@opengeni/worker-bundle 2.2.0-canary.36855269964001 → 2.2.0

package/dist/activities/agent-run-admission.d.ts

@@ -1,6 +1,6 @@
 import { type Settings } from "@opengeni/config";
 import type { ControlActivityServices } from "./types.js";
-export type AgentRunAdmissionDenial = "insufficient_credits" | "allowance_exhausted" | "monthly_model_cost_limit" | "monthly_agent_run_limit";
+export type AgentRunAdmissionDenial = "insufficient_credits" | "monthly_model_cost_limit" | "monthly_agent_run_limit";
 /** One worker-side admission boundary for service-authored agent runs. */
 export declare function agentRunAdmissionDenial(services: Pick<ControlActivityServices, "db" | "entitlements"> & {
     settings: Settings;
@@ -9,6 +9,4 @@ export declare function agentRunAdmissionDenial(services: Pick<ControlActivitySe
     workspaceId: string;
     model: string;
     requestedAgentRuns: number;
-    /** The accepted work's causal human, not the scheduler/service caller. */
-    initiatingHumanSubjectId?: string | null;
 }): Promise<AgentRunAdmissionDenial | null>;

package/dist/activities/agent-turn/admission.d.ts

@@ -1,6 +1,6 @@
 import { resolveTurnExecutionPolicyV1, type Settings } from "@opengeni/config";
 import type { TurnActivityServices as ActivityServices } from "../types.js";
-import { type AllowanceExhaustedRefusal, type SessionEvent, type SessionTurn, type ToolAuthNeededPayload, type TurnExecutionPolicyV1, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
+import { type SessionEvent, type SessionTurn, type ToolAuthNeededPayload, type TurnExecutionPolicyV1, type XaiProviderAccountAuthoritySnapshotV1 } from "@opengeni/contracts";
 export declare class WorkspaceHumanInputDisabledError extends Error {
     constructor(kind: "resume" | "interruption");
 }
@@ -62,27 +62,6 @@ export declare function stableInteractionInterventionUuid(namespace: string, ses
  */
 export declare class BudgetExhaustedError extends Error {
     readonly serializedRunState: string | null;
-    readonly allowance: AllowanceRefusal | null;
-    constructor(message: string, serializedRunState: string | null, allowance?: AllowanceRefusal | null);
+    constructor(message: string, serializedRunState: string | null);
 }
-export type AllowanceRefusal = AllowanceExhaustedRefusal;
-/** Account allowance exhaustion is recoverable state, never a provider failure. */
-export declare class AllowanceExhaustedError extends Error {
-    readonly refusal: AllowanceRefusal;
-    readonly code = "allowance_exhausted";
-    constructor(refusal: AllowanceRefusal);
-}
-/** Revalidate between paid calls without replaying provider work or reserving credits. */
-export declare function ensureRunAllowedBetweenModelCalls(input: {
-    settings: Settings;
-    db: ActivityServices["db"];
-    accountId: string;
-    workspaceId: string;
-    isExternallyBilledTurn: boolean;
-    entitlements?: ActivityServices["entitlements"];
-    chargesOpenGeniCredits: boolean;
-    countsTowardTokenCap: boolean;
-    initiatingHumanSubjectId: string | null;
-    serializedRunState?: () => string | null;
-}): Promise<void>;
-export declare function ensureRunAllowed(settings: Settings, db: ActivityServices["db"], accountId: string, workspaceId: string, isExternallyBilledTurn: boolean, entitlements?: ActivityServices["entitlements"], chargesOpenGeniCredits?: boolean, countsTowardTokenCap?: boolean, initiatingHumanSubjectId?: string | null): Promise<void>;
+export declare function ensureRunAllowed(settings: Settings, db: ActivityServices["db"], accountId: string, workspaceId: string, isExternallyBilledTurn: boolean, entitlements?: ActivityServices["entitlements"], chargesOpenGeniCredits?: boolean, countsTowardTokenCap?: boolean): Promise<void>;

package/dist/activities/agent-turn/claude-usage-observer.d.ts

@@ -15,17 +15,5 @@ export declare function createClaudeUsageObserver(providers: ReturnType<typeof p
     token: string;
     connectionId: string;
     credentialVersion: number;
-} | null>): Promise<((providerId: string, response: Response) => void) & {
-    binding(providerId: string): {
-        readonly scope: Scope;
-        readonly token: string;
-        readonly expectedConnectionId: string;
-        readonly expectedCredentialVersion: number;
-    } | undefined;
-    renew(providerId: string, credential: {
-        token: string;
-        connectionId: string;
-        credentialVersion: number;
-    }): void;
-}>;
+} | null>): Promise<(providerId: string, response: Response) => void>;
 export {};

package/dist/activities/agent-turn/run-credentials.d.ts

@@ -2,7 +2,6 @@ import { type GitCredentialTokenWriterSession, type NormalizedRunCredentialMater
 import { type Settings } from "@opengeni/config";
 import { type GitHubTokenMintAuthorization, type MintedRunGitCredentials, type loadWorkspaceEnvironmentForRunWithCredentials } from "../environment.js";
 import type { mergeResourceRefs } from "../common.js";
-import type { withFirstPartyTools } from "../goals.js";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput } from "../types.js";
 import { type ResumedTurnSandbox } from "../../sandbox-resume.js";
 import type { ClaimTurnOk } from "./claim.js";
@@ -11,7 +10,6 @@ import type { SandboxTurnRuntime } from "./sandbox-runtime.js";
 import type { AttemptIdentityState, EventingState, RenewalState, SandboxRuntimeState } from "./turn-context.js";
 export type PrepareRunCredentialsDeps = {
     localMcpServerIds?: readonly string[];
-    turnTools: ReturnType<typeof withFirstPartyTools>;
     input: RunAgentTurnInput;
     settings: Settings;
     db: ActivityServices["db"];

package/dist/activities/agent-turn/stream-attempt.d.ts

@@ -81,7 +81,6 @@ export type TurnStreamAttemptDeps = {
     groupBoxBackend: Settings["sandboxBackend"];
     turnExecutionPolicy: TurnExecutionPolicyV1;
     turn: Pick<SessionTurn, "initiator" | "initiatorContext"> & {
-        initiatingHumanSubjectId: string | null;
         id: string;
         executionGeneration: number;
         model: string;

package/dist/activities/agent-turn/turn-context.d.ts

@@ -25,7 +25,6 @@ export type TurnSettleFn = (input: {
     sessionStatus: SessionStatus;
     activeTurnId: string | null;
     suppressGoalContinuation?: boolean;
-    allowanceGoalPause?: ApplySessionTurnSettlementInput["allowanceGoalPause"];
     consumeRequestedCompactionFailure?: boolean;
     runState?: ApplySessionTurnSettlementInput["runState"];
 }) => Promise<boolean>;

package/dist/activities/goals.d.ts

@@ -2,7 +2,6 @@ import { type Settings } from "@opengeni/config";
 import { type SessionGoal, type ToolRef } from "@opengeni/contracts";
 import { getWorkspaceModelPolicy } from "@opengeni/db";
 import type { ControlActivityServices, MaybeContinueGoalInput, MaybeContinueGoalResult } from "./types.js";
-import { agentRunAdmissionDenial } from "./agent-run-admission.js";
 export declare function createGoalActivities(services: () => Promise<ControlActivityServices>): {
     enqueueGoalRetryWake: (input: MaybeContinueGoalInput) => Promise<void>;
     maybeContinueGoal: (input: MaybeContinueGoalInput) => Promise<MaybeContinueGoalResult>;
@@ -28,10 +27,3 @@ export declare function goalContinuationPrompt(_goal: SessionGoal, _autoContinua
  * lists anywhere else in the pipeline. No-op when the server is not configured.
  */
 export declare function withFirstPartyTools(settings: Settings, tools: ToolRef[]): ToolRef[];
-/**
- * Goals share scheduled admission and pause visibly without synthesizing work.
- */
-export declare function goalRunBudgetBlocked(services: Parameters<typeof agentRunAdmissionDenial>[0], input: Omit<Parameters<typeof agentRunAdmissionDenial>[1], "requestedAgentRuns">): Promise<{
-    pausedReason: "limits" | "allowance";
-    message: string;
-} | null>;

package/dist/activities/run-credentials.d.ts

@@ -1,4 +1,4 @@
-import type { ConnectionCredentialsPort, CredentialAuthNeededPayload, SandboxBackend, RunCredentialsRequest, Session, SessionTurn, ToolRef } from "@opengeni/contracts";
+import type { ConnectionCredentialsPort, CredentialAuthNeededPayload, SandboxBackend, RunCredentialsRequest, Session, SessionTurn } from "@opengeni/contracts";
 import type { Settings } from "@opengeni/config";
 import { type Database } from "@opengeni/db";
 import { type NormalizedRunCredentialMaterial } from "@opengeni/runtime";
@@ -22,8 +22,6 @@ export type RunCredentialResolutionContext = {
     initiatingHumanSubjectId?: string | null;
     /** Installed in-process API routes must never enter a product callback. */
     localMcpServerIds?: readonly string[];
-    /** Exact execution selection, resolved once at the turn policy boundary. */
-    effectiveTools: readonly ToolRef[];
 };
 export type BoundRunCredentialResolver = {
     resolve(input: {
@@ -31,7 +29,7 @@ export type BoundRunCredentialResolver = {
         forceRefresh: boolean;
     }): Promise<NormalizedRunCredentialMaterial | null>;
 };
-export declare function buildRunCredentialsRequest(input: Omit<RunCredentialResolutionContext, "db" | "connectionCredentials" | "settings" | "initiatingHumanSubjectId" | "effectiveTools"> & {
+export declare function buildRunCredentialsRequest(input: Omit<RunCredentialResolutionContext, "db" | "connectionCredentials" | "settings" | "initiatingHumanSubjectId"> & {
     rootSessionId: string;
     purpose: "provision" | "renewal";
     forceRefresh: boolean;

package/dist/activities/types.d.ts

@@ -357,7 +357,7 @@ export type DispatchScheduledTaskRunResult = {
     diagnostic?: import("@opengeni/contracts").ConnectionAccountSelectionDiagnostic;
     /** Present when the occurrence was refused as a visible run receipt. */
     refusal?: import("@opengeni/contracts").ScheduledTaskAdmissionRefusal;
-    reason: "insufficient_credits" | "allowance_exhausted" | "monthly_model_cost_limit" | "monthly_agent_run_limit" | "malformed_manual_trigger" | "scheduled_task_paused" | "scheduled_authority_exhausted" | "scheduled_run_terminal" | "scheduled_execution_unrepresentable" | "connection_account_unavailable" | "scheduled_authority_unavailable" | "machine_target_unavailable" | "machine_enrollment_inactive" | "variable_set_unavailable" | "rig_version_unavailable" | "knowledge_source_paused" | "legacy_source_schedule_requires_migration" | "incident_preflight_metadata_missing" | "incident_responder_under_capable" | "incident_data_source_unsuitable";
+    reason: "insufficient_credits" | "monthly_model_cost_limit" | "monthly_agent_run_limit" | "malformed_manual_trigger" | "scheduled_task_paused" | "scheduled_authority_exhausted" | "scheduled_run_terminal" | "scheduled_execution_unrepresentable" | "connection_account_unavailable" | "scheduled_authority_unavailable" | "machine_target_unavailable" | "machine_enrollment_inactive" | "variable_set_unavailable" | "rig_version_unavailable" | "knowledge_source_paused" | "legacy_source_schedule_requires_migration" | "incident_preflight_metadata_missing" | "incident_responder_under_capable" | "incident_data_source_unsuitable";
 } | {
     action: "start" | "signal";
     accountId: string;

package/dist/{activities-control-YKXRDVMB.js → activities-control-MHNA3CYV.js}

@@ -8,7 +8,6 @@ import {
 import {
   INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY,
   MAX_AUTOMATIC_PROVIDER_RECOVERIES,
-  agentRunAdmissionDenial,
   assertReusableSessionRevivable,
   captureConnectedCommandOutput,
   createCodexCapacityActivities,
@@ -34,7 +33,7 @@ import {
   warnDrainSnapshotFailure,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-ZCCLJK3V.js";
+} from "./chunk-RZAAGRFQ.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordCreditBalanceGauges,
@@ -68,10 +67,8 @@ import {
   applyCreditDebitAfterUse,
   appendKnowledgeIndexChunks,
   claimKnowledgeIndexJobs,
-  checkWorkspaceAllowance,
   completeKnowledgeIndexJob,
   continueKnowledgeIndexJob,
-  creditDebitAttributionMetadata,
   deferKnowledgeIndexJob,
   freezeKnowledgeIndexBillingMode,
   getBillingBalance,
@@ -216,14 +213,6 @@ function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
                 return;
               }
               const paid = frozenPolicy.mode === "credits";
-              if (paid && claim.billingAttribution.kind === "unknown") {
-                observability.warn("Paid Knowledge indexing awaits initiating attribution", {
-                  errorCode: "knowledge_index_attribution_unavailable"
-                });
-                await deferKnowledgeIndexJob(lockedDb, claim);
-                result.deferred++;
-                return;
-              }
               if (paid && current.nextIndex === 0) {
                 const balance = await getBillingBalance(lockedDb, claim.accountId);
                 if (balance.balanceMicros <= 0) {
@@ -232,18 +221,6 @@ function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
                   return;
                 }
               }
-              if (paid) {
-                const refusal = await checkWorkspaceAllowance(lockedDb, {
-                  accountId: claim.accountId,
-                  workspaceId: current.billingWorkspaceId,
-                  subjectId: claim.billingAttribution.kind === "turn" || claim.billingAttribution.kind === "human" ? claim.billingAttribution.initiatingHumanSubjectId : null
-                });
-                if (refusal) {
-                  await deferKnowledgeIndexJob(lockedDb, claim);
-                  result.deferred++;
-                  return;
-                }
-              }
               if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
                 const limit = configuredStaticUsageLimits(settings).maxDocumentIndexedChunksPerWorkspace;
                 if (limit) {
@@ -342,7 +319,6 @@ function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
                     sourceId: claim.revisionId,
                     idempotencyKey: `knowledge.embedding:${claim.revisionId}:${claim.generation}:${current.nextIndex}`,
                     metadata: {
-                      ...creditDebitAttributionMetadata(claim.billingAttribution),
                       model: claim.model,
                       bytes,
                       chunks: chunks.length,
@@ -489,6 +465,69 @@ import {
   settleAutomationRun
 } from "@opengeni/db";
 import { SessionSkills } from "@opengeni/contracts";
+
+// src/activities/agent-run-admission.ts
+import { configuredStaticUsageLimits as configuredStaticUsageLimits2 } from "@opengeni/config";
+import { modelFundingForAdmission } from "@opengeni/core";
+import { getBillingBalance as getBillingBalance2, isCodexBilledTurn, sumUsageQuantity as sumUsageQuantity2 } from "@opengeni/db";
+async function agentRunAdmissionDenial(services, input) {
+  const codexBilled = await isCodexBilledTurn({
+    db: services.db,
+    settings: services.settings,
+    workspaceId: input.workspaceId,
+    model: input.model
+  });
+  const externallyBilled = modelFundingForAdmission(
+    services.settings,
+    input.model,
+    codexBilled
+  ).fundedWithoutCredits;
+  if (!externallyBilled && (services.settings.billingMode === "stripe" || services.settings.usageLimitsMode === "managed")) {
+    if (services.entitlements) {
+      const decision = await services.entitlements.admitRun({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        action: "agent_run:create",
+        quantity: input.requestedAgentRuns
+      });
+      if (!decision.allowed) return "insufficient_credits";
+    } else {
+      const balance = await getBillingBalance2(services.db, input.accountId);
+      if (balance.balanceMicros <= 0) return "insufficient_credits";
+    }
+  }
+  if (services.settings.usageLimitsMode !== "static" && services.settings.usageLimitsMode !== "managed") {
+    return null;
+  }
+  const limits = configuredStaticUsageLimits2(services.settings);
+  if (!externallyBilled && limits.maxMonthlyCostMicrosPerAccount) {
+    const used = await sumUsageQuantity2(services.db, {
+      accountId: input.accountId,
+      eventType: "model.cost",
+      since: startOfUtcMonth()
+    });
+    if (used >= limits.maxMonthlyCostMicrosPerAccount) {
+      return "monthly_model_cost_limit";
+    }
+  }
+  if (limits.maxMonthlyAgentRunsPerWorkspace) {
+    const used = await sumUsageQuantity2(services.db, {
+      workspaceId: input.workspaceId,
+      eventType: "agent_run.created",
+      since: startOfUtcMonth()
+    });
+    if (used + input.requestedAgentRuns > limits.maxMonthlyAgentRunsPerWorkspace) {
+      return "monthly_agent_run_limit";
+    }
+  }
+  return null;
+}
+function startOfUtcMonth() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+
+// src/activities/automations.ts
 function createAutomationActivities(services, options = {}) {
   const claim = options.claim ?? claimAutomationRun;
   const settle = options.settle ?? settleAutomationRun;
@@ -5660,8 +5699,7 @@ function createScheduledTaskActivities(services) {
           accountId: task.accountId,
           workspaceId: task.workspaceId,
           model: targetSessionExecution?.model ?? model,
-          requestedAgentRuns: input.agentRunUsageIdempotencyKey ? 0 : 1,
-          initiatingHumanSubjectId: causalHumanSubjectId
+          requestedAgentRuns: input.agentRunUsageIdempotencyKey ? 0 : 1
         }
       );
       if (admissionDenial) {
@@ -7981,4 +8019,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-YKXRDVMB.js.map
+//# sourceMappingURL=activities-control-MHNA3CYV.js.map