
+  // subscription contributes no catalog entry, so its rows are not read.
+  const providerKinds: WorkspaceCustomModelProviderKind[] = [
+    "vercel_gateway",
+    "openrouter",
+    ...CLAUDE_CONNECTION_KINDS.filter(
+      (kind) => kind !== "claude_subscription" || settings.claudeSubscriptionEnabled,
+    ),
+  ];
   const inputRead = (async () =>
     Promise.all([
-      restrictionsRead,
-      claudePoolRead,
+      connectionRestrictionsAndXaiReadiness(db, settings, context),
+      loadWorkspaceClaudeSubscriptionReadiness(db, settings, context),
       getWorkspaceModelPolicy(db, workspaceId),
       workspaceCodexSubscriptionActive(db, settings, workspaceId),
       options.observeAvailability === false
         ? Promise.resolve({})
         : loadWorkspaceCodexModelAvailability(db, settings, workspaceId),
-      workspaceVercelAiGatewayConnectionActive(db, workspaceId),
-      listWorkspaceGatewayCustomModels(db, { accountId, workspaceId }),
-      workspaceOpenRouterConnectionActive(db, workspaceId),
-      listWorkspaceOpenRouterCustomModels(db, { accountId, workspaceId }),
-      organizationModelProviderConnectionActiveForWorkspace(db, {
-        accountId,
-        workspaceId,
-        providerKind: "vercel_gateway",
-      }),
-      organizationModelProviderConnectionActiveForWorkspace(db, {
-        accountId,
-        workspaceId,
-        providerKind: "openrouter",
-      }),
-      listOrganizationModelProviderCustomModelsForWorkspace(db, {
-        accountId,
-        workspaceId,
-        providerKind: "vercel_gateway",
-      }),
-      listOrganizationModelProviderCustomModelsForWorkspace(db, {
-        accountId,
-        workspaceId,
-        providerKind: "openrouter",
-      }),
     ]))();
-  const claudeConnections: ClaudeConnectionCatalog = {};
-  const workspaceClaudeConnections: ClaudeConnectionCatalog = {};
   // Transaction handles share one backend and LOCAL scope. Preserve the old
   // batch ordering there rather than introduce concurrent nested savepoints.
   if (typeof (db as Database & { rollback?: unknown }).rollback === "function") await inputRead;
-  // Catalog metadata does not depend on the other providers' policy/readiness
-  // batch. Only subscription activation joins its exact existing pool read.
-  // These helpers keep their separate root-pool RLS scopes; no shared transaction.
+  // One scoped read per catalog family (workspace connection metadata,
+  // workspace custom models, organization provider readiness + models) instead
+  // of one scoped transaction per provider kind. The batched readers keep each
+  // provider's filters, bound and overflow error, exactly as the workspace
+  // model catalog route reads them.
   const catalogRead = (async () =>
-    Promise.all(
-      CLAUDE_CONNECTION_KINDS.map(async (kind) => {
-        if (kind === "claude_subscription" && !settings.claudeSubscriptionEnabled) return;
-        const [active, models, metadata, workspaceModels] = await Promise.all([
-          kind === "claude_subscription"
-            ? claudePoolRead.then((pool) => pool.organization)
-            : organizationModelProviderConnectionActiveForWorkspace(db, {
-                accountId,
-                workspaceId,
-                providerKind: kind,
-              }),
-          listOrganizationModelProviderCustomModelsForWorkspace(db, {
-            accountId,
-            workspaceId,
-            providerKind: kind,
-          }),
-          kind === "claude_subscription"
-            ? Promise.resolve(null)
-            : getWorkspaceProviderApiKeyConnectionMetadata(db, workspaceId, kind),
-          listWorkspaceProviderCustomModels(db, { accountId, workspaceId, providerKind: kind }),
-        ]);
-        claudeConnections[kind] = { active, models };
-        workspaceClaudeConnections[kind] = {
-          active:
-            kind === "claude_subscription" ? (await claudePoolRead).workspace : metadata !== null,
-          models: workspaceModels,
-        };
+    Promise.all([
+      listConnectionsMetadata(db, workspaceId, null),
+      listWorkspaceProviderCustomModelsByKind(db, { accountId, workspaceId, providerKinds }),
+      getOrganizationModelProviderCatalogForWorkspace(db, {
+        accountId,
+        workspaceId,
+        providerKinds,
       }),
-    ))();
+    ]))();
   // Observe both batches before admission resumes or fails. Retain the previous
   // input-batch error precedence even if the independent catalog fails first.
   const [inputResult, catalogResult] = await Promise.allSettled([inputRead, catalogRead]);
@@ -505,19 +463,31 @@ export async function loadWorkspaceModelSelectionInput(
   if (catalogResult.status === "rejected") throw catalogResult.reason;
   const [
     { restrictions: connectionModelRestrictions, xaiSubscriptionActive },
-    _claudePool,
+    claudePool,
     policy,
     codexSubscriptionActive,
     observations,
-    workspaceGatewayConnectionActive,
-    workspaceGatewayCustomModels,
-    openRouterConnectionActive,
-    workspaceOpenRouterCustomModels,
-    organizationGatewayConnectionActive,
-    organizationOpenRouterConnectionActive,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels,
   ] = inputResult.value;
+  const [workspaceConnections, workspaceCustomModels, organizationProviders] = catalogResult.value;
+  const workspaceConnectionActive = (kind: WorkspaceCustomModelProviderKind) =>
+    workspaceProviderApiKeyConnectionMetadataFromConnections(workspaceConnections, kind) !== null;
+  const claudeConnections: ClaudeConnectionCatalog = {};
+  const workspaceClaudeConnections: ClaudeConnectionCatalog = {};
+  for (const kind of CLAUDE_CONNECTION_KINDS) {
+    if (kind === "claude_subscription" && !settings.claudeSubscriptionEnabled) continue;
+    claudeConnections[kind] = {
+      active:
+        kind === "claude_subscription"
+          ? claudePool.organization
+          : organizationProviders[kind].active,
+      models: organizationProviders[kind].models,
+    };
+    workspaceClaudeConnections[kind] = {
+      active:
+        kind === "claude_subscription" ? claudePool.workspace : workspaceConnectionActive(kind),
+      models: workspaceCustomModels[kind],
+    };
+  }
   return {
     claudeConnections,
     workspaceClaudeConnections,
@@ -527,14 +497,14 @@ export async function loadWorkspaceModelSelectionInput(
     codexSubscriptionActive,
     observations,
     xaiSubscriptionActive,
-    workspaceGatewayConnectionActive,
-    workspaceGatewayCustomModels,
-    workspaceOpenRouterConnectionActive: openRouterConnectionActive,
-    workspaceOpenRouterCustomModels,
-    organizationGatewayConnectionActive,
-    organizationOpenRouterConnectionActive,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels,
+    workspaceGatewayConnectionActive: workspaceConnectionActive("vercel_gateway"),
+    workspaceGatewayCustomModels: workspaceCustomModels.vercel_gateway,
+    workspaceOpenRouterConnectionActive: workspaceConnectionActive("openrouter"),
+    workspaceOpenRouterCustomModels: workspaceCustomModels.openrouter,
+    organizationGatewayConnectionActive: organizationProviders.vercel_gateway.active,
+    organizationOpenRouterConnectionActive: organizationProviders.openrouter.active,
+    organizationGatewayCustomModels: organizationProviders.vercel_gateway.models,
+    organizationOpenRouterCustomModels: organizationProviders.openrouter.models,
   };
 }
 

package/src/domain/capabilities.ts

@@ -3,7 +3,12 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { isDeepStrictEqual } from "node:util";
 import { withLockedCapabilityInstallation } from "@opengeni/db/capability-reconciliation";
-import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
+import {
+  environmentsEncryptionKeyBytes,
+  findIntegrationsOauthClient,
+  parseIntegrationsOauthClientsJson,
+  type Settings,
+} from "@opengeni/config";
 import { pinnedFetch } from "@opengeni/network";
 import {
   CapabilityCatalogItem,
@@ -102,6 +107,7 @@ export async function buildCapabilityCatalog(input: {
     listEnabledMcpCapabilityServers(input.db, input.workspaceId),
   ]);
   const runnableCapabilityIds = new Set(runnableMcpServers.map((server) => server.capabilityId));
+  const operatorOAuthClientConfigured = operatorOAuthClientResolver(input.settings);
   const catalogInstallations = capabilityInstallations.filter(
     (installation) => installation.kind === "mcp",
   );
@@ -164,7 +170,9 @@ export async function buildCapabilityCatalog(input: {
               },
             }
           : projected;
-      return applyCapabilityLifecycle(runtimeProjected);
+      return applyCapabilityLifecycle(
+        applyOperatorOAuthClientRequirement(runtimeProjected, operatorOAuthClientConfigured),
+      );
     })
     .sort(compareCatalogItems);
   return {
@@ -173,6 +181,40 @@ export async function buildCapabilityCatalog(input: {
   };
 }
 
+/**
+ * `metadata.oauthClientRequirement` is stamped by the catalog import from
+ * `data/catalog/oauth-client-requirements.json` for providers that refuse
+ * OAuth self-registration. Whether the row can connect here is a deployment
+ * fact, so the catalog projects it rather than every surface guessing. The
+ * matcher is the one the OAuth start uses to find an operator client.
+ */
+function operatorOAuthClientResolver(settings: Settings): (issuer: string) => boolean {
+  let configured: ReturnType<typeof parseIntegrationsOauthClientsJson> = {};
+  try {
+    configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
+  } catch {
+    // Startup validates this setting; a malformed value can configure nothing.
+  }
+  return (issuer) => findIntegrationsOauthClient(configured, [issuer]) !== null;
+}
+
+export function applyOperatorOAuthClientRequirement(
+  item: CapabilityCatalogItem,
+  configured: (issuer: string) => boolean,
+): CapabilityCatalogItem {
+  if (item.kind !== "mcp") return item;
+  const requirement = item.metadata.oauthClientRequirement;
+  const issuer =
+    requirement && typeof requirement === "object" && !Array.isArray(requirement)
+      ? (requirement as Record<string, unknown>).issuer
+      : undefined;
+  if (typeof issuer !== "string" || !issuer) return item;
+  return {
+    ...item,
+    runtime: { ...item.runtime, operatorOAuthClient: { configured: configured(issuer) } },
+  };
+}
+
 export async function createCatalogItem(input: {
   db: Database;
   accountId: string;

package/src/domain/realtime-voice-billing.ts

@@ -20,6 +20,7 @@ import {
   loadSessionRealtimeBillingFacts,
   recordUsageEvent,
   sumUsageQuantity,
+  VOICE_CREDIT_USAGE,
   withRlsContext,
   type CreditDebitAttribution,
   type Database,
@@ -43,6 +44,25 @@ export type DeploymentRealtimeVoice = {
  * return null. (The catalog lists hosted GPT Live instead of the managed
  * Gateway choices when both are configured; both remain priced and gated.)
  */
+const reportedPricingErrors = new Set<string>();
+
+/**
+ * Malformed pricing withholds the model (like voice input) instead of failing
+ * API/worker boot; each distinct error is logged once.
+ */
+function tolerantPricing<T>(parse: () => T, fallback: T): T {
+  try {
+    return parse();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!reportedPricingErrors.has(message)) {
+      reportedPricingErrors.add(message);
+      console.error(`Live voice pricing ignored: ${message}`);
+    }
+    return fallback;
+  }
+}
+
 export function deploymentRealtimeVoice(
   settings: Settings,
   model: SessionRealtimeModel | string,
@@ -52,7 +72,14 @@ export function deploymentRealtimeVoice(
     return {
       provider: "azure-live",
       configured: azureConfigured,
-      pricing: parseRealtimeVoicePricingJson(settings.azureLivePricingJson),
+      pricing: tolerantPricing(
+        () =>
+          parseRealtimeVoicePricingJson(
+            settings.azureLivePricingJson,
+            "OPENGENI_AZURE_LIVE_PRICING_JSON",
+          ),
+        null,
+      ),
     };
   }
   for (const gateway of Object.values(AI_GATEWAY_REALTIME_MODELS)) {
@@ -61,9 +88,14 @@ export function deploymentRealtimeVoice(
       provider: "ai-gateway",
       configured: Boolean(settings.vercelAiGatewayApiKey),
       pricing:
-        parseRealtimeVoicePricingTableJson(settings.aiGatewayRealtimePricingJson)[
-          gateway.upstreamModelId
-        ] ?? null,
+        tolerantPricing(
+          () =>
+            parseRealtimeVoicePricingTableJson(
+              settings.aiGatewayRealtimePricingJson,
+              "OPENGENI_AI_GATEWAY_REALTIME_PRICING_JSON",
+            ),
+          {} as Record<string, RealtimeVoicePricing>,
+        )[gateway.upstreamModelId] ?? null,
     };
   }
   return null;
@@ -105,6 +137,37 @@ export function realtimeVoiceOfferProblem(
 export const REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE =
   "Live voice needs Opengeni credits. Add credits to continue.";
 
+/**
+ * Credits voice can spend (general and signup credits), only model-scoped
+ * promotional credits, or neither.
+ */
+export type VoiceCreditStanding = "spendable" | "promotional_only" | "none";
+
+/** `balance` must be the voice-spendable balance (see {@link VOICE_CREDIT_USAGE}). */
+export function voiceCreditStanding(balance: {
+  balanceMicros: number;
+  promotionalCredits?: readonly { remainingMicros: number }[] | undefined;
+}): VoiceCreditStanding {
+  if (balance.balanceMicros > 0) return "spendable";
+  return (balance.promotionalCredits ?? []).some((grant) => grant.remainingMicros > 0)
+    ? "promotional_only"
+    : "none";
+}
+
+/**
+ * Insufficient-credit copy for voice. Signup credits pay for voice like
+ * general credits; other promotional credits are scoped to chat models, so an
+ * account holding only those must not be told it has nothing.
+ */
+export function voiceInsufficientCreditsMessage(
+  feature: "Live voice" | "Voice input",
+  standing: VoiceCreditStanding,
+): string {
+  return standing === "promotional_only"
+    ? `Promotional credits don't cover ${feature.toLowerCase()}. Add credits to use it.`
+    : `${feature} needs Opengeni credits. Add credits to continue.`;
+}
+
 function startOfUtcMonth(now: Date): Date {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
 }
@@ -126,7 +189,7 @@ export type RealtimeVoiceSettlement = {
  * Credit admission and time metering for deployment-funded live voice.
  *
  * Admission mirrors voice-input admission (same refusal codes and HTTP
- * shape): spendable general credits must be positive, the workspace/member
+ * shape): voice-spendable credits (general plus signup) must be positive, the workspace/member
  * allowance must not be exhausted, and the static monthly cost cap applies.
  * Metering bills every started minute of each issued provider connection,
  * measured only from server-observed facts (connection claim time, owner
@@ -142,11 +205,11 @@ export function createRealtimeVoiceBilling(deps: { db: Database; settings: Setti
     attribution: CreditDebitAttribution;
     now: Date;
   }): Promise<TranscriptionBillingRefusedError | null> {
-    const balance = await getSpendableCreditBalance(deps.db, input.accountId);
+    const balance = await getSpendableCreditBalance(deps.db, input.accountId, VOICE_CREDIT_USAGE);
     if (balance.balanceMicros <= 0) {
       return new TranscriptionBillingRefusedError({
         code: "insufficient_credits",
-        message: REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE,
+        message: voiceInsufficientCreditsMessage("Live voice", voiceCreditStanding(balance)),
       });
     }
     const allowance = await checkWorkspaceAllowance(deps.db, {
@@ -208,9 +271,15 @@ export function createRealtimeVoiceBilling(deps: { db: Database; settings: Setti
 
     /** Spendable credits are positive (always true when credits are not enforced). */
     async hasSpendableCredits(accountId: string): Promise<boolean> {
-      if (!billingActive()) return true;
-      const balance = await getSpendableCreditBalance(deps.db, accountId);
-      return balance.balanceMicros > 0;
+      return (await this.creditStanding(accountId)) === "spendable";
+    },
+
+    /** Credit standing for live voice ("spendable" when credits are not enforced). */
+    async creditStanding(accountId: string): Promise<VoiceCreditStanding> {
+      if (!billingActive()) return "spendable";
+      return voiceCreditStanding(
+        await getSpendableCreditBalance(deps.db, accountId, VOICE_CREDIT_USAGE),
+      );
     },
 
     /**
@@ -296,6 +365,7 @@ export function createRealtimeVoiceBilling(deps: { db: Database; settings: Setti
               sourceId,
               idempotencyKey: `credit:${REALTIME_VOICE_DEBIT_TYPE}:${sourceId}`,
               occurredAt: minute.startsAt,
+              usage: VOICE_CREDIT_USAGE,
               metadata: {
                 provider: voice.provider,
                 model: facts.model,

package/src/domain/session-start-timing.ts

@@ -2,10 +2,15 @@ import { withTraceContext, type Observability, type Span } from "@opengeni/obser
 
 type SessionStartPhase =
   | "workspace_read"
+  | "idempotent_replay"
   | "model_catalog_initial"
   | "default_model"
   | "model_catalog_effective"
   | "capability_settings"
+  | "resource_validation"
+  | "rig_binding"
+  | "model_admission"
+  | "connection_freeze"
   | "initiator_freeze"
   | "allowance"
   | "shell_insert"

package/src/domain/session-tool-policy.ts

@@ -235,12 +235,14 @@ export async function workspaceSessionToolPolicyContext(
   workspaceId: string,
   settings: Settings,
   subjectId?: string,
+  /** An in-flight read of this exact workspace a caller already started. */
+  workspaceRead?: ReturnType<typeof requireWorkspace>,
 ): Promise<{ workspaceServerIds: string[]; workspaceDefaultServerIds: string[] }> {
   const [runtimeSettings, workspace] = await Promise.all([
     settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
       ...(subjectId ? { subjectId } : {}),
     }),
-    requireWorkspace(db, workspaceId),
+    workspaceRead ?? requireWorkspace(db, workspaceId),
   ]);
   return {
     workspaceServerIds: sortedIds(runtimeSettings.mcpServers.map((server) => server.id)),
@@ -326,6 +328,8 @@ export async function workspaceSessionEffectiveToolsContext(
   workspaceId: string,
   subjectId: string,
   sessions: readonly Session[],
+  /** An in-flight read of this exact workspace a caller already started. */
+  workspaceRead?: ReturnType<typeof requireWorkspace>,
 ): Promise<SessionEffectiveToolsContext> {
   const configured = sessions.filter((session) => session.agent != null);
   const baseline: SessionEffectiveToolsContext = {
@@ -336,7 +340,7 @@ export async function workspaceSessionEffectiveToolsContext(
   };
   if (configured.length === 0) return baseline;
   const [workspace, catalog, descriptors, sandboxes, routerHistory] = await Promise.all([
-    requireWorkspace(deps.db, workspaceId),
+    workspaceRead ?? requireWorkspace(deps.db, workspaceId),
     resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
       accountId: configured[0]!.accountId,
       workspaceId,