@opengeni/core 3.0.1 → 3.1.2

package/dist/application/modal-native-worker-host-transport.d.ts

@@ -0,0 +1,297 @@
+import type { Settings } from "@opengeni/config";
+import { z } from "zod";
+declare const intent: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    protocol: z.ZodLiteral<"opengeni-modal-native-worker-host-proof">;
+    version: z.ZodLiteral<2>;
+    principalKind: z.ZodLiteral<"worker_host">;
+    purpose: z.ZodLiteral<"original-native-custody-proof">;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    requestId: z.ZodString;
+    action: z.ZodLiteral<"declare_preparation">;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<"opengeni-modal-native-worker-host-proof">;
+    version: z.ZodLiteral<2>;
+    principalKind: z.ZodLiteral<"worker_host">;
+    purpose: z.ZodLiteral<"original-native-custody-proof">;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    requestId: z.ZodString;
+    action: z.ZodLiteral<"claim_namespace_read">;
+    recordRevision: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<"opengeni-modal-native-worker-host-proof">;
+    version: z.ZodLiteral<2>;
+    principalKind: z.ZodLiteral<"worker_host">;
+    purpose: z.ZodLiteral<"original-native-custody-proof">;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    requestId: z.ZodString;
+    action: z.ZodLiteral<"claim_original_command_read">;
+    recordRevision: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<"opengeni-modal-native-worker-host-proof">;
+    version: z.ZodLiteral<2>;
+    principalKind: z.ZodLiteral<"worker_host">;
+    purpose: z.ZodLiteral<"original-native-custody-proof">;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    requestId: z.ZodString;
+    action: z.ZodLiteral<"capture_namespace_binding">;
+    acquisition: z.ZodObject<{
+        claimId: z.ZodString;
+        nonce: z.ZodString;
+        claimRevision: z.ZodNumber;
+        recordRevision: z.ZodNumber;
+        captureId: z.ZodString;
+        acquisitionId: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<"opengeni-modal-native-worker-host-proof">;
+    version: z.ZodLiteral<2>;
+    principalKind: z.ZodLiteral<"worker_host">;
+    purpose: z.ZodLiteral<"original-native-custody-proof">;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    requestId: z.ZodString;
+    action: z.ZodLiteral<"capture_original_page">;
+    acquisition: z.ZodObject<{
+        claimId: z.ZodString;
+        nonce: z.ZodString;
+        claimRevision: z.ZodNumber;
+        recordRevision: z.ZodNumber;
+        captureId: z.ZodString;
+        acquisitionId: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<"opengeni-modal-native-worker-host-proof">;
+    version: z.ZodLiteral<2>;
+    principalKind: z.ZodLiteral<"worker_host">;
+    purpose: z.ZodLiteral<"original-native-custody-proof">;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    requestId: z.ZodString;
+    action: z.ZodLiteral<"reconcile_same_capture">;
+    acquisition: z.ZodObject<{
+        claimId: z.ZodString;
+        nonce: z.ZodString;
+        claimRevision: z.ZodNumber;
+        recordRevision: z.ZodNumber;
+        captureId: z.ZodString;
+        acquisitionId: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<"opengeni-modal-native-worker-host-proof">;
+    version: z.ZodLiteral<2>;
+    principalKind: z.ZodLiteral<"worker_host">;
+    purpose: z.ZodLiteral<"original-native-custody-proof">;
+    scope: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        declarationId: z.ZodString;
+        planId: z.ZodString;
+        creatorId: z.ZodString;
+        accountId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        attemptId: z.ZodString;
+        executionGeneration: z.ZodNumber;
+        triggerEventId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        routeKind: z.ZodLiteral<"home">;
+        routeTargetId: z.ZodNull;
+        routeEpoch: z.ZodNumber;
+    }, z.core.$strict>;
+    configurationCaptureRef: z.ZodObject<{
+        id: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>;
+    proofGrantRef: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+    }, z.core.$strict>;
+    requestId: z.ZodString;
+    action: z.ZodLiteral<"settle_original_acquisition">;
+    acquisition: z.ZodObject<{
+        claimId: z.ZodString;
+        nonce: z.ZodString;
+        claimRevision: z.ZodNumber;
+        recordRevision: z.ZodNumber;
+        captureId: z.ZodString;
+        acquisitionId: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>], "action">;
+declare const timing: z.ZodObject<{
+    bodySha256: z.ZodString;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>;
+type Intent = z.infer<typeof intent>;
+export type NativeWorkerHostTransportDescriptionV2 = Intent & z.infer<typeof timing>;
+declare const transportBrand: unique symbol;
+export type NativeWorkerHostTransport = Readonly<{
+    [transportBrand]: true;
+}>;
+declare const verifiedBrand: unique symbol;
+export type VerifiedNativeWorkerHostTransport = Readonly<{
+    [verifiedBrand]: true;
+}>;
+/** Host startup only. Deliberately DOES NOT call resolveFirstPartyDelegationSecret:
+ * neither configured access-key substitution nor the public local/test fallback
+ * can select this new purpose root. Missing explicit deployment secret is OFF.
+ * No variable lookup, provider request, config mutation or persistence occurs. */
+export declare function configuredNativeWorkerHostTransport(settings: Pick<Settings, "delegationSecret">): NativeWorkerHostTransport | null;
+/** Release only this transport's derived-key copy, not a config/grant/custody
+ * lifecycle or observation slot. Outstanding native I/O needs its own join. */
+export declare function disposeNativeWorkerHostTransport(transport: NativeWorkerHostTransport): void;
+/** Private worker/core transport serialization. The caller MUST first establish
+ * canonical original-host admission. This helper cannot establish that admission
+ * and is intentionally not exported from the core package's public entrypoints. */
+export declare function signNativeWorkerHostTransport(transport: NativeWorkerHostTransport, input: Intent, body: Uint8Array, nowSeconds?: number): string;
+/** Only host transport authenticity is verified. A later narrow authorizer must
+ * independently source-join original live/maintenance authority, configuration,
+ * grant, claim, acquisition, body fields/cursors and exact action-specific CAS. */
+export declare function verifyNativeWorkerHostTransport(transport: NativeWorkerHostTransport, envelope: string, body: Uint8Array, nowSeconds?: number): VerifiedNativeWorkerHostTransport | null;
+/** Request-local inspection of a previously verified MAC, NOT current admission.
+ * The narrow host authorizer must still recheck expiry and current authority/CAS.
+ * Copying a description, token or ref cannot mint grant or native-I/O authority. */
+export declare function nativeWorkerHostTransportDescription(transport: NativeWorkerHostTransport, proof: VerifiedNativeWorkerHostTransport): NativeWorkerHostTransportDescriptionV2;
+export {};

package/dist/application/new-session-drafts.d.ts

@@ -1,9 +1,25 @@
 import { type AccessGrant, type NewSessionDraft as NewSessionDraftValue } from "@opengeni/contracts";
 import type { AppDependencies } from "../dependencies.js";
 import { type AccessGrantAuthorization } from "../access/index.js";
+import { type Settings } from "@opengeni/config";
 type NewSessionDraftDependencies = Pick<AppDependencies, "settings" | "db" | "objectStorage">;
+/**
+ * Whether a stored draft's model policy was the person's choice. A row written
+ * before the marker existed (or by an older client) counts as a choice unless
+ * it is exactly the deployment default policy (model, reasoning, standard
+ * speed), which is what an untouched composer used to save.
+ */
+export declare function draftModelProvided(settings: Settings, draft: Pick<NewSessionDraftValue, "model" | "reasoningEffort" | "latencyMode" | "modelProvided">): boolean;
+type NewSessionDraftReadOptions = {
+    /**
+     * Project a draft that follows the default onto today's resolved default.
+     * Callers that only reuse a chosen model (Slack defaults) skip the
+     * resolution; session creation resolves the default itself.
+     */
+    projectDefaultModel?: boolean;
+};
 /** Read the authenticated actor's server-authoritative pre-session composer state. */
-declare function getActorNewSessionDraftInFileScope(deps: Pick<NewSessionDraftDependencies, "settings" | "db">, grant: AccessGrant, workspaceId: string): Promise<NewSessionDraftValue>;
+declare function getActorNewSessionDraftInFileScope(deps: Pick<NewSessionDraftDependencies, "settings" | "db">, grant: AccessGrant, workspaceId: string, readOptions?: NewSessionDraftReadOptions): Promise<NewSessionDraftValue>;
 /**
  * Validate and save one exact actor-private draft revision. Create-time-only
  * checks (live machine target, rig/variable-set state, and permission
@@ -19,6 +35,17 @@ declare function saveActorNewSessionDraftInFileScope(deps: NewSessionDraftDepend
  * the historical bare-membership fence.
  */
 canonicalManagedHumanSession?: boolean, externalAuthorization?: AccessGrantAuthorization): Promise<NewSessionDraftValue>;
-export declare function getActorNewSessionDraft(deps: Parameters<typeof getActorNewSessionDraftInFileScope>[0], grant: AccessGrant, workspaceId: string, authorization?: AccessGrantAuthorization): Promise<NewSessionDraftValue>;
+export declare function getActorNewSessionDraft(deps: Parameters<typeof getActorNewSessionDraftInFileScope>[0], grant: AccessGrant, workspaceId: string, authorization?: AccessGrantAuthorization, readOptions?: NewSessionDraftReadOptions): Promise<NewSessionDraftValue>;
 export declare function saveActorNewSessionDraft(...args: Parameters<typeof saveActorNewSessionDraftInFileScope>): Promise<NewSessionDraftValue>;
+/**
+ * The model policy the person explicitly chose in the website composer, or an
+ * empty object when their draft follows the default.
+ *
+ * Only the model policy is reused. Connectors, repositories, Variable Sets,
+ * Sandbox Environment and compute target in the draft are the person's last
+ * explicit narrowing of one website chat, so surfaces that start work without
+ * the composer (Slack) resolve those from workspace defaults instead of
+ * silently inheriting that narrowing.
+ */
+export declare function getActorNewSessionModelChoice(deps: Parameters<typeof getActorNewSessionDraft>[0], grant: AccessGrant, workspaceId: string): Promise<Pick<NewSessionDraftValue, "model" | "reasoningEffort" | "latencyMode"> | Record<string, never>>;
 export {};

package/dist/application/organization-privacy.d.ts

@@ -0,0 +1,57 @@
+import type { Settings } from "@opengeni/config";
+import type { OrganizationPrivacySettings, UpdateOrganizationPrivacySettingsRequest } from "@opengeni/contracts";
+import { type Database, type OrganizationPrivacyPreferences } from "@opengeni/db";
+/**
+ * Privacy: who can see chats, schedules and their runs. An organization's
+ * owners and admins choose whether Only me is allowed (the private session
+ * setting), the default audience for new chats and schedules, and whether
+ * admins see that other people's Only me schedules exist. A deployment, such
+ * as a product that embeds Opengeni, can only narrow those choices. See
+ * docs/design/privacy-audiences-2026-10-11.md.
+ */
+export type PrivacySettings = Pick<Settings, "privacyOnlyMeAllowed" | "privacyWorkspaceDefaultRequired" | "privacyAdminScheduleSummariesRequired">;
+export type PrivacyDeploymentLimits = OrganizationPrivacySettings["limits"];
+export declare function privacyDeploymentLimits(settings: PrivacySettings): PrivacyDeploymentLimits;
+export type EffectiveOrganizationPrivacy = {
+    defaultVisibility: "private" | "workspace";
+    adminsSeePrivateSchedules: boolean;
+};
+/** The organization's choices with the deployment's limits applied. */
+export declare function effectiveOrganizationPrivacy(preferences: Pick<OrganizationPrivacyPreferences, "defaultVisibility" | "adminsSeePrivateSchedules">, limits: PrivacyDeploymentLimits): EffectiveOrganizationPrivacy;
+export declare function resolveOrganizationPrivacy(deps: {
+    db: Database;
+    settings: PrivacySettings;
+}, accountId: string): Promise<EffectiveOrganizationPrivacy>;
+/**
+ * Refuse a new Only me chat or schedule in a shared workspace when this
+ * deployment turns Only me off. A Personal workspace is only ever its owner's,
+ * so it is unaffected. Existing Only me items keep their audience: narrowing
+ * is always allowed, widening never happens silently.
+ */
+export declare function requireDeploymentAllowsOnlyMe(deps: {
+    db: Database;
+    settings: PrivacySettings;
+}, input: {
+    workspaceId: string;
+    actorSubjectId: string;
+}): Promise<void>;
+/** Raised when a change would go past what this deployment allows. */
+export declare class OrganizationPrivacyLockedError extends Error {
+    readonly name = "OrganizationPrivacyLockedError";
+}
+export declare function getOrganizationPrivacySettings(deps: {
+    db: Database;
+    settings: PrivacySettings;
+}, organizationId: string): Promise<OrganizationPrivacySettings>;
+/**
+ * Change the organization's privacy choices. Only an owner or admin may, and
+ * never past the deployment's limits.
+ */
+export declare function updateOrganizationPrivacySettings(deps: {
+    db: Database;
+    settings: PrivacySettings;
+}, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    request: UpdateOrganizationPrivacySettingsRequest;
+}): Promise<OrganizationPrivacySettings>;

package/dist/application/prepared-mcp-connection.d.ts

@@ -0,0 +1,31 @@
+import { type AccessGrant, type ConnectionMetadata } from "@opengeni/contracts";
+import type { ConnectOwnership, PreparedMcpSetup } from "@opengeni/contracts/connect";
+import type { Settings } from "@opengeni/config";
+import { type Database } from "@opengeni/db";
+import { type McpCapabilityProbe } from "../domain/capabilities.js";
+/** Initialize/list tools before committing anything. Secret headers stay in this
+ * invocation; the installation contains only an ordinary native connection ref.
+ * The caller commits the connection and this installation in one authorized
+ * Connect operation, so retries cannot leave an orphan credential or catalog. */
+export declare function prepareMcpConnectionActivation(input: {
+    grant: AccessGrant;
+    settings: Settings;
+    setup: PreparedMcpSetup;
+    ownership: ConnectOwnership;
+    headers: Record<string, string>;
+    probe?: McpCapabilityProbe;
+}): Promise<{
+    capabilityId: string;
+    commit: (db: Database, connection: ConnectionMetadata) => Promise<{
+        id: string;
+        accountId: string;
+        workspaceId: string;
+        capabilityId: string;
+        kind: "api" | "mcp" | "plugin" | "skill";
+        status: "active" | "disabled";
+        config: Record<string, unknown>;
+        metadata: Record<string, unknown>;
+        enabledAt: string;
+        updatedAt: string;
+    }>;
+}>;

package/dist/application/sandbox-recovery.d.ts

@@ -0,0 +1,58 @@
+import type { SandboxRecoveryRequest } from "@opengeni/contracts";
+import { type AccessGrantAuthorization } from "../access/index.js";
+import type { AppDependencies } from "../dependencies.js";
+type Dependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
+/** The read-only projection also serves the exact built-in local human. Its
+ * provenance stamp is set only by the local resolver, never a bearer claim. */
+export declare function requireSandboxRecoveryPreviewHuman(authorization: AccessGrantAuthorization, workspaceId: string): void;
+export declare function getManagedHumanSandboxRecovery(deps: Dependencies, authorization: AccessGrantAuthorization, workspaceId: string, sessionId: string): Promise<{
+    version: 1;
+    status: "blocked" | "consent_accepted" | "eligible" | "restored" | "restoring" | "unsupported";
+    reason: string | null;
+    checkpoint: {
+        version: 1;
+        sessionId: string;
+        sandboxGroupId: string;
+        leaseId: string;
+        routeEpoch: number;
+        authorityEpoch: number;
+        leaseEpoch: number;
+        workspaceGeneration: number;
+        archiveGeneration: number;
+        artifactId: string;
+        revision: string;
+        capturedAt: string;
+    } | null;
+    operationId: string | null;
+    automaticAvailable?: boolean | undefined;
+    automaticLane?: "checkpoint" | "fresh_workspace" | undefined;
+    availableAt?: string | undefined;
+}>;
+export declare function consentManagedHumanSandboxRecovery(deps: Dependencies, authorization: AccessGrantAuthorization, workspaceId: string, sessionId: string, request: SandboxRecoveryRequest): Promise<{
+    outcome: "accepted" | "replayed";
+    operationId: string;
+    recovery: {
+        version: 1;
+        status: "blocked" | "consent_accepted" | "eligible" | "restored" | "restoring" | "unsupported";
+        reason: string | null;
+        checkpoint: {
+            version: 1;
+            sessionId: string;
+            sandboxGroupId: string;
+            leaseId: string;
+            routeEpoch: number;
+            authorityEpoch: number;
+            leaseEpoch: number;
+            workspaceGeneration: number;
+            archiveGeneration: number;
+            artifactId: string;
+            revision: string;
+            capturedAt: string;
+        } | null;
+        operationId: string | null;
+        automaticAvailable?: boolean | undefined;
+        automaticLane?: "checkpoint" | "fresh_workspace" | undefined;
+        availableAt?: string | undefined;
+    };
+}>;
+export {};

package/dist/application/session-commands.d.ts

@@ -1,4 +1,5 @@
 import type { ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, MoveSessionQueueItemRequest, SaveComposerDraftRequest, SessionAuthorizationPort, SessionAuthorizationSurface, SessionControlRequest, SessionControlResponse, SessionQueueMutationResponse, SteerSessionQueueItemRequest, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse } from "@opengeni/contracts";
+import type { Settings } from "@opengeni/config";
 import { type Database, type SessionCommandReceiptRow } from "@opengeni/db";
 import { type EventBus } from "@opengeni/events";
 import type { SessionWorkflowClient } from "../dependencies.js";
@@ -37,6 +38,7 @@ type SessionCommandPostCommitDeps = {
 };
 export declare function sendAgentSessionMessage(deps: {
     db: Database;
+    settings?: Settings;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     sessionAuthorization?: SessionAuthorizationPort | null;
@@ -47,6 +49,7 @@ export declare function sendAgentSessionMessage(deps: {
 }): Promise<import("@opengeni/db").AgentInternalUpdateCommandResult>;
 export declare function steerAgentSession(deps: {
     db: Database;
+    settings?: Settings;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
     sessionAuthorization?: SessionAuthorizationPort | null;

package/dist/application/session-tenancy.d.ts

@@ -1,7 +1,10 @@
-import { ForkSessionResponse, SessionTenancyCreateCapabilities, UpdateSessionVisibilityResponse, type ForkSessionRequest, type SessionAuthorizationSurface, type UpdateSessionVisibilityRequest } from "@opengeni/contracts";
+import { ForkSessionResponse, SessionVisibilityChangePreview, SessionTenancyCreateCapabilities, UpdateSessionVisibilityResponse, type ForkSessionRequest, type SessionAuthorizationSurface, type SessionVisibility, type UpdateSessionVisibilityRequest } from "@opengeni/contracts";
 import { type AccessGrantAuthorization } from "../access/index.js";
 import type { AppDependencies } from "../dependencies.js";
 type SessionTenancyDependencies = Pick<AppDependencies, "db" | "bus" | "sessionAuthorization" | "settings">;
+type SessionVisibilityDependencies = SessionTenancyDependencies & {
+    workflowClient: Pick<AppDependencies["workflowClient"], "wakeSessionWorkflow">;
+};
 export declare class SessionTenancyManagedHumanRequiredError extends Error {
     readonly name = "SessionTenancyManagedHumanRequiredError";
     constructor();
@@ -12,8 +15,14 @@ export declare class SessionTenancyPersistenceOutcomeUnknownError extends Error
 }
 export declare function requireCanonicalManagedHuman(authorization: AccessGrantAuthorization, workspaceId: string): void;
 export declare function requireVerifiedOwningUser(authorization: AccessGrantAuthorization, workspaceId: string): void;
-export declare function getManagedHumanSessionCreateCapabilities(deps: Pick<SessionTenancyDependencies, "db">, authorization: AccessGrantAuthorization, workspaceId: string): Promise<SessionTenancyCreateCapabilities>;
-export declare function requireManagedHumanPrivateSessionCreate(deps: Pick<SessionTenancyDependencies, "db">, authorization: AccessGrantAuthorization, workspaceId: string): Promise<void>;
-export declare function updateManagedHumanSessionVisibility(deps: SessionTenancyDependencies, authorization: AccessGrantAuthorization, workspaceId: string, sessionId: string, request: UpdateSessionVisibilityRequest, authorizationSurface?: SessionAuthorizationSurface): Promise<UpdateSessionVisibilityResponse>;
+export declare function getManagedHumanSessionCreateCapabilities(deps: Pick<SessionTenancyDependencies, "db" | "settings">, authorization: AccessGrantAuthorization, workspaceId: string): Promise<SessionTenancyCreateCapabilities>;
+export declare function requireManagedHumanPrivateSessionCreate(deps: Pick<SessionTenancyDependencies, "db" | "settings">, authorization: AccessGrantAuthorization, workspaceId: string): Promise<void>;
+export declare function updateManagedHumanSessionVisibility(deps: SessionVisibilityDependencies, authorization: AccessGrantAuthorization, workspaceId: string, sessionId: string, request: UpdateSessionVisibilityRequest, authorizationSurface?: SessionAuthorizationSurface): Promise<UpdateSessionVisibilityResponse>;
+/**
+ * Owner-only preview for the audience dialog: what a change to `visibility`
+ * would stop, and what would still refuse it. Same gates as the change itself,
+ * so a non-owner learns nothing a refused change would not tell them.
+ */
+export declare function previewManagedHumanSessionVisibilityChange(deps: SessionTenancyDependencies, authorization: AccessGrantAuthorization, workspaceId: string, sessionId: string, targetVisibility: SessionVisibility, authorizationSurface?: SessionAuthorizationSurface): Promise<SessionVisibilityChangePreview>;
 export declare function forkManagedHumanSession(deps: SessionTenancyDependencies, authorization: AccessGrantAuthorization, workspaceId: string, sourceSessionId: string, request: ForkSessionRequest, authorizationSurface?: SessionAuthorizationSurface): Promise<ForkSessionResponse>;
 export {};

package/dist/billing/agent-run-admission.d.ts

@@ -0,0 +1,21 @@
+import { type Settings } from "@opengeni/config";
+import type { EntitlementsPort } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+export type AgentRunAdmissionDenial = "insufficient_credits" | "allowance_exhausted" | "monthly_model_cost_limit" | "monthly_agent_run_limit";
+/** Read-only admission shared by service-authored runs and goal Resume. */
+export declare function agentRunAdmissionDenial(services: {
+    db: Database;
+    settings: Settings;
+    entitlements?: EntitlementsPort | null;
+}, input: {
+    accountId: string;
+    workspaceId: string;
+    model: string;
+    requestedAgentRuns: number;
+    /** The accepted work's causal human, not the scheduler/service caller. */
+    initiatingHumanSubjectId?: string | null;
+    acceptedTurn?: {
+        sessionId: string;
+        turnId: string;
+    };
+}): Promise<AgentRunAdmissionDenial | null>;

package/dist/billing/limits.d.ts

@@ -2,17 +2,43 @@ import { type Settings } from "@opengeni/config";
 import type { LimitAction, LimitDecision, SessionTurnSource, TurnInitiator, TurnInitiatorContext } from "@opengeni/contracts";
 import type { ApiRouteDeps } from "../dependencies.js";
 export type LimitDependencies = Pick<ApiRouteDeps, "db" | "settings">;
+/** Deterministic/local embeddings never debit credits, even in paid mode. */
+export declare function paidDocumentEmbedding(settings: Settings): boolean;
+/** Round up each provider request so a positive input cannot become a free debit. */
+export declare function documentEmbeddingCostMicros(settings: Settings, inputBytes: number): number;
 export type LimitCheckInput = {
     accountId: string;
     workspaceId?: string;
+    /** Frozen causal human, never the API key or service admitting the work. */
+    initiatingHumanSubjectId?: string | null;
+    acceptedTurn?: {
+        sessionId: string;
+        turnId: string;
+    };
     action: LimitAction;
     quantity?: number;
     model?: string | null;
 };
-export declare function modelFundingForAdmission(settings: Settings, model: string | null | undefined, codexBilled: boolean): {
+export declare function modelFundingForAdmission(settings: Settings, model: string | null | undefined, codexBilled: boolean, 
+/**
+ * The shared core's live funding answer for a connected subscription that
+ * has cut over to the core (`coreRoutedSubscriptionFunding`); undefined
+ * keeps the legacy answer.
+ */
+coreRoutedFunding?: boolean): {
     fundedWithoutCredits: boolean;
     countsTowardTokenCap: boolean;
 };
+export declare function coreRoutedSubscriptionFunding(db: LimitDependencies["db"], settings: Settings, input: {
+    accountId: string;
+    workspaceId: string;
+    model: string | null | undefined;
+    subjectId: string | null;
+    acceptedTurn?: {
+        sessionId: string;
+        turnId: string;
+    };
+}): Promise<boolean | undefined>;
 export declare function requireLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<void>;
 export declare function checkLimit(deps: LimitDependencies, input: LimitCheckInput): Promise<LimitDecision>;
 export declare function recordWorkspaceUsage(deps: LimitDependencies, input: {

package/dist/billing/model-call-admission.d.ts

@@ -0,0 +1,34 @@
+import { type Settings } from "@opengeni/config";
+import type { EntitlementsPort } from "@opengeni/contracts";
+import { type Database } from "@opengeni/db";
+export type ModelCallAdmissionDenial = "insufficient_credits" | "allowance_exhausted" | "monthly_model_cost_limit" | "monthly_token_limit";
+export type ModelCallAdmission = {
+    allowed: true;
+    creditPolicyRevision: number | undefined;
+} | {
+    allowed: false;
+    denial: ModelCallAdmissionDenial;
+    message: string;
+};
+/**
+ * Admission for one stateless model call, with the same funding rules as an
+ * agent turn between model calls: an Opengeni-credit model needs a positive
+ * spendable balance, the workspace allowance must not be exhausted, and the
+ * static monthly caps apply. Admission is a read, never a reservation or an
+ * estimate of the call's cost; settlement charges actual usage afterwards.
+ * Externally funded calls (subscriptions, workspace or organization keys)
+ * skip the credit gate and the token cap.
+ */
+export declare function admitModelCall(services: {
+    db: Database;
+    settings: Settings;
+    entitlements?: EntitlementsPort | null;
+}, input: {
+    accountId: string;
+    workspaceId: string;
+    /** Canonical product model id; scopes model-specific promotional credits. */
+    model: string;
+    chargesOpenGeniCredits: boolean;
+    countsTowardTokenCap: boolean;
+    subjectId: string | null;
+}): Promise<ModelCallAdmission>;