@opengeni/core 4.0.1 → 4.0.3-canary.36199476632001

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "4.0.1",
+  "version": "4.0.3-canary.36199476632001",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -50,17 +50,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "^0.3.4",
-    "@opengeni/codex": "^0.2.25",
-    "@opengeni/config": "^2.1.0",
-    "@opengeni/contracts": "^5.1.0",
-    "@opengeni/db": "^6.0.1",
-    "@opengeni/documents": "^0.8.32",
-    "@opengeni/events": "^0.4.30",
-    "@opengeni/network": "^0.3.1",
-    "@opengeni/observability": "^0.8.31",
-    "@opengeni/runtime": "^4.0.1",
-    "@opengeni/storage": "^0.2.132",
+    "@opengeni/capabilities": "^0.3.4-canary.36199476632001",
+    "@opengeni/codex": "^0.2.26-canary.36199476632001",
+    "@opengeni/config": "^2.1.1-canary.36199476632001",
+    "@opengeni/contracts": "^5.1.1-canary.36199476632001",
+    "@opengeni/db": "^6.0.3-canary.36199476632001",
+    "@opengeni/documents": "^0.8.34-canary.36199476632001",
+    "@opengeni/events": "^0.4.32-canary.36199476632001",
+    "@opengeni/network": "^0.3.1-canary.36199476632001",
+    "@opengeni/observability": "^0.8.32-canary.36199476632001",
+    "@opengeni/runtime": "^4.0.3-canary.36199476632001",
+    "@opengeni/storage": "^0.2.133-canary.36199476632001",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/application/new-session-drafts.ts

@@ -13,6 +13,7 @@ import {
   getSandbox,
   getVariableSet,
   NewSessionDraftAccessError,
+  newSessionDraftModelProvided,
   newSessionDraftSelectedProjectChannelId,
   newSessionDraftToolsProvided,
   newSessionSelectionHistory,
@@ -38,6 +39,8 @@ import {
   type AccessGrantAuthorization,
 } from "../access";
 import { assertConfiguredModel, assertWorkspaceModelPolicyAllows } from "../domain/sessions";
+import { resolveDefaultSessionModel } from "../default-session-model";
+import { canonicalizeConfiguredModelId, type Settings } from "@opengeni/config";
 
 type NewSessionDraftDependencies = Pick<AppDependencies, "settings" | "db" | "objectStorage">;
 
@@ -59,6 +62,9 @@ function mapNewSessionDraft(
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     latencyMode: row.latencyMode,
+    ...(newSessionDraftModelProvided(row) !== undefined
+      ? { modelProvided: newSessionDraftModelProvided(row) }
+      : {}),
     ...(selectedProjectChannelId !== undefined ? { selectedProjectChannelId } : {}),
     options: publicNewSessionDraftOptions(row),
     selectionHistory: newSessionSelectionHistory(row),
@@ -66,15 +72,71 @@ function mapNewSessionDraft(
   });
 }
 
+/**
+ * Whether a stored draft's model policy was the person's choice. A row written
+ * before the marker existed (or by an older client) counts as a choice unless
+ * it is exactly the deployment default policy (model, reasoning, standard
+ * speed), which is what an untouched composer used to save.
+ */
+export function draftModelProvided(
+  settings: Settings,
+  draft: Pick<NewSessionDraftValue, "model" | "reasoningEffort" | "latencyMode" | "modelProvided">,
+): boolean {
+  if (draft.modelProvided !== undefined) return draft.modelProvided;
+  return !(
+    canonicalizeConfiguredModelId(settings, draft.model) ===
+      canonicalizeConfiguredModelId(settings, settings.openaiModel) &&
+    draft.reasoningEffort === settings.openaiReasoningEffort &&
+    draft.latencyMode === "standard"
+  );
+}
+
+/** The resolved new-chat default for this actor and workspace. */
+async function actorDefaultModel(
+  deps: Pick<NewSessionDraftDependencies, "db" | "settings">,
+  grant: AccessGrant,
+  workspaceId: string,
+) {
+  return await resolveDefaultSessionModel(deps.db, deps.settings, {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId,
+  });
+}
+
+type NewSessionDraftReadOptions = {
+  /**
+   * Project a draft that follows the default onto today's resolved default.
+   * Callers that only reuse a chosen model (Slack defaults) skip the
+   * resolution; session creation resolves the default itself.
+   */
+  projectDefaultModel?: boolean;
+};
+
 async function hydrateNewSessionDraft(
   deps: Pick<NewSessionDraftDependencies, "db" | "settings">,
   grant: AccessGrant,
   workspaceId: string,
   row: Awaited<ReturnType<typeof getNewSessionDraftInTransaction>>,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue | null> {
   if (!row) return null;
-  const mapped = mapNewSessionDraft(row);
-  if (!mapped) return null;
+  const stored = mapNewSessionDraft(row);
+  if (!stored) return null;
+  // A draft that follows the default is projected onto today's default, so a
+  // later subscription connect or credit purchase replaces an untouched free
+  // model. The stored row is unchanged until the person saves again.
+  const modelProvided = draftModelProvided(deps.settings, stored);
+  let mapped: NewSessionDraftValue = { ...stored, modelProvided };
+  if (!modelProvided && readOptions.projectDefaultModel !== false) {
+    const resolved = await actorDefaultModel(deps, grant, workspaceId);
+    mapped = {
+      ...mapped,
+      model: resolved.model,
+      reasoningEffort: resolved.reasoningEffort,
+      latencyMode: resolved.model === stored.model ? stored.latencyMode : "standard",
+    };
+  }
   const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
     deps.db,
     workspaceId,
@@ -191,6 +253,7 @@ async function getActorNewSessionDraftInFileScope(
   deps: Pick<NewSessionDraftDependencies, "settings" | "db">,
   grant: AccessGrant,
   workspaceId: string,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue> {
   const row = await withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, (scoped) =>
     getNewSessionDraftInTransaction(scoped, {
@@ -198,21 +261,26 @@ async function getActorNewSessionDraftInFileScope(
       subjectId: grant.subjectId,
     }),
   );
-  return (
-    (await hydrateNewSessionDraft(deps, grant, workspaceId, row)) ?? {
-      revision: 0,
-      text: "",
-      resources: [],
-      tools: [],
-      toolsProvided: false,
-      model: deps.settings.openaiModel,
-      reasoningEffort: deps.settings.openaiReasoningEffort,
-      latencyMode: "standard",
-      options: {},
-      selectionHistory: { projects: [] },
-      updatedAt: null,
-    }
-  );
+  const hydrated = await hydrateNewSessionDraft(deps, grant, workspaceId, row, readOptions);
+  if (hydrated) return hydrated;
+  const resolved =
+    readOptions.projectDefaultModel === false
+      ? { model: deps.settings.openaiModel, reasoningEffort: deps.settings.openaiReasoningEffort }
+      : await actorDefaultModel(deps, grant, workspaceId);
+  return {
+    revision: 0,
+    text: "",
+    resources: [],
+    tools: [],
+    toolsProvided: false,
+    model: resolved.model,
+    reasoningEffort: resolved.reasoningEffort,
+    latencyMode: "standard",
+    modelProvided: false,
+    options: {},
+    selectionHistory: { projects: [] },
+    updatedAt: null,
+  };
 }
 
 /**
@@ -284,6 +352,7 @@ async function saveActorNewSessionDraftInFileScope(
           model: input.model,
           reasoningEffort: input.reasoningEffort,
           latencyMode: input.latencyMode,
+          ...(input.modelProvided !== undefined ? { modelProvided: input.modelProvided } : {}),
           ...(input.selectedProjectChannelId !== undefined
             ? { selectedProjectChannelId: input.selectedProjectChannelId }
             : {}),
@@ -303,7 +372,10 @@ async function saveActorNewSessionDraftInFileScope(
         }),
       ),
     );
-    return mapNewSessionDraft(saved)!;
+    // Report the same model-policy marker a read of this row reports, so the
+    // save response and the next GET agree for old and new clients alike.
+    const mapped = mapNewSessionDraft(saved)!;
+    return { ...mapped, modelProvided: draftModelProvided(deps.settings, mapped) };
   } catch (error) {
     if (error instanceof NewSessionDraftAccessError) {
       throw new HTTPException(403, { message: error.message });
@@ -317,12 +389,13 @@ export async function getActorNewSessionDraft(
   grant: AccessGrant,
   workspaceId: string,
   authorization?: AccessGrantAuthorization,
+  readOptions: NewSessionDraftReadOptions = {},
 ): Promise<NewSessionDraftValue> {
   const actor = authorization
     ? await fileOwnerContextForAccess(deps, authorization, "sessions:read")
     : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
   return withSessionRlsActorContext(actor, () =>
-    getActorNewSessionDraftInFileScope(deps, grant, workspaceId),
+    getActorNewSessionDraftInFileScope(deps, grant, workspaceId, readOptions),
   );
 }
 export async function saveActorNewSessionDraft(
@@ -341,11 +414,17 @@ export async function getActorNewSessionDefaults(
   grant: AccessGrant,
   workspaceId: string,
 ) {
-  const draft = await getActorNewSessionDraft(deps, grant, workspaceId);
+  // The model is reused only when the person chose it, so a draft that follows
+  // the default is not projected here; session creation resolves it once.
+  const draft = await getActorNewSessionDraft(deps, grant, workspaceId, undefined, {
+    projectDefaultModel: false,
+  });
   const options = draft.options;
   return {
-    // Revision zero is a synthetic empty form, not a user's model preference.
-    ...(draft.revision > 0
+    // Only a model the person chose is carried over. A draft that follows the
+    // default (including the synthetic revision-zero form) leaves the model
+    // out, so session creation resolves the same default itself.
+    ...(draft.revision > 0 && draft.modelProvided === true
       ? {
           model: draft.model,
           reasoningEffort: draft.reasoningEffort,

package/src/application/session-mcp-credential-rotation.ts

@@ -27,6 +27,11 @@ import {
 import { requireVariableSetEncryption } from "../domain/environments";
 import { normalizedSessionMcpCredentialHeaders } from "../domain/sessions";
 import { externalContinuationCommitAuthorizer } from "./external-continuation";
+import {
+  listOwnConnectionAccountsForGrant,
+  personalConnectionDelegationSourceForGrant,
+} from "../domain/personal-connection-delegations";
+import { nativeSessionConnectionReplacement } from "../domain/session-native-connection-replacement";
 
 /** HMAC domains separate request identity from key availability. The key tag
  * carries no request material and neither fingerprint is returned publicly. */
@@ -80,11 +85,20 @@ export async function rotateSessionMcpCredentialsForRequest(
           id: update.id,
           expectedCredentialVersion: update.expectedCredentialVersion,
           expectedServerUrl: update.expectedServerUrl,
-          headers: Object.fromEntries(
-            Object.entries(normalizedSessionMcpCredentialHeaders(update.headers))
-              .map(([name, value]) => [name.toLowerCase(), value] as const)
-              .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
-          ),
+          ...("nativeConnectionId" in update
+            ? {
+                nativeConnectionId: update.nativeConnectionId,
+                ...(update.replacementServerUrl
+                  ? { replacementServerUrl: update.replacementServerUrl }
+                  : {}),
+              }
+            : {
+                headers: Object.fromEntries(
+                  Object.entries(normalizedSessionMcpCredentialHeaders(update.headers))
+                    .map(([name, value]) => [name.toLowerCase(), value] as const)
+                    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+                ),
+              }),
         }))
         .sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),
     };
@@ -102,20 +116,45 @@ export async function rotateSessionMcpCredentialsForRequest(
     actorType: grant.principalKind === "service" ? ("service" as const) : ("human" as const),
   };
   const externalAuthorize = externalContinuationCommitAuthorizer(authorization);
+  let authorizedGrant = grant;
   try {
     return await rotateSessionMcpCredentialsAtomically(deps.db, {
       ...scope,
       operationKey: request.operationKey,
       ...sessionMcpRotationFingerprint(encryptionKey, scope, request),
-      updates: request.updates.map(({ headers, ...update }) => ({
-        ...update,
-        headersEncrypted: Object.fromEntries(
-          Object.entries(headers).map(([name, value]) => [
-            name,
-            encryptVariableSetValue(encryptionKey, value),
-          ]),
-        ),
-      })),
+      updates: request.updates.map((update) =>
+        "nativeConnectionId" in update
+          ? update
+          : {
+              id: update.id,
+              expectedCredentialVersion: update.expectedCredentialVersion,
+              expectedServerUrl: update.expectedServerUrl,
+              headersEncrypted: Object.fromEntries(
+                Object.entries(update.headers).map(([name, value]) => [
+                  name,
+                  encryptVariableSetValue(encryptionKey, value),
+                ]),
+              ),
+            },
+      ),
+      resolveNativeConnection: async (tx, server, nativeConnectionId, replacementServerUrl) => {
+        const connections = await listOwnConnectionAccountsForGrant(tx, authorizedGrant);
+        const source = personalConnectionDelegationSourceForGrant(authorizedGrant);
+        try {
+          return nativeSessionConnectionReplacement({
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: source.kind === "subject" ? source.subjectId : null,
+            serverUrl: server.url,
+            ...(replacementServerUrl ? { replacementServerUrl } : {}),
+            currentRef: server.connectionRef,
+            nativeConnectionId,
+            connections,
+          });
+        } catch {
+          throw new SessionMcpCredentialRotationError("connection_unavailable");
+        }
+      },
       authorize: async (tx) => {
         await externalAuthorize?.(tx);
         const fresh = await reauthorize(tx);
@@ -145,6 +184,7 @@ export async function rotateSessionMcpCredentialsForRequest(
           operation: "session.mcp.credentials.rotate",
           surface: "http",
         });
+        authorizedGrant = fresh;
       },
     });
   } catch (error) {
@@ -162,7 +202,9 @@ export async function rotateSessionMcpCredentialsForRequest(
             ? 403
             : error.code === "not_found"
               ? 404
-              : error.code === "invalid_request" || error.code === "brokered_server"
+              : error.code === "invalid_request" ||
+                  error.code === "brokered_server" ||
+                  error.code === "connection_unavailable"
                 ? 422
                 : 409;
       throw new HTTPException(status, { message: `credential_rotation_${error.code}` });

package/src/billing/limits.ts

@@ -25,6 +25,26 @@ import type { ApiRouteDeps } from "../dependencies";
 
 export type LimitDependencies = Pick<ApiRouteDeps, "db" | "settings">;
 
+/** Deterministic/local embeddings never debit credits, even in paid mode. */
+export function paidDocumentEmbedding(settings: Settings): boolean {
+  return (
+    settings.documentEmbeddingBillingMode === "credits" &&
+    settings.documentEmbeddingProvider === "openai"
+  );
+}
+
+/** Round up each provider request so a positive input cannot become a free debit. */
+export function documentEmbeddingCostMicros(settings: Settings, inputBytes: number): number {
+  if (!Number.isSafeInteger(inputBytes) || inputBytes < 0)
+    throw new Error("invalid embedding bytes");
+  const amount =
+    (BigInt(inputBytes) * BigInt(settings.documentEmbeddingRateMicrosPerMillionBytes) + 999_999n) /
+    1_000_000n;
+  if (amount > BigInt(Number.MAX_SAFE_INTEGER))
+    throw new Error("embedding cost exceeds safe integer");
+  return Number(amount);
+}
+
 export type LimitCheckInput = {
   accountId: string;
   workspaceId?: string;
@@ -296,9 +316,10 @@ function usesCreditLimits(deps: LimitDependencies): boolean {
 }
 
 function isCostlyAction(action: LimitAction): boolean {
-  return (
-    action === "agent_run:create" || action === "tokens:consume" || action === "document:index"
-  );
+  // Document admission retains the monthly chunk quota above, but parsing and
+  // source retention do not consume embedding credits. The worker admits paid
+  // embedding separately and settles its actual provider input after use.
+  return action === "agent_run:create" || action === "tokens:consume";
 }
 
 function blocked(code: string, message: string): LimitDecision {