@opengeni/core 4.0.1 → 4.0.3-canary.36199476632001

package/dist/index.js

@@ -1378,8 +1378,257 @@ async function knowledgeContextForAccess(deps, access, permission) {
 
 // src/domain/knowledge-search.ts
 import { KnowledgeEntryListRequest } from "@opengeni/contracts";
-import { listKnowledgeEntries } from "@opengeni/db";
-async function searchKnowledgeEntries(db, context, input, embedder) {
+import {
+  applyCreditDebitAfterUse,
+  getBillingBalance as getBillingBalance2,
+  listKnowledgeEntries,
+  recordUsageEvent as recordUsageEvent2,
+  sumUsageQuantity as sumUsageQuantity2,
+  withKnowledgeQueryAccountLock
+} from "@opengeni/db";
+
+// src/billing/limits.ts
+import {
+  configuredStaticUsageLimits,
+  resolveModelProviderForTurn
+} from "@opengeni/config";
+import {
+  countActiveApiKeysForWorkspace,
+  countActiveOrganizationApiKeysForAccount,
+  countScheduledTasksForWorkspace,
+  countWorkspacesForAccount,
+  getBillingBalance,
+  isCodexBilledTurn,
+  recordUsageEvent,
+  sumUsageQuantity
+} from "@opengeni/db";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
+function paidDocumentEmbedding(settings) {
+  return settings.documentEmbeddingBillingMode === "credits" && settings.documentEmbeddingProvider === "openai";
+}
+function documentEmbeddingCostMicros(settings, inputBytes) {
+  if (!Number.isSafeInteger(inputBytes) || inputBytes < 0)
+    throw new Error("invalid embedding bytes");
+  const amount = (BigInt(inputBytes) * BigInt(settings.documentEmbeddingRateMicrosPerMillionBytes) + 999999n) / 1000000n;
+  if (amount > BigInt(Number.MAX_SAFE_INTEGER))
+    throw new Error("embedding cost exceeds safe integer");
+  return Number(amount);
+}
+function modelFundingForAdmission(settings, model, codexBilled) {
+  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
+  const codexSubscriptionModel = resolvedModel?.credentialSource.kind === "connected_subscription" && resolvedModel.credentialSource.provider === "codex";
+  return {
+    // A Codex namespace/definition never bypasses credits by itself: the live
+    // workspace credential predicate above remains authoritative. SuperGrok's
+    // static overlay is likewise secret-free; its worker/provider admission
+    // owns live account selection before any upstream request can occur.
+    fundedWithoutCredits: codexBilled || resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits",
+    countsTowardTokenCap: !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment"
+  };
+}
+async function requireLimit(deps, input) {
+  const decision = await checkLimit(deps, input);
+  if (decision.allowed) {
+    return;
+  }
+  throw new HTTPException4(decision.code === "insufficient_credits" ? 402 : 429, {
+    message: decision.message
+  });
+}
+async function checkLimit(deps, input) {
+  const codexBilled = input.workspaceId ? await isCodexBilledTurn({
+    db: deps.db,
+    settings: deps.settings,
+    workspaceId: input.workspaceId,
+    model: input.model
+  }) : false;
+  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
+    deps.settings,
+    input.model,
+    codexBilled
+  );
+  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
+  if (!creditDecision.allowed) {
+    return creditDecision;
+  }
+  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
+    return { allowed: true };
+  }
+  return await checkStaticCaps(deps, input, {
+    fundedWithoutCredits,
+    countsTowardTokenCap
+  });
+}
+async function checkCreditBalance(deps, input, externallyBilled) {
+  if (externallyBilled) {
+    return { allowed: true };
+  }
+  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
+    return { allowed: true };
+  }
+  const balance = await getBillingBalance(deps.db, input.accountId);
+  if (balance.balanceMicros > 0) {
+    return { allowed: true };
+  }
+  return { allowed: false, code: "insufficient_credits", message: "insufficient OpenGeni credits" };
+}
+async function checkStaticCaps(deps, input, funding) {
+  const limits = configuredStaticUsageLimits(deps.settings);
+  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !funding.fundedWithoutCredits) {
+    const used = await sumUsageQuantity(deps.db, {
+      accountId: input.accountId,
+      eventType: "model.cost",
+      since: startOfUtcMonth()
+    });
+    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
+      return blocked(
+        "max_monthly_cost_micros_per_account",
+        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`
+      );
+    }
+  }
+  switch (input.action) {
+    case "workspace:create": {
+      if (!limits.maxWorkspacesPerAccount) {
+        return { allowed: true };
+      }
+      const count = await countWorkspacesForAccount(deps.db, input.accountId);
+      return count < limits.maxWorkspacesPerAccount ? { allowed: true } : blocked(
+        "max_workspaces_per_account",
+        `workspace limit reached (${limits.maxWorkspacesPerAccount})`
+      );
+    }
+    case "api_key:create": {
+      if (!limits.maxApiKeysPerWorkspace) {
+        return { allowed: true };
+      }
+      const count = input.workspaceId ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId) : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
+      return count < limits.maxApiKeysPerWorkspace ? { allowed: true } : blocked(
+        "max_api_keys_per_workspace",
+        `API key limit reached (${limits.maxApiKeysPerWorkspace})`
+      );
+    }
+    case "schedule:create": {
+      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);
+      return count < limits.maxSchedulesPerWorkspace ? { allowed: true } : blocked(
+        "max_schedules_per_workspace",
+        `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`
+      );
+    }
+    case "file:upload": {
+      if (!limits.maxFileUploadBytes || !input.quantity) {
+        return { allowed: true };
+      }
+      return input.quantity <= limits.maxFileUploadBytes ? { allowed: true } : blocked(
+        "max_file_upload_bytes",
+        `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`
+      );
+    }
+    case "agent_run:create": {
+      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "agent_run.created",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace ? { allowed: true } : blocked(
+        "max_monthly_agent_runs_per_workspace",
+        `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`
+      );
+    }
+    case "tokens:consume": {
+      if (!funding.countsTowardTokenCap || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "model.tokens",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxMonthlyTokensPerWorkspace ? { allowed: true } : blocked(
+        "max_monthly_tokens_per_workspace",
+        `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`
+      );
+    }
+    case "document:index": {
+      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "document.indexed",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace ? { allowed: true } : blocked(
+        "max_document_indexed_chunks_per_workspace",
+        `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`
+      );
+    }
+  }
+}
+async function recordWorkspaceUsage(deps, input) {
+  await recordUsageEvent(deps.db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId ?? null,
+    eventType: input.eventType,
+    quantity: input.quantity,
+    unit: input.unit,
+    sourceResourceType: input.sourceResourceType,
+    sourceResourceId: input.sourceResourceId,
+    sessionId: input.sessionId ?? null,
+    turnId: input.turnId ?? null,
+    turnAttemptId: input.turnAttemptId ?? null,
+    initiator: input.initiator ?? (input.subjectId ? { kind: "subject", subjectId: input.subjectId } : null),
+    ...input.initiatorContext ? { initiatorContext: input.initiatorContext } : {},
+    origin: input.origin ?? null,
+    idempotencyKey: input.idempotencyKey
+  });
+}
+function usesCreditLimits(deps) {
+  return deps.settings.billingMode === "stripe" || deps.settings.usageLimitsMode === "managed";
+}
+function isCostlyAction(action) {
+  return action === "agent_run:create" || action === "tokens:consume";
+}
+function blocked(code, message) {
+  return { allowed: false, code, message };
+}
+function startOfUtcMonth() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+
+// src/domain/knowledge-search.ts
+var MAX_PAID_QUERY_BYTES = 4096;
+var MAX_PAID_QUERY_MICROS = 1e3;
+var MAX_PAID_QUERY_BYTES_PER_MINUTE = 64 * 1024;
+var MAX_PAID_QUERY_BYTES_PER_MONTH = 8 * 1024 * 1024;
+var MAX_PAID_QUERY_MICROS_PER_MINUTE = 1e4;
+var MAX_PAID_QUERY_MICROS_PER_MONTH = 1e6;
+var KnowledgeVectorFundingError = class extends Error {
+  code = "knowledge_vector_funding_required";
+  constructor() {
+    super("Knowledge vector search needs OpenGeni credits; keyword search remains available.");
+    this.name = "KnowledgeVectorFundingError";
+  }
+};
+var KnowledgeVectorQueryRejectedError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "KnowledgeVectorQueryRejectedError";
+  }
+};
+async function searchKnowledgeEntries(db, context, input, embedder, settings) {
   const request = KnowledgeEntryListRequest.parse(input);
   if (!request.query || request.mode === "keyword") {
     return {
@@ -1390,25 +1639,119 @@ async function searchKnowledgeEntries(db, context, input, embedder) {
   const lexicalQuery = /^[\p{L}\p{N}\s]+$/u.test(request.query) && !/\bOR\b/i.test(request.query) ? [...new Set(request.query.trim().split(/\s+/u))].map((term) => `"${term}"`).join(" OR ") : request.query;
   const lexicalRequest = KnowledgeEntryListRequest.safeParse({ ...request, query: lexicalQuery });
   const retrievalRequest = request.mode === "hybrid" && lexicalRequest.success ? lexicalRequest.data : request;
-  let embedding;
-  try {
-    const provider = embedder();
-    const values = await provider.embedQuery(request.query);
-    if (values.length !== provider.dimensions || values.some((value) => !Number.isFinite(value)) || !values.some((value) => value !== 0)) {
-      throw new Error("Knowledge query embedding is unavailable");
-    }
-    embedding = { model: provider.model, values };
-  } catch (error) {
+  const keywordFallback = async (queryDb, error, fallbackReason) => {
     if (request.mode === "vector") throw error;
     return {
-      ...await listKnowledgeEntries(db, context, { ...retrievalRequest, mode: "keyword" }),
-      searchMode: "keyword"
+      ...await listKnowledgeEntries(queryDb, context, { ...retrievalRequest, mode: "keyword" }),
+      searchMode: "keyword",
+      fallbackReason
     };
-  }
-  return {
-    ...await listKnowledgeEntries(db, context, retrievalRequest, embedding),
-    searchMode: request.mode
   };
+  const bytes = Buffer.byteLength(request.query, "utf8");
+  const paidSettings = settings && paidDocumentEmbedding(settings) ? settings : void 0;
+  if (paidSettings && request.cursor)
+    throw new KnowledgeVectorQueryRejectedError(
+      "pagination_unavailable",
+      "Paid semantic Knowledge pagination is unavailable; use keyword mode"
+    );
+  const cost = paidSettings ? documentEmbeddingCostMicros(paidSettings, bytes) : 0;
+  if (paidSettings && (bytes > MAX_PAID_QUERY_BYTES || cost > MAX_PAID_QUERY_MICROS))
+    return keywordFallback(
+      db,
+      new KnowledgeVectorQueryRejectedError(
+        "query_limit",
+        "Paid Knowledge query exceeds the per-request limit"
+      ),
+      "query_limit"
+    );
+  const retrieveThenSettle = async (queryDb) => {
+    let embedding;
+    try {
+      const provider = embedder();
+      const values = await provider.embedQuery(request.query);
+      if (values.length !== provider.dimensions || values.some((value) => !Number.isFinite(value)) || !values.some((value) => value !== 0))
+        throw new Error("Knowledge query embedding is unavailable");
+      embedding = { model: provider.model, values };
+    } catch (error) {
+      return keywordFallback(queryDb, error, "provider_unavailable");
+    }
+    const found = await listKnowledgeEntries(queryDb, context, retrievalRequest, embedding);
+    if (settings) {
+      const usageId = crypto.randomUUID();
+      await recordUsageEvent2(queryDb, {
+        accountId: context.accountId,
+        workspaceId: context.workspaceId,
+        eventType: "document.query_embedding_bytes",
+        quantity: bytes,
+        unit: "byte",
+        sourceResourceType: "knowledge_query",
+        sourceResourceId: usageId,
+        idempotencyKey: `knowledge.query_bytes:${usageId}`
+      });
+      if (paidSettings && cost > 0)
+        await recordUsageEvent2(queryDb, {
+          accountId: context.accountId,
+          workspaceId: context.workspaceId,
+          eventType: "document.query_embedding_cost",
+          quantity: cost,
+          unit: "micro_usd",
+          sourceResourceType: "knowledge_query",
+          sourceResourceId: usageId,
+          idempotencyKey: `knowledge.query_cost:${usageId}`
+        });
+      if (paidSettings && cost > 0)
+        await applyCreditDebitAfterUse(queryDb, {
+          accountId: context.accountId,
+          workspaceId: context.workspaceId,
+          type: "document_embedding_debit",
+          amountMicros: cost,
+          sourceType: "knowledge_query",
+          sourceId: usageId,
+          idempotencyKey: `knowledge.query_embedding:${usageId}`,
+          metadata: { model: embedding.model, bytes }
+        });
+    }
+    return { ...found, searchMode: request.mode };
+  };
+  if (!paidSettings) return retrieveThenSettle(db);
+  return withKnowledgeQueryAccountLock(
+    db,
+    context.accountId,
+    context.workspaceId,
+    async (lockedDb) => {
+      const balance = await getBillingBalance2(lockedDb, context.accountId);
+      if (balance.balanceMicros <= 0)
+        return keywordFallback(lockedDb, new KnowledgeVectorFundingError(), "awaiting_funding");
+      const now = /* @__PURE__ */ new Date();
+      const minuteBytes = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_bytes",
+        since: new Date(now.getTime() - 6e4)
+      });
+      const monthBytes = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_bytes",
+        since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1))
+      });
+      const minuteMicros = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_cost",
+        since: new Date(now.getTime() - 6e4)
+      });
+      const monthMicros = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_cost",
+        since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1))
+      });
+      if (minuteBytes + bytes > MAX_PAID_QUERY_BYTES_PER_MINUTE || monthBytes + bytes > MAX_PAID_QUERY_BYTES_PER_MONTH || minuteMicros + cost > MAX_PAID_QUERY_MICROS_PER_MINUTE || monthMicros + cost > MAX_PAID_QUERY_MICROS_PER_MONTH)
+        return keywordFallback(
+          lockedDb,
+          new KnowledgeVectorQueryRejectedError("quota", "Paid Knowledge query rate limit reached"),
+          "quota"
+        );
+      return retrieveThenSettle(lockedDb);
+    }
+  );
 }
 
 // src/workflow-wake-contract.ts
@@ -1980,6 +2323,270 @@ function resolveWorkspaceModelSelection(input) {
   });
 }
 
+// src/default-session-model.ts
+import {
+  canonicalizeConfiguredModelId
+} from "@opengeni/config";
+import {
+  resolveWorkspaceSessionDefaults
+} from "@opengeni/contracts";
+import {
+  getScheduledTaskXaiProviderAccountAuthoritySnapshot,
+  getSession as getSession2,
+  getWorkspace,
+  getWorkspaceConnectionModelRestrictions,
+  getWorkspaceModelPolicy,
+  listOrganizationModelProviderCustomModelsForWorkspace as listOrganizationModelProviderCustomModelsForWorkspace2,
+  listWorkspaceGatewayCustomModels as listWorkspaceGatewayCustomModels2,
+  listWorkspaceOpenRouterCustomModels as listWorkspaceOpenRouterCustomModels2,
+  organizationModelProviderConnectionActiveForWorkspace,
+  workspaceCodexSubscriptionActive,
+  workspaceOpenRouterConnectionActive,
+  workspaceVercelAiGatewayConnectionActive,
+  organizationHoldsCredits,
+  workspaceXaiSubscriptionActive,
+  workspaceXaiSubscriptionActiveForAuthority,
+  XaiAuthorityPoolInactiveError
+} from "@opengeni/db";
+var REASONING_EFFORT_ORDER = [
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
+function supportedReasoningEfforts(model) {
+  const efforts = model.capabilities.reasoning.efforts;
+  return REASONING_EFFORT_ORDER.filter((effort) => efforts.includes(effort));
+}
+function defaultReasoningEffortForConfiguredModel(model, fallback) {
+  const options = supportedReasoningEfforts(model);
+  if (options.length === 0) return fallback;
+  const configured = model.capabilities.reasoning.defaultEffort;
+  if (configured && options.includes(configured)) return configured;
+  return options[0];
+}
+function clampReasoningEffortForConfiguredModel(model, preferred, fallback) {
+  const options = supportedReasoningEfforts(model);
+  if (options.length === 0) return fallback;
+  if (options.includes(preferred)) return preferred;
+  const ceiling = REASONING_EFFORT_ORDER.indexOf(preferred);
+  const below = options.filter((effort) => REASONING_EFFORT_ORDER.indexOf(effort) <= ceiling);
+  return below.at(-1) ?? defaultReasoningEffortForConfiguredModel(model, fallback);
+}
+function findSelection(selections, modelId) {
+  return selections.find((selection) => selection.model.id === modelId) ?? selections.find((selection) => selection.model.aliases.includes(modelId));
+}
+function creditsCandidate(input) {
+  const fallbackEffort = input.settings.openaiReasoningEffort;
+  const deployment = findSelection(input.selections, input.settings.openaiModel);
+  if (deployment?.availability.selectable && deployment.model.cost === "credits") return null;
+  const configured = findSelection(input.selections, input.settings.creditsDefaultModel);
+  if (configured?.availability.selectable && configured.model.cost === "credits") {
+    return {
+      model: configured.model.id,
+      reasoningEffort: clampReasoningEffortForConfiguredModel(
+        configured.model,
+        input.settings.creditsDefaultReasoningEffort,
+        fallbackEffort
+      ),
+      source: "credits"
+    };
+  }
+  const first = input.selections.find(
+    (selection) => selection.availability.selectable && selection.model.cost === "credits"
+  );
+  return first ? {
+    model: first.model.id,
+    reasoningEffort: defaultReasoningEffortForConfiguredModel(first.model, fallbackEffort),
+    source: "credits"
+  } : null;
+}
+function selectDefaultSessionModel(input) {
+  const fallbackEffort = input.settings.openaiReasoningEffort;
+  if (input.workspaceDefaults) {
+    const saved = findSelection(input.selections, input.workspaceDefaults.model);
+    if (saved?.availability.selectable) {
+      return {
+        model: saved.model.id,
+        reasoningEffort: clampReasoningEffortForConfiguredModel(
+          saved.model,
+          input.workspaceDefaults.reasoningEffort,
+          fallbackEffort
+        ),
+        source: "workspace"
+      };
+    }
+  }
+  const deployment = findSelection(input.selections, input.settings.openaiModel);
+  const subscription = deployment?.availability.selectable && deployment.model.cost === "subscription" ? deployment : input.selections.find(
+    (selection) => selection.availability.selectable && selection.model.cost === "subscription"
+  );
+  if (subscription) {
+    return {
+      model: subscription.model.id,
+      reasoningEffort: defaultReasoningEffortForConfiguredModel(subscription.model, fallbackEffort),
+      source: "subscription"
+    };
+  }
+  if (input.creditsAvailable) {
+    const credits = creditsCandidate(input);
+    if (credits) return credits;
+  }
+  return {
+    model: deployment?.model.id ?? canonicalizeConfiguredModelId(input.settings, input.settings.openaiModel),
+    reasoningEffort: fallbackEffort,
+    source: "deployment"
+  };
+}
+function creditsDefaultSessionModel(input) {
+  if (input.settings.billingMode !== "stripe") return null;
+  return selectDefaultSessionModel({
+    settings: input.settings,
+    selections: input.selections,
+    workspaceDefaults: resolveWorkspaceSessionDefaults(input.workspaceSettings),
+    creditsAvailable: true
+  });
+}
+async function resolveDefaultSessionModelForSelections(db, input) {
+  const decision = {
+    settings: input.settings,
+    selections: input.selections,
+    workspaceDefaults: resolveWorkspaceSessionDefaults(input.workspaceSettings)
+  };
+  const withoutCredits = selectDefaultSessionModel({ ...decision, creditsAvailable: false });
+  if (withoutCredits.source !== "deployment" || input.settings.billingMode !== "stripe" || creditsCandidate(decision) === null) {
+    return withoutCredits;
+  }
+  return await organizationHoldsCredits(db, input.accountId) ? selectDefaultSessionModel({ ...decision, creditsAvailable: true }) : withoutCredits;
+}
+async function connectionRestrictionsAndXaiReadiness(db, settings, context) {
+  const { workspaceId, subjectId, xaiAuthoritySnapshot } = context;
+  if (!xaiAuthoritySnapshot) {
+    const [restrictions2, xaiSubscriptionActive] = await Promise.all([
+      getWorkspaceConnectionModelRestrictions(db, workspaceId, subjectId),
+      workspaceXaiSubscriptionActive(db, settings, workspaceId, subjectId)
+    ]);
+    return { restrictions: restrictions2, xaiSubscriptionActive };
+  }
+  const frozen = await Promise.allSettled([
+    getWorkspaceConnectionModelRestrictions(db, workspaceId, subjectId, xaiAuthoritySnapshot),
+    workspaceXaiSubscriptionActiveForAuthority(db, settings, {
+      workspaceId,
+      subjectId,
+      authoritySnapshot: xaiAuthoritySnapshot
+    })
+  ]);
+  const [restrictions, readiness] = frozen;
+  if (restrictions.status === "fulfilled" && readiness.status === "fulfilled") {
+    return { restrictions: restrictions.value, xaiSubscriptionActive: readiness.value };
+  }
+  for (const result of frozen) {
+    if (result.status === "rejected" && !(result.reason instanceof XaiAuthorityPoolInactiveError)) {
+      throw result.reason;
+    }
+  }
+  const current = await getWorkspaceConnectionModelRestrictions(db, workspaceId, subjectId);
+  return {
+    restrictions: { ...current, "supergrok/": [] },
+    xaiSubscriptionActive: false
+  };
+}
+async function loadWorkspaceModelSelectionInput(db, settings, context) {
+  const { accountId, workspaceId } = context;
+  const [
+    { restrictions: connectionModelRestrictions, xaiSubscriptionActive },
+    policy,
+    codexSubscriptionActive,
+    workspaceGatewayConnectionActive,
+    workspaceGatewayCustomModels,
+    openRouterConnectionActive,
+    workspaceOpenRouterCustomModels,
+    organizationGatewayConnectionActive,
+    organizationOpenRouterConnectionActive,
+    organizationGatewayCustomModels,
+    organizationOpenRouterCustomModels
+  ] = await Promise.all([
+    connectionRestrictionsAndXaiReadiness(db, settings, context),
+    getWorkspaceModelPolicy(db, workspaceId),
+    workspaceCodexSubscriptionActive(db, settings, workspaceId),
+    workspaceVercelAiGatewayConnectionActive(db, workspaceId),
+    listWorkspaceGatewayCustomModels2(db, { accountId, workspaceId }),
+    workspaceOpenRouterConnectionActive(db, workspaceId),
+    listWorkspaceOpenRouterCustomModels2(db, { accountId, workspaceId }),
+    organizationModelProviderConnectionActiveForWorkspace(db, {
+      accountId,
+      workspaceId,
+      providerKind: "vercel_gateway"
+    }),
+    organizationModelProviderConnectionActiveForWorkspace(db, {
+      accountId,
+      workspaceId,
+      providerKind: "openrouter"
+    }),
+    listOrganizationModelProviderCustomModelsForWorkspace2(db, {
+      accountId,
+      workspaceId,
+      providerKind: "vercel_gateway"
+    }),
+    listOrganizationModelProviderCustomModelsForWorkspace2(db, {
+      accountId,
+      workspaceId,
+      providerKind: "openrouter"
+    })
+  ]);
+  return {
+    connectionModelRestrictions,
+    settings,
+    policy,
+    codexSubscriptionActive,
+    xaiSubscriptionActive,
+    workspaceGatewayConnectionActive,
+    workspaceGatewayCustomModels,
+    workspaceOpenRouterConnectionActive: openRouterConnectionActive,
+    workspaceOpenRouterCustomModels,
+    organizationGatewayConnectionActive,
+    organizationOpenRouterConnectionActive,
+    organizationGatewayCustomModels,
+    organizationOpenRouterCustomModels
+  };
+}
+async function resolveDefaultSessionModel(db, settings, context) {
+  const [selectionInput, workspaceSettings] = await Promise.all([
+    loadWorkspaceModelSelectionInput(db, settings, context),
+    context.workspaceSettings !== void 0 ? Promise.resolve(context.workspaceSettings) : getWorkspace(db, context.workspaceId).then((workspace) => workspace?.settings ?? {})
+  ]);
+  return await resolveDefaultSessionModelForSelections(db, {
+    settings,
+    accountId: context.accountId,
+    workspaceSettings,
+    selections: resolveWorkspaceModelSelection(selectionInput)
+  });
+}
+async function resolveScheduledTaskDefaultModel(db, settings, task) {
+  return await resolveDefaultSessionModel(db, settings, {
+    accountId: task.accountId,
+    workspaceId: task.workspaceId,
+    subjectId: task.ownerSubjectId ?? task.createdBy.subjectId,
+    xaiAuthoritySnapshot: await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
+      db,
+      task.workspaceId,
+      task.id
+    )
+  });
+}
+async function resolveScheduledTaskPreflightModel(db, settings, task) {
+  if (task.agentConfig.model) return task.agentConfig.model;
+  const targetSessionId = task.runMode === "existing_session" ? task.targetSessionId : task.runMode === "reusable_session" ? task.reusableSessionId : null;
+  if (targetSessionId) {
+    const session = await getSession2(db, task.workspaceId, targetSessionId);
+    if (session) return session.model;
+  }
+  return (await resolveScheduledTaskDefaultModel(db, settings, task)).model;
+}
+
 // src/sandbox/fleet.ts
 import {
   authorizePersonalMachineForAttempt,
@@ -3272,7 +3879,7 @@ async function provisionSandbox(services, ctx, input) {
 }
 
 // src/application/external-workspace-members.ts
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 import {
   AddExternalWorkspaceMemberRequest,
   ExternalIdentityReference,
@@ -3308,12 +3915,12 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
   const context = await requireAccessContext(c, deps);
   const authority = accountScopedApiKeyWorkspaceAuthority(context);
   if (!authority)
-    throw new HTTPException4(403, {
+    throw new HTTPException5(403, {
       message: "external onboarding requires an organization service key"
     });
   const grant = await requireFreshAccessGrant(c, deps, workspaceId, "members:manage");
   if (grant.accountId !== authority.accountId || payload.permissions.some((permission) => !hasPermission(grant.permissions, permission))) {
-    throw new HTTPException4(403, { message: "membership exceeds key authority" });
+    throw new HTTPException5(403, { message: "membership exceeds key authority" });
   }
   if (payload.operationId) {
     try {
@@ -3339,11 +3946,11 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
       "members:manage"
     );
     if (live.accountId !== grant.accountId || live.subjectId !== grant.subjectId || payload.permissions.some((permission) => !hasPermission(live.permissions, permission))) {
-      throw new HTTPException4(403, { message: "membership authority changed" });
+      throw new HTTPException5(403, { message: "membership authority changed" });
     }
     const workspace = await requireWorkspace2(tx, workspaceId);
     if (workspace.kind !== "shared" || workspace.accountId !== authority.accountId)
-      throw new HTTPException4(403, {
+      throw new HTTPException5(403, {
         message: "external onboarding requires a shared organization workspace"
       });
     const identity = await ensureExternalIdentity2(tx, {
@@ -3357,7 +3964,7 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
     const permissions = [...new Set(payload.permissions)];
     if (existing) {
       if (existing.permissions.length !== permissions.length || existing.permissions.some((permission) => !permissions.includes(permission))) {
-        throw new HTTPException4(409, {
+        throw new HTTPException5(409, {
           message: "existing membership differs; onboarding does not overwrite permissions"
         });
       }
@@ -3376,7 +3983,7 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
 function rethrowExternalWorkspaceOperation(error) {
   const status = organizationMembershipHttpStatus(nestedPostgresSqlState2(error));
   if (status)
-    throw new HTTPException4(status, {
+    throw new HTTPException5(status, {
       message: status === 409 ? "External membership operation changed or was cancelled" : "External membership operation is not available"
     });
   throw error;
@@ -3385,7 +3992,7 @@ async function externalService(c, deps, organizationId) {
   const context = await requireAccessContext(c, deps);
   const authority = accountScopedApiKeyWorkspaceAuthority(context);
   if (!authority || authority.accountId !== organizationId || !hasPermission(authority.permissions, "members:manage")) {
-    throw new HTTPException4(403, {
+    throw new HTTPException5(403, {
       message: "External membership operation requires an organization service key"
     });
   }
@@ -3395,7 +4002,7 @@ async function lookupExternalIdentityForRequest(c, deps, organizationId, input)
   const service = await externalService(c, deps, organizationId);
   const identity = ExternalIdentityReference.safeParse(input);
   if (!identity.success)
-    throw new HTTPException4(422, { message: "Invalid external identity reference" });
+    throw new HTTPException5(422, { message: "Invalid external identity reference" });
   try {
     return await lookupExternalIdentity(deps.db, service, identity.data);
   } catch (error) {
@@ -3406,7 +4013,7 @@ async function cancelExternalWorkspaceMemberGrantForRequest(c, deps, organizatio
   const service = await externalService(c, deps, organizationId);
   const request = CancelExternalWorkspaceMemberGrantRequest.safeParse(input);
   if (!request.success)
-    throw new HTTPException4(422, { message: "Invalid external grant cancellation" });
+    throw new HTTPException5(422, { message: "Invalid external grant cancellation" });
   try {
     return await cancelExternalWorkspaceMemberGrant(
       deps.db,
@@ -3419,7 +4026,7 @@ async function cancelExternalWorkspaceMemberGrantForRequest(c, deps, organizatio
 }
 
 // src/application/external-identity-lifecycle.ts
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
 import { UpdateExternalIdentityMembershipRequest } from "@opengeni/contracts/external-identities";
 import { updateOrganizationMember } from "@opengeni/db";
 async function updateExternalIdentityMembershipForRequest(context, deps, organizationId, membershipId, input) {
@@ -3429,13 +4036,13 @@ async function updateExternalIdentityMembershipForRequest(context, deps, organiz
     (grant) => grant.accountId === organizationId && grant.subjectId === access.subjectId
   );
   if (!service || service.accountId !== organizationId || !account?.permissions.includes("account:admin")) {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "external identity administration requires an organization service key"
     });
   }
   const parsed = UpdateExternalIdentityMembershipRequest.safeParse(input);
   if (!parsed.success)
-    throw new HTTPException5(422, { message: "invalid external identity transition" });
+    throw new HTTPException6(422, { message: "invalid external identity transition" });
   return updateOrganizationMember(deps.db, {
     organizationId,
     membershipId,
@@ -3457,7 +4064,7 @@ import {
   nestedPostgresSqlState as nestedPostgresSqlState3,
   withWorkspaceSubjectRls as withWorkspaceSubjectRls3
 } from "@opengeni/db";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 function externalContinuationCommitAuthorizer(authorization) {
   const continuation = authorization ? externalActorContinuationForAuthorization(authorization) : null;
   if (!continuation || !authorization) return void 0;
@@ -3472,7 +4079,7 @@ function externalContinuationCommitAuthorizer(authorization) {
       await requireExternalContinuationAuthority(tx, continuation, scope, permissions);
     } catch (error) {
       const denied2 = nestedPostgresSqlState3(error) === "42501" || error instanceof Error && error.message === "External continuation authority unavailable";
-      throw new HTTPException6(denied2 ? 403 : 503, {
+      throw new HTTPException7(denied2 ? 403 : 503, {
         message: denied2 ? "external authority changed" : "external authority is unavailable",
         cause: error
       });
@@ -3537,12 +4144,12 @@ import {
   variableSetVariableNameReservation
 } from "@opengeni/contracts";
 import { getVariableSet, recordAuditEvent } from "@opengeni/db";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 var MAX_ENVIRONMENTS_PER_WORKSPACE = 25;
 var MAX_VARIABLES_PER_ENVIRONMENT = 100;
 function assertAllowedVariableSetVariableName(name) {
   if (variableSetVariableNameReservation(name)) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: `reserved variable set variable name / reserved environment variable name: ${name}`
     });
   }
@@ -3551,7 +4158,7 @@ var assertAllowedEnvironmentVariableName = assertAllowedVariableSetVariableName;
 function requireVariableSetEncryption(settings) {
   const key = environmentsEncryptionKeyBytes(settings);
   if (!key) {
-    throw new HTTPException7(503, {
+    throw new HTTPException8(503, {
       message: "variable sets require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"
     });
   }
@@ -3569,7 +4176,7 @@ async function requireVariableSetForApi(db, grant, variableSetId) {
     variableSetId
   );
   if (!variableSet) {
-    throw new HTTPException7(404, { message: "variableSet not found" });
+    throw new HTTPException8(404, { message: "variableSet not found" });
   }
   return variableSet;
 }
@@ -3583,7 +4190,7 @@ async function validateVariableSetAttachment(deps, grant, workspaceId, variableS
     variableSetId
   );
   if (!variableSet) {
-    throw new HTTPException7(422, { message: "unknown variableSetId" });
+    throw new HTTPException8(422, { message: "unknown variableSetId" });
   }
   return variableSet;
 }
@@ -3681,7 +4288,7 @@ function sessionCreationMetadata(metadata) {
 
 // src/domain/sessions.ts
 import {
-  canonicalizeConfiguredModelId,
+  canonicalizeConfiguredModelId as canonicalizeConfiguredModelId2,
   configuredAllowedModels,
   withCodexCatalogProvider as withCodexCatalogProvider2,
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX as ORGANIZATION_GATEWAY_MODEL_ID_PREFIX2,
@@ -3691,7 +4298,8 @@ import {
   resolveTurnExecutionPolicyV1,
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX as WORKSPACE_GATEWAY_MODEL_ID_PREFIX2,
   WORKSPACE_OPENROUTER_MODEL_ID_PREFIX as WORKSPACE_OPENROUTER_MODEL_ID_PREFIX2,
-  XAI_SUBSCRIPTION_MODEL_ID_PREFIX
+  XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
+  codeSearchDeploymentPolicy
 } from "@opengeni/config";
 import {
   AUTOMATIC_SESSION_TITLE_FALLBACK,
@@ -3732,7 +4340,7 @@ import {
   listEnabledMcpCapabilityServers as listEnabledMcpCapabilityServers2,
   requireApprovalWithFloor,
   getSandbox as getSandbox3,
-  getSession as getSession2,
+  getSession as getSession3,
   getInitializedSessionCreateReplay,
   getSessionAuthorityProjection as getSessionAuthorityProjection4,
   SessionIdConflictError,
@@ -3743,7 +4351,7 @@ import {
   getSessionTurnForAttempt as getSessionTurnForAttempt3,
   getSessionTurnPersonalConnectionDelegations as getSessionTurnPersonalConnectionDelegations2,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
-  getWorkspaceModelPolicy,
+  getWorkspaceModelPolicy as getWorkspaceModelPolicy2,
   requireWorkspace as requireWorkspace4,
   initializeSessionStartAtomically,
   listSessionTurns,
@@ -3772,287 +4380,78 @@ import {
   publishDurableSessionEvents as publishDurableSessionEvents2,
   publishDurableWorkspaceControlEvent
 } from "@opengeni/events";
-import { HTTPException as HTTPException15 } from "hono/http-exception";
-
-// src/domain/external-creation-attribution.ts
-import { HTTPException as HTTPException8 } from "hono/http-exception";
-var EXTERNAL_CREATION_ATTRIBUTION_KEY = "opengeniExternalCreationAttribution";
-function externalCreationMetadata(metadata, authorization, grant) {
-  if (metadata && Object.hasOwn(metadata, EXTERNAL_CREATION_ATTRIBUTION_KEY)) {
-    throw new HTTPException8(422, {
-      message: `${EXTERNAL_CREATION_ATTRIBUTION_KEY} is server-owned`
-    });
-  }
-  const attribution = externalAttributionForAuthorization(authorization, grant);
-  if (!attribution) return metadata;
-  return { ...metadata, [EXTERNAL_CREATION_ATTRIBUTION_KEY]: attribution };
-}
-
-// src/application/external-link-work-admission.ts
-import { ExternalLinkWorkSnapshot } from "@opengeni/contracts/external-identities";
-import {
-  captureExternalLinkTurnAuthority,
-  captureExternalLinkTaskAuthority,
-  getExternalLinkTurnSnapshot,
-  getSessionTurnForAttempt as getSessionTurnForAttempt2
-} from "@opengeni/db";
-function snapshotFor(authorization) {
-  const continuation = authorization ? externalActorContinuationForAuthorization(authorization) : null;
-  return continuation?.actor.actingMode === "linked_native" ? ExternalLinkWorkSnapshot.parse({
-    ...continuation,
-    permissions: [...authorization.grant.permissions]
-  }) : null;
-}
-function prepareExternalLinkTurnAdmission(authorization) {
-  const snapshot = snapshotFor(authorization);
-  if (!snapshot || !authorization) return void 0;
-  const workspaceId = authorization.grant.workspaceId;
-  const accountId = authorization.grant.accountId;
-  const commit = externalContinuationCommitAuthorizer(authorization);
-  return async (tx, sessionId, turnId) => {
-    await commit(tx);
-    await captureExternalLinkTurnAuthority(tx, {
-      accountId,
-      workspaceId,
-      sessionId,
-      turnId,
-      snapshot
-    });
-  };
-}
-function prepareExternalLinkTaskAdmission(authorization, actor) {
-  const snapshot = snapshotFor(authorization);
-  const commit = externalContinuationCommitAuthorizer(authorization);
-  if (snapshot)
-    return async (tx, task) => {
-      await commit?.(tx);
-      await captureExternalLinkTaskAuthority(tx, task, snapshot);
-    };
-  if (!actor) {
-    return authorization && hasVerifiedOwningUserAuthorization(authorization) ? async () => {
-    } : void 0;
-  }
-  return async (tx, task) => {
-    const turn = await getSessionTurnForAttempt2(
-      tx,
-      task.workspaceId,
-      actor.sessionId,
-      actor.attemptId
-    );
-    if (!turn || turn.id !== actor.turnId || turn.executionGeneration !== actor.executionGeneration)
-      throw new Error("Linked task creator attempt is no longer active");
-    const inherited = await getExternalLinkTurnSnapshot(tx, task, actor.turnId);
-    if (inherited) await captureExternalLinkTaskAuthority(tx, task, inherited);
-  };
-}
-
-// src/billing/limits.ts
-import {
-  configuredStaticUsageLimits,
-  resolveModelProviderForTurn
-} from "@opengeni/config";
-import {
-  countActiveApiKeysForWorkspace,
-  countActiveOrganizationApiKeysForAccount,
-  countScheduledTasksForWorkspace,
-  countWorkspacesForAccount,
-  getBillingBalance,
-  isCodexBilledTurn,
-  recordUsageEvent,
-  sumUsageQuantity
-} from "@opengeni/db";
-import { HTTPException as HTTPException9 } from "hono/http-exception";
-function modelFundingForAdmission(settings, model, codexBilled) {
-  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
-  const codexSubscriptionModel = resolvedModel?.credentialSource.kind === "connected_subscription" && resolvedModel.credentialSource.provider === "codex";
-  return {
-    // A Codex namespace/definition never bypasses credits by itself: the live
-    // workspace credential predicate above remains authoritative. SuperGrok's
-    // static overlay is likewise secret-free; its worker/provider admission
-    // owns live account selection before any upstream request can occur.
-    fundedWithoutCredits: codexBilled || resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits",
-    countsTowardTokenCap: !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment"
-  };
-}
-async function requireLimit(deps, input) {
-  const decision = await checkLimit(deps, input);
-  if (decision.allowed) {
-    return;
-  }
-  throw new HTTPException9(decision.code === "insufficient_credits" ? 402 : 429, {
-    message: decision.message
-  });
-}
-async function checkLimit(deps, input) {
-  const codexBilled = input.workspaceId ? await isCodexBilledTurn({
-    db: deps.db,
-    settings: deps.settings,
-    workspaceId: input.workspaceId,
-    model: input.model
-  }) : false;
-  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
-    deps.settings,
-    input.model,
-    codexBilled
-  );
-  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
-  if (!creditDecision.allowed) {
-    return creditDecision;
-  }
-  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
-    return { allowed: true };
-  }
-  return await checkStaticCaps(deps, input, {
-    fundedWithoutCredits,
-    countsTowardTokenCap
-  });
-}
-async function checkCreditBalance(deps, input, externallyBilled) {
-  if (externallyBilled) {
-    return { allowed: true };
-  }
-  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
-    return { allowed: true };
-  }
-  const balance = await getBillingBalance(deps.db, input.accountId);
-  if (balance.balanceMicros > 0) {
-    return { allowed: true };
-  }
-  return { allowed: false, code: "insufficient_credits", message: "insufficient OpenGeni credits" };
-}
-async function checkStaticCaps(deps, input, funding) {
-  const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !funding.fundedWithoutCredits) {
-    const used = await sumUsageQuantity(deps.db, {
-      accountId: input.accountId,
-      eventType: "model.cost",
-      since: startOfUtcMonth()
+import { HTTPException as HTTPException15 } from "hono/http-exception";
+
+// src/domain/external-creation-attribution.ts
+import { HTTPException as HTTPException9 } from "hono/http-exception";
+var EXTERNAL_CREATION_ATTRIBUTION_KEY = "opengeniExternalCreationAttribution";
+function externalCreationMetadata(metadata, authorization, grant) {
+  if (metadata && Object.hasOwn(metadata, EXTERNAL_CREATION_ATTRIBUTION_KEY)) {
+    throw new HTTPException9(422, {
+      message: `${EXTERNAL_CREATION_ATTRIBUTION_KEY} is server-owned`
     });
-    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
-      return blocked(
-        "max_monthly_cost_micros_per_account",
-        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`
-      );
-    }
-  }
-  switch (input.action) {
-    case "workspace:create": {
-      if (!limits.maxWorkspacesPerAccount) {
-        return { allowed: true };
-      }
-      const count = await countWorkspacesForAccount(deps.db, input.accountId);
-      return count < limits.maxWorkspacesPerAccount ? { allowed: true } : blocked(
-        "max_workspaces_per_account",
-        `workspace limit reached (${limits.maxWorkspacesPerAccount})`
-      );
-    }
-    case "api_key:create": {
-      if (!limits.maxApiKeysPerWorkspace) {
-        return { allowed: true };
-      }
-      const count = input.workspaceId ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId) : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
-      return count < limits.maxApiKeysPerWorkspace ? { allowed: true } : blocked(
-        "max_api_keys_per_workspace",
-        `API key limit reached (${limits.maxApiKeysPerWorkspace})`
-      );
-    }
-    case "schedule:create": {
-      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);
-      return count < limits.maxSchedulesPerWorkspace ? { allowed: true } : blocked(
-        "max_schedules_per_workspace",
-        `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`
-      );
-    }
-    case "file:upload": {
-      if (!limits.maxFileUploadBytes || !input.quantity) {
-        return { allowed: true };
-      }
-      return input.quantity <= limits.maxFileUploadBytes ? { allowed: true } : blocked(
-        "max_file_upload_bytes",
-        `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`
-      );
-    }
-    case "agent_run:create": {
-      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "agent_run.created",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace ? { allowed: true } : blocked(
-        "max_monthly_agent_runs_per_workspace",
-        `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`
-      );
-    }
-    case "tokens:consume": {
-      if (!funding.countsTowardTokenCap || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "model.tokens",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxMonthlyTokensPerWorkspace ? { allowed: true } : blocked(
-        "max_monthly_tokens_per_workspace",
-        `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`
-      );
-    }
-    case "document:index": {
-      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "document.indexed",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace ? { allowed: true } : blocked(
-        "max_document_indexed_chunks_per_workspace",
-        `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`
-      );
-    }
   }
+  const attribution = externalAttributionForAuthorization(authorization, grant);
+  if (!attribution) return metadata;
+  return { ...metadata, [EXTERNAL_CREATION_ATTRIBUTION_KEY]: attribution };
 }
-async function recordWorkspaceUsage(deps, input) {
-  await recordUsageEvent(deps.db, {
-    accountId: input.accountId,
-    workspaceId: input.workspaceId,
-    subjectId: input.subjectId ?? null,
-    eventType: input.eventType,
-    quantity: input.quantity,
-    unit: input.unit,
-    sourceResourceType: input.sourceResourceType,
-    sourceResourceId: input.sourceResourceId,
-    sessionId: input.sessionId ?? null,
-    turnId: input.turnId ?? null,
-    turnAttemptId: input.turnAttemptId ?? null,
-    initiator: input.initiator ?? (input.subjectId ? { kind: "subject", subjectId: input.subjectId } : null),
-    ...input.initiatorContext ? { initiatorContext: input.initiatorContext } : {},
-    origin: input.origin ?? null,
-    idempotencyKey: input.idempotencyKey
-  });
-}
-function usesCreditLimits(deps) {
-  return deps.settings.billingMode === "stripe" || deps.settings.usageLimitsMode === "managed";
-}
-function isCostlyAction(action) {
-  return action === "agent_run:create" || action === "tokens:consume" || action === "document:index";
+
+// src/application/external-link-work-admission.ts
+import { ExternalLinkWorkSnapshot } from "@opengeni/contracts/external-identities";
+import {
+  captureExternalLinkTurnAuthority,
+  captureExternalLinkTaskAuthority,
+  getExternalLinkTurnSnapshot,
+  getSessionTurnForAttempt as getSessionTurnForAttempt2
+} from "@opengeni/db";
+function snapshotFor(authorization) {
+  const continuation = authorization ? externalActorContinuationForAuthorization(authorization) : null;
+  return continuation?.actor.actingMode === "linked_native" ? ExternalLinkWorkSnapshot.parse({
+    ...continuation,
+    permissions: [...authorization.grant.permissions]
+  }) : null;
 }
-function blocked(code, message) {
-  return { allowed: false, code, message };
+function prepareExternalLinkTurnAdmission(authorization) {
+  const snapshot = snapshotFor(authorization);
+  if (!snapshot || !authorization) return void 0;
+  const workspaceId = authorization.grant.workspaceId;
+  const accountId = authorization.grant.accountId;
+  const commit = externalContinuationCommitAuthorizer(authorization);
+  return async (tx, sessionId, turnId) => {
+    await commit(tx);
+    await captureExternalLinkTurnAuthority(tx, {
+      accountId,
+      workspaceId,
+      sessionId,
+      turnId,
+      snapshot
+    });
+  };
 }
-function startOfUtcMonth() {
-  const now = /* @__PURE__ */ new Date();
-  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+function prepareExternalLinkTaskAdmission(authorization, actor) {
+  const snapshot = snapshotFor(authorization);
+  const commit = externalContinuationCommitAuthorizer(authorization);
+  if (snapshot)
+    return async (tx, task) => {
+      await commit?.(tx);
+      await captureExternalLinkTaskAuthority(tx, task, snapshot);
+    };
+  if (!actor) {
+    return authorization && hasVerifiedOwningUserAuthorization(authorization) ? async () => {
+    } : void 0;
+  }
+  return async (tx, task) => {
+    const turn = await getSessionTurnForAttempt2(
+      tx,
+      task.workspaceId,
+      actor.sessionId,
+      actor.attemptId
+    );
+    if (!turn || turn.id !== actor.turnId || turn.executionGeneration !== actor.executionGeneration)
+      throw new Error("Linked task creator attempt is no longer active");
+    const inherited = await getExternalLinkTurnSnapshot(tx, task, actor.turnId);
+    if (inherited) await captureExternalLinkTaskAuthority(tx, task, inherited);
+  };
 }
 
 // src/domain/native-mcp-connection-admission.ts
@@ -4071,6 +4470,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import { isDeepStrictEqual } from "util";
 import { withLockedCapabilityInstallation } from "@opengeni/db/capability-reconciliation";
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
+import { pinnedFetch } from "@opengeni/network";
 import {
   CapabilityCatalogItem,
   capabilityCatalogItemIsTrustedForExposure,
@@ -4344,7 +4744,12 @@ async function prepareCapabilityEnable(input) {
     assertRequiredMcpCredentialHeaders(item, headers, connectionRef);
     installationMetadata = {
       ...installationMetadata,
-      ...connectionRef && !headers ? authDeferredMcpConnectivity() : await validateMcpCapabilityConnection(item, input.probeMcpServer, headers ?? void 0)
+      ...connectionRef && !headers ? authDeferredMcpConnectivity() : await validateMcpCapabilityConnection(
+        item,
+        input.probeMcpServer,
+        headers ?? void 0,
+        input.settings
+      )
     };
     if (connectionRef) {
       installationConfig.connectionRef = connectionRef;
@@ -4591,7 +4996,7 @@ function requireCapabilityHeaderEncryption(settings) {
   }
   return key;
 }
-async function validateMcpCapabilityConnection(item, probe = probeStreamableHttpMcpServer, headers) {
+async function validateMcpCapabilityConnection(item, probe = probeStreamableHttpMcpServer, headers, settings) {
   if (item.kind !== "mcp") {
     return {};
   }
@@ -4606,7 +5011,8 @@ async function validateMcpCapabilityConnection(item, probe = probeStreamableHttp
       name: item.name,
       url: item.endpointUrl,
       timeoutMs: mcpCapabilityProbeTimeoutMs,
-      ...headers ? { headers } : {}
+      ...headers ? { headers } : {},
+      ...settings ? { settings } : {}
     });
     return {
       mcpConnectivity: {
@@ -4622,6 +5028,8 @@ async function validateMcpCapabilityConnection(item, probe = probeStreamableHttp
   }
 }
 async function probeStreamableHttpMcpServer(input) {
+  const settings = input.settings;
+  if (!settings) throw new Error("Network policy is unavailable for MCP validation");
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), input.timeoutMs);
   const client = new Client(
@@ -4633,7 +5041,11 @@ async function probeStreamableHttpMcpServer(input) {
       requestInit: {
         signal: controller.signal,
         ...input.headers ? { headers: input.headers } : {}
-      }
+      },
+      fetch: (url, init) => pinnedFetch(url, init, settings, {
+        label: "MCP capability probe",
+        requireHttpsOutsideLocalTest: true
+      })
     });
     await client.connect(transport, {
       timeout: input.timeoutMs,
@@ -5048,6 +5460,7 @@ function fikenCatalogItem(fikenConnections) {
     metadata: {
       connectorMode: "first_party_fiken",
       ownership: "workspace",
+      connectionStatus: fikenConnection?.status ?? null,
       // Derived from the contracts catalog so a new fiken_* tool cannot be
       // registered without also appearing on the capability tile.
       firstPartyMcpTools: FIRST_PARTY_MCP_TOOL_NAMES.filter((name) => name.startsWith("fiken_"))
@@ -5249,15 +5662,15 @@ function socialProviderConnectionCounts(item) {
   };
 }
 function applyCapabilityEnablement(item, installation) {
+  if (item.surfaceType === "first_party_fiken") {
+    return { ...item, connectionRef: null };
+  }
   if (item.kind === "skill" || item.kind === "api" || item.kind === "plugin") {
     return { ...item, enabled: false, enabledReason: null, connectionRef: null };
   }
   if (isSocialProviderIntegration(item)) {
     return { ...item, connectionRef: null };
   }
-  if (item.surfaceType === "first_party_fiken") {
-    return { ...item, connectionRef: null };
-  }
   if (item.surfaceType === "codex_apps") {
     return { ...item, connectionRef: null };
   }
@@ -7895,6 +8308,7 @@ async function createAndStartSessionWithOutcome(input) {
       ...input.scopeSubjectId !== void 0 ? { scopeSubjectId: input.scopeSubjectId } : {},
       ...input.memoryScope ? { memoryScope: input.memoryScope } : {},
       parentSessionId: input.parentSessionId ?? null,
+      ...input.codeSearchDeploymentPolicy ? { codeSearchDeploymentPolicy: input.codeSearchDeploymentPolicy } : {},
       sandboxGroupId: input.sandboxGroupId ?? null,
       ...input.sandboxOs ? { sandboxOs: input.sandboxOs } : {},
       mcpServers: input.mcpServers ?? [],
@@ -8019,7 +8433,7 @@ function canonicalConfiguredModel(settings, model) {
   if (model === null || model === void 0) {
     return model;
   }
-  const canonicalModel = canonicalizeConfiguredModelId(settings, model);
+  const canonicalModel = canonicalizeConfiguredModelId2(settings, model);
   if (canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX) && settings.resolvedCodexModelsJson !== void 0) {
     if (settings.codexSubscriptionEnabled && configuredAllowedModels(withCodexCatalogProvider2(settings)).includes(canonicalModel)) {
       return canonicalModel;
@@ -8066,7 +8480,7 @@ async function assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model
   if (canonicalModel === null || canonicalModel === void 0) {
     return;
   }
-  const policy = await getWorkspaceModelPolicy(db, workspaceId);
+  const policy = await getWorkspaceModelPolicy2(db, workspaceId);
   if (!policy) {
     return;
   }
@@ -8548,7 +8962,7 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
       throw error;
     }
   }
-  const parentSession = parentSessionId ? await getSession2(db, workspaceId, parentSessionId) : null;
+  const parentSession = parentSessionId ? await getSession3(db, workspaceId, parentSessionId) : null;
   if (parentSessionId && !parentSession) {
     throw new HTTPException15(404, {
       message: `parent session not found in workspace: ${parentSessionId}`
@@ -8615,6 +9029,7 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   }
   const replayManagedHumanSubjectId = creationInitiator.actor ? parentCallingTurn?.initiatingHumanSubjectId ?? (parentCallingTurn?.initiator.kind === "subject" ? parentCallingTurn.initiator.subjectId : null) : authorization?.canonicalManagedHumanSession || grant.principalKind === "human_session" ? grant.subjectId : null;
   let retainedKeyedShellModel = null;
+  let retainedKeyedShellReasoningEffort = null;
   if (payload.idempotencyKey && (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)) {
     try {
       const initializedReplay = await getInitializedSessionCreateReplay(db, {
@@ -8639,6 +9054,7 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
         }
         if (initializedReplay.outcome === "pending") {
           retainedKeyedShellModel = initializedReplay.session.model;
+          retainedKeyedShellReasoningEffort = initializedReplay.session.reasoningEffort;
         } else {
           if (initializedReplay.workflowWakeRevision !== null) {
             await unresolvedDeps.workflowClient.wakeSessionWorkflow({
@@ -8696,7 +9112,13 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
     payload.personalResourceAttachment,
     false
   );
-  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
+  const resolvedDefault = parentSession || payload.model !== void 0 ? null : retainedKeyedShellModel !== null && retainedKeyedShellReasoningEffort !== null ? { model: retainedKeyedShellModel, reasoningEffort: retainedKeyedShellReasoningEffort } : await resolveDefaultSessionModel(db, settings, {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId,
+    workspaceSettings: workspace.settings
+  });
+  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? resolvedDefault?.model ?? settings.openaiModel;
   const effectiveModelId = payload.model ?? inheritedModel;
   const effectiveCatalogSettings = await resolveWorkspaceModelBoundarySettings(
     deps,
@@ -8950,7 +9372,7 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
     throw new Error("effective session model unexpectedly resolved to null");
   }
   await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
-  const inheritedReasoningEffort = parentCallingTurn?.reasoningEffort ?? parentSession?.reasoningEffort ?? settings.openaiReasoningEffort;
+  const inheritedReasoningEffort = parentCallingTurn?.reasoningEffort ?? parentSession?.reasoningEffort ?? resolvedDefault?.reasoningEffort ?? settings.openaiReasoningEffort;
   const inheritedLatencyMode = parentCallingTurn?.latencyMode ?? parentSession?.latencyMode ?? "standard";
   const reasoningEffort = payload.reasoningEffort ?? inheritedReasoningEffort;
   const latencyMode = payload.latencyMode ?? inheritedLatencyMode;
@@ -9238,6 +9660,7 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
       db,
       bus,
       workflowClient,
+      codeSearchDeploymentPolicy: codeSearchDeploymentPolicy(deps.settings),
       accountId: grant.accountId,
       workspaceId,
       visibility: effectiveVisibility,
@@ -10094,7 +10517,7 @@ async function readSessionLineage(deps, grant, sessionId) {
     surface: "core"
   });
   if (authorization?.relatedSessionAccess === "target") {
-    const session = await getSession2(deps.db, grant.workspaceId, sessionId);
+    const session = await getSession3(deps.db, grant.workspaceId, sessionId);
     if (!session) {
       throw new HTTPException15(404, { message: "session not found" });
     }
@@ -10136,6 +10559,39 @@ async function acceptSessionUserMessageWithOutcome(...args) {
   return withSessionRlsActorContext4(actor, () => acceptSessionUserMessageInFileScope(...args));
 }
 
+// src/domain/session-native-connection-replacement.ts
+import { connectionMetadataMatchesBinding } from "@opengeni/db/session-mcp-credential-rotation";
+function nativeSessionConnectionReplacement(input) {
+  const connection = input.connections.find(
+    (candidate) => candidate.id === input.nativeConnectionId
+  );
+  if (!connection || connection.accountId !== input.accountId || connection.status !== "active" || (connection.subjectId === null ? connection.workspaceId !== input.workspaceId : !input.subjectId || connection.subjectId !== input.subjectId || !connection.authorityId)) {
+    throw new Error("native connection unavailable");
+  }
+  const {
+    authoritySource: _authoritySource,
+    hostBinding: _hostBinding,
+    accountSelection: _accountSelection,
+    ...retained
+  } = input.currentRef ?? {};
+  if (input.currentRef && input.currentRef.providerDomain.toLowerCase() !== connection.providerDomain.toLowerCase())
+    throw new Error("native connection provider mismatch");
+  const ref = {
+    ...retained,
+    ...!input.currentRef?.resource && typeof connection.metadata.resource === "string" ? { resource: connection.metadata.resource } : {},
+    connectionId: connection.id,
+    providerDomain: connection.providerDomain,
+    kind: connection.kind,
+    subjectScope: connection.subjectId === null ? "workspace" : "subject"
+  };
+  const destination = input.replacementServerUrl ?? input.serverUrl;
+  if (input.replacementServerUrl && (typeof connection.metadata.mcpUrl !== "string" || !connection.metadata.mcpUrl.trim()))
+    throw new Error("native connection destination unavailable");
+  if (!connectionMetadataMatchesBinding(connection, ref, destination))
+    throw new Error("native connection binding mismatch");
+  return ref;
+}
+
 // src/application/session-mcp-credential-rotation.ts
 function sessionMcpRotationFingerprint(key, scope, request) {
   return {
@@ -10167,9 +10623,14 @@ async function rotateSessionMcpCredentialsForRequest(deps, authorization, sessio
         id: update.id,
         expectedCredentialVersion: update.expectedCredentialVersion,
         expectedServerUrl: update.expectedServerUrl,
-        headers: Object.fromEntries(
-          Object.entries(normalizedSessionMcpCredentialHeaders(update.headers)).map(([name, value]) => [name.toLowerCase(), value]).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
-        )
+        ..."nativeConnectionId" in update ? {
+          nativeConnectionId: update.nativeConnectionId,
+          ...update.replacementServerUrl ? { replacementServerUrl: update.replacementServerUrl } : {}
+        } : {
+          headers: Object.fromEntries(
+            Object.entries(normalizedSessionMcpCredentialHeaders(update.headers)).map(([name, value]) => [name.toLowerCase(), value]).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+          )
+        }
       })).sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0)
     };
     if (new Set(request.updates.map((update) => update.id)).size !== request.updates.length)
@@ -10185,20 +10646,43 @@ async function rotateSessionMcpCredentialsForRequest(deps, authorization, sessio
     actorType: grant.principalKind === "service" ? "service" : "human"
   };
   const externalAuthorize = externalContinuationCommitAuthorizer(authorization);
+  let authorizedGrant = grant;
   try {
     return await rotateSessionMcpCredentialsAtomically(deps.db, {
       ...scope,
       operationKey: request.operationKey,
       ...sessionMcpRotationFingerprint(encryptionKey, scope, request),
-      updates: request.updates.map(({ headers, ...update }) => ({
-        ...update,
-        headersEncrypted: Object.fromEntries(
-          Object.entries(headers).map(([name, value]) => [
-            name,
-            encryptVariableSetValue3(encryptionKey, value)
-          ])
-        )
-      })),
+      updates: request.updates.map(
+        (update) => "nativeConnectionId" in update ? update : {
+          id: update.id,
+          expectedCredentialVersion: update.expectedCredentialVersion,
+          expectedServerUrl: update.expectedServerUrl,
+          headersEncrypted: Object.fromEntries(
+            Object.entries(update.headers).map(([name, value]) => [
+              name,
+              encryptVariableSetValue3(encryptionKey, value)
+            ])
+          )
+        }
+      ),
+      resolveNativeConnection: async (tx, server, nativeConnectionId, replacementServerUrl) => {
+        const connections = await listOwnConnectionAccountsForGrant(tx, authorizedGrant);
+        const source = personalConnectionDelegationSourceForGrant(authorizedGrant);
+        try {
+          return nativeSessionConnectionReplacement({
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: source.kind === "subject" ? source.subjectId : null,
+            serverUrl: server.url,
+            ...replacementServerUrl ? { replacementServerUrl } : {},
+            currentRef: server.connectionRef,
+            nativeConnectionId,
+            connections
+          });
+        } catch {
+          throw new SessionMcpCredentialRotationError("connection_unavailable");
+        }
+      },
       authorize: async (tx) => {
         await externalAuthorize?.(tx);
         const fresh = await reauthorize(tx);
@@ -10221,6 +10705,7 @@ async function rotateSessionMcpCredentialsForRequest(deps, authorization, sessio
           operation: "session.mcp.credentials.rotate",
           surface: "http"
         });
+        authorizedGrant = fresh;
       }
     });
   } catch (error) {
@@ -10231,7 +10716,7 @@ async function rotateSessionMcpCredentialsForRequest(deps, authorization, sessio
     if (error instanceof SessionAuthorizationUnavailableError)
       throw new HTTPException16(503, { message: "credential rotation authorization unavailable" });
     if (error instanceof SessionMcpCredentialRotationError) {
-      const status = error.code === "receipt_key_unavailable" ? 503 : error.code === "authority_revoked" ? 403 : error.code === "not_found" ? 404 : error.code === "invalid_request" || error.code === "brokered_server" ? 422 : 409;
+      const status = error.code === "receipt_key_unavailable" ? 503 : error.code === "authority_revoked" ? 403 : error.code === "not_found" ? 404 : error.code === "invalid_request" || error.code === "brokered_server" || error.code === "connection_unavailable" ? 422 : 409;
       throw new HTTPException16(status, { message: `credential_rotation_${error.code}` });
     }
     throw new HTTPException16(503, { message: "credential rotation unavailable" });
@@ -10672,7 +11157,7 @@ function sha256Hex2(bytes) {
 }
 
 // src/domain/skill-search.ts
-import { pinnedFetch, readResponseJsonBounded } from "@opengeni/network";
+import { pinnedFetch as pinnedFetch2, readResponseJsonBounded } from "@opengeni/network";
 var PublicSkillSearchError = class extends Error {
   constructor(code, message, retryAfterSeconds = null) {
     super(message);
@@ -10687,7 +11172,7 @@ var maxResponseBytes = 256 * 1024;
 var maxResults = 20;
 var ownerPattern = /^[a-z0-9](?:[a-z0-9-]{0,38})$/iu;
 var segmentPattern = /^[a-z0-9](?:[a-z0-9._-]{0,98}[a-z0-9])?$/iu;
-function createPublicSkillSearchClient(settings, fetcher = pinnedFetch) {
+function createPublicSkillSearchClient(settings, fetcher = pinnedFetch2) {
   return {
     async search(input) {
       const query = input.query.trim();
@@ -10814,7 +11299,7 @@ function parseRetryAfter(value) {
 
 // src/domain/github-skill-source.ts
 import { HTTPException as HTTPException19 } from "hono/http-exception";
-import { pinnedFetch as pinnedFetch2, readResponseJsonBounded as readResponseJsonBounded2, readResponseTextBounded } from "@opengeni/network";
+import { pinnedFetch as pinnedFetch3, readResponseJsonBounded as readResponseJsonBounded2, readResponseTextBounded } from "@opengeni/network";
 import {
   PORTABLE_SKILL_MAX_FILES as PORTABLE_SKILL_MAX_FILES2,
   PORTABLE_SKILL_MAX_FILE_BYTES as PORTABLE_SKILL_MAX_FILE_BYTES2,
@@ -10915,7 +11400,7 @@ function createGitHubSkillSourceClient(settings, requestJson = (path, maxBytes,
 }
 async function downloadSkillSnapshot(settings, owner, repository, slug) {
   const signal = AbortSignal.timeout(githubRequestTimeoutMs);
-  const response = await pinnedFetch2(
+  const response = await pinnedFetch3(
     `https://skills.sh/api/download/${[owner, repository, slug].map(encodeURIComponent).join("/")}`,
     { headers: { accept: "application/json" }, credentials: "omit", redirect: "manual", signal },
     settings,
@@ -10950,7 +11435,7 @@ async function githubJson(settings, path, maxBytes, label) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), githubRequestTimeoutMs);
   try {
-    const response = await pinnedFetch2(
+    const response = await pinnedFetch3(
       `${githubApiBase}${path}`,
       {
         method: "GET",
@@ -12409,10 +12894,10 @@ import {
   getRig as getRig4,
   getScheduledTask,
   getScheduledTaskIncludingDeletedForUpdate,
-  getScheduledTaskXaiProviderAccountAuthoritySnapshot,
+  getScheduledTaskXaiProviderAccountAuthoritySnapshot as getScheduledTaskXaiProviderAccountAuthoritySnapshot2,
   getSandbox as getSandbox4,
   getSessionTurnXaiProviderAccountAuthoritySnapshot as getSessionTurnXaiProviderAccountAuthoritySnapshot2,
-  getSession as getSession3,
+  getSession as getSession4,
   getSessionAuthorityProjection as getSessionAuthorityProjection5,
   withSessionRlsActorContext as withSessionRlsActorContext5,
   nestedPostgresSqlState as nestedPostgresSqlState6,
@@ -12669,7 +13154,7 @@ async function createValidatedScheduledTask(input) {
   );
 }
 async function frozenScheduledTaskCreatorPolicy(input) {
-  const session = await getSession3(input.db, input.grant.workspaceId, input.sessionId);
+  const session = await getSession4(input.db, input.grant.workspaceId, input.sessionId);
   if (!session) {
     throw new HTTPException21(403, {
       message: "the calling agent session is not available in this workspace"
@@ -12867,7 +13352,7 @@ async function validateScheduledTaskTarget(input) {
     }
     throw error;
   }
-  const session = await getSession3(input.db, input.grant.workspaceId, input.targetSessionId);
+  const session = await getSession4(input.db, input.grant.workspaceId, input.targetSessionId);
   if (!session || session.accountId !== input.grant.accountId) {
     throw new HTTPException21(404, { message: "target session not found" });
   }
@@ -13139,7 +13624,7 @@ async function validatedScheduledTaskUpdate(input) {
     });
     if (beforeUpdateCommit) update.beforeUpdateCommit = beforeUpdateCommit;
   }
-  const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot(
+  const existingXaiAuthority = await getScheduledTaskXaiProviderAccountAuthoritySnapshot2(
     input.db,
     input.existing.workspaceId,
     input.existing.id
@@ -13429,7 +13914,7 @@ function manualScheduledTaskTriggerUsageKey(workspaceId, taskId, triggerToken) {
 }
 async function validateScheduledTaskAgentConfig(input) {
   const actor = scheduledTaskInitiatorForGrant(input.grant).actor;
-  const parent = actor ? await getSession3(input.db, input.workspaceId, actor.sessionId) : null;
+  const parent = actor ? await getSession4(input.db, input.workspaceId, actor.sessionId) : null;
   if (actor && (!parent || parent.accountId !== input.grant.accountId)) {
     throw new HTTPException21(403, {
       message: "Scheduled Skill selection requires the creating agent's session"
@@ -15974,6 +16459,7 @@ import {
   getSandbox as getSandbox5,
   getVariableSet as getVariableSet3,
   NewSessionDraftAccessError,
+  newSessionDraftModelProvided,
   newSessionDraftSelectedProjectChannelId,
   newSessionDraftToolsProvided,
   newSessionSelectionHistory,
@@ -15984,6 +16470,7 @@ import {
   withWorkspaceSubjectRls as withWorkspaceSubjectRls6
 } from "@opengeni/db";
 import { HTTPException as HTTPException23 } from "hono/http-exception";
+import { canonicalizeConfiguredModelId as canonicalizeConfiguredModelId3 } from "@opengeni/config";
 function hasOwn(value, key) {
   return typeof value === "object" && value !== null && Object.hasOwn(value, key);
 }
@@ -15999,16 +16486,39 @@ function mapNewSessionDraft(row) {
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
+    ...newSessionDraftModelProvided(row) !== void 0 ? { modelProvided: newSessionDraftModelProvided(row) } : {},
     ...selectedProjectChannelId !== void 0 ? { selectedProjectChannelId } : {},
     options: publicNewSessionDraftOptions(row),
     selectionHistory: newSessionSelectionHistory(row),
     updatedAt: row.updatedAt.toISOString()
   });
 }
-async function hydrateNewSessionDraft(deps, grant, workspaceId, row) {
+function draftModelProvided(settings, draft) {
+  if (draft.modelProvided !== void 0) return draft.modelProvided;
+  return !(canonicalizeConfiguredModelId3(settings, draft.model) === canonicalizeConfiguredModelId3(settings, settings.openaiModel) && draft.reasoningEffort === settings.openaiReasoningEffort && draft.latencyMode === "standard");
+}
+async function actorDefaultModel(deps, grant, workspaceId) {
+  return await resolveDefaultSessionModel(deps.db, deps.settings, {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId
+  });
+}
+async function hydrateNewSessionDraft(deps, grant, workspaceId, row, readOptions = {}) {
   if (!row) return null;
-  const mapped = mapNewSessionDraft(row);
-  if (!mapped) return null;
+  const stored = mapNewSessionDraft(row);
+  if (!stored) return null;
+  const modelProvided = draftModelProvided(deps.settings, stored);
+  let mapped = { ...stored, modelProvided };
+  if (!modelProvided && readOptions.projectDefaultModel !== false) {
+    const resolved = await actorDefaultModel(deps, grant, workspaceId);
+    mapped = {
+      ...mapped,
+      model: resolved.model,
+      reasoningEffort: resolved.reasoningEffort,
+      latencyMode: resolved.model === stored.model ? stored.latencyMode : "standard"
+    };
+  }
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     workspaceId,
@@ -16098,7 +16608,7 @@ async function hydrateNewSessionDraft(deps, grant, workspaceId, row) {
     options
   };
 }
-async function getActorNewSessionDraftInFileScope(deps, grant, workspaceId) {
+async function getActorNewSessionDraftInFileScope(deps, grant, workspaceId, readOptions = {}) {
   const row = await withWorkspaceSubjectRls6(
     deps.db,
     workspaceId,
@@ -16108,15 +16618,19 @@ async function getActorNewSessionDraftInFileScope(deps, grant, workspaceId) {
       subjectId: grant.subjectId
     })
   );
-  return await hydrateNewSessionDraft(deps, grant, workspaceId, row) ?? {
+  const hydrated = await hydrateNewSessionDraft(deps, grant, workspaceId, row, readOptions);
+  if (hydrated) return hydrated;
+  const resolved = readOptions.projectDefaultModel === false ? { model: deps.settings.openaiModel, reasoningEffort: deps.settings.openaiReasoningEffort } : await actorDefaultModel(deps, grant, workspaceId);
+  return {
     revision: 0,
     text: "",
     resources: [],
     tools: [],
     toolsProvided: false,
-    model: deps.settings.openaiModel,
-    reasoningEffort: deps.settings.openaiReasoningEffort,
+    model: resolved.model,
+    reasoningEffort: resolved.reasoningEffort,
     latencyMode: "standard",
+    modelProvided: false,
     options: {},
     selectionHistory: { projects: [] },
     updatedAt: null
@@ -16167,6 +16681,7 @@ async function saveActorNewSessionDraftInFileScope(deps, grant, workspaceId, raw
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           latencyMode: input.latencyMode,
+          ...input.modelProvided !== void 0 ? { modelProvided: input.modelProvided } : {},
           ...input.selectedProjectChannelId !== void 0 ? { selectedProjectChannelId: input.selectedProjectChannelId } : {},
           options: input.options,
           // Only managed people are removed through removeWorkspaceMember().
@@ -16182,7 +16697,8 @@ async function saveActorNewSessionDraftInFileScope(deps, grant, workspaceId, raw
         })
       )
     );
-    return mapNewSessionDraft(saved);
+    const mapped = mapNewSessionDraft(saved);
+    return { ...mapped, modelProvided: draftModelProvided(deps.settings, mapped) };
   } catch (error) {
     if (error instanceof NewSessionDraftAccessError) {
       throw new HTTPException23(403, { message: error.message });
@@ -16190,11 +16706,11 @@ async function saveActorNewSessionDraftInFileScope(deps, grant, workspaceId, raw
     throw error;
   }
 }
-async function getActorNewSessionDraft(deps, grant, workspaceId, authorization) {
+async function getActorNewSessionDraft(deps, grant, workspaceId, authorization, readOptions = {}) {
   const actor = authorization ? await fileOwnerContextForAccess(deps, authorization, "sessions:read") : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
   return withSessionRlsActorContext6(
     actor,
-    () => getActorNewSessionDraftInFileScope(deps, grant, workspaceId)
+    () => getActorNewSessionDraftInFileScope(deps, grant, workspaceId, readOptions)
   );
 }
 async function saveActorNewSessionDraft(...args) {
@@ -16203,11 +16719,15 @@ async function saveActorNewSessionDraft(...args) {
   return withSessionRlsActorContext6(actor, () => saveActorNewSessionDraftInFileScope(...args));
 }
 async function getActorNewSessionDefaults(deps, grant, workspaceId) {
-  const draft = await getActorNewSessionDraft(deps, grant, workspaceId);
+  const draft = await getActorNewSessionDraft(deps, grant, workspaceId, void 0, {
+    projectDefaultModel: false
+  });
   const options = draft.options;
   return {
-    // Revision zero is a synthetic empty form, not a user's model preference.
-    ...draft.revision > 0 ? {
+    // Only a model the person chose is carried over. A draft that follows the
+    // default (including the synthetic revision-zero form) leaves the model
+    // out, so session creation resolves the same default itself.
+    ...draft.revision > 0 && draft.modelProvided === true ? {
       model: draft.model,
       reasoningEffort: draft.reasoningEffort,
       latencyMode: draft.latencyMode
@@ -16270,7 +16790,7 @@ import {
   deleteSessionQueueItemInTransaction,
   editQueuedTurnInTransaction,
   getComposerDraftInTransaction,
-  getSession as getSession4,
+  getSession as getSession5,
   getSessionEvent as getSessionEvent3,
   getWorkspaceControlEvent as getWorkspaceControlEvent2,
   getSessionQueueSnapshot,
@@ -16968,7 +17488,7 @@ async function getHumanComposerDraft(deps, context) {
   );
   const mapped = composerDraft(row);
   if (mapped) return mapped;
-  const session = await getSession4(deps.db, context.workspaceId, context.sessionId);
+  const session = await getSession5(deps.db, context.workspaceId, context.sessionId);
   if (!session) throw new Error(`Session not found: ${context.sessionId}`);
   return {
     revision: 0,
@@ -17339,7 +17859,7 @@ var CATALOG_PAGE_SIZE = 25;
 var CATALOG_PAGE_BUDGET = 40;
 var DESCRIPTION_CHARS = 2e3;
 var CATALOG_BYTES = 256 * 1024;
-async function prepareKnowledgeSave(db, context, input, embedder, services = defaults) {
+async function prepareKnowledgeSave(db, context, input, embedder, services = defaults, settings) {
   const request = KnowledgeSavePreparationRequest.parse(input);
   if (context.actor.kind !== "agent" && !(context.actor.kind === "human" && context.actor.review)) {
     throw Object.assign(
@@ -17364,20 +17884,31 @@ async function prepareKnowledgeSave(db, context, input, embedder, services = def
     complete: true,
     nextCursors: { published: null, needs_review: null }
   };
-  const matches = {
-    published: await services.search(
-      db,
-      context,
-      { query: request.query, limit: request.limit, view: "published" },
-      sharedEmbedder
-    ),
-    needs_review: await services.search(
-      db,
-      context,
-      { query: request.query, limit: request.limit, view: "needs_review" },
-      sharedEmbedder
-    )
-  };
+  const paid = settings != null && paidDocumentEmbedding(settings);
+  const published = await services.search(
+    db,
+    context,
+    {
+      query: request.query,
+      limit: request.limit,
+      view: "published",
+      ...paid ? { mode: "keyword" } : {}
+    },
+    sharedEmbedder,
+    paid ? void 0 : settings
+  );
+  const needsReview = await services.search(
+    db,
+    context,
+    {
+      query: request.query,
+      limit: request.limit,
+      view: "needs_review",
+      ...published.searchMode === "keyword" ? { mode: "keyword" } : {}
+    },
+    sharedEmbedder
+  );
+  const matches = { published, needs_review: needsReview };
   for (const view of ["published", "needs_review"]) {
     if (request.collectionCursors && request.collectionCursors[view] === null) continue;
     let cursor = request.collectionCursors?.[view] ?? void 0;
@@ -17786,6 +18317,8 @@ export {
   InMemoryEditableArtifactLiveTicketStore,
   InMemoryEditableArtifactStableIdFactory,
   InMemoryEditableArtifactStore,
+  KnowledgeVectorFundingError,
+  KnowledgeVectorQueryRejectedError,
   MAX_CHECKS_PER_RIG,
   MAX_CREDENTIAL_HOOKS_PER_RIG,
   MAX_DEFAULT_VARIABLE_SETS_PER_RIG,
@@ -17896,6 +18429,7 @@ export {
   causalFrontierDominates,
   causalFrontiersEqual,
   checkLimit,
+  clampReasoningEffortForConfiguredModel,
   classifyRigVerificationOutcome,
   codexAppsCatalogItem,
   compareCodeUnits,
@@ -17921,10 +18455,12 @@ export {
   createSessionForRequestWithOutcome,
   createValidatedScheduledTask,
   creationInitiatorForGrant,
+  creditsDefaultSessionModel,
   decodeEditableArtifactBrokerHint,
   decodeEditableArtifactLiveClientWireFrame,
   decodeEditableArtifactLiveServerWireFrame,
   defaultPrReviewProviderBaseUrl,
+  defaultReasoningEffortForConfiguredModel,
   defaultSessionMcpServerIds,
   defaultVideoGenerationPolicy,
   deleteHumanQueuePrompt,
@@ -17934,6 +18470,8 @@ export {
   directRetainedProcessMatchesBackend,
   disableCapability,
   discoverMcpRegistryCapabilities,
+  documentEmbeddingCostMicros,
+  draftModelProvided,
   editHumanQueuePrompt,
   editableArtifactActorKey,
   editableArtifactAuthorizationRevisionPortFromPostgres,
@@ -18038,6 +18576,7 @@ export {
   listRigVersionsForApi,
   listSkills,
   loadRigDefaultVariableSetEnvironment,
+  loadWorkspaceModelSelectionInput,
   lockActiveCustomModelForAdmission,
   lookupExternalIdentityForRequest,
   managedSessionGroupBackend,
@@ -18076,6 +18615,7 @@ export {
   openGeniSlackBotMetadata,
   organizationIntegrationCatalog,
   organizationMembershipHttpStatus,
+  paidDocumentEmbedding,
   parseGitHubRepositoryCoordinates,
   parseSkillSource,
   personalAtlassianDelegationsFromVisibleConnections,
@@ -18155,12 +18695,16 @@ export {
   resolveCatalogSettings,
   resolveChildGoalFromAcceptedSnapshot,
   resolveCodexAppsCredentialIdForRun,
+  resolveDefaultSessionModel,
+  resolveDefaultSessionModelForSelections,
   resolveFikenDefaultCompanySlug,
   resolveFirstPartyMcpToolsForCreate,
   resolveGitHubRepositoryBindings,
   resolveMemberSubjectId,
   resolveRigProviderImageForRun,
   resolveRigProviderImageSelection,
+  resolveScheduledTaskDefaultModel,
+  resolveScheduledTaskPreflightModel,
   resolveSessionCreateScope,
   resolveSessionCreateVisibility,
   resolveSessionSandboxRuntime,
@@ -18201,6 +18745,7 @@ export {
   scheduledTaskTriggerToken,
   searchCapabilityCatalogItems,
   searchKnowledgeEntries,
+  selectDefaultSessionModel,
   selectedPersonalConnectionServers,
   sendAgentSessionMessage,
   sessionGroupMachinePresentation,