@opengeni/core 4.0.1 → 4.0.3

package/dist/index.js

@@ -1378,8 +1378,257 @@ async function knowledgeContextForAccess(deps, access, permission) {
 
 // src/domain/knowledge-search.ts
 import { KnowledgeEntryListRequest } from "@opengeni/contracts";
-import { listKnowledgeEntries } from "@opengeni/db";
-async function searchKnowledgeEntries(db, context, input, embedder) {
+import {
+  applyCreditDebitAfterUse,
+  getBillingBalance as getBillingBalance2,
+  listKnowledgeEntries,
+  recordUsageEvent as recordUsageEvent2,
+  sumUsageQuantity as sumUsageQuantity2,
+  withKnowledgeQueryAccountLock
+} from "@opengeni/db";
+
+// src/billing/limits.ts
+import {
+  configuredStaticUsageLimits,
+  resolveModelProviderForTurn
+} from "@opengeni/config";
+import {
+  countActiveApiKeysForWorkspace,
+  countActiveOrganizationApiKeysForAccount,
+  countScheduledTasksForWorkspace,
+  countWorkspacesForAccount,
+  getBillingBalance,
+  isCodexBilledTurn,
+  recordUsageEvent,
+  sumUsageQuantity
+} from "@opengeni/db";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
+function paidDocumentEmbedding(settings) {
+  return settings.documentEmbeddingBillingMode === "credits" && settings.documentEmbeddingProvider === "openai";
+}
+function documentEmbeddingCostMicros(settings, inputBytes) {
+  if (!Number.isSafeInteger(inputBytes) || inputBytes < 0)
+    throw new Error("invalid embedding bytes");
+  const amount = (BigInt(inputBytes) * BigInt(settings.documentEmbeddingRateMicrosPerMillionBytes) + 999999n) / 1000000n;
+  if (amount > BigInt(Number.MAX_SAFE_INTEGER))
+    throw new Error("embedding cost exceeds safe integer");
+  return Number(amount);
+}
+function modelFundingForAdmission(settings, model, codexBilled) {
+  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
+  const codexSubscriptionModel = resolvedModel?.credentialSource.kind === "connected_subscription" && resolvedModel.credentialSource.provider === "codex";
+  return {
+    // A Codex namespace/definition never bypasses credits by itself: the live
+    // workspace credential predicate above remains authoritative. SuperGrok's
+    // static overlay is likewise secret-free; its worker/provider admission
+    // owns live account selection before any upstream request can occur.
+    fundedWithoutCredits: codexBilled || resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits",
+    countsTowardTokenCap: !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment"
+  };
+}
+async function requireLimit(deps, input) {
+  const decision = await checkLimit(deps, input);
+  if (decision.allowed) {
+    return;
+  }
+  throw new HTTPException4(decision.code === "insufficient_credits" ? 402 : 429, {
+    message: decision.message
+  });
+}
+async function checkLimit(deps, input) {
+  const codexBilled = input.workspaceId ? await isCodexBilledTurn({
+    db: deps.db,
+    settings: deps.settings,
+    workspaceId: input.workspaceId,
+    model: input.model
+  }) : false;
+  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
+    deps.settings,
+    input.model,
+    codexBilled
+  );
+  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
+  if (!creditDecision.allowed) {
+    return creditDecision;
+  }
+  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
+    return { allowed: true };
+  }
+  return await checkStaticCaps(deps, input, {
+    fundedWithoutCredits,
+    countsTowardTokenCap
+  });
+}
+async function checkCreditBalance(deps, input, externallyBilled) {
+  if (externallyBilled) {
+    return { allowed: true };
+  }
+  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
+    return { allowed: true };
+  }
+  const balance = await getBillingBalance(deps.db, input.accountId);
+  if (balance.balanceMicros > 0) {
+    return { allowed: true };
+  }
+  return { allowed: false, code: "insufficient_credits", message: "insufficient OpenGeni credits" };
+}
+async function checkStaticCaps(deps, input, funding) {
+  const limits = configuredStaticUsageLimits(deps.settings);
+  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !funding.fundedWithoutCredits) {
+    const used = await sumUsageQuantity(deps.db, {
+      accountId: input.accountId,
+      eventType: "model.cost",
+      since: startOfUtcMonth()
+    });
+    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
+      return blocked(
+        "max_monthly_cost_micros_per_account",
+        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`
+      );
+    }
+  }
+  switch (input.action) {
+    case "workspace:create": {
+      if (!limits.maxWorkspacesPerAccount) {
+        return { allowed: true };
+      }
+      const count = await countWorkspacesForAccount(deps.db, input.accountId);
+      return count < limits.maxWorkspacesPerAccount ? { allowed: true } : blocked(
+        "max_workspaces_per_account",
+        `workspace limit reached (${limits.maxWorkspacesPerAccount})`
+      );
+    }
+    case "api_key:create": {
+      if (!limits.maxApiKeysPerWorkspace) {
+        return { allowed: true };
+      }
+      const count = input.workspaceId ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId) : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
+      return count < limits.maxApiKeysPerWorkspace ? { allowed: true } : blocked(
+        "max_api_keys_per_workspace",
+        `API key limit reached (${limits.maxApiKeysPerWorkspace})`
+      );
+    }
+    case "schedule:create": {
+      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);
+      return count < limits.maxSchedulesPerWorkspace ? { allowed: true } : blocked(
+        "max_schedules_per_workspace",
+        `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`
+      );
+    }
+    case "file:upload": {
+      if (!limits.maxFileUploadBytes || !input.quantity) {
+        return { allowed: true };
+      }
+      return input.quantity <= limits.maxFileUploadBytes ? { allowed: true } : blocked(
+        "max_file_upload_bytes",
+        `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`
+      );
+    }
+    case "agent_run:create": {
+      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "agent_run.created",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace ? { allowed: true } : blocked(
+        "max_monthly_agent_runs_per_workspace",
+        `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`
+      );
+    }
+    case "tokens:consume": {
+      if (!funding.countsTowardTokenCap || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "model.tokens",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxMonthlyTokensPerWorkspace ? { allowed: true } : blocked(
+        "max_monthly_tokens_per_workspace",
+        `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`
+      );
+    }
+    case "document:index": {
+      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {
+        return { allowed: true };
+      }
+      const used = await sumUsageQuantity(deps.db, {
+        workspaceId: input.workspaceId,
+        eventType: "document.indexed",
+        since: startOfUtcMonth()
+      });
+      const requested = input.quantity ?? 0;
+      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace ? { allowed: true } : blocked(
+        "max_document_indexed_chunks_per_workspace",
+        `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`
+      );
+    }
+  }
+}
+async function recordWorkspaceUsage(deps, input) {
+  await recordUsageEvent(deps.db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId ?? null,
+    eventType: input.eventType,
+    quantity: input.quantity,
+    unit: input.unit,
+    sourceResourceType: input.sourceResourceType,
+    sourceResourceId: input.sourceResourceId,
+    sessionId: input.sessionId ?? null,
+    turnId: input.turnId ?? null,
+    turnAttemptId: input.turnAttemptId ?? null,
+    initiator: input.initiator ?? (input.subjectId ? { kind: "subject", subjectId: input.subjectId } : null),
+    ...input.initiatorContext ? { initiatorContext: input.initiatorContext } : {},
+    origin: input.origin ?? null,
+    idempotencyKey: input.idempotencyKey
+  });
+}
+function usesCreditLimits(deps) {
+  return deps.settings.billingMode === "stripe" || deps.settings.usageLimitsMode === "managed";
+}
+function isCostlyAction(action) {
+  return action === "agent_run:create" || action === "tokens:consume";
+}
+function blocked(code, message) {
+  return { allowed: false, code, message };
+}
+function startOfUtcMonth() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+
+// src/domain/knowledge-search.ts
+var MAX_PAID_QUERY_BYTES = 4096;
+var MAX_PAID_QUERY_MICROS = 1e3;
+var MAX_PAID_QUERY_BYTES_PER_MINUTE = 64 * 1024;
+var MAX_PAID_QUERY_BYTES_PER_MONTH = 8 * 1024 * 1024;
+var MAX_PAID_QUERY_MICROS_PER_MINUTE = 1e4;
+var MAX_PAID_QUERY_MICROS_PER_MONTH = 1e6;
+var KnowledgeVectorFundingError = class extends Error {
+  code = "knowledge_vector_funding_required";
+  constructor() {
+    super("Knowledge vector search needs OpenGeni credits; keyword search remains available.");
+    this.name = "KnowledgeVectorFundingError";
+  }
+};
+var KnowledgeVectorQueryRejectedError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "KnowledgeVectorQueryRejectedError";
+  }
+};
+async function searchKnowledgeEntries(db, context, input, embedder, settings) {
   const request = KnowledgeEntryListRequest.parse(input);
   if (!request.query || request.mode === "keyword") {
     return {
@@ -1390,25 +1639,119 @@ async function searchKnowledgeEntries(db, context, input, embedder) {
   const lexicalQuery = /^[\p{L}\p{N}\s]+$/u.test(request.query) && !/\bOR\b/i.test(request.query) ? [...new Set(request.query.trim().split(/\s+/u))].map((term) => `"${term}"`).join(" OR ") : request.query;
   const lexicalRequest = KnowledgeEntryListRequest.safeParse({ ...request, query: lexicalQuery });
   const retrievalRequest = request.mode === "hybrid" && lexicalRequest.success ? lexicalRequest.data : request;
-  let embedding;
-  try {
-    const provider = embedder();
-    const values = await provider.embedQuery(request.query);
-    if (values.length !== provider.dimensions || values.some((value) => !Number.isFinite(value)) || !values.some((value) => value !== 0)) {
-      throw new Error("Knowledge query embedding is unavailable");
-    }
-    embedding = { model: provider.model, values };
-  } catch (error) {
+  const keywordFallback = async (queryDb, error, fallbackReason) => {
     if (request.mode === "vector") throw error;
     return {
-      ...await listKnowledgeEntries(db, context, { ...retrievalRequest, mode: "keyword" }),
-      searchMode: "keyword"
+      ...await listKnowledgeEntries(queryDb, context, { ...retrievalRequest, mode: "keyword" }),
+      searchMode: "keyword",
+      fallbackReason
     };
-  }
-  return {
-    ...await listKnowledgeEntries(db, context, retrievalRequest, embedding),
-    searchMode: request.mode
   };
+  const bytes = Buffer.byteLength(request.query, "utf8");
+  const paidSettings = settings && paidDocumentEmbedding(settings) ? settings : void 0;
+  if (paidSettings && request.cursor)
+    throw new KnowledgeVectorQueryRejectedError(
+      "pagination_unavailable",
+      "Paid semantic Knowledge pagination is unavailable; use keyword mode"
+    );
+  const cost = paidSettings ? documentEmbeddingCostMicros(paidSettings, bytes) : 0;
+  if (paidSettings && (bytes > MAX_PAID_QUERY_BYTES || cost > MAX_PAID_QUERY_MICROS))
+    return keywordFallback(
+      db,
+      new KnowledgeVectorQueryRejectedError(
+        "query_limit",
+        "Paid Knowledge query exceeds the per-request limit"
+      ),
+      "query_limit"
+    );
+  const retrieveThenSettle = async (queryDb) => {
+    let embedding;
+    try {
+      const provider = embedder();
+      const values = await provider.embedQuery(request.query);
+      if (values.length !== provider.dimensions || values.some((value) => !Number.isFinite(value)) || !values.some((value) => value !== 0))
+        throw new Error("Knowledge query embedding is unavailable");
+      embedding = { model: provider.model, values };
+    } catch (error) {
+      return keywordFallback(queryDb, error, "provider_unavailable");
+    }
+    const found = await listKnowledgeEntries(queryDb, context, retrievalRequest, embedding);
+    if (settings) {
+      const usageId = crypto.randomUUID();
+      await recordUsageEvent2(queryDb, {
+        accountId: context.accountId,
+        workspaceId: context.workspaceId,
+        eventType: "document.query_embedding_bytes",
+        quantity: bytes,
+        unit: "byte",
+        sourceResourceType: "knowledge_query",
+        sourceResourceId: usageId,
+        idempotencyKey: `knowledge.query_bytes:${usageId}`
+      });
+      if (paidSettings && cost > 0)
+        await recordUsageEvent2(queryDb, {
+          accountId: context.accountId,
+          workspaceId: context.workspaceId,
+          eventType: "document.query_embedding_cost",
+          quantity: cost,
+          unit: "micro_usd",
+          sourceResourceType: "knowledge_query",
+          sourceResourceId: usageId,
+          idempotencyKey: `knowledge.query_cost:${usageId}`
+        });
+      if (paidSettings && cost > 0)
+        await applyCreditDebitAfterUse(queryDb, {
+          accountId: context.accountId,
+          workspaceId: context.workspaceId,
+          type: "document_embedding_debit",
+          amountMicros: cost,
+          sourceType: "knowledge_query",
+          sourceId: usageId,
+          idempotencyKey: `knowledge.query_embedding:${usageId}`,
+          metadata: { model: embedding.model, bytes }
+        });
+    }
+    return { ...found, searchMode: request.mode };
+  };
+  if (!paidSettings) return retrieveThenSettle(db);
+  return withKnowledgeQueryAccountLock(
+    db,
+    context.accountId,
+    context.workspaceId,
+    async (lockedDb) => {
+      const balance = await getBillingBalance2(lockedDb, context.accountId);
+      if (balance.balanceMicros <= 0)
+        return keywordFallback(lockedDb, new KnowledgeVectorFundingError(), "awaiting_funding");
+      const now = /* @__PURE__ */ new Date();
+      const minuteBytes = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_bytes",
+        since: new Date(now.getTime() - 6e4)
+      });
+      const monthBytes = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_bytes",
+        since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1))
+      });
+      const minuteMicros = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_cost",
+        since: new Date(now.getTime() - 6e4)
+      });
+      const monthMicros = await sumUsageQuantity2(lockedDb, {
+        accountId: context.accountId,
+        eventType: "document.query_embedding_cost",
+        since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1))
+      });
+      if (minuteBytes + bytes > MAX_PAID_QUERY_BYTES_PER_MINUTE || monthBytes + bytes > MAX_PAID_QUERY_BYTES_PER_MONTH || minuteMicros + cost > MAX_PAID_QUERY_MICROS_PER_MINUTE || monthMicros + cost > MAX_PAID_QUERY_MICROS_PER_MONTH)
+        return keywordFallback(
+          lockedDb,
+          new KnowledgeVectorQueryRejectedError("quota", "Paid Knowledge query rate limit reached"),
+          "quota"
+        );
+      return retrieveThenSettle(lockedDb);
+    }
+  );
 }
 
 // src/workflow-wake-contract.ts
@@ -3272,7 +3615,7 @@ async function provisionSandbox(services, ctx, input) {
 }
 
 // src/application/external-workspace-members.ts
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 import {
   AddExternalWorkspaceMemberRequest,
   ExternalIdentityReference,
@@ -3308,12 +3651,12 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
   const context = await requireAccessContext(c, deps);
   const authority = accountScopedApiKeyWorkspaceAuthority(context);
   if (!authority)
-    throw new HTTPException4(403, {
+    throw new HTTPException5(403, {
       message: "external onboarding requires an organization service key"
     });
   const grant = await requireFreshAccessGrant(c, deps, workspaceId, "members:manage");
   if (grant.accountId !== authority.accountId || payload.permissions.some((permission) => !hasPermission(grant.permissions, permission))) {
-    throw new HTTPException4(403, { message: "membership exceeds key authority" });
+    throw new HTTPException5(403, { message: "membership exceeds key authority" });
   }
   if (payload.operationId) {
     try {
@@ -3339,11 +3682,11 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
       "members:manage"
     );
     if (live.accountId !== grant.accountId || live.subjectId !== grant.subjectId || payload.permissions.some((permission) => !hasPermission(live.permissions, permission))) {
-      throw new HTTPException4(403, { message: "membership authority changed" });
+      throw new HTTPException5(403, { message: "membership authority changed" });
     }
     const workspace = await requireWorkspace2(tx, workspaceId);
     if (workspace.kind !== "shared" || workspace.accountId !== authority.accountId)
-      throw new HTTPException4(403, {
+      throw new HTTPException5(403, {
         message: "external onboarding requires a shared organization workspace"
       });
     const identity = await ensureExternalIdentity2(tx, {
@@ -3357,7 +3700,7 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
     const permissions = [...new Set(payload.permissions)];
     if (existing) {
       if (existing.permissions.length !== permissions.length || existing.permissions.some((permission) => !permissions.includes(permission))) {
-        throw new HTTPException4(409, {
+        throw new HTTPException5(409, {
           message: "existing membership differs; onboarding does not overwrite permissions"
         });
       }
@@ -3376,7 +3719,7 @@ async function addExternalWorkspaceMemberForRequest(c, deps, workspaceId, input)
 function rethrowExternalWorkspaceOperation(error) {
   const status = organizationMembershipHttpStatus(nestedPostgresSqlState2(error));
   if (status)
-    throw new HTTPException4(status, {
+    throw new HTTPException5(status, {
       message: status === 409 ? "External membership operation changed or was cancelled" : "External membership operation is not available"
     });
   throw error;
@@ -3385,7 +3728,7 @@ async function externalService(c, deps, organizationId) {
   const context = await requireAccessContext(c, deps);
   const authority = accountScopedApiKeyWorkspaceAuthority(context);
   if (!authority || authority.accountId !== organizationId || !hasPermission(authority.permissions, "members:manage")) {
-    throw new HTTPException4(403, {
+    throw new HTTPException5(403, {
       message: "External membership operation requires an organization service key"
     });
   }
@@ -3395,7 +3738,7 @@ async function lookupExternalIdentityForRequest(c, deps, organizationId, input)
   const service = await externalService(c, deps, organizationId);
   const identity = ExternalIdentityReference.safeParse(input);
   if (!identity.success)
-    throw new HTTPException4(422, { message: "Invalid external identity reference" });
+    throw new HTTPException5(422, { message: "Invalid external identity reference" });
   try {
     return await lookupExternalIdentity(deps.db, service, identity.data);
   } catch (error) {
@@ -3406,7 +3749,7 @@ async function cancelExternalWorkspaceMemberGrantForRequest(c, deps, organizatio
   const service = await externalService(c, deps, organizationId);
   const request = CancelExternalWorkspaceMemberGrantRequest.safeParse(input);
   if (!request.success)
-    throw new HTTPException4(422, { message: "Invalid external grant cancellation" });
+    throw new HTTPException5(422, { message: "Invalid external grant cancellation" });
   try {
     return await cancelExternalWorkspaceMemberGrant(
       deps.db,
@@ -3419,7 +3762,7 @@ async function cancelExternalWorkspaceMemberGrantForRequest(c, deps, organizatio
 }
 
 // src/application/external-identity-lifecycle.ts
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
 import { UpdateExternalIdentityMembershipRequest } from "@opengeni/contracts/external-identities";
 import { updateOrganizationMember } from "@opengeni/db";
 async function updateExternalIdentityMembershipForRequest(context, deps, organizationId, membershipId, input) {
@@ -3429,13 +3772,13 @@ async function updateExternalIdentityMembershipForRequest(context, deps, organiz
     (grant) => grant.accountId === organizationId && grant.subjectId === access.subjectId
   );
   if (!service || service.accountId !== organizationId || !account?.permissions.includes("account:admin")) {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "external identity administration requires an organization service key"
     });
   }
   const parsed = UpdateExternalIdentityMembershipRequest.safeParse(input);
   if (!parsed.success)
-    throw new HTTPException5(422, { message: "invalid external identity transition" });
+    throw new HTTPException6(422, { message: "invalid external identity transition" });
   return updateOrganizationMember(deps.db, {
     organizationId,
     membershipId,
@@ -3457,7 +3800,7 @@ import {
   nestedPostgresSqlState as nestedPostgresSqlState3,
   withWorkspaceSubjectRls as withWorkspaceSubjectRls3
 } from "@opengeni/db";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 function externalContinuationCommitAuthorizer(authorization) {
   const continuation = authorization ? externalActorContinuationForAuthorization(authorization) : null;
   if (!continuation || !authorization) return void 0;
@@ -3472,7 +3815,7 @@ function externalContinuationCommitAuthorizer(authorization) {
       await requireExternalContinuationAuthority(tx, continuation, scope, permissions);
     } catch (error) {
       const denied2 = nestedPostgresSqlState3(error) === "42501" || error instanceof Error && error.message === "External continuation authority unavailable";
-      throw new HTTPException6(denied2 ? 403 : 503, {
+      throw new HTTPException7(denied2 ? 403 : 503, {
         message: denied2 ? "external authority changed" : "external authority is unavailable",
         cause: error
       });
@@ -3537,12 +3880,12 @@ import {
   variableSetVariableNameReservation
 } from "@opengeni/contracts";
 import { getVariableSet, recordAuditEvent } from "@opengeni/db";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 var MAX_ENVIRONMENTS_PER_WORKSPACE = 25;
 var MAX_VARIABLES_PER_ENVIRONMENT = 100;
 function assertAllowedVariableSetVariableName(name) {
   if (variableSetVariableNameReservation(name)) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: `reserved variable set variable name / reserved environment variable name: ${name}`
     });
   }
@@ -3551,7 +3894,7 @@ var assertAllowedEnvironmentVariableName = assertAllowedVariableSetVariableName;
 function requireVariableSetEncryption(settings) {
   const key = environmentsEncryptionKeyBytes(settings);
   if (!key) {
-    throw new HTTPException7(503, {
+    throw new HTTPException8(503, {
       message: "variable sets require OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"
     });
   }
@@ -3569,7 +3912,7 @@ async function requireVariableSetForApi(db, grant, variableSetId) {
     variableSetId
   );
   if (!variableSet) {
-    throw new HTTPException7(404, { message: "variableSet not found" });
+    throw new HTTPException8(404, { message: "variableSet not found" });
   }
   return variableSet;
 }
@@ -3583,7 +3926,7 @@ async function validateVariableSetAttachment(deps, grant, workspaceId, variableS
     variableSetId
   );
   if (!variableSet) {
-    throw new HTTPException7(422, { message: "unknown variableSetId" });
+    throw new HTTPException8(422, { message: "unknown variableSetId" });
   }
   return variableSet;
 }
@@ -3775,11 +4118,11 @@ import {
 import { HTTPException as HTTPException15 } from "hono/http-exception";
 
 // src/domain/external-creation-attribution.ts
-import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
 var EXTERNAL_CREATION_ATTRIBUTION_KEY = "opengeniExternalCreationAttribution";
 function externalCreationMetadata(metadata, authorization, grant) {
   if (metadata && Object.hasOwn(metadata, EXTERNAL_CREATION_ATTRIBUTION_KEY)) {
-    throw new HTTPException8(422, {
+    throw new HTTPException9(422, {
       message: `${EXTERNAL_CREATION_ATTRIBUTION_KEY} is server-owned`
     });
   }
@@ -3846,215 +4189,6 @@ function prepareExternalLinkTaskAdmission(authorization, actor) {
   };
 }
 
-// src/billing/limits.ts
-import {
-  configuredStaticUsageLimits,
-  resolveModelProviderForTurn
-} from "@opengeni/config";
-import {
-  countActiveApiKeysForWorkspace,
-  countActiveOrganizationApiKeysForAccount,
-  countScheduledTasksForWorkspace,
-  countWorkspacesForAccount,
-  getBillingBalance,
-  isCodexBilledTurn,
-  recordUsageEvent,
-  sumUsageQuantity
-} from "@opengeni/db";
-import { HTTPException as HTTPException9 } from "hono/http-exception";
-function modelFundingForAdmission(settings, model, codexBilled) {
-  const resolvedModel = model ? resolveModelProviderForTurn(settings, model)?.model : null;
-  const codexSubscriptionModel = resolvedModel?.credentialSource.kind === "connected_subscription" && resolvedModel.credentialSource.provider === "codex";
-  return {
-    // A Codex namespace/definition never bypasses credits by itself: the live
-    // workspace credential predicate above remains authoritative. SuperGrok's
-    // static overlay is likewise secret-free; its worker/provider admission
-    // owns live account selection before any upstream request can occur.
-    fundedWithoutCredits: codexBilled || resolvedModel != null && !codexSubscriptionModel && resolvedModel.cost !== "credits",
-    countsTowardTokenCap: !codexBilled && resolvedModel != null && resolvedModel.billing.upstreamPayer === "deployment"
-  };
-}
-async function requireLimit(deps, input) {
-  const decision = await checkLimit(deps, input);
-  if (decision.allowed) {
-    return;
-  }
-  throw new HTTPException9(decision.code === "insufficient_credits" ? 402 : 429, {
-    message: decision.message
-  });
-}
-async function checkLimit(deps, input) {
-  const codexBilled = input.workspaceId ? await isCodexBilledTurn({
-    db: deps.db,
-    settings: deps.settings,
-    workspaceId: input.workspaceId,
-    model: input.model
-  }) : false;
-  const { fundedWithoutCredits, countsTowardTokenCap } = modelFundingForAdmission(
-    deps.settings,
-    input.model,
-    codexBilled
-  );
-  const creditDecision = await checkCreditBalance(deps, input, fundedWithoutCredits);
-  if (!creditDecision.allowed) {
-    return creditDecision;
-  }
-  if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
-    return { allowed: true };
-  }
-  return await checkStaticCaps(deps, input, {
-    fundedWithoutCredits,
-    countsTowardTokenCap
-  });
-}
-async function checkCreditBalance(deps, input, externallyBilled) {
-  if (externallyBilled) {
-    return { allowed: true };
-  }
-  if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
-    return { allowed: true };
-  }
-  const balance = await getBillingBalance(deps.db, input.accountId);
-  if (balance.balanceMicros > 0) {
-    return { allowed: true };
-  }
-  return { allowed: false, code: "insufficient_credits", message: "insufficient OpenGeni credits" };
-}
-async function checkStaticCaps(deps, input, funding) {
-  const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !funding.fundedWithoutCredits) {
-    const used = await sumUsageQuantity(deps.db, {
-      accountId: input.accountId,
-      eventType: "model.cost",
-      since: startOfUtcMonth()
-    });
-    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
-      return blocked(
-        "max_monthly_cost_micros_per_account",
-        `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`
-      );
-    }
-  }
-  switch (input.action) {
-    case "workspace:create": {
-      if (!limits.maxWorkspacesPerAccount) {
-        return { allowed: true };
-      }
-      const count = await countWorkspacesForAccount(deps.db, input.accountId);
-      return count < limits.maxWorkspacesPerAccount ? { allowed: true } : blocked(
-        "max_workspaces_per_account",
-        `workspace limit reached (${limits.maxWorkspacesPerAccount})`
-      );
-    }
-    case "api_key:create": {
-      if (!limits.maxApiKeysPerWorkspace) {
-        return { allowed: true };
-      }
-      const count = input.workspaceId ? await countActiveApiKeysForWorkspace(deps.db, input.workspaceId) : await countActiveOrganizationApiKeysForAccount(deps.db, input.accountId);
-      return count < limits.maxApiKeysPerWorkspace ? { allowed: true } : blocked(
-        "max_api_keys_per_workspace",
-        `API key limit reached (${limits.maxApiKeysPerWorkspace})`
-      );
-    }
-    case "schedule:create": {
-      if (!limits.maxSchedulesPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const count = await countScheduledTasksForWorkspace(deps.db, input.workspaceId);
-      return count < limits.maxSchedulesPerWorkspace ? { allowed: true } : blocked(
-        "max_schedules_per_workspace",
-        `scheduled task limit reached (${limits.maxSchedulesPerWorkspace})`
-      );
-    }
-    case "file:upload": {
-      if (!limits.maxFileUploadBytes || !input.quantity) {
-        return { allowed: true };
-      }
-      return input.quantity <= limits.maxFileUploadBytes ? { allowed: true } : blocked(
-        "max_file_upload_bytes",
-        `file upload exceeds static limit of ${limits.maxFileUploadBytes} bytes`
-      );
-    }
-    case "agent_run:create": {
-      if (!limits.maxMonthlyAgentRunsPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "agent_run.created",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxMonthlyAgentRunsPerWorkspace ? { allowed: true } : blocked(
-        "max_monthly_agent_runs_per_workspace",
-        `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`
-      );
-    }
-    case "tokens:consume": {
-      if (!funding.countsTowardTokenCap || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "model.tokens",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxMonthlyTokensPerWorkspace ? { allowed: true } : blocked(
-        "max_monthly_tokens_per_workspace",
-        `monthly token limit reached (${limits.maxMonthlyTokensPerWorkspace})`
-      );
-    }
-    case "document:index": {
-      if (!limits.maxDocumentIndexedChunksPerWorkspace || !input.workspaceId) {
-        return { allowed: true };
-      }
-      const used = await sumUsageQuantity(deps.db, {
-        workspaceId: input.workspaceId,
-        eventType: "document.indexed",
-        since: startOfUtcMonth()
-      });
-      const requested = input.quantity ?? 0;
-      return used + requested <= limits.maxDocumentIndexedChunksPerWorkspace ? { allowed: true } : blocked(
-        "max_document_indexed_chunks_per_workspace",
-        `monthly document indexing limit reached (${limits.maxDocumentIndexedChunksPerWorkspace} chunks)`
-      );
-    }
-  }
-}
-async function recordWorkspaceUsage(deps, input) {
-  await recordUsageEvent(deps.db, {
-    accountId: input.accountId,
-    workspaceId: input.workspaceId,
-    subjectId: input.subjectId ?? null,
-    eventType: input.eventType,
-    quantity: input.quantity,
-    unit: input.unit,
-    sourceResourceType: input.sourceResourceType,
-    sourceResourceId: input.sourceResourceId,
-    sessionId: input.sessionId ?? null,
-    turnId: input.turnId ?? null,
-    turnAttemptId: input.turnAttemptId ?? null,
-    initiator: input.initiator ?? (input.subjectId ? { kind: "subject", subjectId: input.subjectId } : null),
-    ...input.initiatorContext ? { initiatorContext: input.initiatorContext } : {},
-    origin: input.origin ?? null,
-    idempotencyKey: input.idempotencyKey
-  });
-}
-function usesCreditLimits(deps) {
-  return deps.settings.billingMode === "stripe" || deps.settings.usageLimitsMode === "managed";
-}
-function isCostlyAction(action) {
-  return action === "agent_run:create" || action === "tokens:consume" || action === "document:index";
-}
-function blocked(code, message) {
-  return { allowed: false, code, message };
-}
-function startOfUtcMonth() {
-  const now = /* @__PURE__ */ new Date();
-  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
-}
-
 // src/domain/native-mcp-connection-admission.ts
 import { HTTPException as HTTPException10 } from "hono/http-exception";
 function assertNativeMcpConnectionRef(connectionRef) {
@@ -5048,6 +5182,7 @@ function fikenCatalogItem(fikenConnections) {
     metadata: {
       connectorMode: "first_party_fiken",
       ownership: "workspace",
+      connectionStatus: fikenConnection?.status ?? null,
       // Derived from the contracts catalog so a new fiken_* tool cannot be
       // registered without also appearing on the capability tile.
       firstPartyMcpTools: FIRST_PARTY_MCP_TOOL_NAMES.filter((name) => name.startsWith("fiken_"))
@@ -5249,15 +5384,15 @@ function socialProviderConnectionCounts(item) {
   };
 }
 function applyCapabilityEnablement(item, installation) {
+  if (item.surfaceType === "first_party_fiken") {
+    return { ...item, connectionRef: null };
+  }
   if (item.kind === "skill" || item.kind === "api" || item.kind === "plugin") {
     return { ...item, enabled: false, enabledReason: null, connectionRef: null };
   }
   if (isSocialProviderIntegration(item)) {
     return { ...item, connectionRef: null };
   }
-  if (item.surfaceType === "first_party_fiken") {
-    return { ...item, connectionRef: null };
-  }
   if (item.surfaceType === "codex_apps") {
     return { ...item, connectionRef: null };
   }
@@ -17339,7 +17474,7 @@ var CATALOG_PAGE_SIZE = 25;
 var CATALOG_PAGE_BUDGET = 40;
 var DESCRIPTION_CHARS = 2e3;
 var CATALOG_BYTES = 256 * 1024;
-async function prepareKnowledgeSave(db, context, input, embedder, services = defaults) {
+async function prepareKnowledgeSave(db, context, input, embedder, services = defaults, settings) {
   const request = KnowledgeSavePreparationRequest.parse(input);
   if (context.actor.kind !== "agent" && !(context.actor.kind === "human" && context.actor.review)) {
     throw Object.assign(
@@ -17364,20 +17499,31 @@ async function prepareKnowledgeSave(db, context, input, embedder, services = def
     complete: true,
     nextCursors: { published: null, needs_review: null }
   };
-  const matches = {
-    published: await services.search(
-      db,
-      context,
-      { query: request.query, limit: request.limit, view: "published" },
-      sharedEmbedder
-    ),
-    needs_review: await services.search(
-      db,
-      context,
-      { query: request.query, limit: request.limit, view: "needs_review" },
-      sharedEmbedder
-    )
-  };
+  const paid = settings != null && paidDocumentEmbedding(settings);
+  const published = await services.search(
+    db,
+    context,
+    {
+      query: request.query,
+      limit: request.limit,
+      view: "published",
+      ...paid ? { mode: "keyword" } : {}
+    },
+    sharedEmbedder,
+    paid ? void 0 : settings
+  );
+  const needsReview = await services.search(
+    db,
+    context,
+    {
+      query: request.query,
+      limit: request.limit,
+      view: "needs_review",
+      ...published.searchMode === "keyword" ? { mode: "keyword" } : {}
+    },
+    sharedEmbedder
+  );
+  const matches = { published, needs_review: needsReview };
   for (const view of ["published", "needs_review"]) {
     if (request.collectionCursors && request.collectionCursors[view] === null) continue;
     let cursor = request.collectionCursors?.[view] ?? void 0;
@@ -17786,6 +17932,8 @@ export {
   InMemoryEditableArtifactLiveTicketStore,
   InMemoryEditableArtifactStableIdFactory,
   InMemoryEditableArtifactStore,
+  KnowledgeVectorFundingError,
+  KnowledgeVectorQueryRejectedError,
   MAX_CHECKS_PER_RIG,
   MAX_CREDENTIAL_HOOKS_PER_RIG,
   MAX_DEFAULT_VARIABLE_SETS_PER_RIG,
@@ -17934,6 +18082,7 @@ export {
   directRetainedProcessMatchesBackend,
   disableCapability,
   discoverMcpRegistryCapabilities,
+  documentEmbeddingCostMicros,
   editHumanQueuePrompt,
   editableArtifactActorKey,
   editableArtifactAuthorizationRevisionPortFromPostgres,
@@ -18076,6 +18225,7 @@ export {
   openGeniSlackBotMetadata,
   organizationIntegrationCatalog,
   organizationMembershipHttpStatus,
+  paidDocumentEmbedding,
   parseGitHubRepositoryCoordinates,
   parseSkillSource,
   personalAtlassianDelegationsFromVisibleConnections,