@opengeni/core 3.0.1 → 3.1.2

package/src/application/modal-native-worker-host-transport.ts

@@ -0,0 +1,263 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { types } from "node:util";
+import type { Settings } from "@opengeni/config";
+import {
+  ModalNativeConfigurationCaptureRefV2,
+  ModalNativeOriginalScopeV2,
+  ModalNativeProofGrantRefV2,
+} from "@opengeni/contracts/modal-native-proof-v2";
+import { z } from "zod";
+
+// Private transport only. This module is not an ordinary access-token entry,
+// native acquisition issuer, custody authorizer, public registrar or effect CAS.
+// A successful MAC authenticates this host transport, NOT the named human,
+// live origin, grant, configuration, provider response or physical settlement.
+const PREFIX = "ogmnp2_";
+const SUBKEY_DOMAIN = "opengeni:modal-native-worker-host:transport:subkey:v2";
+const MESSAGE_DOMAIN = "opengeni:modal-native-worker-host:transport:message:v2\0";
+const TRANSPORT_TTL_SECONDS = 60;
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+const MAX_ENVELOPE_BYTES = 16_384;
+const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+const nativeByteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength")!.get!;
+const nativeByteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset")!.get!;
+const nativeBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer")!.get!;
+const uuid = z.string().uuid();
+const revision = z.number().int().positive().safe();
+const base = {
+  protocol: z.literal("opengeni-modal-native-worker-host-proof"),
+  version: z.literal(2),
+  principalKind: z.literal("worker_host"),
+  purpose: z.literal("original-native-custody-proof"),
+  scope: ModalNativeOriginalScopeV2,
+  configurationCaptureRef: ModalNativeConfigurationCaptureRefV2,
+  proofGrantRef: ModalNativeProofGrantRefV2,
+  requestId: uuid,
+};
+const acquisition = z
+  .object({
+    claimId: uuid,
+    nonce: uuid,
+    claimRevision: revision,
+    recordRevision: revision,
+    captureId: uuid,
+    acquisitionId: uuid,
+  })
+  .strict();
+const intent = z.discriminatedUnion("action", [
+  z.object({ ...base, action: z.literal("declare_preparation") }).strict(),
+  z
+    .object({ ...base, action: z.literal("claim_namespace_read"), recordRevision: revision })
+    .strict(),
+  z
+    .object({ ...base, action: z.literal("claim_original_command_read"), recordRevision: revision })
+    .strict(),
+  z.object({ ...base, action: z.literal("capture_namespace_binding"), acquisition }).strict(),
+  z.object({ ...base, action: z.literal("capture_original_page"), acquisition }).strict(),
+  z.object({ ...base, action: z.literal("reconcile_same_capture"), acquisition }).strict(),
+  z.object({ ...base, action: z.literal("settle_original_acquisition"), acquisition }).strict(),
+]);
+const timing = z
+  .object({
+    bodySha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    issuedAt: z.number().int().nonnegative().safe(),
+    expiresAt: z.number().int().positive().safe(),
+  })
+  .strict();
+type Intent = z.infer<typeof intent>;
+export type NativeWorkerHostTransportDescriptionV2 = Intent & z.infer<typeof timing>;
+
+declare const transportBrand: unique symbol;
+export type NativeWorkerHostTransport = Readonly<{ [transportBrand]: true }>;
+declare const verifiedBrand: unique symbol;
+export type VerifiedNativeWorkerHostTransport = Readonly<{ [verifiedBrand]: true }>;
+const transports = new WeakMap<NativeWorkerHostTransport, Buffer>();
+const verified = new WeakMap<
+  VerifiedNativeWorkerHostTransport,
+  {
+    transport: NativeWorkerHostTransport;
+    description: NativeWorkerHostTransportDescriptionV2;
+  }
+>();
+
+/** Inspect before schema parsing; getters/Proxies must not execute inside the
+ * signing boundary. This is JSON correlation, never an authority constructor. */
+function ownJson(value: unknown, depth = 0): void {
+  if (depth > 12) throw new Error("Unsupported native host transport input");
+  if (value === null || typeof value === "string" || typeof value === "boolean") return;
+  if (typeof value === "number" && Number.isFinite(value) && !Object.is(value, -0)) return;
+  if (typeof value !== "object" || types.isProxy(value))
+    throw new Error("Unsupported native host transport input");
+  const array = Array.isArray(value);
+  const prototype = Object.getPrototypeOf(value);
+  if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null)
+    throw new Error("Unsupported native host transport input");
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const keys = Reflect.ownKeys(descriptors).filter((key) => !(array && key === "length"));
+  if (array && keys.length !== (value as unknown[]).length)
+    throw new Error("Unsupported native host transport input");
+  for (const key of keys) {
+    if (typeof key !== "string" || (array && !/^(0|[1-9][0-9]*)$/u.test(key)))
+      throw new Error("Unsupported native host transport input");
+    const descriptor = descriptors[key]!;
+    if (!descriptor.enumerable || !("value" in descriptor))
+      throw new Error("Unsupported native host transport input");
+    ownJson(descriptor.value, depth + 1);
+  }
+}
+
+function bodyHash(body: Uint8Array): string {
+  if (types.isProxy(body) || !types.isUint8Array(body))
+    throw new Error("Unsupported native host transport body");
+  // Native getters ignore caller-owned byteLength/buffer/offset overrides. Reject
+  // shared backing storage: its bytes could change concurrently during the copy.
+  const length = nativeByteLength.call(body) as number;
+  const backing = nativeBuffer.call(body) as ArrayBuffer;
+  if (length > MAX_BODY_BYTES || !types.isArrayBuffer(backing))
+    throw new Error("Unsupported native host transport body");
+  const snapshot = new Uint8Array(length);
+  try {
+    snapshot.set(new Uint8Array(backing, nativeByteOffset.call(body) as number, length));
+    return createHash("sha256").update(snapshot).digest("hex");
+  } catch {
+    throw new Error("Unsupported native host transport body");
+  } finally {
+    snapshot.fill(0);
+  }
+}
+
+function keyFor(transport: NativeWorkerHostTransport): Buffer {
+  const key = transports.get(transport);
+  if (!key) throw new Error("Native host transport is unavailable");
+  return key;
+}
+
+function mac(key: Buffer, encoded: string): Buffer {
+  return createHmac("sha256", key).update(MESSAGE_DOMAIN).update(PREFIX).update(encoded).digest();
+}
+
+/** Host startup only. Deliberately DOES NOT call resolveFirstPartyDelegationSecret:
+ * neither configured access-key substitution nor the public local/test fallback
+ * can select this new purpose root. Missing explicit deployment secret is OFF.
+ * No variable lookup, provider request, config mutation or persistence occurs. */
+export function configuredNativeWorkerHostTransport(
+  settings: Pick<Settings, "delegationSecret">,
+): NativeWorkerHostTransport | null {
+  if (!settings || typeof settings !== "object" || types.isProxy(settings)) return null;
+  const descriptor = Object.getOwnPropertyDescriptor(settings, "delegationSecret");
+  if (!descriptor || !("value" in descriptor) || typeof descriptor.value !== "string") return null;
+  const secret = descriptor.value.trim();
+  if (!secret) return null;
+  const transient = Buffer.from(secret, "utf8");
+  try {
+    const key = createHmac("sha256", transient).update(SUBKEY_DOMAIN).digest();
+    const handle = Object.freeze(Object.create(null)) as NativeWorkerHostTransport;
+    transports.set(handle, key);
+    return handle;
+  } finally {
+    transient.fill(0);
+  }
+}
+
+/** Release only this transport's derived-key copy, not a config/grant/custody
+ * lifecycle or observation slot. Outstanding native I/O needs its own join. */
+export function disposeNativeWorkerHostTransport(transport: NativeWorkerHostTransport): void {
+  const key = transports.get(transport);
+  if (key) key.fill(0);
+  transports.delete(transport);
+}
+
+/** Private worker/core transport serialization. The caller MUST first establish
+ * canonical original-host admission. This helper cannot establish that admission
+ * and is intentionally not exported from the core package's public entrypoints. */
+export function signNativeWorkerHostTransport(
+  transport: NativeWorkerHostTransport,
+  input: Intent,
+  body: Uint8Array,
+  nowSeconds = Math.floor(Date.now() / 1000),
+): string {
+  const key = keyFor(transport);
+  ownJson(input);
+  const parsed = intent.safeParse(input);
+  const clock = z.number().int().nonnegative().safe().safeParse(nowSeconds);
+  if (!parsed.success || !clock.success) throw new Error("Unsupported native host transport input");
+  const timed = timing.safeParse({
+    bodySha256: bodyHash(body),
+    issuedAt: clock.data,
+    expiresAt: clock.data + TRANSPORT_TTL_SECONDS,
+  });
+  if (!timed.success) throw new Error("Unsupported native host transport input");
+  const description: NativeWorkerHostTransportDescriptionV2 = {
+    ...parsed.data,
+    ...timed.data,
+  };
+  const encoded = Buffer.from(JSON.stringify(description), "utf8").toString("base64url");
+  if (PREFIX.length + encoded.length + 1 + 43 > MAX_ENVELOPE_BYTES)
+    throw new Error("Unsupported native host transport input");
+  return `${PREFIX}${encoded}.${mac(key, encoded).toString("base64url")}`;
+}
+
+/** Only host transport authenticity is verified. A later narrow authorizer must
+ * independently source-join original live/maintenance authority, configuration,
+ * grant, claim, acquisition, body fields/cursors and exact action-specific CAS. */
+export function verifyNativeWorkerHostTransport(
+  transport: NativeWorkerHostTransport,
+  envelope: string,
+  body: Uint8Array,
+  nowSeconds = Math.floor(Date.now() / 1000),
+): VerifiedNativeWorkerHostTransport | null {
+  const key = keyFor(transport);
+  if (
+    typeof envelope !== "string" ||
+    envelope.length > MAX_ENVELOPE_BYTES ||
+    !envelope.startsWith(PREFIX)
+  )
+    return null;
+  const pieces = envelope.slice(PREFIX.length).split(".");
+  if (pieces.length !== 2) return null;
+  const [encoded, signature] = pieces as [string, string];
+  if (!/^[A-Za-z0-9_-]+$/u.test(encoded) || !/^[A-Za-z0-9_-]{43}$/u.test(signature)) return null;
+  const received = Buffer.from(signature, "base64url");
+  if (received.length !== 32 || received.toString("base64url") !== signature) return null;
+  if (!timingSafeEqual(received, mac(key, encoded))) return null;
+  try {
+    const decoded = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")) as Record<
+      string,
+      unknown
+    >;
+    const { bodySha256, issuedAt, expiresAt, ...rawIntent } = decoded;
+    const description = {
+      ...intent.parse(rawIntent),
+      ...timing.parse({ bodySha256, issuedAt, expiresAt }),
+    };
+    if (
+      !Number.isSafeInteger(nowSeconds) ||
+      nowSeconds < 0 ||
+      description.issuedAt > nowSeconds ||
+      description.expiresAt <= nowSeconds ||
+      description.expiresAt - description.issuedAt !== TRANSPORT_TTL_SECONDS ||
+      description.bodySha256 !== bodyHash(body) ||
+      Buffer.from(JSON.stringify(description), "utf8").toString("base64url") !== encoded
+    )
+      return null;
+    const proof = Object.freeze(Object.create(null)) as VerifiedNativeWorkerHostTransport;
+    verified.set(proof, { transport, description });
+    return proof;
+  } catch {
+    return null;
+  }
+}
+
+/** Request-local inspection of a previously verified MAC, NOT current admission.
+ * The narrow host authorizer must still recheck expiry and current authority/CAS.
+ * Copying a description, token or ref cannot mint grant or native-I/O authority. */
+export function nativeWorkerHostTransportDescription(
+  transport: NativeWorkerHostTransport,
+  proof: VerifiedNativeWorkerHostTransport,
+): NativeWorkerHostTransportDescriptionV2 {
+  keyFor(transport);
+  const record = verified.get(proof);
+  if (!record || record.transport !== transport)
+    throw new Error("Native host transport proof is unavailable");
+  return structuredClone(record.description);
+}

package/src/application/new-session-drafts.ts

@@ -11,8 +11,8 @@ import {
   getEnrollment,
   getRig,
   getSandbox,
-  getVariableSet,
   NewSessionDraftAccessError,
+  newSessionDraftModelProvided,
   newSessionDraftSelectedProjectChannelId,
   newSessionDraftToolsProvided,
   newSessionSelectionHistory,
@@ -31,12 +31,14 @@ import {
   validateGitHubRepositorySelection,
   validateToolRefs,
 } from "../domain/resources";
-import {
-  hasPermission,
-  externalAttributionForAuthorization,
-  type AccessGrantAuthorization,
-} from "../access";
+import { hasVerifiedOwningUserAuthorization, type AccessGrantAuthorization } from "../access";
 import { assertConfiguredModel, assertWorkspaceModelPolicyAllows } from "../domain/sessions";
+import {
+  resolveCallerWorkspaceModelSelections,
+  resolveDefaultSessionModel,
+  workspaceCatalogListsModel,
+} from "../default-session-model";
+import { canonicalizeConfiguredModelId, type Settings } from "@opengeni/config";
 
 type NewSessionDraftDependencies = Pick<AppDependencies, "settings" | "db" | "objectStorage">;
 
@@ -58,6 +60,9 @@ function mapNewSessionDraft(
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
+    ...(newSessionDraftModelProvided(row) !== undefined
+      ? { modelProvided: newSessionDraftModelProvided(row) }
+      : {}),
     ...(selectedProjectChannelId !== undefined ? { selectedProjectChannelId } : {}),
     options: publicNewSessionDraftOptions(row),
     selectionHistory: newSessionSelectionHistory(row),
@@ -65,15 +70,108 @@ function mapNewSessionDraft(
   });
 }
 
+/**
+ * Whether a stored draft's model policy was the person's choice. A row written
+ * before the marker existed (or by an older client) counts as a choice unless
+ * it is exactly the deployment default policy (model, reasoning, standard
+ * speed), which is what an untouched composer used to save.
+ */
+export function draftModelProvided(
+  settings: Settings,
+  draft: Pick<NewSessionDraftValue, "model" | "reasoningEffort" | "latencyMode" | "modelProvided">,
+): boolean {
+  if (draft.modelProvided !== undefined) return draft.modelProvided;
+  return !(
+    canonicalizeConfiguredModelId(settings, draft.model) ===
+      canonicalizeConfiguredModelId(settings, settings.openaiModel) &&
+    draft.reasoningEffort === settings.openaiReasoningEffort &&
+    draft.latencyMode === "standard"
+  );
+}
+
+/** The resolved new-chat default for this actor and workspace. */
+async function actorDefaultModel(
+  deps: Pick<NewSessionDraftDependencies, "db" | "settings">,
+  grant: AccessGrant,
+  workspaceId: string,
+) {
+  return await resolveDefaultSessionModel(deps.db, deps.settings, {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId,
+  });
+}
+
+/**
+ * False only when this workspace's catalog demonstrably no longer lists the
+ * model. A catalog read failure is not proof of removal, so it keeps the
+ * saved choice.
+ */
+async function workspaceCatalogMayHaveModel(
+  deps: Pick<NewSessionDraftDependencies, "db" | "settings">,
+  grant: AccessGrant,
+  workspaceId: string,
+  modelId: string,
+): Promise<boolean> {
+  try {
+    const selections = await resolveCallerWorkspaceModelSelections(deps.db, deps.settings, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+    });
+    return workspaceCatalogListsModel(
+      selections,
+      canonicalizeConfiguredModelId(deps.settings, modelId),
+    );
+  } catch {
+    return true;
+  }
+}
+
+type NewSessionDraftReadOptions = {
+  /**
+   * Project a draft that follows the default onto today's resolved default.
+   * Callers that only reuse a chosen model (Slack defaults) skip the
+   * resolution; session creation resolves the default itself.
+   */
+  projectDefaultModel?: boolean;
+};
+
 async function hydrateNewSessionDraft(
   deps: Pick<NewSessionDraftDependencies, "db" | "settings">,
   grant: AccessGrant,
   workspaceId: string,
   row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue | null> {
   if (!row) return null;
-  const mapped = mapNewSessionDraft(row);
-  if (!mapped) return null;
+  const stored = mapNewSessionDraft(row);
+  if (!stored) return null;
+  // A draft that follows the default is projected onto today's default, so a
+  // later subscription connect or credit purchase replaces an untouched free
+  // model. The stored row is unchanged until the person saves again.
+  let modelProvided = draftModelProvided(deps.settings, stored);
+  if (
+    modelProvided &&
+    readOptions.projectDefaultModel !== false &&
+    !(await workspaceCatalogMayHaveModel(deps, grant, workspaceId, stored.model))
+  ) {
+    // The saved choice left this workspace's catalog (a removed provider or a
+    // retired model). A new chat must not start on a model that cannot run, so
+    // the draft follows today's default until the person picks again. A model
+    // that is listed but temporarily unavailable keeps the person's choice.
+    modelProvided = false;
+  }
+  let mapped: NewSessionDraftValue = { ...stored, modelProvided };
+  if (!modelProvided && readOptions.projectDefaultModel !== false) {
+    const resolved = await actorDefaultModel(deps, grant, workspaceId);
+    mapped = {
+      ...mapped,
+      model: resolved.model,
+      reasoningEffort: resolved.reasoningEffort,
+      latencyMode: resolved.model === stored.model ? stored.latencyMode : "standard",
+    };
+  }
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     workspaceId,
@@ -112,35 +210,11 @@ async function hydrateNewSessionDraft(
   }
 
   const options = { ...mapped.options };
-  const variableSetIds = options.variableSetIds ?? [];
-  if (variableSetIds.length > 0) {
-    const selectionsAuthorized =
-      hasPermission(grant.permissions, "variable-sets:attach") &&
-      hasPermission(grant.permissions, "variable-sets:use") &&
-      (
-        await Promise.all(
-          variableSetIds.map((variableSetId) =>
-            getVariableSet(
-              deps.db,
-              { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
-              variableSetId,
-            ),
-          ),
-        )
-      ).every(Boolean);
-    if (selectionsAuthorized) {
-      options.variableSetIds = variableSetIds;
-      options.variableSetId = variableSetIds[variableSetIds.length - 1];
-    } else {
-      delete options.variableSetIds;
-      delete options.variableSetId;
-    }
-  } else {
-    delete options.variableSetIds;
-    delete options.variableSetId;
-  }
+  // Variable Sets were replaced by vaults: stale draft selections are dropped.
+  delete options.variableSetIds;
+  delete options.variableSetId;
   if (options.rigId) {
-    const rig = await getRig(deps.db, workspaceId, options.rigId);
+    const rig = await getRig(deps.db, { ...grant, workspaceId }, options.rigId);
     if (!rig?.activeVersion) delete options.rigId;
   }
   if (options.targetSandboxId) {
@@ -190,6 +264,7 @@ async function getActorNewSessionDraftInFileScope(
   deps: Pick<NewSessionDraftDependencies, "settings" | "db">,
   grant: AccessGrant,
   workspaceId: string,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue> {
   const row = await withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, (scoped) =>
     getNewSessionDraftInTransaction(scoped, {
@@ -197,21 +272,26 @@ async function getActorNewSessionDraftInFileScope(
       subjectId: grant.subjectId,
     }),
   );
-  return (
-    (await hydrateNewSessionDraft(deps, grant, workspaceId, row)) ?? {
-      revision: 0,
-      text: "",
-      resources: [],
-      tools: [],
-      toolsProvided: false,
-      model: deps.settings.openaiModel,
-      reasoningEffort: deps.settings.openaiReasoningEffort,
-      latencyMode: "standard",
-      options: {},
-      selectionHistory: { projects: [] },
-      updatedAt: null,
-    }
-  );
+  const hydrated = await hydrateNewSessionDraft(deps, grant, workspaceId, row, readOptions);
+  if (hydrated) return hydrated;
+  const resolved =
+    readOptions.projectDefaultModel === false
+      ? { model: deps.settings.openaiModel, reasoningEffort: deps.settings.openaiReasoningEffort }
+      : await actorDefaultModel(deps, grant, workspaceId);
+  return {
+    revision: 0,
+    text: "",
+    resources: [],
+    tools: [],
+    toolsProvided: false,
+    model: resolved.model,
+    reasoningEffort: resolved.reasoningEffort,
+    latencyMode: "standard",
+    modelProvided: false,
+    options: {},
+    selectionHistory: { projects: [] },
+    updatedAt: null,
+  };
 }
 
 /**
@@ -283,6 +363,7 @@ async function saveActorNewSessionDraftInFileScope(
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           latencyMode: input.latencyMode,
+          ...(input.modelProvided !== undefined ? { modelProvided: input.modelProvided } : {}),
           ...(input.selectedProjectChannelId !== undefined
             ? { selectedProjectChannelId: input.selectedProjectChannelId }
             : {}),
@@ -295,14 +376,18 @@ async function saveActorNewSessionDraftInFileScope(
           // A managed human's own personal workspace has no membership row at
           // all, so the human-removal fence above must fall back to the
           // organization-membership pointer for them — and only for the
-          // canonical managed-cookie session that owns it.
+          // verified owning-user authorization for this exact grant.
           personalWorkspaceOwnerException:
             canonicalManagedHumanSession ||
-            externalAttributionForAuthorization(externalAuthorization, grant) !== null,
+            (externalAuthorization?.grant === grant &&
+              hasVerifiedOwningUserAuthorization(externalAuthorization)),
         }),
       ),
     );
-    return mapNewSessionDraft(saved)!;
+    // Report the same model-policy marker a read of this row reports, so the
+    // save response and the next GET agree for old and new clients alike.
+    const mapped = mapNewSessionDraft(saved)!;
+    return { ...mapped, modelProvided: draftModelProvided(deps.settings, mapped) };
   } catch (error) {
     if (error instanceof NewSessionDraftAccessError) {
       throw new HTTPException(403, { message: error.message });
@@ -316,12 +401,13 @@ export async function getActorNewSessionDraft(
   grant: AccessGrant,
   workspaceId: string,
   authorization?: AccessGrantAuthorization,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue> {
   const actor = authorization
     ? await fileOwnerContextForAccess(deps, authorization, "sessions:read")
     : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
   return withSessionRlsActorContext(actor, () =>
-    getActorNewSessionDraftInFileScope(deps, grant, workspaceId),
+    getActorNewSessionDraftInFileScope(deps, grant, workspaceId, readOptions),
   );
 }
 export async function saveActorNewSessionDraft(
@@ -333,3 +419,34 @@ export async function saveActorNewSessionDraft(
     : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
   return withSessionRlsActorContext(actor, () => saveActorNewSessionDraftInFileScope(...args));
 }
+
+/**
+ * The model policy the person explicitly chose in the website composer, or an
+ * empty object when their draft follows the default.
+ *
+ * Only the model policy is reused. Connectors, repositories, Variable Sets,
+ * Sandbox Environment and compute target in the draft are the person's last
+ * explicit narrowing of one website chat, so surfaces that start work without
+ * the composer (Slack) resolve those from workspace defaults instead of
+ * silently inheriting that narrowing.
+ */
+export async function getActorNewSessionModelChoice(
+  deps: Parameters<typeof getActorNewSessionDraft>[0],
+  grant: AccessGrant,
+  workspaceId: string,
+): Promise<
+  Pick<NewSessionDraftValue, "model" | "reasoningEffort" | "latencyMode"> | Record<string, never>
+> {
+  // A draft that follows the default is not projected here; session creation
+  // resolves the default itself, once.
+  const draft = await getActorNewSessionDraft(deps, grant, workspaceId, undefined, {
+    projectDefaultModel: false,
+  });
+  return draft.revision > 0 && draft.modelProvided === true
+    ? {
+        model: draft.model,
+        reasoningEffort: draft.reasoningEffort,
+        latencyMode: draft.latencyMode,
+      }
+    : {};
+}