@opengeni/core 4.0.0 → 4.0.1-canary.35916963870001

package/dist/index.js

@@ -1378,8 +1378,257 @@ async function knowledgeContextForAccess(deps, access, permission) {
 
 // src/domain/knowledge-search.ts
 import { KnowledgeEntryListRequest } from "@opengeni/contracts";
-import { listKnowledgeEntries } from "@opengeni/db";
-async function searchKnowledgeEntries(db, context, input, embedder) {
+import {
+  applyCreditDebitAfterUse,
+  getBillingBalance as getBillingBalance2,
+  listKnowledgeEntries,
+  recordUsageEvent as recordUsageEvent2,
+  sumUsageQuantity as sumUsageQuantity2,
+  withKnowledgeQueryAccountLock
+} from "@opengeni/db";
+
+// src/billing/limits.ts
+import {
+  configuredStaticUsageLimits,
+  resolveModelProviderForTurn
+} from "@opengeni/config";
+import {
+  countActiveApiKeysForWorkspace,
+  countActiveOrganizationApiKeysForAccount,
+  countScheduledTasksForWorkspace,
+  countWorkspacesForAccount,
+  getBillingBalance,
+  isCodexBilledTurn,
+  recordUsageEvent,
+  sumUsageQuantity
+} from "@opengeni/db";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
+function paidDocumentEmbedding(settings) {
+  return settings.documentEmbeddingBillingMode === "credits" && settings.documentEmbeddingProvider === "openai";
+}
+function documentEmbeddingCostMicros(settings, inputBytes) {
+  if (!Number.isSafeInteger(inputBytes) || inputBytes < 0)
+    throw new Error("invalid embedding bytes");
+  const amount = (BigInt(inputBytes) * BigInt(settings.documentEmbeddingRateMicrosPerMillionBytes) + 999999n) / 1000000n;
+  if (amount > BigInt(Number.MAX_SAFE_INTEGER))
+    throw new Error("embedding cost exceeds safe integer");
+  return Number(amount);
+}
+function modelFundingForAdmission(settings, model, codexBilled) {
+  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
+  const codexSubscriptionModel = resolvedModel?.credentialSource.kind === "connected_subscription" && resolvedModel.credentialSource.provider === "codex";
+  return {
+    // A Codex namespace/definition never bypasses credits by itself: the live
+    // workspace credential predicate above remains authoritative. SuperGrok's
+    // static overlay is likewise secret-free; its worker/provider admission
+    // owns live account selection before any upstream request can occur.
+    fundedWithoutCredits: codexBilled || resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits",
+    countsTowardTokenCap: !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment"
+  };
+}
+async function requireLimit(deps, input) {
+  const decision = await checkLimit(deps, input);
+  if (decision.allowed) {
+    return;
+  }
+  throw new HTTPException4(decision.code === "insufficient_credits" ? 402 : 429, {
+    message: decision.message
+  });
+}
+async function checkLimit(deps, input) {
+  const codexBilled = input.workspaceId ? await isCodexBilledTurn({
+    db: deps.db,
+    settings: deps.settings,
+    workspaceId: input.workspaceId,
+    model: input.model
+  }) : false;
+  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
+    deps.settings,
+    input.model,
+    codexBilled
+  );
+  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
+  if (!creditDecision.allowed) {
+    return creditDecision;
+  }
+  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
+    return { allowed: true };
+  }
+  return await checkStaticCaps(deps, input, {
+    fundedWithoutCredits,
+    countsTowardTokenCap
+  });
+}
+async function checkCreditBalance(deps, input, externallyBilled) {
+  if (externallyBilled) {
+    return { allowed: true };
+  }
+  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
+    return { allowed: true };
+  }
+  const balance = await getBillingBalance(deps.db, input.accountId);
+  if (balance.balanceMicros > 0) {
+    return { allowed: true };
+  }
+  return { allowed: false, code: "insufficient_credits", message: "insufficient OpenGeni credits" };
+}
+async function checkStaticCaps(deps, input, funding) {
+  const limits = configuredStaticUsageLimits(deps.settings);
+  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !funding.fundedWithoutCredits) {
+    const used = await sumUsageQuantity(deps.db, {
+      accountId: input.accountId,
+      eventType: "model.cost",
+      since: startOfUtcMonth()
+    });
+    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
+      return blocked(
+        "max_monthly_cost_micros_per_account",
+        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`
+      );
+    }
+  }
+  switch (input.action) {
+    case "workspace:create": {
+      if (!limits.maxWorkspacesPerAccount) {
+        return { allowed: true };
+      }
+      const count = await countWorkspacesForAccount(deps.db, input.accountId);
+      return count < limits.maxWorkspacesPerAccount ? { allowed: true } : blocked(
+        "max_workspaces_per_account",
+        `workspace limit reached (${limits.maxWorkspacesPerAccount})`
+      );
+    }
+    case "api_key:create": {
+      if (!limits.maxApiKeysPerWorkspace) {
+        return { allowed: true };
+      }
+      const count = input.workspaceId ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId) : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
+      return count < limits.maxApiKeysPerWorkspace ? { allowed: true } : blocked(
+        "max_api_keys_per_workspace",
+        `API key limit reached (${limits.maxApiKeysPerWorkspace})`
+      );
+    }
+    case "schedule:create": {
+      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);
+      return count < limits.maxSchedulesPerWorkspace ? { allowed: true } : blocked(
+        "max_schedules_per_workspace",
+        `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`
+      );
+    }
+    case "file:upload": {
+      if (!limits.maxFileUploadBytes || !input.quantity) {
+        return { allowed: true };
+      }
+      return input.quantity <= limits.maxFileUploadBytes ? { allowed: true } : blocked(
+        "max_file_upload_bytes",
+        `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`
+      );
+    }
+    case "agent_run:create": {
+      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "agent_run.created",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace ? { allowed: true } : blocked(
+        "max_monthly_agent_runs_per_workspace",
+        `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`
+      );
+    }
+    case "tokens:consume": {
+      if (!funding.countsTowardTokenCap || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "model.tokens",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxMonthlyTokensPerWorkspace ? { allowed: true } : blocked(
+        "max_monthly_tokens_per_workspace",
+        `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`
+      );
+    }
+    case "document:index": {
+      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "document.indexed",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace ? { allowed: true } : blocked(
+        "max_document_indexed_chunks_per_workspace",
+        `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`
+      );
+    }
+  }
+}
+async function recordWorkspaceUsage(deps, input) {
+  await recordUsageEvent(deps.db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId ?? null,
+    eventType: input.eventType,
+    quantity: input.quantity,
+    unit: input.unit,
+    sourceResourceType: input.sourceResourceType,
+    sourceResourceId: input.sourceResourceId,
+    sessionId: input.sessionId ?? null,
+    turnId: input.turnId ?? null,
+    turnAttemptId: input.turnAttemptId ?? null,
+    initiator: input.initiator ?? (input.subjectId ? { kind: "subject", subjectId: input.subjectId } : null),
+    ...input.initiatorContext ? { initiatorContext: input.initiatorContext } : {},
+    origin: input.origin ?? null,
+    idempotencyKey: input.idempotencyKey
+  });
+}
+function usesCreditLimits(deps) {
+  return deps.settings.billingMode === "stripe" || deps.settings.usageLimitsMode === "managed";
+}
+function isCostlyAction(action) {
+  return action === "agent_run:create" || action === "tokens:consume";
+}
+function blocked(code, message) {
+  return { allowed: false, code, message };
+}
+function startOfUtcMonth() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+
+// src/domain/knowledge-search.ts
+var MAX_PAID_QUERY_BYTES = 4096;
+var MAX_PAID_QUERY_MICROS = 1e3;
+var MAX_PAID_QUERY_BYTES_PER_MINUTE = 64 * 1024;
+var MAX_PAID_QUERY_BYTES_PER_MONTH = 8 * 1024 * 1024;
+var MAX_PAID_QUERY_MICROS_PER_MINUTE = 1e4;
+var MAX_PAID_QUERY_MICROS_PER_MONTH = 1e6;
+var KnowledgeVectorFundingError = class extends Error {
+  code = "knowledge_vector_funding_required";
+  constructor() {
+    super("Knowledge vector search needs OpenGeni credits; keyword search remains available.");
+    this.name = "KnowledgeVectorFundingError";
+  }
+};
+var KnowledgeVectorQueryRejectedError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "KnowledgeVectorQueryRejectedError";
+  }
+};
+async function searchKnowledgeEntries(db, context, input, embedder, settings) {
   const request = KnowledgeEntryListRequest.parse(input);
   if (!request.query || request.mode === "keyword") {
     return {
@@ -1390,25 +1639,119 @@ async function searchKnowledgeEntries(db, context, input, embedder) {
   const lexicalQuery = /^[\p{L}\p{N}\s]+$/u.test(request.query) && !/\bOR\b/i.test(request.query) ? [...new Set(request.query.trim().split(/\s+/u))].map((term) => `"${term}"`).join(" OR ") : request.query;
   const lexicalRequest = KnowledgeEntryListRequest.safeParse({ ...request, query: lexicalQuery });
   const retrievalRequest = request.mode === "hybrid" && lexicalRequest.success ? lexicalRequest.data : request;
-  let embedding;
-  try {
-    const provider = embedder();
-    const values = await provider.embedQuery(request.query);
-    if (values.length !== provider.dimensions || values.some((value) => !Number.isFinite(value)) || !values.some((value) => value !== 0)) {
-      throw new Error("Knowledge query embedding is unavailable");
-    }
-    embedding = { model: provider.model, values };
-  } catch (error) {
+  const keywordFallback = async (queryDb, error, fallbackReason) => {
     if (request.mode === "vector") throw error;
     return {
-      ...await listKnowledgeEntries(db, context, { ...retrievalRequest, mode: "keyword" }),
-      searchMode: "keyword"
+      ...await listKnowledgeEntries(queryDb, context, { ...retrievalRequest, mode: "keyword" }),
+      searchMode: "keyword",
+      fallbackReason
     };
-  }
-  return {
-    ...await listKnowledgeEntries(db, context, retrievalRequest, embedding),
-    searchMode: request.mode
   };
+  const bytes = Buffer.byteLength(request.query, "utf8");
+  const paidSettings = settings && paidDocumentEmbedding(settings) ? settings : void 0;
+  if (paidSettings && request.cursor)
+    throw new KnowledgeVectorQueryRejectedError(
+      "pagination_unavailable",
+      "Paid semantic Knowledge pagination is unavailable; use keyword mode"
+    );
+  const cost = paidSettings ? documentEmbeddingCostMicros(paidSettings, bytes) : 0;
+  if (paidSettings && (bytes > MAX_PAID_QUERY_BYTES || cost > MAX_PAID_QUERY_MICROS))
+    return keywordFallback(
+      db,
+      new KnowledgeVectorQueryRejectedError(
+        "query_limit",
+        "Paid Knowledge query exceeds the per-request limit"
+      ),
+      "query_limit"
+    );
+  const retrieveThenSettle = async (queryDb) => {
+    let embedding;
+    try {
+      const provider = embedder();
+      const values = await provider.embedQuery(request.query);
+      if (values.length !== provider.dimensions || values.some((value) => !Number.isFinite(value)) || !values.some((value) => value !== 0))
+        throw new Error("Knowledge query embedding is unavailable");
+      embedding = { model: provider.model, values };
+    } catch (error) {
+      return keywordFallback(queryDb, error, "provider_unavailable");
+    }
+    const found = await listKnowledgeEntries(queryDb, context, retrievalRequest, embedding);
+    if (settings) {
+      const usageId = crypto.randomUUID();
+      await recordUsageEvent2(queryDb, {
+        accountId: context.accountId,
+        workspaceId: context.workspaceId,
+        eventType: "document.query_embedding_bytes",
+        quantity: bytes,
+        unit: "byte",
+        sourceResourceType: "knowledge_query",
+        sourceResourceId: usageId,
+        idempotencyKey: `knowledge.query_bytes:${usageId}`
+      });
+      if (paidSettings && cost > 0)
+        await recordUsageEvent2(queryDb, {
+          accountId: context.accountId,
+          workspaceId: context.workspaceId,
+          eventType: "document.query_embedding_cost",
+          quantity: cost,
+          unit: "micro_usd",
+          sourceResourceType: "knowledge_query",
+          sourceResourceId: usageId,
+          idempotencyKey: `knowledge.query_cost:${usageId}`
+        });
+      if (paidSettings && cost > 0)
+        await applyCreditDebitAfterUse(queryDb, {
+          accountId: context.accountId,
+          workspaceId: context.workspaceId,
+          type: "document_embedding_debit",
+          amountMicros: cost,
+          sourceType: "knowledge_query",
+          sourceId: usageId,
+          idempotencyKey: `knowledge.query_embedding:${usageId}`,
+          metadata: { model: embedding.model, bytes }
+        });
+    }
+    return { ...found, searchMode: request.mode };
+  };
+  if (!paidSettings) return retrieveThenSettle(db);
+  return withKnowledgeQueryAccountLock(
+    db,
+    context.accountId,
+    context.workspaceId,
+    async (lockedDb) => {
+      const balance = await getBillingBalance2(lockedDb, context.accountId);
+      if (balance.balanceMicros <= 0)
+        return keywordFallback(lockedDb, new KnowledgeVectorFundingError(), "awaiting_funding");
+      const now = /* @__PURE__ */ new Date();
+      const minuteBytes = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_bytes",
+        since: new Date(now.getTime() - 6e4)
+      });
+      const monthBytes = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_bytes",
+        since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1))
+      });
+      const minuteMicros = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_cost",
+        since: new Date(now.getTime() - 6e4)
+      });
+      const monthMicros = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_cost",
+        since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1))
+      });
+      if (minuteBytes + bytes > MAX_PAID_QUERY_BYTES_PER_MINUTE || monthBytes + bytes > MAX_PAID_QUERY_BYTES_PER_MONTH || minuteMicros + cost > MAX_PAID_QUERY_MICROS_PER_MINUTE || monthMicros + cost > MAX_PAID_QUERY_MICROS_PER_MONTH)
+        return keywordFallback(
+          lockedDb,
+          new KnowledgeVectorQueryRejectedError("quota", "Paid Knowledge query rate limit reached"),
+          "quota"
+        );
+      return retrieveThenSettle(lockedDb);
+    }
+  );
 }
 
 // src/workflow-wake-contract.ts
@@ -1501,6 +1844,7 @@ import {
   configuredGatewayWorkspaceProductModelIds,
   configuredGatewayOrganizationProductModelIds,
   configuredModels,
+  isModelAvailableForNewSelection,
   configuredModelNotes,
   configuredOpenRouterWorkspaceProductModelIds,
   configuredOpenRouterOrganizationProductModelIds,
@@ -1944,7 +2288,7 @@ function resolveWorkspaceModelSelection(input) {
   const requestedNowMs = input.now?.getTime();
   const nowMs = typeof requestedNowMs === "number" && Number.isFinite(requestedNowMs) ? requestedNowMs : Date.now();
   const maxAgeMs = typeof input.credentialReadinessMaxAgeMs === "number" && Number.isFinite(input.credentialReadinessMaxAgeMs) && input.credentialReadinessMaxAgeMs >= 0 ? input.credentialReadinessMaxAgeMs : MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS;
-  return configuredModels(catalogSettings).map((model) => {
+  return configuredModels(catalogSettings).filter((model) => isModelAvailableForNewSelection(catalogSettings, model.id)).map((model) => {
     const provider = providers.get(model.providerId);
     const policyAllowed = evaluateWorkspaceModelPolicy(input.policy, {
       providerId: model.providerId,
@@ -2462,6 +2806,21 @@ function managedSessionGroupBackend(deploymentBackend, sessionBackend) {
   const backend = sessionBackend === "selfhosted" ? deploymentBackend : sessionBackend;
   return backend === "none" || backend === "selfhosted" ? null : backend;
 }
+var SESSION_GROUP_MACHINE_NAMES = {
+  local: "this computer",
+  docker: "Docker",
+  modal: "Modal",
+  daytona: "Daytona",
+  runloop: "Runloop",
+  e2b: "E2B",
+  blaxel: "Blaxel",
+  cloudflare: "Cloudflare",
+  vercel: "Vercel",
+  opensandbox: "OpenSandbox"
+};
+function sessionGroupMachinePresentation(backend) {
+  return { name: SESSION_GROUP_MACHINE_NAMES[backend], kind: backend };
+}
 function managedSessionGroupOs(sessionBackend, sessionOs) {
   return sessionBackend === "selfhosted" ? "linux" : sessionOs;
 }
@@ -2671,10 +3030,11 @@ async function listFleet(services, ctx) {
       groupLease && (groupLease.recovery.restore.status === "degraded" || groupLease.recovery.restore.status === "unrecoverable" || groupLease.recovery.workspace.status === "degraded" || groupLease.recovery.workspace.status === "unrecoverable")
     );
     const groupOperationAvailability = groupOnline ? "ready" : groupRecoveryUnavailable ? "unavailable" : groupRecovering ? "recovering" : "wakeable";
+    const presentation = sessionGroupMachinePresentation(groupBackend);
     entries.push({
       id: ctx.sessionGroupId,
-      kind: groupBackend === "opensandbox" ? "opensandbox" : "modal",
-      name: "session sandbox",
+      kind: presentation.kind,
+      name: presentation.name,
       liveness: groupOnline ? "online" : groupRecovering ? "reconnecting" : "offline",
       active: groupActive,
       isSessionGroup: true,
@@ -3255,7 +3615,7 @@ async function provisionSandbox(services, ctx, input) {
 }
 
 // src/application/external-workspace-members.ts
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 import {
   AddExternalWorkspaceMemberRequest,
   ExternalIdentityReference,
@@ -3291,12 +3651,12 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
   const context = await requireAccessContext(c, deps);
   const authority = accountScopedApiKeyWorkspaceAuthority(context);
   if (!authority)
-    throw new HTTPException4(403, {
+    throw new HTTPException5(403, {
       message: "external onboarding requires an organization service key"
     });
   const grant = await requireFreshAccessGrant(c, deps, workspaceId, "members:manage");
   if (grant.accountId !== authority.accountId || payload.permissions.some((permission) => !hasPermission(grant.permissions, permission))) {
-    throw new HTTPException4(403, { message: "membership exceeds key authority" });
+    throw new HTTPException5(403, { message: "membership exceeds key authority" });
   }
   if (payload.operationId) {
     try {
@@ -3322,11 +3682,11 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
       "members:manage"
     );
     if (live.accountId !== grant.accountId || live.subjectId !== grant.subjectId || payload.permissions.some((permission) => !hasPermission(live.permissions, permission))) {
-      throw new HTTPException4(403, { message: "membership authority changed" });
+      throw new HTTPException5(403, { message: "membership authority changed" });
     }
     const workspace = await requireWorkspace2(tx, workspaceId);
     if (workspace.kind !== "shared" || workspace.accountId !== authority.accountId)
-      throw new HTTPException4(403, {
+      throw new HTTPException5(403, {
         message: "external onboarding requires a shared organization workspace"
       });
     const identity = await ensureExternalIdentity2(tx, {
@@ -3340,7 +3700,7 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
     const permissions = [...new Set(payload.permissions)];
     if (existing) {
       if (existing.permissions.length !== permissions.length || existing.permissions.some((permission) => !permissions.includes(permission))) {
-        throw new HTTPException4(409, {
+        throw new HTTPException5(409, {
           message: "existing membership differs; onboarding does not overwrite permissions"
         });
       }
@@ -3359,7 +3719,7 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
 function rethrowExternalWorkspaceOperation(error) {
   const status = organizationMembershipHttpStatus(nestedPostgresSqlState2(error));
   if (status)
-    throw new HTTPException4(status, {
+    throw new HTTPException5(status, {
       message: status === 409 ? "External membership operation changed or was cancelled" : "External membership operation is not available"
     });
   throw error;
@@ -3368,7 +3728,7 @@ async function externalService(c, deps, organizationId) {
   const context = await requireAccessContext(c, deps);
   const authority = accountScopedApiKeyWorkspaceAuthority(context);
   if (!authority || authority.accountId !== organizationId || !hasPermission(authority.permissions, "members:manage")) {
-    throw new HTTPException4(403, {
+    throw new HTTPException5(403, {
       message: "External membership operation requires an organization service key"
     });
   }
@@ -3378,7 +3738,7 @@ async function lookupExternalIdentityForRequest(c, deps, organizationId, input)
   const service = await externalService(c, deps, organizationId);
   const identity = ExternalIdentityReference.safeParse(input);
   if (!identity.success)
-    throw new HTTPException4(422, { message: "Invalid external identity reference" });
+    throw new HTTPException5(422, { message: "Invalid external identity reference" });
   try {
     return await lookupExternalIdentity(deps.db, service, identity.data);
   } catch (error) {
@@ -3389,7 +3749,7 @@ async function cancelExternalWorkspaceMemberGrantForRequest(c, deps, organizatio
   const service = await externalService(c, deps, organizationId);
   const request = CancelExternalWorkspaceMemberGrantRequest.safeParse(input);
   if (!request.success)
-    throw new HTTPException4(422, { message: "Invalid external grant cancellation" });
+    throw new HTTPException5(422, { message: "Invalid external grant cancellation" });
   try {
     return await cancelExternalWorkspaceMemberGrant(
       deps.db,
@@ -3402,7 +3762,7 @@ async function cancelExternalWorkspaceMemberGrantForRequest(c, deps, organizatio
 }
 
 // src/application/external-identity-lifecycle.ts
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
 import { UpdateExternalIdentityMembershipRequest } from "@opengeni/contracts/external-identities";
 import { updateOrganizationMember } from "@opengeni/db";
 async function updateExternalIdentityMembershipForRequest(context, deps, organizationId, membershipId, input) {
@@ -3412,13 +3772,13 @@ async function updateExternalIdentityMembershipForRequest(context, deps, organiz
     (grant) => grant.accountId === organizationId && grant.subjectId === access.subjectId
   );
   if (!service || service.accountId !== organizationId || !account?.permissions.includes("account:admin")) {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "external identity administration requires an organization service key"
     });
   }
   const parsed = UpdateExternalIdentityMembershipRequest.safeParse(input);
   if (!parsed.success)
-    throw new HTTPException5(422, { message: "invalid external identity transition" });
+    throw new HTTPException6(422, { message: "invalid external identity transition" });
   return updateOrganizationMember(deps.db, {
     organizationId,
     membershipId,
@@ -3440,7 +3800,7 @@ import {
   nestedPostgresSqlState as nestedPostgresSqlState3,
   withWorkspaceSubjectRls as withWorkspaceSubjectRls3
 } from "@opengeni/db";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 function externalContinuationCommitAuthorizer(authorization) {
   const continuation = authorization ? externalActorContinuationForAuthorization(authorization) : null;
   if (!continuation || !authorization) return void 0;
@@ -3455,7 +3815,7 @@ function externalContinuationCommitAuthorizer(authorization) {
       await requireExternalContinuationAuthority(tx, continuation, scope, permissions);
     } catch (error) {
       const denied2 = nestedPostgresSqlState3(error) === "42501" || error instanceof Error && error.message === "External continuation authority unavailable";
-      throw new HTTPException6(denied2 ? 403 : 503, {
+      throw new HTTPException7(denied2 ? 403 : 503, {
         message: denied2 ? "external authority changed" : "external authority is unavailable",
         cause: error
       });
@@ -3520,12 +3880,12 @@ import {
   variableSetVariableNameReservation
 } from "@opengeni/contracts";
 import { getVariableSet, recordAuditEvent } from "@opengeni/db";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 var MAX_ENVIRONMENTS_PER_WORKSPACE = 25;
 var MAX_VARIABLES_PER_ENVIRONMENT = 100;
 function assertAllowedVariableSetVariableName(name) {
   if (variableSetVariableNameReservation(name)) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: `reserved variable set variable name / reserved environment variable name: ${name}`
     });
   }
@@ -3534,7 +3894,7 @@ var assertAllowedEnvironmentVariableName = assertAllowedVariableSetVariableName;
 function requireVariableSetEncryption(settings) {
   const key = environmentsEncryptionKeyBytes(settings);
   if (!key) {
-    throw new HTTPException7(503, {
+    throw new HTTPException8(503, {
       message: "variable sets require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"
     });
   }
@@ -3552,7 +3912,7 @@ async function requireVariableSetForApi(db, grant, variableSetId) {
     variableSetId
   );
   if (!variableSet) {
-    throw new HTTPException7(404, { message: "variableSet not found" });
+    throw new HTTPException8(404, { message: "variableSet not found" });
   }
   return variableSet;
 }
@@ -3566,7 +3926,7 @@ async function validateVariableSetAttachment(deps, grant, workspaceId, variableS
     variableSetId
   );
   if (!variableSet) {
-    throw new HTTPException7(422, { message: "unknown variableSetId" });
+    throw new HTTPException8(422, { message: "unknown variableSetId" });
   }
   return variableSet;
 }
@@ -3666,6 +4026,7 @@ function sessionCreationMetadata(metadata) {
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
+  withCodexCatalogProvider as withCodexCatalogProvider2,
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX as ORGANIZATION_GATEWAY_MODEL_ID_PREFIX2,
   ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX as ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX2,
   resolveFirstPartyMcpToolPolicy,
@@ -3691,7 +4052,7 @@ import {
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy as evaluateWorkspaceModelPolicy2,
   normalizeAutomaticSessionTitle,
-  resolveWorkspaceSessionToolDefaults,
+  resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults2,
   metadataWithTurnExecutionPolicyV1,
   readTurnExecutionPolicyV1,
   stableJson as stableJson3,
@@ -3726,7 +4087,7 @@ import {
   getSessionTurnPersonalConnectionDelegations as getSessionTurnPersonalConnectionDelegations2,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
   getWorkspaceModelPolicy,
-  requireWorkspace as requireWorkspace3,
+  requireWorkspace as requireWorkspace4,
   initializeSessionStartAtomically,
   listSessionTurns,
   listSessionMcpServersForChildInheritance,
@@ -3757,11 +4118,11 @@ import {
 import { HTTPException as HTTPException15 } from "hono/http-exception";
 
 // src/domain/external-creation-attribution.ts
-import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
 var EXTERNAL_CREATION_ATTRIBUTION_KEY = "opengeniExternalCreationAttribution";
 function externalCreationMetadata(metadata, authorization, grant) {
   if (metadata && Object.hasOwn(metadata, EXTERNAL_CREATION_ATTRIBUTION_KEY)) {
-    throw new HTTPException8(422, {
+    throw new HTTPException9(422, {
       message: `${EXTERNAL_CREATION_ATTRIBUTION_KEY} is server-owned`
     });
   }
@@ -3828,215 +4189,6 @@ function prepareExternalLinkTaskAdmission(authorization, actor) {
   };
 }
 
-// src/billing/limits.ts
-import {
-  configuredStaticUsageLimits,
-  resolveModelProviderForTurn
-} from "@opengeni/config";
-import {
-  countActiveApiKeysForWorkspace,
-  countActiveOrganizationApiKeysForAccount,
-  countScheduledTasksForWorkspace,
-  countWorkspacesForAccount,
-  getBillingBalance,
-  isCodexBilledTurn,
-  recordUsageEvent,
-  sumUsageQuantity
-} from "@opengeni/db";
-import { HTTPException as HTTPException9 } from "hono/http-exception";
-function modelFundingForAdmission(settings, model, codexBilled) {
-  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
-  const codexSubscriptionModel = resolvedModel?.credentialSource.kind === "connected_subscription" && resolvedModel.credentialSource.provider === "codex";
-  return {
-    // A Codex namespace/definition never bypasses credits by itself: the live
-    // workspace credential predicate above remains authoritative. SuperGrok's
-    // static overlay is likewise secret-free; its worker/provider admission
-    // owns live account selection before any upstream request can occur.
-    fundedWithoutCredits: codexBilled || resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits",
-    countsTowardTokenCap: !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment"
-  };
-}
-async function requireLimit(deps, input) {
-  const decision = await checkLimit(deps, input);
-  if (decision.allowed) {
-    return;
-  }
-  throw new HTTPException9(decision.code === "insufficient_credits" ? 402 : 429, {
-    message: decision.message
-  });
-}
-async function checkLimit(deps, input) {
-  const codexBilled = input.workspaceId ? await isCodexBilledTurn({
-    db: deps.db,
-    settings: deps.settings,
-    workspaceId: input.workspaceId,
-    model: input.model
-  }) : false;
-  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
-    deps.settings,
-    input.model,
-    codexBilled
-  );
-  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
-  if (!creditDecision.allowed) {
-    return creditDecision;
-  }
-  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
-    return { allowed: true };
-  }
-  return await checkStaticCaps(deps, input, {
-    fundedWithoutCredits,
-    countsTowardTokenCap
-  });
-}
-async function checkCreditBalance(deps, input, externallyBilled) {
-  if (externallyBilled) {
-    return { allowed: true };
-  }
-  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
-    return { allowed: true };
-  }
-  const balance = await getBillingBalance(deps.db, input.accountId);
-  if (balance.balanceMicros > 0) {
-    return { allowed: true };
-  }
-  return { allowed: false, code: "insufficient_credits", message: "insufficient OpenGeni credits" };
-}
-async function checkStaticCaps(deps, input, funding) {
-  const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !funding.fundedWithoutCredits) {
-    const used = await sumUsageQuantity(deps.db, {
-      accountId: input.accountId,
-      eventType: "model.cost",
-      since: startOfUtcMonth()
-    });
-    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
-      return blocked(
-        "max_monthly_cost_micros_per_account",
-        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`
-      );
-    }
-  }
-  switch (input.action) {
-    case "workspace:create": {
-      if (!limits.maxWorkspacesPerAccount) {
-        return { allowed: true };
-      }
-      const count = await countWorkspacesForAccount(deps.db, input.accountId);
-      return count < limits.maxWorkspacesPerAccount ? { allowed: true } : blocked(
-        "max_workspaces_per_account",
-        `workspace limit reached (${limits.maxWorkspacesPerAccount})`
-      );
-    }
-    case "api_key:create": {
-      if (!limits.maxApiKeysPerWorkspace) {
-        return { allowed: true };
-      }
-      const count = input.workspaceId ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId) : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
-      return count < limits.maxApiKeysPerWorkspace ? { allowed: true } : blocked(
-        "max_api_keys_per_workspace",
-        `API key limit reached (${limits.maxApiKeysPerWorkspace})`
-      );
-    }
-    case "schedule:create": {
-      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);
-      return count < limits.maxSchedulesPerWorkspace ? { allowed: true } : blocked(
-        "max_schedules_per_workspace",
-        `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`
-      );
-    }
-    case "file:upload": {
-      if (!limits.maxFileUploadBytes || !input.quantity) {
-        return { allowed: true };
-      }
-      return input.quantity <= limits.maxFileUploadBytes ? { allowed: true } : blocked(
-        "max_file_upload_bytes",
-        `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`
-      );
-    }
-    case "agent_run:create": {
-      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "agent_run.created",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace ? { allowed: true } : blocked(
-        "max_monthly_agent_runs_per_workspace",
-        `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`
-      );
-    }
-    case "tokens:consume": {
-      if (!funding.countsTowardTokenCap || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "model.tokens",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxMonthlyTokensPerWorkspace ? { allowed: true } : blocked(
-        "max_monthly_tokens_per_workspace",
-        `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`
-      );
-    }
-    case "document:index": {
-      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "document.indexed",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace ? { allowed: true } : blocked(
-        "max_document_indexed_chunks_per_workspace",
-        `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`
-      );
-    }
-  }
-}
-async function recordWorkspaceUsage(deps, input) {
-  await recordUsageEvent(deps.db, {
-    accountId: input.accountId,
-    workspaceId: input.workspaceId,
-    subjectId: input.subjectId ?? null,
-    eventType: input.eventType,
-    quantity: input.quantity,
-    unit: input.unit,
-    sourceResourceType: input.sourceResourceType,
-    sourceResourceId: input.sourceResourceId,
-    sessionId: input.sessionId ?? null,
-    turnId: input.turnId ?? null,
-    turnAttemptId: input.turnAttemptId ?? null,
-    initiator: input.initiator ?? (input.subjectId ? { kind: "subject", subjectId: input.subjectId } : null),
-    ...input.initiatorContext ? { initiatorContext: input.initiatorContext } : {},
-    origin: input.origin ?? null,
-    idempotencyKey: input.idempotencyKey
-  });
-}
-function usesCreditLimits(deps) {
-  return deps.settings.billingMode === "stripe" || deps.settings.usageLimitsMode === "managed";
-}
-function isCostlyAction(action) {
-  return action === "agent_run:create" || action === "tokens:consume" || action === "document:index";
-}
-function blocked(code, message) {
-  return { allowed: false, code, message };
-}
-function startOfUtcMonth() {
-  const now = /* @__PURE__ */ new Date();
-  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
-}
-
 // src/domain/native-mcp-connection-admission.ts
 import { HTTPException as HTTPException10 } from "hono/http-exception";
 function assertNativeMcpConnectionRef(connectionRef) {
@@ -5030,6 +5182,7 @@ function fikenCatalogItem(fikenConnections) {
     metadata: {
       connectorMode: "first_party_fiken",
       ownership: "workspace",
+      connectionStatus: fikenConnection?.status ?? null,
       // Derived from the contracts catalog so a new fiken_* tool cannot be
       // registered without also appearing on the capability tile.
       firstPartyMcpTools: FIRST_PARTY_MCP_TOOL_NAMES.filter((name) => name.startsWith("fiken_"))
@@ -5231,15 +5384,15 @@ function socialProviderConnectionCounts(item) {
   };
 }
 function applyCapabilityEnablement(item, installation) {
+  if (item.surfaceType === "first_party_fiken") {
+    return { ...item, connectionRef: null };
+  }
   if (item.kind === "skill" || item.kind === "api" || item.kind === "plugin") {
     return { ...item, enabled: false, enabledReason: null, connectionRef: null };
   }
   if (isSocialProviderIntegration(item)) {
     return { ...item, connectionRef: null };
   }
-  if (item.surfaceType === "first_party_fiken") {
-    return { ...item, connectionRef: null };
-  }
   if (item.surfaceType === "codex_apps") {
     return { ...item, connectionRef: null };
   }
@@ -5534,50 +5687,197 @@ function mcpRegistryEntryToCatalogItem(entry) {
       packages: server.packages ?? [],
       requiredHeaders
     }
-  });
+  });
+}
+function requiredRemoteHeaders(remote) {
+  return (remote.headers ?? []).filter((header) => header.name && header.isRequired !== false).map((header) => header.name.trim()).filter(Boolean);
+}
+function validUrl(value) {
+  if (!value) {
+    return null;
+  }
+  try {
+    return new URL(value).toString();
+  } catch {
+    return null;
+  }
+}
+function capabilityInstallationRuntimeReady(item, installation) {
+  if (!installation || item.kind !== "mcp") {
+    return !!installation;
+  }
+  if (!item.runtime.available) {
+    return false;
+  }
+  if (!storedCredentialHeadersSatisfy(item, installation)) {
+    return false;
+  }
+  const connectivity = installation.metadata.mcpConnectivity;
+  return !!connectivity && typeof connectivity === "object" && "status" in connectivity && (connectivity.status === "ok" || connectivity.status === "auth_deferred");
+}
+function storedCredentialHeadersSatisfy(item, installation) {
+  if (storedConnectionRef(installation.config)) {
+    return true;
+  }
+  const storedNames = new Set(
+    (Array.isArray(installation.config.headerNames) ? installation.config.headerNames : []).filter((name) => typeof name === "string").map((name) => name.toLowerCase())
+  );
+  const required = requiredCapabilityHeaders(item.metadata);
+  if (required.some((name) => !storedNames.has(name.toLowerCase()))) {
+    return false;
+  }
+  return !item.authModel || storedNames.size > 0;
+}
+function storedConnectionRef(config) {
+  const ref = config.connectionRef;
+  return !!ref && typeof ref === "object" && !Array.isArray(ref) && typeof ref.providerDomain === "string";
+}
+
+// src/domain/session-tool-policy.ts
+import {
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
+  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
+  mergeToolRefs,
+  resolveWorkspaceSessionToolDefaults
+} from "@opengeni/contracts";
+import { requireWorkspace as requireWorkspace3 } from "@opengeni/db";
+var MANDATORY_SESSION_MCP_SERVER_IDS = ["opengeni"];
+var PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;
+function sortedIds(ids) {
+  return [...new Set(ids)].sort();
+}
+function defaultSessionMcpServerIds(servers) {
+  const mandatory = new Set(MANDATORY_SESSION_MCP_SERVER_IDS);
+  return sortedIds([...servers].map((server) => server.id).filter((id) => !mandatory.has(id)));
+}
+function projectIds(ids) {
+  const projectable = ids.filter(
+    (id) => id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id)
+  );
+  return {
+    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),
+    truncated: projectable.length !== ids.length || projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT
+  };
+}
+function resolveSessionToolPolicy(input) {
+  const policy = input.toolPolicy;
+  const availableIds = new Set(input.availableMcpServerIds);
+  const defaultIds = new Set(input.defaultMcpServerIds ?? []);
+  const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
+    (id) => availableIds.has(id)
+  );
+  const mandatoryIdSet = new Set(mandatoryIds);
+  const tracksWorkspaceDefaults = policy.mode === "workspace_default";
+  const excludedIds = new Set(tracksWorkspaceDefaults ? policy.excludedMcpServerIds : []);
+  const selectedRefs = mergeToolRefs([], input.sessionTools).filter(
+    (tool) => !excludedIds.has(tool.id) || mandatoryIdSet.has(tool.id)
+  );
+  let toolRefs = selectedRefs.filter((tool) => availableIds.has(tool.id));
+  if (tracksWorkspaceDefaults) {
+    toolRefs = mergeToolRefs(
+      toolRefs,
+      sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true }))
+    );
+  }
+  toolRefs = mergeToolRefs(
+    toolRefs,
+    mandatoryIds.map((id) => ({ kind: "mcp", id }))
+  );
+  const requestedEffectiveRefs = mergeToolRefs(
+    selectedRefs,
+    tracksWorkspaceDefaults ? sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true })) : []
+  );
+  const effectiveIds = sortedIds(
+    mergeToolRefs(
+      requestedEffectiveRefs,
+      mandatoryIds.map((id) => ({ kind: "mcp", id }))
+    ).map((tool) => tool.id)
+  );
+  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
+  const configuredIdSet = new Set(configuredIds);
+  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
+  const deferredIds = sortedIds(
+    toolRefs.filter((tool) => configuredIdSet.has(tool.id) && tool.eager !== true).map((tool) => tool.id)
+  );
+  const selectedIds = sortedIds(
+    selectedRefs.filter(
+      (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
+    ).map((tool) => tool.id)
+  );
+  const projections = {
+    selected: projectIds(selectedIds),
+    effective: projectIds(effectiveIds),
+    mandatory: projectIds(sortedIds(mandatoryIds)),
+    deferred: projectIds(deferredIds),
+    configured: projectIds(configuredIds),
+    dropped: projectIds(droppedIds)
+  };
+  return {
+    toolRefs,
+    effectivePolicy: {
+      mode: policy.mode,
+      inheritedFromSessionId: policy.inheritedFromSessionId,
+      selectedIds: projections.selected.ids,
+      effectiveIds: projections.effective.ids,
+      mandatoryIds: projections.mandatory.ids,
+      lazyRouter: {
+        state: deferredIds.length > 0 ? "required" : "disabled",
+        deferredIds: projections.deferred.ids
+      },
+      configuredIds: projections.configured.ids,
+      droppedIds: projections.dropped.ids,
+      counts: {
+        selected: selectedIds.length,
+        effective: effectiveIds.length,
+        mandatory: mandatoryIds.length,
+        deferred: deferredIds.length,
+        configured: configuredIds.length,
+        dropped: droppedIds.length
+      },
+      idsTruncated: Object.values(projections).some((projection) => projection.truncated)
+    }
+  };
 }
-function requiredRemoteHeaders(remote) {
-  return (remote.headers ?? []).filter((header) => header.name && header.isRequired !== false).map((header) => header.name.trim()).filter(Boolean);
+async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings, subjectId) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
+    ...subjectId ? { subjectId } : {}
+  });
+  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
 }
-function validUrl(value) {
-  if (!value) {
-    return null;
-  }
-  try {
-    return new URL(value).toString();
-  } catch {
-    return null;
-  }
+async function workspaceSessionToolPolicyDefaultServerIds(db, workspaceId, settings, subjectId) {
+  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
+    ...subjectId ? { subjectId } : {}
+  });
+  const workspace = await requireWorkspace3(db, workspaceId);
+  return workspaceSessionToolPolicyDefaultServerIdsFor(
+    runtimeSettings.mcpServers,
+    workspace.settings
+  );
 }
-function capabilityInstallationRuntimeReady(item, installation) {
-  if (!installation || item.kind !== "mcp") {
-    return !!installation;
-  }
-  if (!item.runtime.available) {
-    return false;
-  }
-  if (!storedCredentialHeadersSatisfy(item, installation)) {
-    return false;
-  }
-  const connectivity = installation.metadata.mcpConnectivity;
-  return !!connectivity && typeof connectivity === "object" && "status" in connectivity && (connectivity.status === "ok" || connectivity.status === "auth_deferred");
+function workspaceSessionToolPolicyDefaultServerIdsFor(runtimeMcpServers, workspaceSettings) {
+  const availableDefaults = defaultSessionMcpServerIds(runtimeMcpServers);
+  const configured = resolveWorkspaceSessionToolDefaults(workspaceSettings);
+  if (!configured?.mcpServerIds) return availableDefaults;
+  const available = new Set(availableDefaults);
+  return sortedIds([
+    ...configured.mcpServerIds.filter((id) => available.has(id)),
+    ...configured.inheritConnectedMcpServers ? availableDefaults.filter((id) => !["opengeni", "files", "docs"].includes(id)) : []
+  ]);
 }
-function storedCredentialHeadersSatisfy(item, installation) {
-  if (storedConnectionRef(installation.config)) {
-    return true;
-  }
-  const storedNames = new Set(
-    (Array.isArray(installation.config.headerNames) ? installation.config.headerNames : []).filter((name) => typeof name === "string").map((name) => name.toLowerCase())
-  );
-  const required = requiredCapabilityHeaders(item.metadata);
-  if (required.some((name) => !storedNames.has(name.toLowerCase()))) {
-    return false;
+function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds = []) {
+  const availableIds = new Set(workspaceServerIds);
+  for (const server of session.mcpServers) {
+    availableIds.add(server.id);
   }
-  return !item.authModel || storedNames.size > 0;
-}
-function storedConnectionRef(config) {
-  const ref = config.connectionRef;
-  return !!ref && typeof ref === "object" && !Array.isArray(ref) && typeof ref.providerDomain === "string";
+  return {
+    ...session,
+    effectiveToolPolicy: resolveSessionToolPolicy({
+      toolPolicy: session.toolPolicy,
+      sessionTools: session.tools,
+      availableMcpServerIds: availableIds,
+      defaultMcpServerIds: workspaceDefaultServerIds
+    }).effectivePolicy
+  };
 }
 
 // src/domain/timeline-annotations.ts
@@ -5760,7 +6060,7 @@ import {
   gitCredentialProviderForRepository,
   defaultRepositoryMountPath,
   mergeResourceRefs as mergeContractResourceRefs,
-  mergeToolRefs,
+  mergeToolRefs as mergeToolRefs2,
   normalizeRepositorySubpath,
   normalizeRepositoryTransportUri,
   normalizeResourceMountPath,
@@ -5800,20 +6100,20 @@ function validateToolRefs(tools, settings) {
       ...tool.eager === true ? { eager: true } : {}
     });
   }
-  return mergeToolRefs([], out);
+  return mergeToolRefs2([], out);
 }
 function enabledCapabilityMcpToolRefs(settings, runtimeSettings) {
   const configuredIds = new Set(settings.mcpServers.map((server) => server.id));
   return runtimeSettings.mcpServers.filter((server) => !configuredIds.has(server.id)).map((server) => ({ kind: "mcp", id: server.id, optional: true }));
 }
 function withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings) {
-  return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
+  return mergeToolRefs2(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
 function withWorkspaceDefaultMcpTools(tools, settings, runtimeSettings, defaults2) {
   if (!defaults2?.mcpServerIds) {
     return withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings);
   }
-  return mergeToolRefs(
+  return mergeToolRefs2(
     tools,
     validateToolRefs(
       [
@@ -7855,6 +8155,12 @@ function canonicalConfiguredModel(settings, model) {
     return model;
   }
   const canonicalModel = canonicalizeConfiguredModelId(settings, model);
+  if (canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX) && settings.resolvedCodexModelsJson !== void 0) {
+    if (settings.codexSubscriptionEnabled && configuredAllowedModels(withCodexCatalogProvider2(settings)).includes(canonicalModel)) {
+      return canonicalModel;
+    }
+    throw new HTTPException15(422, { message: `model is not available: ${model}` });
+  }
   if (configuredAllowedModels(settings).includes(canonicalModel)) {
     return canonicalModel;
   }
@@ -8383,8 +8689,8 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
       message: `parent session not found in workspace: ${parentSessionId}`
     });
   }
-  const workspace = await requireWorkspace3(db, workspaceId);
-  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  const workspace = await requireWorkspace4(db, workspaceId);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults2(workspace.settings);
   const parentAuthority = parentSession ? await getSessionAuthorityProjection4(db, workspaceId, parentSession.id) : null;
   if (parentSession && !parentAuthority) {
     throw new HTTPException15(403, {
@@ -9426,23 +9732,32 @@ async function acceptSessionUserMessageInFileScope(deps, grant, workspaceId, ses
       connectionDelegationSource.sessionId,
       connectionDelegationSource.turnId
     ) : null;
+    const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
+      db,
+      workspaceId,
+      settings,
+      inheritedPersonalConnectionDelegations ? {
+        personalConnectionDelegations: inheritedPersonalConnectionDelegations
+      } : { subjectId: grant.subjectId }
+    );
     const runtimeSettings = settingsWithSessionMcpServerMetadata(
-      await settingsWithEnabledCapabilityMcpServers(
-        db,
-        workspaceId,
-        settings,
-        inheritedPersonalConnectionDelegations ? {
-          personalConnectionDelegations: inheritedPersonalConnectionDelegations
-        } : { subjectId: grant.subjectId }
-      ),
+      capabilityRuntimeSettings,
       existingSession.mcpServers
     );
+    const connectionAccountTools = sessionToolsForConnectionAccounts({
+      session: existingSession,
+      runtimeMcpServers: runtimeSettings.mcpServers,
+      defaultMcpServerIds: workspaceSessionToolPolicyDefaultServerIdsFor(
+        capabilityRuntimeSettings.mcpServers,
+        (await requireWorkspace4(db, workspaceId)).settings
+      )
+    });
     const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
       db,
       accountId: grant.accountId,
       workspaceId,
       settings: runtimeSettings,
-      tools: existingSession.tools,
+      tools: connectionAccountTools,
       resources: [...existingSession.resources, ...requestedResources],
       source: connectionDelegationSource,
       targetSessionId: sessionId,
@@ -9607,7 +9922,7 @@ async function updateSessionMcpApprovalPolicy(deps, grant, sessionId, serverId,
   };
 }
 function toolPolicyAuditSnapshot(session, tools, firstPartyMcpTools, policy = session.toolPolicy) {
-  const allToolRefs = mergeToolRefs([], tools).sort((left, right) => {
+  const allToolRefs = mergeToolRefs2([], tools).sort((left, right) => {
     const leftMandatory = left.kind === "mcp" && left.id === "opengeni";
     const rightMandatory = right.kind === "mcp" && right.id === "opengeni";
     if (leftMandatory !== rightMandatory) return leftMandatory ? -1 : 1;
@@ -9644,8 +9959,8 @@ async function updateSessionToolPolicy(deps, grant, sessionId, request) {
   requirePermission(grant, "sessions:control");
   const agentAttemptCaller = grantHasAgentAttemptAuthority(grant);
   const existingSession = await requireSession2(deps.db, grant.workspaceId, sessionId);
-  const workspace = await requireWorkspace3(deps.db, grant.workspaceId);
-  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  const workspace = await requireWorkspace4(deps.db, grant.workspaceId);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults2(workspace.settings);
   const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     grant.workspaceId,
@@ -9930,7 +10245,15 @@ function withFirstPartyTools(tools, runtimeSettings) {
   if (!runtimeSettings.mcpServers.some((server) => server.id === "opengeni")) {
     return tools;
   }
-  return mergeToolRefs(tools, [{ kind: "mcp", id: "opengeni" }]);
+  return mergeToolRefs2(tools, [{ kind: "mcp", id: "opengeni" }]);
+}
+function sessionToolsForConnectionAccounts(input) {
+  return resolveSessionToolPolicy({
+    toolPolicy: input.session.toolPolicy,
+    sessionTools: input.session.tools,
+    availableMcpServerIds: [...input.runtimeMcpServers].map((server) => server.id),
+    defaultMcpServerIds: input.defaultMcpServerIds
+  }).toolRefs;
 }
 function hasOwnProperty(value, key) {
   return Boolean(
@@ -10629,12 +10952,13 @@ import { HTTPException as HTTPException19 } from "hono/http-exception";
 import { pinnedFetch as pinnedFetch2, readResponseJsonBounded as readResponseJsonBounded2, readResponseTextBounded } from "@opengeni/network";
 import {
   PORTABLE_SKILL_MAX_FILES as PORTABLE_SKILL_MAX_FILES2,
+  PORTABLE_SKILL_MAX_FILE_BYTES as PORTABLE_SKILL_MAX_FILE_BYTES2,
   PORTABLE_SKILL_MAX_TOTAL_BYTES as PORTABLE_SKILL_MAX_TOTAL_BYTES2
 } from "@opengeni/runtime/skill-library";
 var githubApiBase = "https://api.github.com";
 var githubRequestTimeoutMs = 15e3;
 var githubMetadataMaxBytes = 4 * 1024 * 1024;
-var githubBlobResponseMaxBytes = 512 * 1024;
+var githubBlobResponseMaxBytes = PORTABLE_SKILL_MAX_FILE_BYTES2 * 2;
 function createGitHubSkillSourceClient(settings, requestJson = (path, maxBytes, label) => githubJson(settings, path, maxBytes, label)) {
   const readJson = requestJson;
   const cache = /* @__PURE__ */ new Map();
@@ -12187,147 +12511,6 @@ function personalGitHubActionPolicyActor(input) {
   };
 }
 
-// src/domain/session-tool-policy.ts
-import {
-  SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
-  SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
-  mergeToolRefs as mergeToolRefs2,
-  resolveWorkspaceSessionToolDefaults as resolveWorkspaceSessionToolDefaults2
-} from "@opengeni/contracts";
-import { requireWorkspace as requireWorkspace4 } from "@opengeni/db";
-var MANDATORY_SESSION_MCP_SERVER_IDS = ["opengeni"];
-var PROJECTABLE_REGISTRY_ID = /^[A-Za-z0-9_-]+$/;
-function sortedIds(ids) {
-  return [...new Set(ids)].sort();
-}
-function defaultSessionMcpServerIds(servers) {
-  const mandatory = new Set(MANDATORY_SESSION_MCP_SERVER_IDS);
-  return sortedIds([...servers].map((server) => server.id).filter((id) => !mandatory.has(id)));
-}
-function projectIds(ids) {
-  const projectable = ids.filter(
-    (id) => id.length <= SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH && PROJECTABLE_REGISTRY_ID.test(id)
-  );
-  return {
-    ids: projectable.slice(0, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT),
-    truncated: projectable.length !== ids.length || projectable.length > SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT
-  };
-}
-function resolveSessionToolPolicy(input) {
-  const policy = input.toolPolicy;
-  const availableIds = new Set(input.availableMcpServerIds);
-  const defaultIds = new Set(input.defaultMcpServerIds ?? []);
-  const mandatoryIds = MANDATORY_SESSION_MCP_SERVER_IDS.filter(
-    (id) => availableIds.has(id)
-  );
-  const mandatoryIdSet = new Set(mandatoryIds);
-  const tracksWorkspaceDefaults = policy.mode === "workspace_default";
-  const excludedIds = new Set(tracksWorkspaceDefaults ? policy.excludedMcpServerIds : []);
-  const selectedRefs = mergeToolRefs2([], input.sessionTools).filter(
-    (tool) => !excludedIds.has(tool.id) || mandatoryIdSet.has(tool.id)
-  );
-  let toolRefs = selectedRefs.filter((tool) => availableIds.has(tool.id));
-  if (tracksWorkspaceDefaults) {
-    toolRefs = mergeToolRefs2(
-      toolRefs,
-      sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true }))
-    );
-  }
-  toolRefs = mergeToolRefs2(
-    toolRefs,
-    mandatoryIds.map((id) => ({ kind: "mcp", id }))
-  );
-  const requestedEffectiveRefs = mergeToolRefs2(
-    selectedRefs,
-    tracksWorkspaceDefaults ? sortedIds(defaultIds).filter((id) => availableIds.has(id) && !excludedIds.has(id)).map((id) => ({ kind: "mcp", id, optional: true })) : []
-  );
-  const effectiveIds = sortedIds(
-    mergeToolRefs2(
-      requestedEffectiveRefs,
-      mandatoryIds.map((id) => ({ kind: "mcp", id }))
-    ).map((tool) => tool.id)
-  );
-  const configuredIds = effectiveIds.filter((id) => availableIds.has(id));
-  const configuredIdSet = new Set(configuredIds);
-  const droppedIds = effectiveIds.filter((id) => !configuredIdSet.has(id));
-  const deferredIds = sortedIds(
-    toolRefs.filter((tool) => configuredIdSet.has(tool.id) && tool.eager !== true).map((tool) => tool.id)
-  );
-  const selectedIds = sortedIds(
-    selectedRefs.filter(
-      (tool) => !mandatoryIdSet.has(tool.id) && !(tracksWorkspaceDefaults && tool.optional === true)
-    ).map((tool) => tool.id)
-  );
-  const projections = {
-    selected: projectIds(selectedIds),
-    effective: projectIds(effectiveIds),
-    mandatory: projectIds(sortedIds(mandatoryIds)),
-    deferred: projectIds(deferredIds),
-    configured: projectIds(configuredIds),
-    dropped: projectIds(droppedIds)
-  };
-  return {
-    toolRefs,
-    effectivePolicy: {
-      mode: policy.mode,
-      inheritedFromSessionId: policy.inheritedFromSessionId,
-      selectedIds: projections.selected.ids,
-      effectiveIds: projections.effective.ids,
-      mandatoryIds: projections.mandatory.ids,
-      lazyRouter: {
-        state: deferredIds.length > 0 ? "required" : "disabled",
-        deferredIds: projections.deferred.ids
-      },
-      configuredIds: projections.configured.ids,
-      droppedIds: projections.dropped.ids,
-      counts: {
-        selected: selectedIds.length,
-        effective: effectiveIds.length,
-        mandatory: mandatoryIds.length,
-        deferred: deferredIds.length,
-        configured: configuredIds.length,
-        dropped: droppedIds.length
-      },
-      idsTruncated: Object.values(projections).some((projection) => projection.truncated)
-    }
-  };
-}
-async function workspaceSessionToolPolicyServerIds(db, workspaceId, settings, subjectId) {
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
-    ...subjectId ? { subjectId } : {}
-  });
-  return sortedIds(runtimeSettings.mcpServers.map((server) => server.id));
-}
-async function workspaceSessionToolPolicyDefaultServerIds(db, workspaceId, settings, subjectId) {
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
-    ...subjectId ? { subjectId } : {}
-  });
-  const availableDefaults = defaultSessionMcpServerIds(runtimeSettings.mcpServers);
-  const workspace = await requireWorkspace4(db, workspaceId);
-  const configured = resolveWorkspaceSessionToolDefaults2(workspace.settings);
-  if (!configured?.mcpServerIds) return availableDefaults;
-  const available = new Set(availableDefaults);
-  return sortedIds([
-    ...configured.mcpServerIds.filter((id) => available.has(id)),
-    ...configured.inheritConnectedMcpServers ? availableDefaults.filter((id) => !["opengeni", "files", "docs"].includes(id)) : []
-  ]);
-}
-function sessionWithEffectiveToolPolicy(session, workspaceServerIds, workspaceDefaultServerIds = []) {
-  const availableIds = new Set(workspaceServerIds);
-  for (const server of session.mcpServers) {
-    availableIds.add(server.id);
-  }
-  return {
-    ...session,
-    effectiveToolPolicy: resolveSessionToolPolicy({
-      toolPolicy: session.toolPolicy,
-      sessionTools: session.tools,
-      availableMcpServerIds: availableIds,
-      defaultMcpServerIds: workspaceDefaultServerIds
-    }).effectivePolicy
-  };
-}
-
 // src/domain/scheduled-tasks.ts
 import {
   scheduledTaskKnowledgeSource,
@@ -15932,6 +16115,7 @@ import {
   publicNewSessionDraftOptions,
   requireFileForSubject as requireFileForSubject2,
   saveNewSessionDraftInTransaction,
+  reusableNewSessionRepositoryResource,
   withWorkspaceSubjectRls as withWorkspaceSubjectRls6
 } from "@opengeni/db";
 import { HTTPException as HTTPException23 } from "hono/http-exception";
@@ -16153,6 +16337,31 @@ async function saveActorNewSessionDraft(...args) {
   const actor = authorization ? await fileOwnerContextForAccess(deps, authorization, "sessions:create") : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
   return withSessionRlsActorContext6(actor, () => saveActorNewSessionDraftInFileScope(...args));
 }
+async function getActorNewSessionDefaults(deps, grant, workspaceId) {
+  const draft = await getActorNewSessionDraft(deps, grant, workspaceId);
+  const options = draft.options;
+  return {
+    // Revision zero is a synthetic empty form, not a user's model preference.
+    ...draft.revision > 0 ? {
+      model: draft.model,
+      reasoningEffort: draft.reasoningEffort,
+      latencyMode: draft.latencyMode
+    } : {},
+    resources: draft.resources.flatMap(
+      (resource) => resource.kind === "repository" ? [reusableNewSessionRepositoryResource(resource)] : []
+    ),
+    ...draft.toolsProvided ? { tools: draft.tools } : options.excludedMcpServerIds ? { excludedMcpServerIds: options.excludedMcpServerIds } : {},
+    ...options.firstPartyMcpTools ? { firstPartyMcpTools: options.firstPartyMcpTools } : {},
+    ...options.firstPartyMcpPermissions ? { firstPartyMcpPermissions: options.firstPartyMcpPermissions } : {},
+    ...options.variableSetIds ? { variableSetIds: options.variableSetIds } : {},
+    ...options.rigId ? { rigId: options.rigId } : {},
+    ...options.sandboxBackend ? { sandboxBackend: options.sandboxBackend } : {},
+    ...options.targetSandboxId ? {
+      targetSandboxId: options.targetSandboxId,
+      ...options.workingDir ? { workingDir: options.workingDir } : {}
+    } : {}
+  };
+}
 
 // src/application/composer-submit.ts
 async function submitComposerDraftForRequest(deps, grant, workspaceId, sessionId, input, options = {}) {
@@ -17265,7 +17474,7 @@ var CATALOG_PAGE_SIZE = 25;
 var CATALOG_PAGE_BUDGET = 40;
 var DESCRIPTION_CHARS = 2e3;
 var CATALOG_BYTES = 256 * 1024;
-async function prepareKnowledgeSave(db, context, input, embedder, services = defaults) {
+async function prepareKnowledgeSave(db, context, input, embedder, services = defaults, settings) {
   const request = KnowledgeSavePreparationRequest.parse(input);
   if (context.actor.kind !== "agent" && !(context.actor.kind === "human" && context.actor.review)) {
     throw Object.assign(
@@ -17290,20 +17499,31 @@ async function prepareKnowledgeSave(db, context, input, embedder, services = def
     complete: true,
     nextCursors: { published: null, needs_review: null }
   };
-  const matches = {
-    published: await services.search(
-      db,
-      context,
-      { query: request.query, limit: request.limit, view: "published" },
-      sharedEmbedder
-    ),
-    needs_review: await services.search(
-      db,
-      context,
-      { query: request.query, limit: request.limit, view: "needs_review" },
-      sharedEmbedder
-    )
-  };
+  const paid = settings != null && paidDocumentEmbedding(settings);
+  const published = await services.search(
+    db,
+    context,
+    {
+      query: request.query,
+      limit: request.limit,
+      view: "published",
+      ...paid ? { mode: "keyword" } : {}
+    },
+    sharedEmbedder,
+    paid ? void 0 : settings
+  );
+  const needsReview = await services.search(
+    db,
+    context,
+    {
+      query: request.query,
+      limit: request.limit,
+      view: "needs_review",
+      ...published.searchMode === "keyword" ? { mode: "keyword" } : {}
+    },
+    sharedEmbedder
+  );
+  const matches = { published, needs_review: needsReview };
   for (const view of ["published", "needs_review"]) {
     if (request.collectionCursors && request.collectionCursors[view] === null) continue;
     let cursor = request.collectionCursors?.[view] ?? void 0;
@@ -17712,6 +17932,8 @@ export {
   InMemoryEditableArtifactLiveTicketStore,
   InMemoryEditableArtifactStableIdFactory,
   InMemoryEditableArtifactStore,
+  KnowledgeVectorFundingError,
+  KnowledgeVectorQueryRejectedError,
   MAX_CHECKS_PER_RIG,
   MAX_CREDENTIAL_HOOKS_PER_RIG,
   MAX_DEFAULT_VARIABLE_SETS_PER_RIG,
@@ -17860,6 +18082,7 @@ export {
   directRetainedProcessMatchesBackend,
   disableCapability,
   discoverMcpRegistryCapabilities,
+  documentEmbeddingCostMicros,
   editHumanQueuePrompt,
   editableArtifactActorKey,
   editableArtifactAuthorizationRevisionPortFromPostgres,
@@ -17907,6 +18130,7 @@ export {
   freezeAgentChildAutomaticTitleInCreatorContext,
   freezeConnectionAccounts,
   freezePersonalConnectionDelegations,
+  getActorNewSessionDefaults,
   getActorNewSessionDraft,
   getAutomationAdapter,
   getConnectorToolPermissions,
@@ -17977,7 +18201,7 @@ export {
   mergeCausalFrontiers,
   mergeResourceRefs,
   mergeRigDefaultVariableSetEnvironment,
-  mergeToolRefs,
+  mergeToolRefs2 as mergeToolRefs,
   modelFundingForAdmission,
   moveHumanQueuePrompt,
   nativeConnectionCapabilityRecommendations,
@@ -18001,6 +18225,7 @@ export {
   openGeniSlackBotMetadata,
   organizationIntegrationCatalog,
   organizationMembershipHttpStatus,
+  paidDocumentEmbedding,
   parseGitHubRepositoryCoordinates,
   parseSkillSource,
   personalAtlassianDelegationsFromVisibleConnections,
@@ -18128,9 +18353,11 @@ export {
   searchKnowledgeEntries,
   selectedPersonalConnectionServers,
   sendAgentSessionMessage,
+  sessionGroupMachinePresentation,
   sessionMcpRotationFingerprint,
   sessionRlsActorForAuthorization,
   sessionSpawnDenialEnvelope,
+  sessionToolsForConnectionAccounts,
   sessionWithEffectiveToolPolicy,
   settingsWithApiIntegrationServers,
   settingsWithCodexAppsMcpServer,
@@ -18196,6 +18423,7 @@ export {
   workspaceCustomModelReference,
   workspaceInsightsPhaseMetricObserver,
   workspaceSessionToolPolicyDefaultServerIds,
+  workspaceSessionToolPolicyDefaultServerIdsFor,
   workspaceSessionToolPolicyServerIds,
   wrapChannelABoxWithRouting
 };