@opengeni/core 2.5.3 → 2.6.4-canary.0

package/dist/managed-auth-session-sets.d.ts

@@ -110,4 +110,22 @@ export declare function authenticateAndAdoptManagedAuthSession(input: {
     projection: ManagedAuthDatabaseProjection;
     returnIntent: string | null;
 }>;
+export declare function adoptManagedAuthSession(input: {
+    db: Database;
+    adapter: ManagedAuthSessionAdapter;
+    authority: string;
+    authorityHash: string;
+    csrfHash: string;
+    operationId: string;
+    requestDigest: string;
+    expectedGeneration: string;
+    expectedActorEpoch: string;
+    transactionId: string;
+    transactionSecretHash: string;
+    authSessionId: string;
+    mode: ManagedAuthSessionSetMode;
+}): Promise<{
+    projection: ManagedAuthDatabaseProjection;
+    returnIntent: string | null;
+}>;
 export declare function isolatedManagedAuthHeaders(request: Request): Headers;

package/dist/managed-auth-session-sets.js

@@ -7,6 +7,7 @@ import {
   ManagedAuthActorChangeError,
   ManagedAuthCompletionOutcomeUnknownError,
   ManagedAuthRequestAdmissionError,
+  adoptManagedAuthSession,
   authenticateAndAdoptManagedAuthSession,
   isolatedManagedAuthHeaders,
   managedAuthCsrfHash,
@@ -21,7 +22,7 @@ import {
   requireManagedAuthMutationAdmission,
   resolveManagedAuthSelectedSession,
   withManagedAuthCsrfToken
-} from "./chunk-YGOMUGYS.js";
+} from "./chunk-QO5GVFFO.js";
 export {
   MANAGED_AUTH_ACTOR_EPOCH_HEADER,
   MANAGED_AUTH_CSRF_HEADER,
@@ -31,6 +32,7 @@ export {
   ManagedAuthActorChangeError,
   ManagedAuthCompletionOutcomeUnknownError,
   ManagedAuthRequestAdmissionError,
+  adoptManagedAuthSession,
   authenticateAndAdoptManagedAuthSession,
   isolatedManagedAuthHeaders,
   managedAuthCsrfHash,

package/dist/model-catalog.d.ts

@@ -0,0 +1,89 @@
+import { type ConfiguredModel, type Settings } from "@opengeni/config";
+import { type ModelAvailabilityV1, type ModelCredentialReadinessV1, type WorkspaceModelPolicyContract } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+export type ResolvedCatalogSettings = {
+    settings: Settings;
+    source: "code" | "database";
+    version: number | null;
+    modelNotes: Record<string, string>;
+};
+/**
+ * Curated workspace Gateway products and workspace-owned custom slugs share
+ * one public prefix. Only the latter have a mutable catalog row whose active
+ * generation must be rechecked at a fresh acceptance commit boundary.
+ */
+export declare function isWorkspaceGatewayCustomModelId(settings: Settings, modelId: string): boolean;
+export declare function isWorkspaceOpenRouterCustomModelId(settings: Settings, modelId: string): boolean;
+export type WorkspaceCustomModelReference = {
+    providerKind: "vercel_gateway" | "openrouter";
+    upstreamModelId: string;
+};
+export declare function workspaceCustomModelReference(settings: Settings, modelId: string): WorkspaceCustomModelReference | null;
+export declare function isWorkspaceCustomModelId(settings: Settings, modelId: string): boolean;
+/**
+ * Resolve the deployment catalog without making synchronous env settings read
+ * Postgres. Database mode fails closed when the singleton is absent or invalid;
+ * code mode preserves the already-validated env catalog.
+ */
+export declare function resolveCatalogSettings(db: Database, envSettings: Settings): Promise<ResolvedCatalogSettings>;
+/**
+ * Resolve the deployment catalog and add only the custom Gateway slugs owned by
+ * one workspace. Use this at model-bearing workspace boundaries; public config
+ * and deployment-operator surfaces must continue to use `resolveCatalogSettings`.
+ */
+export declare function resolveWorkspaceCatalogSettings(db: Database, envSettings: Settings, input: {
+    accountId: string;
+    workspaceId: string;
+    retainedProductModelId?: string | null;
+    retainedProductModelIds?: readonly (string | null | undefined)[];
+}): Promise<ResolvedCatalogSettings>;
+export type ModelAvailabilityObservation = {
+    status: "available" | "degraded" | "unavailable";
+    reason: "not_entitled" | "provider_unhealthy" | null;
+    checkedAt: string;
+};
+export type ModelCredentialReadinessObservation = {
+    status: "ready";
+    checkedAt: string;
+} | {
+    status: "not_ready";
+    reason: "prerequisites_missing" | "needs_reauth";
+    checkedAt: string;
+} | {
+    status: "error";
+    reason: "resolver_error";
+    checkedAt: string;
+};
+export declare const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS: number;
+export type WorkspaceModelSelectionInput = {
+    settings: Settings;
+    policy: WorkspaceModelPolicyContract | null;
+    codexSubscriptionActive: boolean;
+    xaiSubscriptionActive?: boolean;
+    workspaceGatewayConnectionActive?: boolean;
+    workspaceOpenRouterConnectionActive?: boolean;
+    workspaceGatewayCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    workspaceOpenRouterCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    credentialReadinessObservations?: Readonly<Record<string, ModelCredentialReadinessObservation>> | undefined;
+    observations?: Readonly<Record<string, ModelAvailabilityObservation>> | undefined;
+    now?: Date | undefined;
+    credentialReadinessMaxAgeMs?: number | undefined;
+};
+export type WorkspaceModelSelection = {
+    model: ConfiguredModel;
+    credentialReadiness: ModelCredentialReadinessV1;
+    policyAllowed: boolean;
+    availability: ModelAvailabilityV1;
+};
+/**
+ * One shared picker/tool decision. Catalog membership, credential readiness,
+ * workspace policy, and optional provider-health observations are evaluated in
+ * configured catalog order so every consumer exposes the same selectable set.
+ */
+export declare function resolveWorkspaceModelSelection(input: WorkspaceModelSelectionInput): WorkspaceModelSelection[];

package/dist/sandbox/fleet.d.ts

@@ -1,4 +1,5 @@
 import type { Settings } from "@opengeni/config";
+import type { SandboxBackend } from "@opengeni/contracts";
 import { type Database, type SandboxRecord } from "@opengeni/db";
 import type { EventBus } from "@opengeni/events";
 import { type BackendUnresolvableCode, type ControlRpc, type SelfhostedRelayConfig, type SelfhostedOpStreamDeps, type SelfhostedOperationAdmission, type SelfhostedOperationResourcePolicy } from "@opengeni/runtime/sandbox";
@@ -28,8 +29,8 @@ export type FleetContext = {
     /** The calling session (the pointer the attach/swap mutates + whose group box
      *  is the default fleet member). */
     sessionId: string;
-    /** The session's own group sandbox backend (modal/selfhosted/…). */
-    sessionBackend: string;
+    /** The session's durable home-compute policy. */
+    sessionBackend: SandboxBackend;
     /** The session's own group sandbox id (the lease group). */
     sessionGroupId: string;
 };
@@ -122,8 +123,9 @@ export type FleetSwapResult = {
  * List the fleet: the session's own group box when it has one (a synthetic
  * entry) + the workspace's first-class selfhosted sandboxes (each probed for
  * liveness), each with an `active` marker derived from the session's active
- * pointer. A backend:none session has no synthetic home entry; a null pointer
- * then means no compute is attached.
+ * pointer. A backend:none session and a machine-home session on a deployment
+ * without a managed provider have no synthetic group entry; a null pointer then
+ * means no compute is attached.
  */
 export declare function listFleet(services: FleetServices, ctx: FleetContext): Promise<FleetListResult>;
 /**

package/dist/sandbox/routing.d.ts

@@ -1,7 +1,7 @@
 import { type Settings } from "@opengeni/config";
-import { type Database } from "@opengeni/db";
+import { type Database, type SandboxRetainedProcess } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
-import { type EstablishedSandboxSession, type ResolvedActiveBackend, type RoutingRetainedProcess, type RoutingSandboxOperationObserver, type SelfhostedRelayConfig } from "@opengeni/runtime/sandbox";
+import { type EstablishedSandboxSession, type ResolvedActiveBackend, type RoutingRetainedProcess, type RoutingRetainedProcessTerminalProof, type RoutingSandboxOperationObserver, type SelfhostedRelayConfig } from "@opengeni/runtime/sandbox";
 type DirectRetainedProcessRoute = {
     providerSessionId: number;
     providerBackend: string;
@@ -14,6 +14,11 @@ type DirectRetainedProcessRoute = {
 /** API-direct requests always use active-route authority. The default active
  * pointer is represented by a null target id; it is not a home-route write. */
 export declare function directRetainedProcessMatchesBackend(durable: DirectRetainedProcessRoute, process: RoutingRetainedProcess, backend: ResolvedActiveBackend): boolean;
+export declare function retainedProcessBackgroundSettlement(process: Pick<SandboxRetainedProcess, "state" | "exitCode" | "settlementReason">, fallback: RoutingRetainedProcessTerminalProof): {
+    outcome: "exited" | "lost";
+    exitCode: number | null;
+    reason: string;
+};
 export type ChannelARoutingServices = {
     db: Database;
     settings: Settings;

package/dist/sandbox/runtime-settings.d.ts

@@ -1,7 +1,23 @@
 import type { Settings } from "@opengeni/config";
-import { CapabilityPack, type RigVersion, type Session, type SandboxBackend } from "@opengeni/contracts";
+import { CapabilityPack, type RigVersion, type Session, type SandboxBackend, type SandboxOs } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import { resolveModalCheckpointProviderBinding } from "@opengeni/runtime/sandbox";
+export type ManagedSessionGroupBackend = Exclude<SandboxBackend, "none" | "selfhosted">;
+/**
+ * Resolve the provider backend behind a session's synthetic managed group.
+ *
+ * A machine-home session keeps `selfhosted` as its durable policy while a
+ * non-null active pointer selects the enrolled machine. Clearing that pointer
+ * is an explicit switch to the deployment's managed group, so API readiness,
+ * viewer attachment, Channel-A, and worker turns must all select the same
+ * provider. Deployments configured with `none` or `selfhosted` have no managed
+ * fallback to expose.
+ */
+export declare function managedSessionGroupBackend(deploymentBackend: SandboxBackend, sessionBackend: SandboxBackend): ManagedSessionGroupBackend | null;
+/** A machine-home row carries the machine's host OS; its managed group uses the
+ * platform's canonical managed-sandbox OS instead. Ordinary sessions preserve
+ * their explicitly selected OS. */
+export declare function managedSessionGroupOs(sessionBackend: SandboxBackend, sessionOs: SandboxOs): SandboxOs;
 /** Pre-V2 Packs are the sole compatibility path where a Pack can still own a
  * sandbox image. V2 installations select a Rig instead. Keep this predicate at
  * the shared runtime boundary so turns, API-direct tools, viewers, Browser and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.5.3",
+  "version": "2.6.4-canary.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -54,15 +54,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.19",
-    "@opengeni/config": "^0.22.0",
-    "@opengeni/contracts": "^2.7.0",
-    "@opengeni/db": "^3.6.0",
-    "@opengeni/documents": "^0.8.6",
-    "@opengeni/events": "^0.4.4",
-    "@opengeni/observability": "^0.8.9",
-    "@opengeni/runtime": "^1.4.2",
-    "@opengeni/storage": "^0.2.110",
+    "@opengeni/codex": "^0.2.20-canary.1",
+    "@opengeni/config": "^0.22.5-canary.1",
+    "@opengeni/contracts": "^2.9.2-canary.1",
+    "@opengeni/db": "^3.7.4-canary.0",
+    "@opengeni/documents": "^0.8.14-canary.0",
+    "@opengeni/events": "^0.4.12-canary.0",
+    "@opengeni/observability": "^0.8.14-canary.1",
+    "@opengeni/runtime": "^2.0.1-canary.1",
+    "@opengeni/storage": "^0.2.115-canary.1",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/index.ts

@@ -43,7 +43,60 @@ const accessContextByRequest = new WeakMap<Request, Promise<AccessContext | null
  * the value the cookie branch produced.
  */
 const canonicalManagedCookieContexts = new WeakSet<AccessContext>();
+const canonicalLocalHumanContexts = new WeakSet<AccessContext>();
 const resolvedAccessGrantAuthorizations = new WeakSet<object>();
+const accountScopedApiKeyContexts = new WeakMap<
+  AccessContext,
+  Readonly<{ accountId: string; permissions: readonly Permission[] }>
+>();
+
+const accountScopedApiKeyAccountPermissions = new Set<Permission>([
+  "account:read",
+  "account:admin",
+  "workspace:create",
+  "billing:read",
+  "billing:manage",
+  "api_keys:manage",
+]);
+const accountScopedApiKeyWorkspaceExcludedPermissions = new Set<Permission>([
+  "account:read",
+  "account:admin",
+  "workspace:create",
+  "billing:read",
+  "billing:manage",
+]);
+
+export type AccountScopedApiKeyWorkspaceAuthority = Readonly<{
+  accountId: string;
+  permissions: Permission[];
+}>;
+
+/**
+ * Return account-scoped API-key workspace authority only for the exact
+ * AccessContext object stamped by successful API-key authentication. Subject
+ * shape alone is deliberately insufficient.
+ */
+export function accountScopedApiKeyWorkspaceAuthority(
+  context: AccessContext,
+): AccountScopedApiKeyWorkspaceAuthority | null {
+  const authority = accountScopedApiKeyContexts.get(context);
+  if (!authority) return null;
+  const matchingAccountGrants = context.accountGrants.filter(
+    (grant) => grant.accountId === authority.accountId && grant.subjectId === context.subjectId,
+  );
+  if (
+    !context.subjectId.startsWith("api_key:") ||
+    matchingAccountGrants.length !== 1 ||
+    context.defaultAccountId !== authority.accountId ||
+    context.defaultWorkspaceId !== null
+  ) {
+    return null;
+  }
+  return {
+    accountId: authority.accountId,
+    permissions: [...authority.permissions],
+  };
+}
 
 /**
  * Opaque, request-local proof that the canonical access resolver authorized the
@@ -119,6 +172,8 @@ export type AccessGrantAuthorization = {
    * principal, and for any future path that does not verify a cookie.
    */
   canonicalManagedHumanSession: boolean;
+  /** Exact in-process single-user local bootstrap, never a delegated bearer. */
+  canonicalLocalHumanSession: boolean;
 };
 
 export function accessGrantAuthorizationFromContext(
@@ -151,6 +206,7 @@ export function accessGrantAuthorizationFromContext(
     authenticatedSubjectId: context.subjectId,
     contextIntegrity,
     canonicalManagedHumanSession: isCanonicalManagedHumanSession(context, grant),
+    canonicalLocalHumanSession: isCanonicalLocalHumanSession(context, grant),
   };
   resolvedAccessGrantAuthorizations.add(authorization);
   return authorization;
@@ -187,6 +243,37 @@ export function requireAccountAdminAuthorizationStamp(
   });
 }
 
+/**
+ * Resolve the exact built-in single-user local administrator for an account.
+ *
+ * This is intentionally narrower than checking `context.mode === "local"` or
+ * the `dev` subject name. Only the in-process local bootstrap branch can place
+ * the resolved context in `canonicalLocalHumanContexts`, so delegated bearer
+ * tokens and caller-constructed contexts cannot borrow this authority.
+ */
+export async function requireCanonicalLocalAccountAdministrator(
+  c: Context,
+  deps: AccessDeps,
+  accountId: string,
+): Promise<{ subjectId: string; authorization: AccessGrantAuthorization }> {
+  if (c.req.header("authorization")) {
+    throw new HTTPException(401, { message: "organization administrator session required" });
+  }
+  const context = await requireAccessContext(c, deps);
+  const grant = context.workspaceGrants.find((candidate) => candidate.accountId === accountId);
+  if (!grant) {
+    throw new HTTPException(403, {
+      message: "local organization administration is not authorized",
+    });
+  }
+  const authorization = accessGrantAuthorizationFromContext(context, grant);
+  if (!authorization.canonicalLocalHumanSession) {
+    throw new HTTPException(401, { message: "organization administrator session required" });
+  }
+  requireAccountAdminAuthorizationStamp(authorization);
+  return { subjectId: context.subjectId, authorization };
+}
+
 export async function requireAccessGrantAuthorization(
   c: Context,
   deps: AccessDeps,
@@ -204,7 +291,7 @@ async function accessGrantAuthorization(
   permission?: Permission,
 ): Promise<AccessGrantAuthorization> {
   const principalKind = hostedHumanSessionPrincipalKind(context);
-  const grant =
+  let grant =
     context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ??
     (await getWorkspaceGrant(
       deps.db,
@@ -217,7 +304,25 @@ async function accessGrantAuthorization(
     if (!workspace) {
       throw new HTTPException(404, { message: "workspace not found" });
     }
-    throw new HTTPException(403, { message: "workspace access denied" });
+    const authority = accountScopedApiKeyWorkspaceAuthority(context);
+    const requiredWorkspacePermission = permission ?? "workspace:read";
+    if (
+      authority &&
+      workspace.accountId === authority.accountId &&
+      workspace.kind === "shared" &&
+      hasPermission(authority.permissions, requiredWorkspacePermission)
+    ) {
+      grant = {
+        workspaceId: workspace.id,
+        accountId: workspace.accountId,
+        subjectId: context.subjectId,
+        ...(context.subjectLabel ? { subjectLabel: context.subjectLabel } : {}),
+        permissions: authority.permissions,
+        principalKind: "api_key",
+      };
+    } else {
+      throw new HTTPException(403, { message: "workspace access denied" });
+    }
   }
   if (permission) {
     requirePermission(grant, permission);
@@ -262,6 +367,18 @@ function isCanonicalManagedHumanSession(context: AccessContext, grant: AccessGra
   );
 }
 
+function isCanonicalLocalHumanSession(context: AccessContext, grant: AccessGrant): boolean {
+  return (
+    canonicalLocalHumanContexts.has(context) &&
+    context.mode === "local" &&
+    context.subjectId === "dev" &&
+    grant.subjectId === context.subjectId &&
+    grant.principalKind === "human_session" &&
+    grant.metadata?.delegated !== true &&
+    !grant.serviceInitiator
+  );
+}
+
 function hostedHumanSessionPrincipalKind(context: AccessContext): "human_session" | undefined {
   if (context.mode !== "managed" || context.workspaceGrants.length === 0) {
     return undefined;
@@ -330,7 +447,7 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
     if (delegated) {
       return delegated;
     }
-    return await bootstrapWorkspace(deps.db, {
+    const context = await bootstrapWorkspace(deps.db, {
       accountExternalSource: "opengeni:local",
       accountExternalId: "default",
       accountName: "Local",
@@ -340,6 +457,8 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
       subjectId: "dev",
       subjectLabel: "Local dev",
     });
+    canonicalLocalHumanContexts.add(context);
+    return context;
   }
 
   if (deps.settings.productAccessMode === "configured") {
@@ -423,8 +542,10 @@ async function apiKeyAccessContext(
     ? apiKey.permissions.filter(
         (permission) => permission === "billing:read" || permission === "billing:manage",
       )
-    : apiKey.permissions;
-  return {
+    : apiKey.permissions.filter((permission) =>
+        accountScopedApiKeyAccountPermissions.has(permission),
+      );
+  const context = {
     mode,
     subjectId,
     subjectLabel: apiKey.name,
@@ -451,6 +572,20 @@ async function apiKeyAccessContext(
     defaultAccountId: apiKey.accountId,
     defaultWorkspaceId: apiKey.workspaceId,
   } satisfies AccessContext;
+  if (apiKey.workspaceId === null && apiKey.credentialKind === "organization") {
+    accountScopedApiKeyContexts.set(
+      context,
+      Object.freeze({
+        accountId: apiKey.accountId,
+        permissions: Object.freeze(
+          apiKey.permissions.filter(
+            (permission) => !accountScopedApiKeyWorkspaceExcludedPermissions.has(permission),
+          ),
+        ),
+      }),
+    );
+  }
+  return context;
 }
 
 async function delegatedAccessContext(

package/src/application/user-resource-grants.ts

@@ -6,6 +6,7 @@ import type {
 } from "@opengeni/contracts";
 import {
   issueSelfUserResourceGrant,
+  issueSelfLocalConnectionUseGrant,
   listSelfUserResourceAuthorities,
   revokeSelfUserResourceGrant,
   sessionTenancyProductActivated,
@@ -14,7 +15,10 @@ import {
 import { requirePermission, type AccessGrantAuthorization } from "../access";
 import type { AppDependencies } from "../dependencies";
 import { requireSessionAuthorization } from "../session-authorization";
-import { requireCanonicalManagedHuman } from "./session-tenancy";
+import {
+  requireCanonicalManagedHuman,
+  SessionTenancyManagedHumanRequiredError,
+} from "./session-tenancy";
 
 type UserResourceGrantDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
 
@@ -53,7 +57,15 @@ function requireOwnerAuthority(
   workspaceId: string,
   permissions: readonly Permission[],
 ): void {
-  requireCanonicalManagedHuman(authorization, workspaceId);
+  if (!authorization.canonicalLocalHumanSession) {
+    requireCanonicalManagedHuman(authorization, workspaceId);
+  } else if (
+    !authorization.contextIntegrity ||
+    authorization.authenticatedSubjectId !== authorization.grant.subjectId ||
+    authorization.grant.workspaceId !== workspaceId
+  ) {
+    throw new SessionTenancyManagedHumanRequiredError();
+  }
   for (const permission of permissions) requirePermission(authorization.grant, permission);
 }
 
@@ -90,6 +102,23 @@ export async function issueManagedHumanUserResourceGrant(
 ) {
   const modePermissions: Permission[] =
     request.mode === "session" ? ["sessions:control"] : ["sessions:create"];
+  if (authorization.canonicalLocalHumanSession) {
+    requireOwnerAuthority(authorization, workspaceId, [
+      ...ISSUE_PERMISSIONS[request.resourceKind],
+      "sessions:create",
+    ]);
+    if (request.resourceKind !== "connection" || request.mode !== "always") {
+      throw new SessionTenancyManagedHumanRequiredError();
+    }
+    return await issueSelfLocalConnectionUseGrant(deps.db, {
+      accountId: authorization.grant.accountId,
+      workspaceId,
+      subjectId: authorization.grant.subjectId,
+      authorityId,
+      context: request.context,
+      workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
+    });
+  }
   await requireOwnerProductGate(deps, authorization, workspaceId, [
     ...ISSUE_PERMISSIONS[request.resourceKind],
     ...modePermissions,

package/src/billing/limits.ts

@@ -1,4 +1,8 @@
-import { configuredStaticUsageLimits, resolveModelProvider } from "@opengeni/config";
+import {
+  configuredStaticUsageLimits,
+  resolveModelProviderForTurn,
+  type Settings,
+} from "@opengeni/config";
 import type {
   LimitAction,
   LimitDecision,
@@ -8,6 +12,7 @@ import type {
 } from "@opengeni/contracts";
 import {
   countActiveApiKeysForWorkspace,
+  countActiveOrganizationApiKeysForAccount,
   countScheduledTasksForWorkspace,
   countWorkspacesForAccount,
   getBillingBalance,
@@ -25,14 +30,35 @@ export type LimitCheckInput = {
   workspaceId?: string;
   action: LimitAction;
   quantity?: number;
-  // The turn's model id, when the action represents an agent turn. Externally
-  // billed models consume ZERO OpenGeni credits, so the credit-balance +
-  // model-cost + token gates are skipped. Connected subscriptions still require
-  // live workspace readiness; an explicitly anonymous deployment route is
-  // statically ready by definition. Non-model infra actions leave this undefined.
+  // The turn's model id, when the action represents an agent turn. The model's
+  // deployment cost controls credit/cost gates; upstream metering independently
+  // controls the token cap. Connected subscriptions still require live workspace
+  // readiness. Non-model infra actions leave this undefined.
   model?: string | null;
 };
 
+export function modelFundingForAdmission(
+  settings: Settings,
+  model: string | null | undefined,
+  codexBilled: boolean,
+): { fundedWithoutCredits: boolean; countsTowardTokenCap: boolean } {
+  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
+  const codexSubscriptionModel =
+    resolvedModel?.credentialSource.kind === "connected_subscription" &&
+    resolvedModel.credentialSource.provider === "codex";
+  return {
+    // A Codex namespace/definition never bypasses credits by itself: the live
+    // workspace credential predicate above remains authoritative. SuperGrok's
+    // static overlay is likewise secret-free; its worker/provider admission
+    // owns live account selection before any upstream request can occur.
+    fundedWithoutCredits:
+      codexBilled ||
+      (resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits"),
+    countsTowardTokenCap:
+      !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment",
+  };
+}
+
 export async function requireLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<void> {
   const decision = await checkLimit(deps, input);
   if (decision.allowed) {
@@ -58,25 +84,22 @@ export async function checkLimit(
         model: input.model,
       })
     : false;
-  const credentialFreeExternal = input.model
-    ? (() => {
-        const resolved = resolveModelProvider(deps.settings, input.model);
-        return (
-          resolved?.model.billing.metering === "external" &&
-          resolved.model.credentialSource.kind === "deployment" &&
-          resolved.model.credentialSource.mechanism === "none"
-        );
-      })()
-    : false;
-  const externallyBilled = codexBilled || credentialFreeExternal;
-  const creditDecision = await checkCreditBalance(deps, input, externallyBilled);
+  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
+    deps.settings,
+    input.model,
+    codexBilled,
+  );
+  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
   if (!creditDecision.allowed) {
     return creditDecision;
   }
   if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
     return { allowed: true };
   }
-  return await checkStaticCaps(deps, input, externallyBilled);
+  return await checkStaticCaps(deps, input, {
+    fundedWithoutCredits,
+    countsTowardTokenCap,
+  });
 }
 
 async function checkCreditBalance(
@@ -100,10 +123,14 @@ async function checkCreditBalance(
 async function checkStaticCaps(
   deps: LimitDependencies,
   input: LimitCheckInput,
-  externallyBilled: boolean,
+  funding: { fundedWithoutCredits: boolean; countsTowardTokenCap: boolean },
 ): Promise<LimitDecision> {
   const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !externallyBilled) {
+  if (
+    limits.maxMonthlyCostMicrosPerAccount &&
+    isCostlyAction(input.action) &&
+    !funding.fundedWithoutCredits
+  ) {
     const used = await sumUsageQuantity(deps.db, {
       accountId: input.accountId,
       eventType: "model.cost",
@@ -130,10 +157,12 @@ async function checkStaticCaps(
           );
     }
     case "api_key:create": {
-      if (!limits.maxApiKeysPerWorkspace || !input.workspaceId) {
+      if (!limits.maxApiKeysPerWorkspace) {
         return { allowed: true };
       }
-      const count = await countActiveApiKeysForWorkspace(deps.db, input.workspaceId);
+      const count = input.workspaceId
+        ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId)
+        : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
       return count < limits.maxApiKeysPerWorkspace
         ? { allowed: true }
         : blocked(
@@ -182,7 +211,11 @@ async function checkStaticCaps(
           );
     }
     case "tokens:consume": {
-      if (externallyBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+      if (
+        !funding.countsTowardTokenCap ||
+        !limits.maxMonthlyTokensPerWorkspace ||
+        !input.workspaceId
+      ) {
         return { allowed: true };
       }
       const used = await sumUsageQuantity(deps.db, {