@opengeni/core 2.6.3-canary.0 → 2.6.4-canary.0

package/dist/model-catalog.d.ts

@@ -0,0 +1,89 @@
+import { type ConfiguredModel, type Settings } from "@opengeni/config";
+import { type ModelAvailabilityV1, type ModelCredentialReadinessV1, type WorkspaceModelPolicyContract } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+export type ResolvedCatalogSettings = {
+    settings: Settings;
+    source: "code" | "database";
+    version: number | null;
+    modelNotes: Record<string, string>;
+};
+/**
+ * Curated workspace Gateway products and workspace-owned custom slugs share
+ * one public prefix. Only the latter have a mutable catalog row whose active
+ * generation must be rechecked at a fresh acceptance commit boundary.
+ */
+export declare function isWorkspaceGatewayCustomModelId(settings: Settings, modelId: string): boolean;
+export declare function isWorkspaceOpenRouterCustomModelId(settings: Settings, modelId: string): boolean;
+export type WorkspaceCustomModelReference = {
+    providerKind: "vercel_gateway" | "openrouter";
+    upstreamModelId: string;
+};
+export declare function workspaceCustomModelReference(settings: Settings, modelId: string): WorkspaceCustomModelReference | null;
+export declare function isWorkspaceCustomModelId(settings: Settings, modelId: string): boolean;
+/**
+ * Resolve the deployment catalog without making synchronous env settings read
+ * Postgres. Database mode fails closed when the singleton is absent or invalid;
+ * code mode preserves the already-validated env catalog.
+ */
+export declare function resolveCatalogSettings(db: Database, envSettings: Settings): Promise<ResolvedCatalogSettings>;
+/**
+ * Resolve the deployment catalog and add only the custom Gateway slugs owned by
+ * one workspace. Use this at model-bearing workspace boundaries; public config
+ * and deployment-operator surfaces must continue to use `resolveCatalogSettings`.
+ */
+export declare function resolveWorkspaceCatalogSettings(db: Database, envSettings: Settings, input: {
+    accountId: string;
+    workspaceId: string;
+    retainedProductModelId?: string | null;
+    retainedProductModelIds?: readonly (string | null | undefined)[];
+}): Promise<ResolvedCatalogSettings>;
+export type ModelAvailabilityObservation = {
+    status: "available" | "degraded" | "unavailable";
+    reason: "not_entitled" | "provider_unhealthy" | null;
+    checkedAt: string;
+};
+export type ModelCredentialReadinessObservation = {
+    status: "ready";
+    checkedAt: string;
+} | {
+    status: "not_ready";
+    reason: "prerequisites_missing" | "needs_reauth";
+    checkedAt: string;
+} | {
+    status: "error";
+    reason: "resolver_error";
+    checkedAt: string;
+};
+export declare const MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS: number;
+export type WorkspaceModelSelectionInput = {
+    settings: Settings;
+    policy: WorkspaceModelPolicyContract | null;
+    codexSubscriptionActive: boolean;
+    xaiSubscriptionActive?: boolean;
+    workspaceGatewayConnectionActive?: boolean;
+    workspaceOpenRouterConnectionActive?: boolean;
+    workspaceGatewayCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    workspaceOpenRouterCustomModels?: readonly {
+        upstreamModelId: string;
+        label?: string | null;
+    }[];
+    credentialReadinessObservations?: Readonly<Record<string, ModelCredentialReadinessObservation>> | undefined;
+    observations?: Readonly<Record<string, ModelAvailabilityObservation>> | undefined;
+    now?: Date | undefined;
+    credentialReadinessMaxAgeMs?: number | undefined;
+};
+export type WorkspaceModelSelection = {
+    model: ConfiguredModel;
+    credentialReadiness: ModelCredentialReadinessV1;
+    policyAllowed: boolean;
+    availability: ModelAvailabilityV1;
+};
+/**
+ * One shared picker/tool decision. Catalog membership, credential readiness,
+ * workspace policy, and optional provider-health observations are evaluated in
+ * configured catalog order so every consumer exposes the same selectable set.
+ */
+export declare function resolveWorkspaceModelSelection(input: WorkspaceModelSelectionInput): WorkspaceModelSelection[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.6.3-canary.0",
+  "version": "2.6.4-canary.0",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -54,15 +54,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.20-canary.0",
-    "@opengeni/config": "^0.22.5-canary.0",
-    "@opengeni/contracts": "^2.9.2-canary.0",
-    "@opengeni/db": "^3.7.3-canary.0",
-    "@opengeni/documents": "^0.8.13-canary.0",
-    "@opengeni/events": "^0.4.11-canary.0",
-    "@opengeni/observability": "^0.8.14-canary.0",
-    "@opengeni/runtime": "^2.0.1-canary.0",
-    "@opengeni/storage": "^0.2.115-canary.0",
+    "@opengeni/codex": "^0.2.20-canary.1",
+    "@opengeni/config": "^0.22.5-canary.1",
+    "@opengeni/contracts": "^2.9.2-canary.1",
+    "@opengeni/db": "^3.7.4-canary.0",
+    "@opengeni/documents": "^0.8.14-canary.0",
+    "@opengeni/events": "^0.4.12-canary.0",
+    "@opengeni/observability": "^0.8.14-canary.1",
+    "@opengeni/runtime": "^2.0.1-canary.1",
+    "@opengeni/storage": "^0.2.115-canary.1",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/billing/limits.ts

@@ -1,4 +1,8 @@
-import { configuredStaticUsageLimits, resolveModelProvider } from "@opengeni/config";
+import {
+  configuredStaticUsageLimits,
+  resolveModelProviderForTurn,
+  type Settings,
+} from "@opengeni/config";
 import type {
   LimitAction,
   LimitDecision,
@@ -26,14 +30,35 @@ export type LimitCheckInput = {
   workspaceId?: string;
   action: LimitAction;
   quantity?: number;
-  // The turn's model id, when the action represents an agent turn. Externally
-  // billed models consume ZERO OpenGeni credits, so the credit-balance +
-  // model-cost + token gates are skipped. Connected subscriptions still require
-  // live workspace readiness; an explicitly anonymous deployment route is
-  // statically ready by definition. Non-model infra actions leave this undefined.
+  // The turn's model id, when the action represents an agent turn. The model's
+  // deployment cost controls credit/cost gates; upstream metering independently
+  // controls the token cap. Connected subscriptions still require live workspace
+  // readiness. Non-model infra actions leave this undefined.
   model?: string | null;
 };
 
+export function modelFundingForAdmission(
+  settings: Settings,
+  model: string | null | undefined,
+  codexBilled: boolean,
+): { fundedWithoutCredits: boolean; countsTowardTokenCap: boolean } {
+  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
+  const codexSubscriptionModel =
+    resolvedModel?.credentialSource.kind === "connected_subscription" &&
+    resolvedModel.credentialSource.provider === "codex";
+  return {
+    // A Codex namespace/definition never bypasses credits by itself: the live
+    // workspace credential predicate above remains authoritative. SuperGrok's
+    // static overlay is likewise secret-free; its worker/provider admission
+    // owns live account selection before any upstream request can occur.
+    fundedWithoutCredits:
+      codexBilled ||
+      (resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits"),
+    countsTowardTokenCap:
+      !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment",
+  };
+}
+
 export async function requireLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<void> {
   const decision = await checkLimit(deps, input);
   if (decision.allowed) {
@@ -59,25 +84,22 @@ export async function checkLimit(
         model: input.model,
       })
     : false;
-  const credentialFreeExternal = input.model
-    ? (() => {
-        const resolved = resolveModelProvider(deps.settings, input.model);
-        return (
-          resolved?.model.billing.metering === "external" &&
-          resolved.model.credentialSource.kind === "deployment" &&
-          resolved.model.credentialSource.mechanism === "none"
-        );
-      })()
-    : false;
-  const externallyBilled = codexBilled || credentialFreeExternal;
-  const creditDecision = await checkCreditBalance(deps, input, externallyBilled);
+  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
+    deps.settings,
+    input.model,
+    codexBilled,
+  );
+  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
   if (!creditDecision.allowed) {
     return creditDecision;
   }
   if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
     return { allowed: true };
   }
-  return await checkStaticCaps(deps, input, externallyBilled);
+  return await checkStaticCaps(deps, input, {
+    fundedWithoutCredits,
+    countsTowardTokenCap,
+  });
 }
 
 async function checkCreditBalance(
@@ -101,10 +123,14 @@ async function checkCreditBalance(
 async function checkStaticCaps(
   deps: LimitDependencies,
   input: LimitCheckInput,
-  externallyBilled: boolean,
+  funding: { fundedWithoutCredits: boolean; countsTowardTokenCap: boolean },
 ): Promise<LimitDecision> {
   const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !externallyBilled) {
+  if (
+    limits.maxMonthlyCostMicrosPerAccount &&
+    isCostlyAction(input.action) &&
+    !funding.fundedWithoutCredits
+  ) {
     const used = await sumUsageQuantity(deps.db, {
       accountId: input.accountId,
       eventType: "model.cost",
@@ -185,7 +211,11 @@ async function checkStaticCaps(
           );
     }
     case "tokens:consume": {
-      if (externallyBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+      if (
+        !funding.countsTowardTokenCap ||
+        !limits.maxMonthlyTokensPerWorkspace ||
+        !input.workspaceId
+      ) {
         return { allowed: true };
       }
       const used = await sumUsageQuantity(deps.db, {

package/src/dependencies.ts

@@ -19,6 +19,7 @@ import type { ManagedAuthSessionAdapter } from "./managed-auth-session-sets";
 import type { ApiSandboxClient, ResumeBoxByIdInput, ResumedSandboxSession } from "./sandbox-types";
 import type { TranscriptionSegmenter, TranscriptionService } from "./transcription";
 import type { EditableArtifactApplicationPort } from "./editable-artifact-live";
+import type { ResolvedCatalogSettings } from "./model-catalog";
 import type {
   EditableArtifactAgentApplication,
   EditableArtifactDurableExportService,
@@ -129,6 +130,13 @@ export type ManagedEmailTransport = {
 
 export type AppDependencies = {
   settings: Settings;
+  /**
+   * Original deployment settings when `settings` is already overlaid with a
+   * deployment/workspace catalog snapshot. Model-bearing request adapters set
+   * this marker so core admission never feeds a synthetic reviewed provider
+   * back through deployment validation.
+   */
+  catalogSourceSettings?: Settings;
   db: Database;
   /**
    * Host-composed editable artifact engine. Standalone startup binds the same
@@ -225,6 +233,7 @@ export type AppDependencies = {
 export type ObjectStorageDependency = ReturnType<typeof createObjectStorage>;
 
 export type ApiRouteDeps = AppDependencies & {
+  resolveCatalogSettings: () => Promise<ResolvedCatalogSettings>;
   managedEmailTransport: ManagedEmailTransport;
   objectStorage: ObjectStorageDependency;
   githubStateSecret: string;
@@ -244,7 +253,12 @@ export type ApiRouteDeps = AppDependencies & {
  */
 export type AcceptSessionUserMessageDependencies = Pick<
   AppDependencies,
-  "settings" | "db" | "bus" | "sessionAuthorization" | "schedulePromptPostCommit"
+  | "settings"
+  | "catalogSourceSettings"
+  | "db"
+  | "bus"
+  | "sessionAuthorization"
+  | "schedulePromptPostCommit"
 > & {
   workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
   objectStorage: ObjectStorageDependency;

package/src/domain/scheduled-tasks.ts

@@ -34,6 +34,8 @@ import {
   getSandbox,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getSession,
+  lockActiveWorkspaceGatewayCustomModelForAdmission,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   nestedPostgresSqlState,
   requireWorkspace,
   scopedKnowledgeScopeKey,
@@ -54,6 +56,7 @@ import {
 } from "../session-authorization";
 import type { SessionWorkflowClient } from "../dependencies";
 import type { ObjectStorageDependency } from "../dependencies";
+import { workspaceCustomModelReference } from "../model-catalog";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
 import { validateVariableSetAttachment } from "./environments";
 import {
@@ -99,6 +102,35 @@ export function scheduledTaskToolsProvided(rawPayload: unknown): boolean {
   );
 }
 
+function workspaceCustomModelCommitGuard(input: {
+  settings: Settings;
+  accountId: string;
+  workspaceId: string;
+  modelId: string;
+}): ((tx: Database) => Promise<void>) | undefined {
+  const reference = workspaceCustomModelReference(input.settings, input.modelId);
+  if (!reference) return undefined;
+  return async (tx: Database): Promise<void> => {
+    const active =
+      reference.providerKind === "openrouter"
+        ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          })
+        : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            upstreamModelId: reference.upstreamModelId,
+          });
+    if (!active) {
+      throw new HTTPException(422, {
+        message: `model is not available: ${input.modelId}`,
+      });
+    }
+  };
+}
+
 export function scheduledConnectionSurfaceEligibility(
   settings: Settings,
   target: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions"> | null,
@@ -146,7 +178,7 @@ export async function createValidatedScheduledTask(input: {
       action: knowledgeAction,
     });
   }
-  const agentConfig = knowledgeAction
+  const agentConfig: ScheduledTaskAgentConfig = knowledgeAction
     ? input.payload.agentConfig
     : await validateScheduledTaskAgentConfig({
         ...input,
@@ -235,6 +267,15 @@ export async function createValidatedScheduledTask(input: {
           workspaceId: input.grant.workspaceId,
           subjectId: input.grant.subjectId,
         });
+  const beforeCreateCommit =
+    !knowledgeAction && input.payload.runMode !== "existing_session"
+      ? workspaceCustomModelCommitGuard({
+          settings: input.settings,
+          accountId: input.grant.accountId,
+          workspaceId: input.grant.workspaceId,
+          modelId: agentConfig.model ?? input.settings.openaiModel,
+        })
+      : undefined;
   return await withScheduledTaskAuthorityWriteErrors(() =>
     createScheduledTask(input.db, {
       id,
@@ -257,6 +298,7 @@ export async function createValidatedScheduledTask(input: {
       variableSetId: input.payload.variableSetId ?? null,
       rigId: input.payload.rigId ?? null,
       metadata: input.payload.metadata,
+      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
     }),
   );
 }
@@ -734,6 +776,15 @@ export async function validatedScheduledTaskUpdate(input: {
     (input.payload.metadata !== undefined &&
       !isDeepStrictEqual(input.payload.metadata, input.existing.metadata)) ||
     (input.existing.status === "paused" && input.payload.status === "active");
+  if (materialExecutionChange && nextRunMode !== "existing_session") {
+    const beforeUpdateCommit = workspaceCustomModelCommitGuard({
+      settings: input.settings,
+      accountId: input.existing.accountId,
+      workspaceId: input.existing.workspaceId,
+      modelId: nextAgentConfig.model ?? input.settings.openaiModel,
+    });
+    if (beforeUpdateCommit) update.beforeUpdateCommit = beforeUpdateCommit;
+  }
   const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
     input.db,
     input.existing.workspaceId,