@opengeni/api-router 0.11.8 → 0.12.1

package/dist/{chunk-DQWFAIPE.js → chunk-S2N4252E.js}

@@ -24,10 +24,10 @@ import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPSe
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
-import { HTTPException as HTTPException24 } from "hono/http-exception";
+import { HTTPException as HTTPException26 } from "hono/http-exception";
 import {
   hasPermission as hasPermission7,
-  requireAccessGrant as requireAccessGrant17,
+  requireAccessGrant as requireAccessGrant18,
   requirePermission,
   requireSessionAuthorization as requireSessionAuthorization3,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError2,
@@ -312,7 +312,7 @@ import {
   createVariableSet,
   deleteScheduledTask,
   encryptVariableSetValue,
-  getSession,
+  getSession as getSession2,
   getSessionGoal,
   getSessionQueueSnapshot,
   getSessionTurn,
@@ -1997,6 +1997,537 @@ function viewerIdAsUuid(rawViewerId) {
   return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20, 32)}`;
 }
 
+// src/integrations/slack-bot.ts
+import { createHmac } from "crypto";
+import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import {
+  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+  OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES,
+  OPENGENI_SLACK_BOT_REQUIRED_SCOPES
+} from "@opengeni/contracts";
+import {
+  isTrustedScheduledSlackBotSession,
+  openGeniSlackBotMetadata,
+  requireOpenGeniSlackBotConnection,
+  scheduledSlackBotConnectionId
+} from "@opengeni/core";
+import {
+  buildConnectionTokenResolver,
+  claimSlackBotPostOperation,
+  completeSlackBotPostOperation,
+  getSession,
+  recordAuditEvent,
+  releaseSlackBotPostOperationClaim
+} from "@opengeni/db";
+import { readResponseJsonBounded } from "@opengeni/network";
+import { HTTPException as HTTPException2 } from "hono/http-exception";
+var SLACK_API_BASE = "https://slack.com/api/";
+var SLACK_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
+var SLACK_TIMEOUT_MS = 1e4;
+var MAX_CHANNEL_PAGE = 200;
+var MAX_HISTORY_PAGE = 100;
+var MAX_USER_PAGE = 200;
+var MAX_PROJECTED_TEXT = 4e3;
+var SLACK_POST_CLAIM_LEASE_MS = 3e4;
+var SlackBotProviderError = class extends Error {
+  constructor(code) {
+    super(`Slack bot request failed: ${safeSlackCode(code)}`);
+    this.code = code;
+    this.name = "SlackBotProviderError";
+  }
+};
+async function verifyOpenGeniSlackBotCredential(token, fetchImpl = fetch, now = /* @__PURE__ */ new Date()) {
+  const authResponse = await slackApiFetch(fetchImpl, "auth.test", token, {});
+  const grantedScopes2 = parseGrantedScopes(authResponse.response.headers.get("x-oauth-scopes"));
+  assertExactOpenGeniSlackBotScopes(grantedScopes2);
+  const auth = authResponse.payload;
+  const slackTeamId = requiredSlackString(auth.team_id, "team_id");
+  const slackTeamName = requiredSlackString(auth.team, "team");
+  const botUserId = requiredSlackString(auth.user_id, "user_id");
+  const botId = requiredSlackString(auth.bot_id, "bot_id");
+  const userResponse = await slackApiFetch(fetchImpl, "users.info", token, {
+    user: botUserId
+  });
+  const user = slackRecord(userResponse.payload.user);
+  if (!user || user.is_bot !== true || user.deleted === true) {
+    throw new HTTPException2(422, { message: "Slack credential must identify an active bot user" });
+  }
+  const profile = slackRecord(user.profile);
+  const displayName = slackString(profile?.display_name) || slackString(profile?.real_name);
+  if (displayName !== "OpenGeni") {
+    throw new HTTPException2(422, {
+      message: 'Slack bot display name must be exactly "OpenGeni"'
+    });
+  }
+  return {
+    grantedScopes: grantedScopes2,
+    metadata: {
+      credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+      credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+      slackTeamId,
+      slackTeamName,
+      botUserId,
+      botId,
+      botDisplayName: "OpenGeni",
+      verifiedAt: now.toISOString()
+    }
+  };
+}
+async function resolveSlackBotConnectionForTool(input) {
+  const session = input.sessionId ? await getSession(input.db, input.grant.workspaceId, input.sessionId) : null;
+  if (input.sessionId && !session) {
+    throw new Error("signed Slack bot session was not found");
+  }
+  const boundConnectionId = scheduledSlackBotConnectionId(session?.metadata);
+  if (boundConnectionId && (!session || !isTrustedScheduledSlackBotSession(session))) {
+    throw new Error("OpenGeni Slack bot routing metadata is not scheduler-authorized");
+  }
+  if (boundConnectionId && input.requestedConnectionId && input.requestedConnectionId !== boundConnectionId) {
+    throw new Error("this scheduled session is bound to a different OpenGeni Slack bot connection");
+  }
+  const connectionId = boundConnectionId ?? input.requestedConnectionId;
+  if (!connectionId) {
+    throw new Error("connectionId is required outside a Slack-bot-bound scheduled session");
+  }
+  if (!boundConnectionId && !input.grant.permissions.includes("connections:read")) {
+    throw new Error("connections:read is required to select an OpenGeni Slack bot connection");
+  }
+  const connection = await requireOpenGeniSlackBotConnection(
+    input.db,
+    input.grant.workspaceId,
+    connectionId
+  );
+  const metadata = openGeniSlackBotMetadata(connection.metadata);
+  if (!metadata) {
+    throw new Error("OpenGeni Slack bot connection metadata is invalid");
+  }
+  return {
+    connection,
+    metadata,
+    context: {
+      accountId: input.grant.accountId,
+      workspaceId: input.grant.workspaceId,
+      subjectId: input.grant.subjectId,
+      sessionId: input.sessionId,
+      scheduledTaskId: typeof session?.metadata.scheduledTaskId === "string" ? session.metadata.scheduledTaskId : null
+    }
+  };
+}
+var OpenGeniSlackBotClient = class {
+  constructor(db, settings, connection, metadata, context, fetchImpl = fetch) {
+    this.db = db;
+    this.settings = settings;
+    this.connection = connection;
+    this.metadata = metadata;
+    this.context = context;
+    this.fetchImpl = fetchImpl;
+    this.resolveCredential = buildConnectionTokenResolver(db, settings);
+  }
+  resolveCredential;
+  async listChannels(input = {}) {
+    return await this.withAudit("channels.list", async (headers) => {
+      const payload = await this.call(headers, "conversations.list", {
+        types: "public_channel,private_channel",
+        exclude_archived: "true",
+        limit: String(boundedInt(input.limit, MAX_CHANNEL_PAGE, 100)),
+        ...input.cursor ? { cursor: input.cursor } : {}
+      });
+      return {
+        channels: slackArray(payload.channels).map(projectChannel).filter((channel) => channel !== null),
+        nextCursor: responseCursor(payload)
+      };
+    });
+  }
+  async channelHistory(input) {
+    return await this.withAudit("channel_history.read", async (headers) => {
+      const info = await this.requireMemberChannel(headers, input.channelId);
+      const payload = await this.call(headers, "conversations.history", {
+        channel: input.channelId,
+        limit: String(boundedInt(input.limit, MAX_HISTORY_PAGE, 50)),
+        ...input.cursor ? { cursor: input.cursor } : {}
+      });
+      return {
+        channel: info,
+        messages: slackArray(payload.messages).map(projectMessage),
+        nextCursor: responseCursor(payload)
+      };
+    });
+  }
+  async listUsers(input = {}) {
+    return await this.withAudit("users.list", async (headers) => {
+      const payload = await this.call(headers, "users.list", {
+        limit: String(boundedInt(input.limit, MAX_USER_PAGE, 100)),
+        ...input.cursor ? { cursor: input.cursor } : {}
+      });
+      return {
+        users: slackArray(payload.members).map(projectUser).filter((user) => user !== null),
+        nextCursor: responseCursor(payload)
+      };
+    });
+  }
+  async postMessage(input) {
+    const operation = "message.post";
+    const claimHolderId = crypto.randomUUID();
+    let claimAcquired = false;
+    let providerCallStarted = false;
+    try {
+      const headers = await this.headersFor(operation);
+      let channelId = input.channelId;
+      if (input.userId) {
+        const opened = await this.call(headers, "conversations.open", { users: input.userId });
+        channelId = requiredSlackString(slackRecord(opened.channel)?.id, "channel.id");
+      } else if (channelId) {
+        await this.requireMemberChannel(headers, channelId);
+      }
+      if (!channelId) {
+        throw new Error("exactly one of channelId or userId is required");
+      }
+      const targetKind = input.userId ? "user" : "channel";
+      const targetId = input.userId ?? input.channelId;
+      const requestDigest = this.postRequestDigest({
+        operationId: input.operationId,
+        targetKind,
+        targetId,
+        text: input.text
+      });
+      const claim = await claimSlackBotPostOperation(this.db, {
+        accountId: this.context.accountId,
+        workspaceId: this.context.workspaceId,
+        connectionId: this.connection.id,
+        operationId: input.operationId,
+        targetKind,
+        targetId,
+        requestDigest,
+        claimHolderId,
+        claimLeaseMs: SLACK_POST_CLAIM_LEASE_MS
+      });
+      if (claim.kind === "connection_not_found") {
+        throw new Error("OpenGeni Slack bot connection no longer exists");
+      }
+      if (claim.kind === "conflict") {
+        throw new Error("operationId is already bound to a different Slack post request");
+      }
+      if (claim.kind === "in_progress") {
+        throw new Error("Slack post operation is already in progress; retry the same operationId");
+      }
+      if (claim.kind === "completed") {
+        return this.completedPostResult(claim.operation, input.operationId);
+      }
+      claimAcquired = true;
+      providerCallStarted = true;
+      const posted = await this.call(headers, "chat.postMessage", {
+        channel: channelId,
+        text: input.text,
+        client_msg_id: input.operationId
+      });
+      const slackChannelId = requiredSlackString(posted.channel, "channel");
+      const slackMessageTimestamp = requiredSlackString(posted.ts, "ts");
+      const completed = await completeSlackBotPostOperation(this.db, {
+        accountId: this.context.accountId,
+        workspaceId: this.context.workspaceId,
+        connectionId: this.connection.id,
+        operationId: input.operationId,
+        claimHolderId,
+        slackChannelId,
+        slackMessageTimestamp,
+        subjectId: this.context.subjectId,
+        auditMetadata: this.auditMetadata(operation, "succeeded", void 0, input.operationId)
+      });
+      if (completed.kind !== "completed") {
+        throw new Error("Slack post completion lost its durable operation claim");
+      }
+      claimAcquired = false;
+      return this.completedPostResult(completed.operation, input.operationId);
+    } catch (error) {
+      const failureCode = safeFailureCode(error);
+      if (claimAcquired) {
+        await releaseSlackBotPostOperationClaim(this.db, {
+          accountId: this.context.accountId,
+          workspaceId: this.context.workspaceId,
+          connectionId: this.connection.id,
+          operationId: input.operationId,
+          claimHolderId,
+          failureCode
+        }).catch(() => void 0);
+      }
+      await this.recordAudit(
+        operation,
+        providerCallStarted && slackPostOutcomeMayBeAmbiguous(error) ? "ambiguous" : "failed",
+        failureCode,
+        input.operationId
+      );
+      throw error;
+    }
+  }
+  async requireMemberChannel(headers, channelId) {
+    const payload = await this.call(headers, "conversations.info", { channel: channelId });
+    const projected = projectChannel(payload.channel);
+    if (!projected || projected.isMember !== true) {
+      throw new SlackBotProviderError("not_in_channel");
+    }
+    return projected;
+  }
+  async call(headers, method, params) {
+    return (await slackApiFetchWithHeaders(this.fetchImpl, method, headers, params)).payload;
+  }
+  async withAudit(operation, run) {
+    try {
+      const headers = await this.headersFor(operation);
+      const result = await run(headers);
+      await this.recordAudit(operation, "succeeded");
+      return { ...result, receipt: this.receipt(operation) };
+    } catch (error) {
+      await this.recordAudit(operation, "failed", safeFailureCode(error));
+      throw error;
+    }
+  }
+  async headersFor(operation) {
+    const result = await this.resolveCredential({
+      workspaceId: this.context.workspaceId,
+      serverId: "opengeni-slack-bot",
+      toolName: `slack_bot_${operation.replaceAll(".", "_")}`,
+      connectionRef: {
+        connectionId: this.connection.id,
+        providerDomain: "slack.com",
+        kind: "app_install",
+        scopes: [...OPENGENI_SLACK_BOT_REQUIRED_SCOPES],
+        subjectScope: "workspace"
+      },
+      destinationUrl: `${SLACK_API_BASE}${slackMethodForOperation(operation)}`
+    });
+    if (result.status !== "ok" || result.connectionId !== this.connection.id) {
+      throw new Error("OpenGeni Slack bot connection needs to be reinstalled");
+    }
+    return result.headers;
+  }
+  receipt(operation, operationId) {
+    return {
+      credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE,
+      credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL,
+      connectionId: this.connection.id,
+      slackTeamId: this.metadata.slackTeamId,
+      operation,
+      ...operationId ? { operationId, clientMessageId: operationId } : {}
+    };
+  }
+  completedPostResult(operation, operationId) {
+    if (!operation.slackChannelId || !operation.slackMessageTimestamp) {
+      throw new Error("completed Slack post operation is missing its provider result");
+    }
+    return {
+      channelId: operation.slackChannelId,
+      timestamp: operation.slackMessageTimestamp,
+      receipt: this.receipt("message.post", operationId)
+    };
+  }
+  postRequestDigest(input) {
+    const key = environmentsEncryptionKeyBytes(this.settings);
+    if (!key) throw new Error("connection encryption is not configured");
+    return createHmac("sha256", key).update(
+      JSON.stringify({
+        operationId: input.operationId,
+        connectionId: this.connection.id,
+        targetKind: input.targetKind,
+        targetId: input.targetId,
+        text: input.text
+      })
+    ).digest("hex");
+  }
+  async recordAudit(operation, outcome, failureCode, operationId) {
+    await recordAuditEvent(this.db, {
+      accountId: this.context.accountId,
+      workspaceId: this.context.workspaceId,
+      subjectId: this.context.subjectId,
+      action: `slack_bot.${operation}`,
+      targetType: "connection",
+      targetId: this.connection.id,
+      metadata: this.auditMetadata(operation, outcome, failureCode, operationId)
+    });
+  }
+  auditMetadata(operation, outcome, failureCode, operationId) {
+    return {
+      ...this.receipt(operation, operationId),
+      outcome,
+      ...failureCode ? { failureCode } : {},
+      ...this.context.sessionId ? { sessionId: this.context.sessionId } : {},
+      ...this.context.scheduledTaskId ? { scheduledTaskId: this.context.scheduledTaskId } : {}
+    };
+  }
+};
+function createOpenGeniSlackBotClient(deps, resolved) {
+  return new OpenGeniSlackBotClient(
+    deps.db,
+    deps.settings,
+    resolved.connection,
+    resolved.metadata,
+    resolved.context,
+    deps.slackFetch
+  );
+}
+async function slackApiFetch(fetchImpl, method, token, params) {
+  return await slackApiFetchWithHeaders(
+    fetchImpl,
+    method,
+    { authorization: `Bearer ${token}` },
+    params
+  );
+}
+async function slackApiFetchWithHeaders(fetchImpl, method, credentialHeaders, params) {
+  if (!/^[a-z]+\.[a-z]+$/i.test(method)) {
+    throw new Error("invalid Slack API method");
+  }
+  const url = new URL(method, SLACK_API_BASE);
+  const body = new URLSearchParams(params);
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        ...credentialHeaders,
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      body,
+      signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
+    });
+  } catch {
+    throw new SlackBotProviderError("transport_error");
+  }
+  if (!response.ok) {
+    await response.body?.cancel().catch(() => void 0);
+    throw new SlackBotProviderError(`http_${response.status}`);
+  }
+  let payload;
+  try {
+    payload = await readResponseJsonBounded(
+      response,
+      SLACK_RESPONSE_MAX_BYTES,
+      `Slack ${method} response`
+    );
+  } catch {
+    throw new SlackBotProviderError("invalid_response");
+  }
+  if (payload.ok !== true) {
+    throw new SlackBotProviderError(slackString(payload.error) || "unknown_error");
+  }
+  return { response, payload };
+}
+function assertExactOpenGeniSlackBotScopes(grantedScopes2) {
+  const required = new Set(OPENGENI_SLACK_BOT_REQUIRED_SCOPES);
+  const granted = new Set(grantedScopes2);
+  const missing = [...required].filter((scope) => !granted.has(scope));
+  const forbidden = OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES.filter((scope) => granted.has(scope));
+  const unsupported = grantedScopes2.filter((scope) => !required.has(scope));
+  if (missing.length || forbidden.length || unsupported.length) {
+    const facts = [
+      ...missing.length ? [`missing: ${missing.join(", ")}`] : [],
+      ...forbidden.length ? [`forbidden: ${forbidden.join(", ")}`] : [],
+      ...unsupported.length ? [`unsupported: ${unsupported.join(", ")}`] : []
+    ];
+    throw new HTTPException2(422, {
+      message: `Slack bot scopes must exactly match the OpenGeni manifest (${facts.join("; ")})`
+    });
+  }
+}
+function parseGrantedScopes(header) {
+  if (!header) {
+    throw new HTTPException2(422, { message: "Slack did not report granted bot scopes" });
+  }
+  return [
+    ...new Set(
+      header.split(",").map((scope) => scope.trim()).filter(Boolean)
+    )
+  ].sort();
+}
+function projectChannel(value) {
+  const channel = slackRecord(value);
+  const id = slackString(channel?.id);
+  if (!channel || !id) return null;
+  return {
+    id,
+    name: boundedSlackString(channel.name, 256),
+    isPrivate: channel.is_private === true,
+    isMember: channel.is_member === true,
+    isArchived: channel.is_archived === true,
+    topic: boundedSlackString(slackRecord(channel.topic)?.value, 1024),
+    purpose: boundedSlackString(slackRecord(channel.purpose)?.value, 1024),
+    numMembers: typeof channel.num_members === "number" && Number.isSafeInteger(channel.num_members) ? channel.num_members : null
+  };
+}
+function projectMessage(value) {
+  const message = slackRecord(value) ?? {};
+  return {
+    timestamp: boundedSlackString(message.ts, 64),
+    userId: boundedSlackString(message.user, 64),
+    botId: boundedSlackString(message.bot_id, 64),
+    threadTimestamp: boundedSlackString(message.thread_ts, 64),
+    text: boundedSlackString(message.text, MAX_PROJECTED_TEXT)
+  };
+}
+function projectUser(value) {
+  const user = slackRecord(value);
+  const id = slackString(user?.id);
+  if (!user || !id) return null;
+  const profile = slackRecord(user.profile);
+  return {
+    id,
+    name: boundedSlackString(user.name, 256),
+    displayName: boundedSlackString(profile?.display_name, 256),
+    realName: boundedSlackString(profile?.real_name, 256),
+    isBot: user.is_bot === true,
+    deleted: user.deleted === true
+  };
+}
+function responseCursor(payload) {
+  return boundedSlackString(slackRecord(payload.response_metadata)?.next_cursor, 1024) || null;
+}
+function slackMethodForOperation(operation) {
+  switch (operation) {
+    case "channels.list":
+      return "conversations.list";
+    case "channel_history.read":
+      return "conversations.history";
+    case "users.list":
+      return "users.list";
+    case "message.post":
+      return "chat.postMessage";
+  }
+}
+function boundedInt(value, max, fallback) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? Math.min(value, max) : fallback;
+}
+function slackArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function slackRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function slackString(value) {
+  return typeof value === "string" ? value : "";
+}
+function requiredSlackString(value, field) {
+  const result = slackString(value);
+  if (!result || result.length > 256) {
+    throw new SlackBotProviderError(`invalid_${field.replaceAll(".", "_")}`);
+  }
+  return result;
+}
+function boundedSlackString(value, max) {
+  return slackString(value).slice(0, max);
+}
+function safeSlackCode(value) {
+  return /^[a-z0-9_.:-]{1,128}$/i.test(value) ? value : "unknown_error";
+}
+function safeFailureCode(error) {
+  if (error instanceof SlackBotProviderError) return safeSlackCode(error.code);
+  return "local_validation_failed";
+}
+function slackPostOutcomeMayBeAmbiguous(error) {
+  if (!(error instanceof SlackBotProviderError)) return true;
+  return error.code === "transport_error" || error.code === "invalid_response" || error.code.startsWith("http_");
+}
+
 // src/mcp/server.ts
 function buildOpenGeniMcpServer(deps, grant, options = {}) {
   const server = new McpServer({
@@ -2038,6 +2569,7 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   }
   if (!toolspaceMode) {
     registerRigTools(server, deps, grant, can, sessionId, json);
+    registerSlackBotTools(server, deps, grant, sessionId, json);
   }
   registerWorkspaceOrchestrationTools(server, deps, grant, can, sessionId, toolspaceMode, json);
   registerVariableSetTools(server, deps, grant, can, json);
@@ -2423,6 +2955,96 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   registerToolspaceProxyTools(server, options.toolspace ?? null);
   return server;
 }
+function registerSlackBotTools(server, deps, grant, sessionId, json) {
+  const clientFor = async (connectionId) => {
+    const resolved = await resolveSlackBotConnectionForTool({
+      db: deps.db,
+      grant,
+      sessionId,
+      ...connectionId ? { requestedConnectionId: connectionId } : {}
+    });
+    return createOpenGeniSlackBotClient(deps, resolved);
+  };
+  server.registerTool(
+    "slack_bot_list_channels",
+    {
+      description: "List public and bot-visible private Slack channels through the workspace-shared OpenGeni bot. isMember identifies channels the bot may read/post in; the bot never joins channels automatically.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(200).optional()
+      }
+    },
+    async ({ connectionId, cursor, limit }) => json(
+      await (await clientFor(connectionId)).listChannels({
+        ...cursor ? { cursor } : {},
+        ...limit !== void 0 ? { limit } : {}
+      })
+    )
+  );
+  server.registerTool(
+    "slack_bot_channel_history",
+    {
+      description: "Read Slack channel history as the workspace-shared OpenGeni bot. Public and private channels both require bot membership; invite the bot to private channels first.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        channelId: z4.string().min(1).max(64),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(100).optional()
+      }
+    },
+    async ({ connectionId, channelId, cursor, limit }) => json(
+      await (await clientFor(connectionId)).channelHistory({
+        channelId,
+        ...cursor ? { cursor } : {},
+        ...limit !== void 0 ? { limit } : {}
+      })
+    )
+  );
+  server.registerTool(
+    "slack_bot_list_users",
+    {
+      description: "List Slack workspace users through the workspace-shared OpenGeni bot.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        cursor: z4.string().max(1024).optional(),
+        limit: z4.number().int().min(1).max(200).optional()
+      }
+    },
+    async ({ connectionId, cursor, limit }) => json(
+      await (await clientFor(connectionId)).listUsers({
+        ...cursor ? { cursor } : {},
+        ...limit !== void 0 ? { limit } : {}
+      })
+    )
+  );
+  server.registerTool(
+    "slack_bot_post_message",
+    {
+      description: "Post as the workspace-shared OpenGeni bot. Pass channelId for a channel where the bot is already a member, or userId to open/post a DM; pass exactly one. Generate one operationId UUID per intended message and reuse that same UUID on every retry.",
+      inputSchema: {
+        connectionId: z4.string().uuid().optional(),
+        operationId: z4.string().uuid(),
+        channelId: z4.string().min(1).max(64).optional(),
+        userId: z4.string().min(1).max(64).optional(),
+        text: z4.string().min(1).max(4e4)
+      }
+    },
+    async ({ connectionId, operationId, channelId, userId, text }) => {
+      if (Boolean(channelId) === Boolean(userId)) {
+        throw new Error("exactly one of channelId or userId is required");
+      }
+      return json(
+        await (await clientFor(connectionId)).postMessage({
+          operationId,
+          ...channelId ? { channelId } : {},
+          ...userId ? { userId } : {},
+          text
+        })
+      );
+    }
+  );
+}
 function registerToolspaceProxyTools(server, surface) {
   if (!surface) {
     return;
@@ -3018,7 +3640,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           sessionId,
           "session.read"
         );
-        const session = await getSession(deps.db, grant.workspaceId, sessionId);
+        const session = await getSession2(deps.db, grant.workspaceId, sessionId);
         if (!session) {
           throw new Error("session not found");
         }
@@ -4025,7 +4647,7 @@ async function withMcpEffectivePolicy(deps, workspaceId, session) {
 // src/mcp/toolspace.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
 import {
   prefixedMcpToolName
 } from "@opengeni/contracts";
@@ -4034,7 +4656,7 @@ import {
   settingsWithEnabledCapabilityMcpServers
 } from "@opengeni/core";
 import {
-  buildConnectionTokenResolver,
+  buildConnectionTokenResolver as buildConnectionTokenResolver2,
   buildHostConnectionTokenResolver,
   clearPendingSessionToolspaceCall,
   getActiveSessionTurnForExecution,
@@ -4316,7 +4938,7 @@ function writeToolListCache(key, entries) {
   toolListCache.write(key, entries);
 }
 async function settingsWithSessionMcpServersForToolspace(deps, workspaceId, sessionId, attemptId, settings) {
-  const encryptionKey = environmentsEncryptionKeyBytes(settings);
+  const encryptionKey = environmentsEncryptionKeyBytes2(settings);
   if (!encryptionKey) {
     const metadata = await listSessionMcpServerMetadata(deps.db, workspaceId, sessionId);
     if (metadata.length === 0) {
@@ -4638,7 +5260,7 @@ function connectionBrokerFetch(baseFetch, input) {
     initiator: input.turn.initiator,
     initiatorContext: input.turn.initiatorContext,
     surface: "toolspace"
-  }) : buildConnectionTokenResolver(input.deps.db, input.deps.settings);
+  }) : buildConnectionTokenResolver2(input.deps.db, input.deps.settings);
   return async (requestInput, init) => {
     const request = await mcpRequestInfo(requestInput, init);
     const destinationUrl = mcpRequestDestinationUrl(requestInput);
@@ -4802,7 +5424,7 @@ import { boundedMcpRequest, McpPayloadTooLargeError as McpPayloadTooLargeError2
 
 // src/routes/install.ts
 import { readFile, stat } from "fs/promises";
-import { HTTPException as HTTPException2 } from "hono/http-exception";
+import { HTTPException as HTTPException3 } from "hono/http-exception";
 var INSTALL_DIR = new URL("../../../../agent/install/", import.meta.url);
 var BAKED_DIR = new URL("baked/", INSTALL_DIR);
 var TEXT_ASSETS = {
@@ -4900,7 +5522,7 @@ function registerInstallRoutes(app, deps) {
   app.get("/agent/latest/:asset", async (c) => {
     const asset = c.req.param("asset");
     if (!ASSET_NAME.test(asset)) {
-      throw new HTTPException2(400, { message: "invalid asset name" });
+      throw new HTTPException3(400, { message: "invalid asset name" });
     }
     return serveAsset(asset, `${releasesBase}/download/${stableAgentTag}/${asset}`);
   });
@@ -4908,7 +5530,7 @@ function registerInstallRoutes(app, deps) {
     const versionSeg = c.req.param("versionSeg");
     const asset = c.req.param("asset");
     if (!VERSION_SEG.test(versionSeg) || !ASSET_NAME.test(asset)) {
-      throw new HTTPException2(400, { message: "invalid version or asset name" });
+      throw new HTTPException3(400, { message: "invalid version or asset name" });
     }
     return serveAsset(asset, `${releasesBase}/download/agent-${versionSeg}/${asset}`);
   });
@@ -4966,7 +5588,7 @@ function isAuthExempt(c, settings) {
   if (installExactPaths.has(path) || isInstallRedirectPath(path)) {
     return true;
   }
-  if (settings.authAllowHealth && (path === "/healthz" || path === "/readyz")) {
+  if (settings.authAllowHealth && (path === "/healthz" || path === "/readyz" || path === "/traffic-readyz")) {
     return true;
   }
   if (settings.authAllowMetrics && path === "/metrics") {
@@ -5020,8 +5642,8 @@ import {
 } from "@opengeni/core";
 
 // src/http/common.ts
-import { getSession as getSession2 } from "@opengeni/db";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { getSession as getSession3 } from "@opengeni/db";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 function boundedLimit(raw) {
   const limit = Number(raw ?? 100);
   if (!Number.isFinite(limit)) {
@@ -5030,8 +5652,8 @@ function boundedLimit(raw) {
   return Math.min(500, Math.max(1, Math.floor(limit)));
 }
 async function assertSessionExists(db, workspaceId, sessionId) {
-  if (!await getSession2(db, workspaceId, sessionId)) {
-    throw new HTTPException3(404, { message: "session not found" });
+  if (!await getSession3(db, workspaceId, sessionId)) {
+    throw new HTTPException4(404, { message: "session not found" });
   }
 }
 
@@ -5103,7 +5725,7 @@ function registerCapabilityRoutes(app, deps) {
 }
 
 // src/routes/catalog-assets.ts
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 var CATALOG_ASSET_PREFIX = "catalog-assets/";
 var MAX_KEY_LENGTH = 512;
 var PRINTABLE_ASCII = /^[\x20-\x7e]+$/;
@@ -5120,22 +5742,22 @@ function registerCatalogAssetRoutes(app, deps) {
   const { settings, objectStorage } = deps;
   app.get("/v1/catalog-assets/*", async (c) => {
     if (!settings.integrationsEnabled) {
-      throw new HTTPException4(404, { message: "integrations are not enabled for this deployment" });
+      throw new HTTPException5(404, { message: "integrations are not enabled for this deployment" });
     }
     if (!objectStorage) {
-      throw new HTTPException4(404, { message: "asset not found" });
+      throw new HTTPException5(404, { message: "asset not found" });
     }
     const key = catalogAssetKeyFromPath(new URL(c.req.url).pathname);
     if (!key) {
-      throw new HTTPException4(404, { message: "asset not found" });
+      throw new HTTPException5(404, { message: "asset not found" });
     }
     const contentType = contentTypeForKey(key);
     if (!contentType) {
-      throw new HTTPException4(404, { message: "asset not found" });
+      throw new HTTPException5(404, { message: "asset not found" });
     }
     const object4 = await objectStorage.getObjectBytes(key);
     if (!object4) {
-      throw new HTTPException4(404, { message: "asset not found" });
+      throw new HTTPException5(404, { message: "asset not found" });
     }
     const etag = etagForKey(key);
     const headers = {
@@ -5188,7 +5810,7 @@ function ifNoneMatchSatisfied(header, etag) {
 }
 
 // src/routes/codex.ts
-import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
+import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes3 } from "@opengeni/config";
 import {
   accessTokenExpiry,
   buildCodexUsageWindowFromCache,
@@ -5237,7 +5859,7 @@ import {
 } from "@opengeni/db";
 import { createSignedState as createSignedState2, readSignedState } from "@opengeni/github";
 import { hasPermission as hasPermission4, requireAccessGrant as requireAccessGrant2 } from "@opengeni/core";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
 import * as z from "zod/v4";
 
 // src/codex-redemption-security.ts
@@ -5377,48 +5999,48 @@ async function managedCookieHuman(c, deps) {
 function requireSameOriginBrowserMutation(c, deps) {
   const contentType = c.req.header("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (contentType !== "application/json") {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "JSON browser request required"
     });
   }
   if (!deps.settings.publicBaseUrl) {
-    throw new HTTPException5(503, {
+    throw new HTTPException6(503, {
       message: "managed browser origin is not configured"
     });
   }
   const expectedOrigin = new URL(deps.settings.publicBaseUrl).origin;
   if (c.req.header("origin") !== expectedOrigin) {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "same-origin browser request required"
     });
   }
   if (c.req.header("sec-fetch-site")?.toLowerCase() !== "same-origin") {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "same-origin fetch metadata required"
     });
   }
 }
 async function requireRedemptionHuman(c, deps, workspaceId) {
   if (deps.settings.productAccessMode !== "managed") {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "reset redemption requires managed product mode"
     });
   }
   if (c.req.header("authorization")) {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "authorization bearer is not allowed for redemption"
     });
   }
   requireSameOriginBrowserMutation(c, deps);
   const human = await managedCookieHuman(c, deps);
   if (!human) {
-    throw new HTTPException5(401, {
+    throw new HTTPException6(401, {
       message: "managed browser session required"
     });
   }
   const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
   if (grant.subjectId !== human.subjectId) {
-    throw new HTTPException5(403, {
+    throw new HTTPException6(403, {
       message: "managed browser identity mismatch"
     });
   }
@@ -5618,7 +6240,7 @@ function registerCodexRoutes(app, deps) {
     try {
       start = await startDeviceCode();
     } catch (error) {
-      throw new HTTPException5(502, {
+      throw new HTTPException6(502, {
         message: error instanceof CodexDeviceError ? error.message : "failed to start Codex device login"
       });
     }
@@ -5640,7 +6262,7 @@ function registerCodexRoutes(app, deps) {
     const { state } = await c.req.json();
     const payload = state ? readSignedState(state, githubStateSecret) : null;
     if (!payload || payload.workspaceId !== workspaceId || !payload.deviceAuthId || !payload.userCode) {
-      throw new HTTPException5(400, {
+      throw new HTTPException6(400, {
         message: "codex connect state is invalid or expired"
       });
     }
@@ -5654,7 +6276,7 @@ function registerCodexRoutes(app, deps) {
         userCode: payload.userCode
       });
     } catch (error) {
-      throw new HTTPException5(502, {
+      throw new HTTPException6(502, {
         message: error instanceof CodexDeviceError ? error.message : "codex device poll failed"
       });
     }
@@ -5671,15 +6293,15 @@ function registerCodexRoutes(app, deps) {
         codeVerifier: poll.codeVerifier
       });
     } catch (error) {
-      throw new HTTPException5(502, {
+      throw new HTTPException6(502, {
         message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed"
       });
     }
     const id = parseIdToken(tokens.idToken);
     const connectingHuman = await managedCookieHuman(c, deps);
-    const key = environmentsEncryptionKeyBytes2(settings);
+    const key = environmentsEncryptionKeyBytes3(settings);
     if (!key) {
-      throw new HTTPException5(500, {
+      throw new HTTPException6(500, {
         message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured"
       });
     }
@@ -5715,7 +6337,7 @@ function registerCodexRoutes(app, deps) {
     );
     const upserted = mutation.result;
     if (upserted.kind === "unresolved_redemption") {
-      throw new HTTPException5(409, {
+      throw new HTTPException6(409, {
         message: "this subscription has an unresolved reset redemption; recover it before changing ownership"
       });
     }
@@ -5811,7 +6433,7 @@ function registerCodexRoutes(app, deps) {
     );
     const activated = mutation.result;
     if (!activated) {
-      throw new HTTPException5(404, { message: "codex account not found" });
+      throw new HTTPException6(404, { message: "codex account not found" });
     }
     await signalCodexCapacityTargets(deps, mutation.wakeTargets);
     return c.json({ activated: true, accountId });
@@ -5825,7 +6447,7 @@ function registerCodexRoutes(app, deps) {
       patch.rotationEnabled = body.rotationEnabled;
     }
     if (patch.rotationEnabled === void 0 && body.rotationStrategy === void 0) {
-      throw new HTTPException5(400, { message: "no settings to update" });
+      throw new HTTPException6(400, { message: "no settings to update" });
     }
     if (patch.rotationEnabled === void 0) {
       return c.json({ rotationStrategy: "sharded", rotationStrategyDeprecated: true });
@@ -5841,7 +6463,7 @@ function registerCodexRoutes(app, deps) {
     );
     const updated = mutation.result;
     if (!updated) {
-      throw new HTTPException5(404, {
+      throw new HTTPException6(404, {
         message: "codex rotation settings not found"
       });
     }
@@ -5861,12 +6483,12 @@ function registerCodexRoutes(app, deps) {
     const label = typeof body.label === "string" ? body.label : null;
     const renamed = await renameCodexAccount(db, workspaceId, accountId, label);
     if (!renamed) {
-      throw new HTTPException5(404, { message: "codex account not found" });
+      throw new HTTPException6(404, { message: "codex account not found" });
     }
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     const row = accounts.find((account) => account.id === accountId);
     if (!row) {
-      throw new HTTPException5(404, { message: "codex account not found" });
+      throw new HTTPException6(404, { message: "codex account not found" });
     }
     return c.json(codexAccountJson(row));
   });
@@ -5878,7 +6500,7 @@ function registerCodexRoutes(app, deps) {
       expectedVersion: z.number().int().positive()
     }).safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException5(400, {
+      throw new HTTPException6(400, {
         message: "enabled and expectedVersion are required"
       });
     }
@@ -5892,7 +6514,7 @@ function registerCodexRoutes(app, deps) {
     });
     const result = mutation.result;
     if (result.kind === "not_found") {
-      throw new HTTPException5(404, { message: "codex account not found" });
+      throw new HTTPException6(404, { message: "codex account not found" });
     }
     const response = {
       allocatorEnabled: result.allocatorEnabled,
@@ -5917,7 +6539,7 @@ function registerCodexRoutes(app, deps) {
     );
     const result = mutation.result;
     if (result.blockedByUnresolvedRedemption) {
-      throw new HTTPException5(409, {
+      throw new HTTPException6(409, {
         message: "this subscription has an unresolved reset redemption; recover it before disconnecting"
       });
     }
@@ -5937,7 +6559,7 @@ function registerCodexRoutes(app, deps) {
     );
     const result = mutation.result;
     if (result.blockedCredentialIds.length > 0) {
-      throw new HTTPException5(409, {
+      throw new HTTPException6(409, {
         message: "one or more subscriptions have unresolved reset redemptions; recover them before disconnecting"
       });
     }
@@ -5949,7 +6571,7 @@ function registerCodexRoutes(app, deps) {
     await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
     const status = await getCodexCredentialStatus(db, workspaceId);
     if (!status?.credentialId) {
-      throw new HTTPException5(404, {
+      throw new HTTPException6(404, {
         message: "codex subscription is not connected"
       });
     }
@@ -5963,7 +6585,7 @@ function registerCodexRoutes(app, deps) {
     const accountId = c.req.param("accountId");
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     if (!accounts.some((account) => account.id === accountId)) {
-      throw new HTTPException5(404, { message: "codex account not found" });
+      throw new HTTPException6(404, { message: "codex account not found" });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, accountId);
     await signalPendingCodexCapacityTargets(deps, workspaceId);
@@ -6088,21 +6710,21 @@ function registerCodexRoutes(app, deps) {
       c.header("cache-control", "no-store");
       const parsed = redemptionPrepareBody.safeParse(await c.req.json().catch(() => null));
       if (!parsed.success) {
-        throw new HTTPException5(400, {
+        throw new HTTPException6(400, {
           message: "attemptId and creditId are required"
         });
       }
       const accounts = await listCodexAccountStatuses(db, workspaceId);
       const account = accounts.find((candidate) => candidate.id === credentialId);
-      if (!account) throw new HTTPException5(404, { message: "codex account not found" });
+      if (!account) throw new HTTPException6(404, { message: "codex account not found" });
       let existing = await getCodexResetRedemptionAttempt(db, workspaceId, parsed.data.attemptId);
       if (account.connectedBySubjectId !== human.subjectId) {
-        throw new HTTPException5(403, {
+        throw new HTTPException6(403, {
           message: "only the human who connected this subscription may redeem its reset credits"
         });
       }
       if (existing && (existing.credentialId !== credentialId || existing.creditId !== parsed.data.creditId || existing.subjectId !== human.subjectId)) {
-        throw new HTTPException5(409, {
+        throw new HTTPException6(409, {
           message: "logical redemption attempt identity mismatch"
         });
       }
@@ -6117,29 +6739,29 @@ function registerCodexRoutes(app, deps) {
           browserSessionHash: human.browserSessionHash
         });
         if (adoption.kind === "in_progress") {
-          throw new HTTPException5(409, {
+          throw new HTTPException6(409, {
             message: "this redemption is still in progress in another browser request"
           });
         }
         if (adoption.kind === "not_found") {
-          throw new HTTPException5(409, { message: "redemption recovery state changed" });
+          throw new HTTPException6(409, { message: "redemption recovery state changed" });
         }
         if (adoption.kind === "forbidden") {
-          throw new HTTPException5(403, { message: "redemption owner is unavailable" });
+          throw new HTTPException6(403, { message: "redemption owner is unavailable" });
         }
         if (adoption.kind === "conflict") {
-          throw new HTTPException5(409, {
+          throw new HTTPException6(409, {
             message: "logical redemption attempt identity mismatch"
           });
         }
         existing = adoption.attempt;
       }
       if (account.status !== "active" && existing?.status !== "completed") {
-        throw new HTTPException5(403, { message: "redemption credential is unavailable" });
+        throw new HTTPException6(403, { message: "redemption credential is unavailable" });
       }
       const secret = settings.betterAuthSecret;
       if (!secret) {
-        throw new HTTPException5(503, {
+        throw new HTTPException6(503, {
           message: "managed browser confirmation is unavailable"
         });
       }
@@ -6175,19 +6797,19 @@ function registerCodexRoutes(app, deps) {
       c.header("cache-control", "no-store");
       const parsed = redemptionBody.safeParse(await c.req.json().catch(() => null));
       if (!parsed.success) {
-        throw new HTTPException5(400, {
+        throw new HTTPException6(400, {
           message: "explicit redemption confirmation is required"
         });
       }
       const secret = settings.betterAuthSecret;
       if (!secret) {
-        throw new HTTPException5(503, {
+        throw new HTTPException6(503, {
           message: "managed browser confirmation is unavailable"
         });
       }
       const claims = await verifyCodexRedemptionConfirmation(secret, parsed.data.confirmationToken);
       if (!claims || claims.attemptId !== parsed.data.attemptId || claims.workspaceId !== workspaceId || claims.credentialId !== credentialId || claims.creditId !== parsed.data.creditId || claims.subjectId !== human.subjectId || claims.browserSessionHash !== human.browserSessionHash) {
-        throw new HTTPException5(403, {
+        throw new HTTPException6(403, {
           message: "redemption confirmation is invalid or expired"
         });
       }
@@ -6204,15 +6826,15 @@ function registerCodexRoutes(app, deps) {
         claimHolderId
       });
       if (claimed.kind === "not_found") {
-        throw new HTTPException5(404, { message: "codex account not found" });
+        throw new HTTPException6(404, { message: "codex account not found" });
       }
       if (claimed.kind === "forbidden") {
-        throw new HTTPException5(403, {
+        throw new HTTPException6(403, {
           message: "redemption owner or credential is unavailable"
         });
       }
       if (claimed.kind === "conflict") {
-        throw new HTTPException5(409, {
+        throw new HTTPException6(409, {
           message: "logical redemption attempt identity mismatch"
         });
       }
@@ -6370,6 +6992,7 @@ function registerCodexRoutes(app, deps) {
 
 // src/routes/connections.ts
 import {
+  ConnectOpenGeniSlackBotRequest,
   ConnectionResponse,
   CreateConnectionRequest,
   IntegrationClientMetadata,
@@ -6378,16 +7001,23 @@ import {
   OAuthStartResponse as OAuthStartResponse2,
   UpdateConnectionRequest
 } from "@opengeni/contracts";
-import { requireAccessGrant as requireAccessGrant3, requireEnvironmentEncryption as requireEnvironmentEncryption2 } from "@opengeni/core";
+import {
+  hasReservedOpenGeniSlackBotMetadata,
+  isOpenGeniSlackBotConnection,
+  openGeniSlackBotMetadata as openGeniSlackBotMetadata2,
+  requireAccessGrant as requireAccessGrant3,
+  requireEnvironmentEncryption as requireEnvironmentEncryption2
+} from "@opengeni/core";
 import {
   createConnection as createConnection2,
   encryptEnvironmentValue as encryptEnvironmentValue3,
   getConnectionMetadata as getConnectionMetadata2,
   listConnectionsMetadata as listConnectionsMetadata2,
+  recordAuditEvent as recordAuditEvent2,
   revokeConnection,
   updateConnection as updateConnection2
 } from "@opengeni/db";
-import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
 
 // src/integrations/oauth-client.ts
 import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
@@ -6413,19 +7043,19 @@ import {
   OAUTH_MAX_RESPONSE_BYTES,
   isLocalTestEnvironment,
   pinnedFetch,
-  readResponseJsonBounded,
+  readResponseJsonBounded as readResponseJsonBounded2,
   validateHttpUrl
 } from "@opengeni/network";
 import { Buffer as Buffer3 } from "buffer";
 import { createHash as createHash3, randomBytes } from "crypto";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 
 // src/integrations/provider-domain.ts
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 function canonicalProviderDomain(value) {
   const canonical = value.trim().toLowerCase().replace(/^www\./, "");
   if (!canonical) {
-    throw new HTTPException6(400, { message: "providerDomain must not be empty" });
+    throw new HTTPException7(400, { message: "providerDomain must not be empty" });
   }
   return canonical;
 }
@@ -6459,7 +7089,7 @@ async function startMcpOAuth(deps, context) {
     connectionId: context.payload.connectionId
   });
   if (context.payload.connectionId && !existing) {
-    throw new HTTPException7(404, { message: "connection not found" });
+    throw new HTTPException8(404, { message: "connection not found" });
   }
   const discovery = await discoverMcpOAuth(mcpUrl, settings);
   const resource = discovery.prm.resource ? canonicalOAuthResource(discovery.prm.resource) : mcpUrl;
@@ -6543,7 +7173,7 @@ async function completeMcpOAuthCallback(deps, input) {
       now: /* @__PURE__ */ new Date()
     });
     if (!consumed) {
-      throw new HTTPException7(400, { message: "OAuth state has already been used" });
+      throw new HTTPException8(400, { message: "OAuth state has already been used" });
     }
   } catch (error) {
     const staged = new OAuthCallbackStageError("state_verify", "state_invalid", error);
@@ -6617,7 +7247,7 @@ async function completeMcpOAuthCallback(deps, input) {
       })
     );
     if (!connection) {
-      throw new HTTPException7(409, {
+      throw new HTTPException8(409, {
         message: "connection changed during OAuth reconnect; start again"
       });
     }
@@ -6640,7 +7270,7 @@ function integrationBaseUrl(publicBaseUrl, requestUrl) {
 function requireIntegrationsStateSecret(settings) {
   const secret = settings.integrationsStateSecret?.trim();
   if (!secret) {
-    throw new HTTPException7(503, {
+    throw new HTTPException8(503, {
       message: "integrations OAuth requires OPENGENI_INTEGRATIONS_STATE_SECRET"
     });
   }
@@ -6655,13 +7285,13 @@ async function discoverMcpOAuth(resource, settings) {
   );
   const authorizationServer = prm.authorizationServers[0];
   if (!authorizationServer) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "MCP protected resource metadata did not advertise an authorization server"
     });
   }
   const as = await discoverAuthorizationServerMetadata(authorizationServer, settings);
   if (!as.codeChallengeMethodsSupported.includes("S256")) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "authorization server does not support required PKCE S256"
     });
   }
@@ -6688,7 +7318,7 @@ async function discoverProtectedResourceMetadata(resource, settings, advertisedU
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
-      if (error instanceof HTTPException7) {
+      if (error instanceof HTTPException8) {
         throw error;
       }
       return null;
@@ -6707,7 +7337,7 @@ async function discoverProtectedResourceMetadata(resource, settings, advertisedU
       ...stringValue(payload.resource) ? { resource: stringValue(payload.resource) } : {}
     };
   }
-  throw new HTTPException7(422, { message: "could not discover MCP protected resource metadata" });
+  throw new HTTPException8(422, { message: "could not discover MCP protected resource metadata" });
 }
 async function discoverAuthorizationServerMetadata(authorizationServer, settings) {
   const safeAuthorizationServer = oauthEndpointUrl(
@@ -6722,7 +7352,7 @@ async function discoverAuthorizationServerMetadata(authorizationServer, settings
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
-      if (error instanceof HTTPException7) {
+      if (error instanceof HTTPException8) {
         throw error;
       }
       return null;
@@ -6760,7 +7390,7 @@ async function discoverAuthorizationServerMetadata(authorizationServer, settings
       ...safeRegistrationEndpoint ? { registrationEndpoint: safeRegistrationEndpoint } : {}
     };
   }
-  throw new HTTPException7(422, {
+  throw new HTTPException8(422, {
     message: "could not discover OAuth authorization server metadata"
   });
 }
@@ -6809,7 +7439,7 @@ async function getOrCreateDynamicClientRegistration(db, settings, as, redirectUr
     };
   }
   if (!as.registrationEndpoint) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "manual OAuth client credentials are required for this authorization server"
     });
   }
@@ -6827,7 +7457,7 @@ async function getOrCreateDynamicClientRegistration(db, settings, as, redirectUr
   if (storedWinner.clientId !== dcr.clientId) {
     const winner = await loadIntegrationOAuthClient(db, settings, as.issuer);
     if (!winner) {
-      throw new HTTPException7(422, {
+      throw new HTTPException8(422, {
         message: "OAuth client registration could not be loaded after a registration race"
       });
     }
@@ -6905,7 +7535,7 @@ function normalizedIssuerKey(value) {
 }
 async function dynamicClientRegistration(settings, as, redirectUri, scopes) {
   if (!as.registrationEndpoint) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "authorization server does not support dynamic client registration"
     });
   }
@@ -6923,18 +7553,18 @@ async function dynamicClientRegistration(settings, as, redirectUri, scopes) {
   });
   if (!response.ok) {
     await cancelResponseBody(response);
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: `dynamic client registration failed with HTTP ${response.status}`
     });
   }
-  const payload = await readResponseJsonBounded(
+  const payload = await readResponseJsonBounded2(
     response,
     OAUTH_MAX_RESPONSE_BYTES,
     "OAuth dynamic registration response"
   );
   const clientId = stringValue(payload.client_id);
   if (!clientId) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "dynamic client registration response did not include client_id"
     });
   }
@@ -6978,12 +7608,12 @@ function buildAuthorizationUrl(input) {
 function readOAuthState(state, settings) {
   const payload = readSignedState2(state, requireIntegrationsStateSecret(settings));
   if (!payload) {
-    throw new HTTPException7(400, { message: "invalid or expired OAuth state" });
+    throw new HTTPException8(400, { message: "invalid or expired OAuth state" });
   }
   const nowSeconds = Math.floor(Date.now() / 1e3);
   const iat = numberValue(payload.iat);
   if (iat === void 0 || nowSeconds - iat > oauthStateTtlMs / 1e3 || nowSeconds < iat) {
-    throw new HTTPException7(400, { message: "invalid or expired OAuth state" });
+    throw new HTTPException8(400, { message: "invalid or expired OAuth state" });
   }
   const resource = requiredString(payload.resource, "state.resource");
   const parsed = {
@@ -7054,7 +7684,7 @@ async function clientForState(db, settings, state) {
   if (state.clientRegistrationMethod === "dcr") {
     const stored = await loadIntegrationOAuthClient(db, settings, state.issuer);
     if (!stored || stored.clientId !== state.clientId || stored.issuer !== state.issuer || stored.authorizationServer !== state.authorizationServer) {
-      throw new HTTPException7(400, { message: "OAuth client registration is no longer available" });
+      throw new HTTPException8(400, { message: "OAuth client registration is no longer available" });
     }
     return {
       method: "dcr",
@@ -7070,7 +7700,7 @@ async function clientForState(db, settings, state) {
   }
   const entry = operatorClientEntryFor(settings, [state.issuer, state.authorizationServer]);
   if (!entry || entry.clientId !== state.clientId) {
-    throw new HTTPException7(400, {
+    throw new HTTPException8(400, {
       message: "operator OAuth client credentials are no longer available"
     });
   }
@@ -7118,7 +7748,7 @@ async function exchangeAuthorizationCode(settings, input) {
       new Error(`OAuth token endpoint returned HTTP ${response.status}`)
     );
   }
-  const payload = await readResponseJsonBounded(
+  const payload = await readResponseJsonBounded2(
     response,
     OAUTH_MAX_RESPONSE_BYTES,
     "OAuth token response"
@@ -7172,7 +7802,7 @@ function logOAuthVerificationWarning(observability, error, state) {
   });
 }
 function sanitizedError(error) {
-  if (error instanceof HTTPException7) {
+  if (error instanceof HTTPException8) {
     return `HTTPException ${error.status}: ${error.message}`;
   }
   if (error instanceof Error) {
@@ -7196,7 +7826,7 @@ async function oauthErrorFromResponse(response) {
     await cancelResponseBody(response);
     return null;
   }
-  const payload = await readResponseJsonBounded(
+  const payload = await readResponseJsonBounded2(
     response,
     OAUTH_MAX_RESPONSE_BYTES,
     "OAuth token error response"
@@ -7288,13 +7918,13 @@ function callbackReturnPath(returnPath, status, params) {
 }
 function canonicalMcpResource(value) {
   if (!value) {
-    throw new HTTPException7(400, { message: "mcpUrl is required" });
+    throw new HTTPException8(400, { message: "mcpUrl is required" });
   }
   let url;
   try {
     url = new URL(value);
   } catch {
-    throw new HTTPException7(422, { message: "MCP resource URL is invalid" });
+    throw new HTTPException8(422, { message: "MCP resource URL is invalid" });
   }
   url.hash = "";
   return url.toString();
@@ -7302,7 +7932,7 @@ function canonicalMcpResource(value) {
 function canonicalOAuthResource(value) {
   const trimmed = value.trim();
   if (!trimmed) {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "MCP protected resource metadata advertised an invalid resource"
     });
   }
@@ -7314,7 +7944,7 @@ function canonicalOAuthResource(value) {
     }
     return trimmed;
   } catch {
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "MCP protected resource metadata advertised an invalid resource"
     });
   }
@@ -7327,18 +7957,18 @@ function oauthEndpointUrl(rawUrl, settings, label) {
     });
   } catch (error) {
     if (error instanceof DestinationPolicyError) {
-      throw new HTTPException7(422, { message: error.message });
+      throw new HTTPException8(422, { message: error.message });
     }
     throw error;
   }
 }
 function safeReturnPath(value) {
   if (!value.startsWith("/") || value.startsWith("//")) {
-    throw new HTTPException7(400, { message: "OAuth returnPath must be a relative path" });
+    throw new HTTPException8(400, { message: "OAuth returnPath must be a relative path" });
   }
   const parsed = new URL(value, "https://opengeni.local");
   if (parsed.origin !== "https://opengeni.local") {
-    throw new HTTPException7(400, { message: "OAuth returnPath must be a relative path" });
+    throw new HTTPException8(400, { message: "OAuth returnPath must be a relative path" });
   }
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
@@ -7348,7 +7978,7 @@ async function fetchJsonObject(url, settings) {
     await cancelResponseBody(response);
     throw new Error(`HTTP ${response.status}`);
   }
-  const payload = await readResponseJsonBounded(
+  const payload = await readResponseJsonBounded2(
     response,
     OAUTH_MAX_RESPONSE_BYTES,
     "OAuth metadata response"
@@ -7368,7 +7998,7 @@ async function fetchOAuth(rawUrl, settings, init = {}, hop = 0) {
     });
   } catch (error) {
     if (error instanceof DestinationPolicyError) {
-      throw new HTTPException7(422, { message: error.message });
+      throw new HTTPException8(422, { message: error.message });
     }
     throw error;
   }
@@ -7377,25 +8007,25 @@ async function fetchOAuth(rawUrl, settings, init = {}, hop = 0) {
   }
   if (!oauthRequestMayFollowRedirect(init)) {
     await cancelResponseBody(response);
-    throw new HTTPException7(422, {
+    throw new HTTPException8(422, {
       message: "OAuth credential-bearing requests may not follow redirects"
     });
   }
   if (hop >= 3) {
     await cancelResponseBody(response);
-    throw new HTTPException7(422, { message: "OAuth fetch exceeded maximum redirect hops" });
+    throw new HTTPException8(422, { message: "OAuth fetch exceeded maximum redirect hops" });
   }
   const location = response.headers.get("location");
   if (!location) {
     await cancelResponseBody(response);
-    throw new HTTPException7(422, { message: "OAuth fetch redirect was missing Location" });
+    throw new HTTPException8(422, { message: "OAuth fetch redirect was missing Location" });
   }
   let nextUrl;
   try {
     nextUrl = new URL(location, rawUrl).toString();
   } catch {
     await cancelResponseBody(response);
-    throw new HTTPException7(422, { message: "OAuth fetch redirect Location was invalid" });
+    throw new HTTPException8(422, { message: "OAuth fetch redirect Location was invalid" });
   }
   await cancelResponseBody(response);
   return await fetchOAuth(nextUrl, settings, init, hop + 1);
@@ -7467,7 +8097,7 @@ function registrationMethod(value) {
   if (value === "operator" || value === "manual" || value === "cimd" || value === "dcr") {
     return value;
   }
-  throw new HTTPException7(400, { message: "invalid OAuth state" });
+  throw new HTTPException8(400, { message: "invalid OAuth state" });
 }
 function expiresAtFromTokenResponse(payload) {
   const expiresAt = stringValue(payload.expires_at);
@@ -7502,17 +8132,21 @@ function numberValue(value) {
 function requiredString(value, field) {
   const result = stringValue(value);
   if (!result) {
-    throw new HTTPException7(400, { message: `invalid OAuth state: missing ${field}` });
+    throw new HTTPException8(400, { message: `invalid OAuth state: missing ${field}` });
   }
   return result;
 }
 
 // src/routes/connections.ts
+import {
+  OPENGENI_SLACK_BOT_CREDENTIAL_LABEL as OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
+  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE as OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2
+} from "@opengeni/contracts";
 function registerConnectionRoutes(app, deps) {
   const { db, settings, observability } = deps;
   function assertIntegrationsEnabled() {
     if (!settings.integrationsEnabled) {
-      throw new HTTPException8(404, { message: "integrations are not enabled for this deployment" });
+      throw new HTTPException9(404, { message: "integrations are not enabled for this deployment" });
     }
   }
   app.get("/v1/workspaces/:workspaceId/connections", async (c) => {
@@ -7528,6 +8162,7 @@ function registerConnectionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
     const payload = CreateConnectionRequest.parse(await c.req.json());
+    assertNotReservedSlackBotMetadata(payload.metadata);
     const key = requireEnvironmentEncryption2(settings);
     const subjectId = writableSubjectId(payload.subjectId, grant.subjectId);
     const connection = await createConnection2(db, {
@@ -7544,6 +8179,92 @@ function registerConnectionRoutes(app, deps) {
     });
     return c.json(ConnectionResponse.parse({ connection }), 201);
   });
+  app.post("/v1/workspaces/:workspaceId/connections/slack-bot", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
+    const payload = ConnectOpenGeniSlackBotRequest.parse(await c.req.json());
+    const verified = await verifyOpenGeniSlackBotCredential(
+      payload.token,
+      deps.slackFetch ?? fetch
+    );
+    const key = requireEnvironmentEncryption2(settings);
+    const credentialEncrypted = encryptCredentialBundle(
+      key,
+      slackBotCredentialBundle(payload.token)
+    );
+    const existing = payload.connectionId ? await getConnectionMetadata2(db, workspaceId, payload.connectionId, grant.subjectId) : null;
+    if (payload.connectionId && !existing) {
+      throw new HTTPException9(404, { message: "connection not found" });
+    }
+    if (existing && !isOpenGeniSlackBotConnection(existing)) {
+      throw new HTTPException9(422, {
+        message: "connectionId is not an OpenGeni Slack bot connection"
+      });
+    }
+    const existingMetadata = existing ? openGeniSlackBotMetadata2(existing.metadata) : null;
+    if (existingMetadata && existingMetadata.slackTeamId !== verified.metadata.slackTeamId) {
+      throw new HTTPException9(409, {
+        message: "a Slack bot connection can only be reinstalled for its original Slack workspace"
+      });
+    }
+    if (existingMetadata && (existingMetadata.botId !== verified.metadata.botId || existingMetadata.botUserId !== verified.metadata.botUserId)) {
+      throw new HTTPException9(409, {
+        message: "a different Slack bot requires a new connection and explicit scheduled-task rebinding"
+      });
+    }
+    const verifiedInstallAt = new Date(verified.metadata.verifiedAt);
+    const connection = existing ? await updateConnection2(db, {
+      workspaceId,
+      connectionId: existing.id,
+      visibleToSubjectId: grant.subjectId,
+      expectedVersion: existing.version,
+      subjectId: null,
+      providerDomain: "slack.com",
+      kind: "app_install",
+      status: "active",
+      credentialEncrypted,
+      grantedScopes: verified.grantedScopes,
+      expiresAt: null,
+      verifiedInstallAt,
+      verifiedInstallVersion: existing.version + 1,
+      metadata: verified.metadata,
+      updatedBySubjectId: grant.subjectId
+    }) : await createConnection2(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: null,
+      providerDomain: "slack.com",
+      kind: "app_install",
+      credentialEncrypted,
+      grantedScopes: verified.grantedScopes,
+      expiresAt: null,
+      verifiedInstallAt,
+      verifiedInstallVersion: 1,
+      metadata: verified.metadata,
+      createdBySubjectId: grant.subjectId
+    });
+    if (!connection) {
+      throw new HTTPException9(409, {
+        message: "Slack bot connection changed during reinstall; retry with the current connection"
+      });
+    }
+    await recordAuditEvent2(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: existing ? "slack_bot.reinstalled" : "slack_bot.connected",
+      targetType: "connection",
+      targetId: connection.id,
+      metadata: {
+        credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+        credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
+        connectionId: connection.id,
+        slackTeamId: verified.metadata.slackTeamId,
+        outcome: "succeeded"
+      }
+    });
+    return c.json(ConnectionResponse.parse({ connection }), existing ? 200 : 201);
+  });
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:read");
@@ -7554,7 +8275,7 @@ function registerConnectionRoutes(app, deps) {
       grant.subjectId
     );
     if (!connection) {
-      throw new HTTPException8(404, { message: "connection not found" });
+      throw new HTTPException9(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -7562,14 +8283,26 @@ function registerConnectionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
     const payload = UpdateConnectionRequest.parse(await c.req.json());
+    assertNotReservedSlackBotMetadata(payload.metadata);
+    const existing = await getConnectionMetadata2(
+      db,
+      workspaceId,
+      c.req.param("connectionId"),
+      grant.subjectId
+    );
+    if (existing && isOpenGeniSlackBotConnection(existing)) {
+      throw new HTTPException9(422, {
+        message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection"
+      });
+    }
     if (payload.status !== void 0) {
       if (payload.status !== "active") {
-        throw new HTTPException8(400, {
+        throw new HTTPException9(400, {
           message: 'status can only be set to "active"; use DELETE to revoke'
         });
       }
       if (payload.credential === void 0) {
-        throw new HTTPException8(400, {
+        throw new HTTPException9(400, {
           message: "reactivating a connection requires a new credential"
         });
       }
@@ -7591,7 +8324,7 @@ function registerConnectionRoutes(app, deps) {
       ...payload.metadata !== void 0 ? { metadata: payload.metadata } : {}
     });
     if (!connection) {
-      throw new HTTPException8(404, { message: "connection not found" });
+      throw new HTTPException9(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -7605,7 +8338,25 @@ function registerConnectionRoutes(app, deps) {
       grant.subjectId
     );
     if (!connection) {
-      throw new HTTPException8(404, { message: "connection not found" });
+      throw new HTTPException9(404, { message: "connection not found" });
+    }
+    if (isOpenGeniSlackBotConnection(connection)) {
+      const metadata = openGeniSlackBotMetadata2(connection.metadata);
+      await recordAuditEvent2(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: grant.subjectId,
+        action: "slack_bot.disconnected",
+        targetType: "connection",
+        targetId: connection.id,
+        metadata: {
+          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
+          connectionId: connection.id,
+          slackTeamId: metadata.slackTeamId,
+          outcome: "succeeded"
+        }
+      });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -7615,7 +8366,7 @@ function registerConnectionRoutes(app, deps) {
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
     const parsed = OAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException8(400, {
+      throw new HTTPException9(400, {
         message: parsed.error.issues[0]?.message ?? "invalid OAuth start request"
       });
     }
@@ -7659,18 +8410,30 @@ function registerConnectionRoutes(app, deps) {
     );
   });
 }
+function assertNotReservedSlackBotMetadata(metadata) {
+  if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
+    throw new HTTPException9(422, {
+      message: "OpenGeni Slack bot metadata is reserved for the dedicated connection flow"
+    });
+  }
+}
 function writableSubjectId(requested, grantSubjectId) {
   if (requested == null) {
     return null;
   }
   if (requested !== grantSubjectId) {
-    throw new HTTPException8(403, { message: "cannot write a connection for another subject" });
+    throw new HTTPException9(403, { message: "cannot write a connection for another subject" });
   }
   return requested;
 }
 function encryptCredentialBundle(key, credential) {
   return encryptEnvironmentValue3(key, JSON.stringify(credential));
 }
+function slackBotCredentialBundle(token) {
+  const headerName = ["author", "ization"].join("");
+  const scheme = ["Bear", "er"].join("");
+  return { headers: { [headerName]: `${scheme} ${token}` } };
+}
 
 // src/routes/documents.ts
 import {
@@ -7712,7 +8475,7 @@ import {
   searchDocuments as searchDocuments2
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { HTTPException as HTTPException11 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant5 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
 
@@ -7939,7 +8702,7 @@ import {
   getRetainedFileArtifact,
   requireFile as requireFile2
 } from "@opengeni/db";
-import { HTTPException as HTTPException9 } from "hono/http-exception";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant4 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage2, requireLimit as requireLimit2 } from "@opengeni/core";
 function registerFileRoutes(app, deps) {
@@ -7948,7 +8711,7 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException9(503, { message: "object storage is not configured" });
+      throw new HTTPException10(503, { message: "object storage is not configured" });
     }
     const payload = CreateFileUploadRequest.parse(await c.req.json());
     await requireLimit2(deps, {
@@ -7958,7 +8721,7 @@ function registerFileRoutes(app, deps) {
       quantity: payload.sizeBytes
     });
     if (payload.sizeBytes > objectStorage.maxSinglePutSizeBytes) {
-      throw new HTTPException9(413, {
+      throw new HTTPException10(413, {
         message: `file exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes`
       });
     }
@@ -7999,11 +8762,11 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException9(503, { message: "object storage is not configured" });
+      throw new HTTPException10(503, { message: "object storage is not configured" });
     }
     const upload = await getFileUpload(db, workspaceId, c.req.param("uploadId"));
     if (!upload) {
-      throw new HTTPException9(404, { message: "file upload not found" });
+      throw new HTTPException10(404, { message: "file upload not found" });
     }
     const recordUploadedFileUsage = async (file2) => {
       await recordWorkspaceUsage2(deps, {
@@ -8027,7 +8790,7 @@ function registerFileRoutes(app, deps) {
         if (current?.status === "completed" && current.file.status === "ready") {
           file2 = current.file;
         } else if (current && current.status !== "pending") {
-          throw new HTTPException9(409, {
+          throw new HTTPException10(409, {
             message: `file upload is ${publicFileUploadStatus(current.status)}`
           });
         } else {
@@ -8048,7 +8811,7 @@ function registerFileRoutes(app, deps) {
         return claim.file;
       }
       if (claim.outcome === "unavailable") {
-        throw new HTTPException9(409, {
+        throw new HTTPException10(409, {
           message: `file upload is ${publicFileUploadStatus(claim.status)}`
         });
       }
@@ -8064,7 +8827,7 @@ function registerFileRoutes(app, deps) {
             error: error instanceof Error ? error.message : String(error)
           }
         );
-        throw new HTTPException9(status, { message });
+        throw new HTTPException10(status, { message });
       }
       const settled = await completeFileUploadCleanup(db, {
         accountId: grant.accountId,
@@ -8074,16 +8837,16 @@ function registerFileRoutes(app, deps) {
         terminalStatus
       });
       if (!settled) {
-        throw new HTTPException9(409, { message: "file upload cleanup claim was superseded" });
+        throw new HTTPException10(409, { message: "file upload cleanup claim was superseded" });
       }
-      throw new HTTPException9(status, { message });
+      throw new HTTPException10(status, { message });
     };
     if (upload.status === "completed" && upload.file.status === "ready") {
       const file2 = await completeAndRecordUsage();
       return c.json(CompleteFileUploadResponse.parse({ file: file2 }));
     }
     if (upload.status !== "pending") {
-      throw new HTTPException9(409, {
+      throw new HTTPException10(409, {
         message: `file upload is ${publicFileUploadStatus(upload.status)}`
       });
     }
@@ -8092,7 +8855,7 @@ function registerFileRoutes(app, deps) {
       return c.json(CompleteFileUploadResponse.parse({ file: file2 }));
     }
     const head = await objectStorage.headFile(upload.file).catch((error) => {
-      throw new HTTPException9(409, {
+      throw new HTTPException10(409, {
         message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}`
       });
     });
@@ -8128,7 +8891,7 @@ function registerFileRoutes(app, deps) {
     await requireAccessGrant4(c, deps, workspaceId, "files:read");
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException9(404, { message: "file not found" });
+      throw new HTTPException10(404, { message: "file not found" });
     }
     return c.json(FileAsset.parse(file));
   });
@@ -8206,7 +8969,7 @@ function registerFileRoutes(app, deps) {
       return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
     }
     if (bytes.byteLength !== range.length) {
-      throw new HTTPException9(502, { message: "object storage returned an invalid byte range" });
+      throw new HTTPException10(502, { message: "object storage returned an invalid byte range" });
     }
     return c.body(new Uint8Array(bytes), range.status, headers);
   });
@@ -8214,14 +8977,14 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant4(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
-      throw new HTTPException9(503, { message: "object storage is not configured" });
+      throw new HTTPException10(503, { message: "object storage is not configured" });
     }
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException9(404, { message: "file not found" });
+      throw new HTTPException10(404, { message: "file not found" });
     }
     if (file.status !== "ready") {
-      throw new HTTPException9(409, { message: `file is ${file.status}` });
+      throw new HTTPException10(409, { message: `file is ${file.status}` });
     }
     const signed = await objectStorage.createGetUrl({ key: file.objectKey });
     return c.json(
@@ -8243,7 +9006,7 @@ function publicFileUploadStatus(status) {
 function retainedArtifactId(value) {
   const parsed = FileAsset.shape.id.safeParse(value);
   if (!parsed.success) {
-    throw new HTTPException9(404, { message: "artifact not found" });
+    throw new HTTPException10(404, { message: "artifact not found" });
   }
   return parsed.data;
 }
@@ -8311,7 +9074,7 @@ function registerDocumentRoutes(app, deps) {
     await requireAccessGrant5(c, deps, workspaceId, "documents:search");
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException10(404, { message: "document base not found" });
+      throw new HTTPException11(404, { message: "document base not found" });
     }
     return c.json(DocumentBase.parse(base));
   });
@@ -8319,7 +9082,7 @@ function registerDocumentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant5(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException11(503, { message: "object storage is not configured" });
     }
     await requireLimit3(deps, {
       accountId: grant.accountId,
@@ -8385,7 +9148,7 @@ function registerDocumentRoutes(app, deps) {
         });
         return c.body(null, 204);
       } catch (error) {
-        if (error instanceof HTTPException10) {
+        if (error instanceof HTTPException11) {
           throw error;
         }
         throw documentHttpException(error);
@@ -8398,7 +9161,7 @@ function registerDocumentRoutes(app, deps) {
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant5(c, deps, workspaceId, "documents:manage");
       if (!objectStorage) {
-        throw new HTTPException10(503, { message: "object storage is not configured" });
+        throw new HTTPException11(503, { message: "object storage is not configured" });
       }
       await requireLimit3(deps, {
         accountId: grant.accountId,
@@ -8411,13 +9174,13 @@ function registerDocumentRoutes(app, deps) {
           viewerSubjectId: grant.subjectId
         });
         if (!document) {
-          throw new HTTPException10(404, { message: "document not found" });
+          throw new HTTPException11(404, { message: "document not found" });
         }
         if (document.status !== "failed") {
-          throw new HTTPException10(422, { message: "only failed documents can be retried" });
+          throw new HTTPException11(422, { message: "only failed documents can be retried" });
         }
         if (document.baseId !== c.req.param("baseId")) {
-          throw new HTTPException10(404, { message: "document not found" });
+          throw new HTTPException11(404, { message: "document not found" });
         }
         const queued = await queueDocumentForReindex(db, workspaceId, document.id, {
           viewerSubjectId: grant.subjectId
@@ -8442,7 +9205,7 @@ function registerDocumentRoutes(app, deps) {
         }
         return c.json(Document.parse(indexed));
       } catch (error) {
-        if (error instanceof HTTPException10) {
+        if (error instanceof HTTPException11) {
           throw error;
         }
         throw documentHttpException(error);
@@ -8455,7 +9218,7 @@ function registerDocumentRoutes(app, deps) {
     const payload = DocumentSearchRequest.parse(await c.req.json());
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException10(404, { message: "document base not found" });
+      throw new HTTPException11(404, { message: "document base not found" });
     }
     return c.json({
       results: await searchDocuments2(
@@ -8499,7 +9262,7 @@ function registerDocumentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant5(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException11(503, { message: "object storage is not configured" });
     }
     await requireLimit3(deps, {
       accountId: grant.accountId,
@@ -8519,7 +9282,7 @@ function registerDocumentRoutes(app, deps) {
           quantity: bytes.length
         });
         if (bytes.length > objectStorage.maxSinglePutSizeBytes) {
-          throw new HTTPException10(413, {
+          throw new HTTPException11(413, {
             message: `drop exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes`
           });
         }
@@ -8598,7 +9361,7 @@ function registerDocumentRoutes(app, deps) {
       }
       return c.json(Document.parse(indexed), wasCreated ? 201 : 200);
     } catch (error) {
-      if (error instanceof HTTPException10) {
+      if (error instanceof HTTPException11) {
         throw error;
       }
       throw documentHttpException(error);
@@ -8613,7 +9376,7 @@ function registerDocumentRoutes(app, deps) {
         viewerSubjectId: grant.subjectId
       });
       if (!document) {
-        throw new HTTPException10(404, { message: "document not found" });
+        throw new HTTPException11(404, { message: "document not found" });
       }
       return c.json(
         Document.parse(
@@ -8627,7 +9390,7 @@ function registerDocumentRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (error instanceof HTTPException10) {
+      if (error instanceof HTTPException11) {
         throw error;
       }
       throw documentHttpException(error);
@@ -8644,7 +9407,7 @@ function registerDocumentRoutes(app, deps) {
       limit: c.req.query("limit") ? Number(c.req.query("limit")) : void 0
     });
     if (!parsed.success) {
-      throw new HTTPException10(400, { message: "invalid knowledge memory query parameters" });
+      throw new HTTPException11(400, { message: "invalid knowledge memory query parameters" });
     }
     return c.json(
       (await listKnowledgeMemories2(db, workspaceId, parsed.data)).map(
@@ -8657,7 +9420,7 @@ function registerDocumentRoutes(app, deps) {
     await requireAccessGrant5(c, deps, workspaceId, "documents:search");
     const memory = await getKnowledgeMemory(db, workspaceId, c.req.param("memoryId"));
     if (!memory) {
-      throw new HTTPException10(404, { message: "knowledge memory not found" });
+      throw new HTTPException11(404, { message: "knowledge memory not found" });
     }
     return c.json(KnowledgeMemory.parse(memory));
   });
@@ -8666,7 +9429,7 @@ function registerDocumentRoutes(app, deps) {
     await requireAccessGrant5(c, deps, workspaceId, "documents:search");
     const parsed = WorkspaceMemorySearchRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException10(400, { message: "invalid workspace memory search request" });
+      throw new HTTPException11(400, { message: "invalid workspace memory search request" });
     }
     const results = await searchWorkspaceMemories2(
       db,
@@ -8688,7 +9451,7 @@ function registerDocumentRoutes(app, deps) {
     const grant = await requireAccessGrant5(c, deps, workspaceId, "documents:manage");
     const parsedBody = CreateKnowledgeMemoryRequest.safeParse(await c.req.json());
     if (!parsedBody.success) {
-      throw new HTTPException10(400, { message: "invalid knowledge memory request" });
+      throw new HTTPException11(400, { message: "invalid knowledge memory request" });
     }
     const payload = parsedBody.data;
     if (payload.status === "active") {
@@ -8771,21 +9534,21 @@ function dropFilename(preferred) {
 function documentHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException10(404, { message });
+    return new HTTPException11(404, { message });
   }
   if (message.includes("already exists")) {
-    return new HTTPException10(409, { message });
+    return new HTTPException11(409, { message });
   }
   if (message.includes("no suggested base")) {
-    return new HTTPException10(422, { message });
+    return new HTTPException11(422, { message });
   }
   if (message.includes("pending") || message.includes("failed") || message.includes("deleted")) {
-    return new HTTPException10(422, { message });
+    return new HTTPException11(422, { message });
   }
   if (message.includes("too long") || message.includes("visible memory is full") || message.includes("empty after sanitization") || message.includes("does not match") || message.includes("Ambiguous memory id")) {
-    return new HTTPException10(400, { message });
+    return new HTTPException11(400, { message });
   }
-  return new HTTPException10(500, { message });
+  return new HTTPException11(500, { message });
 }
 
 // src/routes/enrollments.ts
@@ -8807,7 +9570,7 @@ import {
   RevokeEnrollmentResponse
 } from "@opengeni/contracts";
 import { getWorkspace, listEnrollments, revokeEnrollment } from "@opengeni/db";
-import { HTTPException as HTTPException11 } from "hono/http-exception";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant6 } from "@opengeni/core";
 
 // src/sandbox/enrollment.ts
@@ -9099,7 +9862,7 @@ function registerEnrollmentRoutes(app, deps) {
   const { settings, db } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException11(404, {
+      throw new HTTPException12(404, {
         message: "selfhosted enrollment is not enabled for this deployment"
       });
     }
@@ -9111,7 +9874,7 @@ function registerEnrollmentRoutes(app, deps) {
   function rateLimit(c, limiter) {
     const ip = clientIp(c);
     if (!limiter.take(ip)) {
-      throw new HTTPException11(429, { message: "too many requests; slow down" });
+      throw new HTTPException12(429, { message: "too many requests; slow down" });
     }
   }
   app.post("/v1/enrollments/device/start", async (c) => {
@@ -9119,12 +9882,12 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, startLimiter);
     const parsed = DeviceEnrollmentStartRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException11(400, { message: "invalid device-start request" });
+      throw new HTTPException12(400, { message: "invalid device-start request" });
     }
     const body = parsed.data;
     const workspace = await getWorkspace(db, body.workspaceId);
     if (!workspace) {
-      throw new HTTPException11(404, { message: "workspace not found" });
+      throw new HTTPException12(404, { message: "workspace not found" });
     }
     const result = await startDeviceEnrollment(
       { db, settings },
@@ -9148,7 +9911,7 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, pollLimiter);
     const parsed = DeviceEnrollmentPollRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException11(400, { message: "invalid device-poll request" });
+      throw new HTTPException12(400, { message: "invalid device-poll request" });
     }
     const result = await pollDeviceEnrollment(
       { db, settings },
@@ -9161,19 +9924,19 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, lookupLimiter);
     const parsed = DeviceEnrollmentLookupRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException11(400, { message: "invalid device-lookup request" });
+      throw new HTTPException12(400, { message: "invalid device-lookup request" });
     }
     const record3 = await lookupDeviceEnrollment(
       { db, settings },
       { userCode: parsed.data.userCode }
     );
     if (!record3) {
-      throw new HTTPException11(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException12(404, { message: "no pending enrollment for that code" });
     }
     try {
       await requireAccessGrant6(c, deps, record3.workspaceId, "enrollments:read");
     } catch {
-      throw new HTTPException11(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException12(404, { message: "no pending enrollment for that code" });
     }
     return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record3)), 200);
   });
@@ -9182,7 +9945,7 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, exchangeLimiter);
     const parsed = EnrollTokenExchangeRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException11(400, { message: "invalid enroll-token-exchange request" });
+      throw new HTTPException12(400, { message: "invalid enroll-token-exchange request" });
     }
     const body = parsed.data;
     const result = await exchangeEnrollToken(
@@ -9198,9 +9961,9 @@ function registerEnrollmentRoutes(app, deps) {
     );
     if (!result.ok) {
       if (result.reason === "disabled") {
-        throw new HTTPException11(503, { message: "enrollment credential plane is not configured" });
+        throw new HTTPException12(503, { message: "enrollment credential plane is not configured" });
       }
-      throw new HTTPException11(401, { message: "invalid or expired enroll token" });
+      throw new HTTPException12(401, { message: "invalid or expired enroll token" });
     }
     return c.json(EnrollTokenExchangeResponse.parse({ credentials: result.credentials }), 201);
   });
@@ -9210,7 +9973,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentApproveRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException11(400, { message: "invalid device-approve request" });
+      throw new HTTPException12(400, { message: "invalid device-approve request" });
     }
     const body = parsed.data;
     const approved = await approveDeviceEnrollment(
@@ -9226,7 +9989,7 @@ function registerEnrollmentRoutes(app, deps) {
       }
     );
     if (!approved) {
-      throw new HTTPException11(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException12(404, { message: "no pending enrollment for that code" });
     }
     return c.json(
       DeviceEnrollmentApproveResponse.parse({
@@ -9244,7 +10007,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentDenyRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException11(400, { message: "invalid device-deny request" });
+      throw new HTTPException12(400, { message: "invalid device-deny request" });
     }
     const result = await denyDeviceEnrollment(
       { db, settings },
@@ -9262,7 +10025,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = MintEnrollTokenRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException11(400, { message: "invalid mint-enroll-token request" });
+      throw new HTTPException12(400, { message: "invalid mint-enroll-token request" });
     }
     const minted = await mintEnrollToken(
       { db, settings },
@@ -9273,7 +10036,7 @@ function registerEnrollmentRoutes(app, deps) {
       }
     );
     if (!minted) {
-      throw new HTTPException11(503, { message: "enrollment credential plane is not configured" });
+      throw new HTTPException12(503, { message: "enrollment credential plane is not configured" });
     }
     return c.json(MintEnrollTokenResponse.parse(minted), 201);
   });
@@ -9362,13 +10125,13 @@ import {
   SwapActiveSandboxResponse
 } from "@opengeni/contracts";
 import { getEnrollment as getEnrollment2, readMachineMetricsSeries, requireSession as requireSession3 } from "@opengeni/db";
-import { HTTPException as HTTPException12 } from "hono/http-exception";
+import { HTTPException as HTTPException13 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant7 } from "@opengeni/core";
 import { buildFleetContextForSession as buildFleetContextForSession2, swapActiveSandbox as swapActiveSandbox2 } from "@opengeni/core";
 
 // src/sandbox/machines.ts
 import {
-  getSession as getSession3,
+  getSession as getSession4,
   listEnrollments as listEnrollments2,
   listSandboxes,
   readActiveSandbox,
@@ -9454,7 +10217,7 @@ async function listMachines(services, input) {
   let activeEpoch = 0;
   let session = null;
   if (input.sessionId) {
-    session = await getSession3(db, workspaceId, input.sessionId);
+    session = await getSession4(db, workspaceId, input.sessionId);
     if (session) {
       const pointer = await readActiveSandbox(db, workspaceId, input.sessionId);
       activeSandboxId = pointer?.activeSandboxId ?? null;
@@ -9550,7 +10313,7 @@ function registerMachineRoutes(app, deps) {
   const { settings, db, bus } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException12(404, {
+      throw new HTTPException13(404, {
         message: "selfhosted machines are not enabled for this deployment"
       });
     }
@@ -9570,7 +10333,7 @@ function registerMachineRoutes(app, deps) {
     const enrollmentId = c.req.param("enrollmentId");
     const enrollment = await getEnrollment2(db, workspaceId, enrollmentId);
     if (!enrollment) {
-      throw new HTTPException12(404, { message: "machine not found in this workspace" });
+      throw new HTTPException13(404, { message: "machine not found in this workspace" });
     }
     const windowMs = SERIES_WINDOWS_MS[c.req.query("window") ?? ""] ?? DEFAULT_SERIES_WINDOW_MS;
     const since = new Date(Date.now() - windowMs);
@@ -9636,7 +10399,7 @@ import {
   setVariableSetVariable as setVariableSetVariable2,
   updateVariableSet
 } from "@opengeni/db";
-import { HTTPException as HTTPException13 } from "hono/http-exception";
+import { HTTPException as HTTPException14 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant8 } from "@opengeni/core";
 import {
   assertAllowedVariableSetVariableName as assertAllowedVariableSetVariableName2,
@@ -9665,7 +10428,7 @@ function registerVariableSetRoutes(app, deps) {
       const payload = CreateVariableSetRequest.parse(await c.req.json());
       const name = trimmedVariableSetName(payload.name);
       if (payload.variables.length > MAX_VARIABLES_PER_ENVIRONMENT2) {
-        throw new HTTPException13(422, {
+        throw new HTTPException14(422, {
           message: `a variable set supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables`
         });
       }
@@ -9673,19 +10436,19 @@ function registerVariableSetRoutes(app, deps) {
       for (const variable of payload.variables) {
         assertAllowedVariableSetVariableName2(variable.name);
         if (variableNames.has(variable.name)) {
-          throw new HTTPException13(422, {
+          throw new HTTPException14(422, {
             message: `duplicate variable set variable name: ${variable.name}`
           });
         }
         variableNames.add(variable.name);
       }
       if (await countVariableSets2(db, workspaceId) >= MAX_ENVIRONMENTS_PER_WORKSPACE2) {
-        throw new HTTPException13(422, {
+        throw new HTTPException14(422, {
           message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE2} variable sets`
         });
       }
       if (await getVariableSetByName2(db, workspaceId, name)) {
-        throw new HTTPException13(409, { message: `variable set name is already in use: ${name}` });
+        throw new HTTPException14(409, { message: `variable set name is already in use: ${name}` });
       }
       const created = await createVariableSet2(db, {
         accountId: grant.accountId,
@@ -9722,7 +10485,7 @@ function registerVariableSetRoutes(app, deps) {
       if (name !== void 0 && name !== variableSet.name) {
         const existing = await getVariableSetByName2(db, workspaceId, name);
         if (existing && existing.id !== variableSet.id) {
-          throw new HTTPException13(409, { message: `variable set name is already in use: ${name}` });
+          throw new HTTPException14(409, { message: `variable set name is already in use: ${name}` });
         }
       }
       const updated = await updateVariableSet(db, workspaceId, variableSet.id, {
@@ -9750,7 +10513,7 @@ function registerVariableSetRoutes(app, deps) {
         variableSet.id
       );
       if (attachedTasks > 0) {
-        throw new HTTPException13(409, {
+        throw new HTTPException14(409, {
           message: `variable set is attached to ${attachedTasks} scheduled task(s); detach first`
         });
       }
@@ -9760,7 +10523,7 @@ function registerVariableSetRoutes(app, deps) {
         variableSet.id
       );
       if (activeSessions > 0) {
-        throw new HTTPException13(409, {
+        throw new HTTPException14(409, {
           message: `variable set is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first`
         });
       }
@@ -9785,7 +10548,7 @@ function registerVariableSetRoutes(app, deps) {
       const payload = SetVariableSetVariableRequest.parse(await c.req.json());
       const exists = variableSet.variables.some((variable) => variable.name === name);
       if (!exists && variableSet.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT2) {
-        throw new HTTPException13(422, {
+        throw new HTTPException14(422, {
           message: `a variable set supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables`
         });
       }
@@ -9815,7 +10578,7 @@ function registerVariableSetRoutes(app, deps) {
       );
       const deleted = await deleteVariableSetVariable(db, workspaceId, variableSet.id, name);
       if (!deleted) {
-        throw new HTTPException13(404, { message: "variable set variable not found" });
+        throw new HTTPException14(404, { message: "variable set variable not found" });
       }
       await recordVariableSetAuditEvent2(db, {
         grant,
@@ -9831,7 +10594,7 @@ var registerEnvironmentRoutes = registerVariableSetRoutes;
 function parseVariableName(raw) {
   const parsed = VariableSetVariableName2.safeParse(raw);
   if (!parsed.success) {
-    throw new HTTPException13(422, {
+    throw new HTTPException14(422, {
       message: "variable set variable names must match ^[A-Z][A-Z0-9_]*$"
     });
   }
@@ -9841,7 +10604,7 @@ function parseVariableName(raw) {
 function trimmedVariableSetName(name) {
   const trimmed = name.trim();
   if (!trimmed) {
-    throw new HTTPException13(422, { message: "variable set name is required" });
+    throw new HTTPException14(422, { message: "variable set name is required" });
   }
   return trimmed;
 }
@@ -9850,7 +10613,7 @@ function trimmedVariableSetName(name) {
 import { CreateApiKeyRequest, CreateApiKeyResponse } from "@opengeni/contracts";
 import { createApiKey, listApiKeys, revokeApiKey } from "@opengeni/db";
 import { zValidator } from "@hono/zod-validator";
-import { HTTPException as HTTPException14 } from "hono/http-exception";
+import { HTTPException as HTTPException15 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant9 } from "@opengeni/core";
 import { requireLimit as requireLimit4 } from "@opengeni/core";
 function registerApiKeyRoutes(app, deps) {
@@ -9900,7 +10663,7 @@ function ensureDelegablePermissions(grantPermissions, requested) {
   }
   const missing = requested.filter((permission) => !grantPermissions.includes(permission));
   if (missing.length > 0) {
-    throw new HTTPException14(403, {
+    throw new HTTPException15(403, {
       message: `cannot delegate missing permissions: ${missing.join(", ")}`
     });
   }
@@ -9934,7 +10697,7 @@ import {
   recordStripeWebhookEvent,
   upsertBillingCustomer
 } from "@opengeni/db";
-import { HTTPException as HTTPException15 } from "hono/http-exception";
+import { HTTPException as HTTPException16 } from "hono/http-exception";
 import Stripe from "stripe";
 import { requireAccessContext } from "@opengeni/core";
 function registerBillingRoutes(app, deps) {
@@ -9953,7 +10716,7 @@ function registerBillingRoutes(app, deps) {
     if (workspaceId && !context.workspaceGrants.some(
       (grant) => grant.accountId === accountId && grant.workspaceId === workspaceId
     )) {
-      throw new HTTPException15(403, { message: "missing workspace access for usage query" });
+      throw new HTTPException16(403, { message: "missing workspace access for usage query" });
     }
     return c.json({
       balance: await getBillingBalance(deps.db, accountId),
@@ -9975,12 +10738,12 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/billing/checkout", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException15(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException16(404, { message: "stripe billing is not enabled" });
     }
     const context = await requireAccessContext(c, deps);
     const parsed = CreateCheckoutRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException15(400, {
+      throw new HTTPException16(400, {
         message: parsed.error.issues[0]?.message ?? "invalid checkout request"
       });
     }
@@ -10006,7 +10769,7 @@ function registerBillingRoutes(app, deps) {
       { idempotencyKey }
     );
     if (!session.url) {
-      throw new HTTPException15(502, { message: "Stripe did not return a checkout URL" });
+      throw new HTTPException16(502, { message: "Stripe did not return a checkout URL" });
     }
     return c.json(
       CreateCheckoutResponse.parse({
@@ -10017,11 +10780,11 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/webhooks/stripe", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException15(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException16(404, { message: "stripe billing is not enabled" });
     }
     const signature = c.req.header("stripe-signature");
     if (!signature) {
-      throw new HTTPException15(400, { message: "missing stripe-signature" });
+      throw new HTTPException16(400, { message: "missing stripe-signature" });
     }
     const payload = await c.req.text();
     let event;
@@ -10032,7 +10795,7 @@ function registerBillingRoutes(app, deps) {
         deps.settings.stripeWebhookSecret
       );
     } catch (error) {
-      throw new HTTPException15(400, {
+      throw new HTTPException16(400, {
         message: error instanceof Error ? error.message : "invalid stripe signature"
       });
     }
@@ -10052,7 +10815,7 @@ function registerBillingRoutes(app, deps) {
       await markStripeWebhookProcessed(deps.db, event.id);
       return c.json({ received: true });
     } catch (error) {
-      throw new HTTPException15(500, {
+      throw new HTTPException16(500, {
         message: error instanceof Error ? error.message : String(error)
       });
     }
@@ -10118,7 +10881,7 @@ function stripeCheckoutSessionCreateParams(input) {
 }
 function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   if (!publicBaseUrl) {
-    throw new HTTPException15(500, {
+    throw new HTTPException16(500, {
       message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe checkout"
     });
   }
@@ -10129,7 +10892,7 @@ function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   }
   const parsed = new URL(candidate);
   if (parsed.origin !== base.origin) {
-    throw new HTTPException15(400, { message: `${field} must use the OpenGeni public origin` });
+    throw new HTTPException16(400, { message: `${field} must use the OpenGeni public origin` });
   }
   return parsed.toString();
 }
@@ -10363,7 +11126,7 @@ async function getOrCreateStripeCustomer(deps, stripe, context, accountId) {
   }
   const account = await getManagedAccount(deps.db, accountId);
   if (!account) {
-    throw new HTTPException15(404, { message: "account not found" });
+    throw new HTTPException16(404, { message: "account not found" });
   }
   const customer = await stripe.customers.create({
     name: account.name,
@@ -10389,17 +11152,17 @@ function stripeCustomerProvider(input) {
 function requireSelectedAccount(context, requested, permission) {
   const accountId = requested ?? context.defaultAccountId ?? void 0;
   if (!accountId) {
-    throw new HTTPException15(409, { message: "account selection is required" });
+    throw new HTTPException16(409, { message: "account selection is required" });
   }
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException15(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException16(403, { message: `missing permission: ${permission}` });
   }
   return accountId;
 }
 function stripeClient(deps) {
   if (!deps.settings.stripeSecretKey) {
-    throw new HTTPException15(500, { message: "Stripe secret key is not configured" });
+    throw new HTTPException16(500, { message: "Stripe secret key is not configured" });
   }
   return new Stripe(deps.settings.stripeSecretKey);
 }
@@ -10446,7 +11209,7 @@ import {
   verifySignedState
 } from "@opengeni/github";
 import { deleteCookie, setCookie } from "hono/cookie";
-import { HTTPException as HTTPException16 } from "hono/http-exception";
+import { HTTPException as HTTPException17 } from "hono/http-exception";
 import { hasPermission as hasPermission5, requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
 var githubStateCookie = "opengeni_github_state";
 var githubBindingStateMaxAgeSeconds = 10 * 60;
@@ -10484,15 +11247,15 @@ function registerGitHubRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const state = c.req.query("state");
     if (!state) {
-      throw new HTTPException16(400, { message: "missing GitHub installation state" });
+      throw new HTTPException17(400, { message: "missing GitHub installation state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority" || statePayload.workspaceId !== workspaceId || typeof statePayload.accountId !== "string" || !isFreshGitHubBindingState(statePayload)) {
-      throw new HTTPException16(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
     const slug = settings.githubAppSlug?.trim();
     if (!slug || githubAppMissingSettings2(settings).length > 0) {
-      throw new HTTPException16(409, {
+      throw new HTTPException17(409, {
         message: JSON.stringify({
           message: "GitHub App is not configured",
           missing: githubAppMissingSettings2(settings)
@@ -10511,11 +11274,11 @@ function registerGitHubRoutes(app, deps) {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException16(409, {
+        throw new HTTPException17(409, {
           message: JSON.stringify({ message: error.message, missing: error.missing })
         });
       }
-      throw new HTTPException16(502, {
+      throw new HTTPException17(502, {
         message: error instanceof Error ? error.message : String(error)
       });
     }
@@ -10527,11 +11290,11 @@ function registerGitHubRoutes(app, deps) {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException16(409, {
+        throw new HTTPException17(409, {
           message: JSON.stringify({ message: error.message, missing: error.missing })
         });
       }
-      throw new HTTPException16(502, {
+      throw new HTTPException17(502, {
         message: error instanceof Error ? error.message : String(error)
       });
     }
@@ -10541,7 +11304,7 @@ function registerGitHubRoutes(app, deps) {
     const grant = await requireAccessGrant10(c, deps, workspaceId, "github:manage");
     const installationId = parsePositiveInteger(c.req.param("installationId"));
     if (installationId === null) {
-      throw new HTTPException16(400, { message: "invalid GitHub installation id" });
+      throw new HTTPException17(400, { message: "invalid GitHub installation id" });
     }
     const deleted = await deleteGitHubInstallationBinding(db, {
       accountId: grant.accountId,
@@ -10549,7 +11312,7 @@ function registerGitHubRoutes(app, deps) {
       installationId
     });
     if (!deleted) {
-      throw new HTTPException16(404, { message: "GitHub installation binding not found" });
+      throw new HTTPException17(404, { message: "GitHub installation binding not found" });
     }
     return c.body(null, 204);
   });
@@ -10585,10 +11348,10 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException16(400, { message: "missing GitHub manifest code" });
+      throw new HTTPException17(400, { message: "missing GitHub manifest code" });
     }
     if (!state || !verifySignedState(state, githubStateSecret)) {
-      throw new HTTPException16(400, { message: "invalid or expired GitHub manifest state" });
+      throw new HTTPException17(400, { message: "invalid or expired GitHub manifest state" });
     }
     try {
       const conversion = await convertGitHubAppManifest(code);
@@ -10597,22 +11360,22 @@ function registerGitHubRoutes(app, deps) {
       return c.html(githubSuccessHtml(envLines));
     } catch (error) {
       const message = error instanceof GitHubAppApiError ? error.message : String(error);
-      throw new HTTPException16(502, { message });
+      throw new HTTPException17(502, { message });
     }
   });
   const handleGitHubInstallCallback = async (c) => {
     const state = c.req.query("state");
     if (!state) {
-      throw new HTTPException16(400, { message: "missing GitHub installation state" });
+      throw new HTTPException17(400, { message: "missing GitHub installation state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
-      throw new HTTPException16(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
     requireGitHubStateCookie(c, state);
     const grant = await requireGitHubManageGrant(c, deps, statePayload.workspaceId, statePayload);
     if (grant.accountId !== statePayload.accountId) {
-      throw new HTTPException16(403, {
+      throw new HTTPException17(403, {
         message: "GitHub installation state does not match this workspace"
       });
     }
@@ -10621,15 +11384,15 @@ function registerGitHubRoutes(app, deps) {
       return c.html(githubSetupPendingHtml());
     }
     if (setupAction !== "install" && setupAction !== "update") {
-      throw new HTTPException16(400, { message: "unsupported GitHub setup action" });
+      throw new HTTPException17(400, { message: "unsupported GitHub setup action" });
     }
     const installationId = parsePositiveInteger(c.req.query("installation_id"));
     if (installationId === null) {
-      throw new HTTPException16(400, { message: "missing or invalid GitHub installation_id" });
+      throw new HTTPException17(400, { message: "missing or invalid GitHub installation_id" });
     }
     const clientId = settings.githubClientId?.trim();
     if (!clientId) {
-      throw new HTTPException16(409, {
+      throw new HTTPException17(409, {
         message: JSON.stringify({
           message: "GitHub App is not configured",
           missing: ["OPENGENI_GITHUB_CLIENT_ID"]
@@ -10658,23 +11421,23 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException16(400, { message: "missing GitHub OAuth code" });
+      throw new HTTPException17(400, { message: "missing GitHub OAuth code" });
     }
     if (!state) {
-      throw new HTTPException16(400, { message: "missing GitHub OAuth state" });
+      throw new HTTPException17(400, { message: "missing GitHub OAuth state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority_oauth" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
-      throw new HTTPException16(400, { message: "invalid or expired GitHub OAuth state" });
+      throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
     const installationId = parsePositiveInteger(String(statePayload.installationId ?? ""));
     if (installationId === null) {
-      throw new HTTPException16(400, { message: "invalid GitHub installation id" });
+      throw new HTTPException17(400, { message: "invalid GitHub installation id" });
     }
     requireGitHubStateCookie(c, state);
     const grant = await requireGitHubManageGrant(c, deps, statePayload.workspaceId, statePayload);
     if (grant.accountId !== statePayload.accountId) {
-      throw new HTTPException16(403, {
+      throw new HTTPException17(403, {
         message: "GitHub OAuth state does not match this workspace"
       });
     }
@@ -10685,16 +11448,16 @@ function registerGitHubRoutes(app, deps) {
       throw githubAuthorityHttpError(error);
     }
     if (!proof) {
-      throw new HTTPException16(409, {
+      throw new HTTPException17(409, {
         message: "The configured GitHub provider cannot prove personal-owner or organization-owner authority"
       });
     }
     if (!isConsistentGitHubBindingProof(proof, installationId)) {
-      throw new HTTPException16(409, { message: "GitHub installation proof is stale or invalid" });
+      throw new HTTPException17(409, { message: "GitHub installation proof is stale or invalid" });
     }
     const repositoryIds = [...new Set(proof.repositories.map((repository) => repository.id))];
     if (repositoryIds.length !== proof.repositories.length) {
-      throw new HTTPException16(409, { message: "GitHub returned duplicate repository identities" });
+      throw new HTTPException17(409, { message: "GitHub returned duplicate repository identities" });
     }
     const authorityCheckedAt = /* @__PURE__ */ new Date();
     const expiresAt = new Date((statePayload.iat + githubBindingStateMaxAgeSeconds) * 1e3);
@@ -10718,12 +11481,12 @@ function registerGitHubRoutes(app, deps) {
       });
     } catch (error) {
       if (error instanceof GitHubInstallationAuthorityCommitError) {
-        throw new HTTPException16(409, { message: error.message });
+        throw new HTTPException17(409, { message: error.message });
       }
       throw error;
     }
     if (!bound) {
-      throw new HTTPException16(409, {
+      throw new HTTPException17(409, {
         message: "GitHub installation authorization was already used"
       });
     }
@@ -10740,17 +11503,17 @@ function registerGitHubRoutes(app, deps) {
     const form = new URLSearchParams(await c.req.text());
     const state = form.get("oauth_state");
     if (!state) {
-      throw new HTTPException16(400, { message: "missing GitHub OAuth state" });
+      throw new HTTPException17(400, { message: "missing GitHub OAuth state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || typeof statePayload.accountId !== "string" || statePayload.accountId.length === 0 || statePayload.workspaceId !== workspaceId) {
-      throw new HTTPException16(400, { message: "invalid or expired GitHub OAuth state" });
+      throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
     throw legacyInstallationChooserDisabled();
   });
 }
 function legacyInstallationChooserDisabled() {
-  return new HTTPException16(410, { message: legacyInstallationChooserDisabledMessage });
+  return new HTTPException17(410, { message: legacyInstallationChooserDisabledMessage });
 }
 function setGitHubStateCookie(c, deps, state) {
   setCookie(c, githubStateCookie, state, {
@@ -10763,7 +11526,7 @@ function setGitHubStateCookie(c, deps, state) {
 }
 function requireGitHubStateCookie(c, state) {
   if (!allCookieValues(c, githubStateCookie).includes(state)) {
-    throw new HTTPException16(400, {
+    throw new HTTPException17(400, {
       message: "invalid or expired GitHub installation browser state"
     });
   }
@@ -10772,7 +11535,7 @@ async function requireGitHubManageGrant(c, deps, workspaceId, expectedState) {
   try {
     return await requireAccessGrant10(c, deps, workspaceId, "github:manage");
   } catch (error) {
-    if (!(error instanceof HTTPException16) || error.status !== 401) {
+    if (!(error instanceof HTTPException17) || error.status !== 401) {
       throw error;
     }
     const grant = githubBrowserGrantFromState(deps.settings, expectedState, workspaceId);
@@ -10794,27 +11557,27 @@ function allCookieValues(c, name) {
   });
 }
 function githubAuthorityHttpError(error) {
-  if (error instanceof HTTPException16) {
+  if (error instanceof HTTPException17) {
     return error;
   }
   if (error instanceof GitHubInstallationAuthorityError) {
     if (error.reason === "authority_denied") {
-      return new HTTPException16(403, { message: error.message });
+      return new HTTPException17(403, { message: error.message });
     }
     if (error.reason === "installation_missing") {
-      return new HTTPException16(404, { message: error.message });
+      return new HTTPException17(404, { message: error.message });
     }
-    return new HTTPException16(409, { message: error.message });
+    return new HTTPException17(409, { message: error.message });
   }
   if (error instanceof GitHubAppConfigurationError2) {
-    return new HTTPException16(409, {
+    return new HTTPException17(409, {
       message: JSON.stringify({ message: error.message, missing: error.missing })
     });
   }
   if (error instanceof GitHubAppApiError) {
-    return new HTTPException16(502, { message: error.message });
+    return new HTTPException17(502, { message: error.message });
   }
-  return new HTTPException16(502, { message: "GitHub authority verification failed" });
+  return new HTTPException17(502, { message: "GitHub authority verification failed" });
 }
 function isSecureRequest(c, deps) {
   return deps.settings.publicBaseUrl?.startsWith("https://") || c.req.header("x-forwarded-proto") === "https" || new URL(c.req.url).protocol === "https:";
@@ -10894,7 +11657,7 @@ import {
   updatePackInstallationStatus
 } from "@opengeni/db";
 import { getDocumentBase as getDocumentBase2 } from "@opengeni/documents";
-import { HTTPException as HTTPException17 } from "hono/http-exception";
+import { HTTPException as HTTPException18 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant11 } from "@opengeni/core";
 import { requireLimit as requireLimit5 } from "@opengeni/core";
 import { validateVariableSetAttachment } from "@opengeni/core";
@@ -10922,7 +11685,7 @@ function registerPackRoutes(app, deps) {
     const grant = await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const manifest = RegisterCapabilityPackRequest.parse(await c.req.json());
     if (isBuiltInCapabilityPack(manifest.id)) {
-      throw new HTTPException17(409, {
+      throw new HTTPException18(409, {
         message: `pack id ${manifest.id} is a built-in pack and cannot be replaced`
       });
     }
@@ -10938,10 +11701,10 @@ function registerPackRoutes(app, deps) {
     await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const packId = c.req.param("packId");
     if (isBuiltInCapabilityPack(packId)) {
-      throw new HTTPException17(409, { message: "built-in packs cannot be unregistered" });
+      throw new HTTPException18(409, { message: "built-in packs cannot be unregistered" });
     }
     if (!await getWorkspacePack(db, workspaceId, packId)) {
-      throw new HTTPException17(404, { message: "pack not found" });
+      throw new HTTPException18(404, { message: "pack not found" });
     }
     const installation = await getPackInstallation(db, workspaceId, packId);
     if (installation && installation.status === "active") {
@@ -10982,7 +11745,7 @@ function registerPackRoutes(app, deps) {
     const storedVariableSetId = typeof existing?.metadata.variableSetId === "string" ? existing.metadata.variableSetId : typeof existing?.metadata.environmentId === "string" ? existing.metadata.environmentId : void 0;
     const variableSetId = payload.variableSetId ?? storedVariableSetId;
     if (pack.variableSet?.required && !variableSetId) {
-      throw new HTTPException17(422, {
+      throw new HTTPException18(422, {
         message: "this pack requires a variableSet attachment; pass variableSetId"
       });
     }
@@ -10998,7 +11761,7 @@ function registerPackRoutes(app, deps) {
         (name) => !variableSet.variables.some((variable) => variable.name === name)
       );
       if (missing.length > 0) {
-        throw new HTTPException17(422, {
+        throw new HTTPException18(422, {
           message: `variableSet is missing required variable(s): ${missing.join(", ")}`
         });
       }
@@ -11023,7 +11786,7 @@ function registerPackRoutes(app, deps) {
       const pack = await requirePack(db, workspaceId, MARKETING_SOCIAL_PACK_ID);
       const installation = await getPackInstallation(db, workspaceId, pack.id);
       if (installation?.status !== "active") {
-        throw new HTTPException17(409, {
+        throw new HTTPException18(409, {
           message: "enable the marketing social pack before creating its scheduled tasks"
         });
       }
@@ -11036,7 +11799,7 @@ function registerPackRoutes(app, deps) {
       });
       const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
       if (connections.length === 0) {
-        throw new HTTPException17(422, {
+        throw new HTTPException18(422, {
           message: "at least one connected social account is required"
         });
       }
@@ -11083,7 +11846,7 @@ function registerPackRoutes(app, deps) {
 async function requirePack(db, workspaceId, packId) {
   const pack = await resolveCapabilityPack(db, workspaceId, packId);
   if (!pack) {
-    throw new HTTPException17(404, { message: "pack not found" });
+    throw new HTTPException18(404, { message: "pack not found" });
   }
   return pack;
 }
@@ -11093,7 +11856,7 @@ async function resolveSocialConnections(db, workspaceId, connectionIds) {
     ids.map(async (id) => {
       const connection = await getSocialConnection(db, workspaceId, id);
       if (!connection) {
-        throw new HTTPException17(422, { message: `unknown social connection: ${id}` });
+        throw new HTTPException18(422, { message: `unknown social connection: ${id}` });
       }
       return connection;
     })
@@ -11102,7 +11865,7 @@ async function resolveSocialConnections(db, workspaceId, connectionIds) {
   );
   const inactive = connections.find((connection) => connection.status !== "connected");
   if (inactive) {
-    throw new HTTPException17(422, {
+    throw new HTTPException18(422, {
       message: `social connection ${inactive.id} is ${inactive.status}`
     });
   }
@@ -11112,7 +11875,7 @@ async function validateDocumentBaseIds(db, workspaceId, documentBaseIds) {
   for (const baseId of [...new Set(documentBaseIds)]) {
     const base = await getDocumentBase2(db, workspaceId, baseId);
     if (!base) {
-      throw new HTTPException17(422, { message: `unknown document base: ${baseId}` });
+      throw new HTTPException18(422, { message: `unknown document base: ${baseId}` });
     }
   }
 }
@@ -11130,7 +11893,7 @@ import {
   RigChangeAlreadyVerifyingError as RigChangeAlreadyVerifyingError2,
   RigChangeTransitionError as RigChangeTransitionError2
 } from "@opengeni/db";
-import { HTTPException as HTTPException18 } from "hono/http-exception";
+import { HTTPException as HTTPException19 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant12 } from "@opengeni/core";
 import {
   activateRigVersionForApi,
@@ -11154,7 +11917,7 @@ function registerRigRoutes(app, deps) {
       change = await beginRigChangeVerificationAttempt2(db, workspaceId, changeId, { startedAt });
     } catch (error) {
       if (error instanceof RigChangeAlreadyVerifyingError2 || error instanceof RigChangeTransitionError2) {
-        throw new HTTPException18(409, { message: error.message });
+        throw new HTTPException19(409, { message: error.message });
       }
       throw error;
     }
@@ -11491,8 +12254,8 @@ import {
   clearSessionContext,
   getOpenPtySession,
   getRetainedProcess,
-  getSandbox as getSandbox2,
-  getSession as getSession4,
+  getSandbox as getSandbox3,
+  getSession as getSession5,
   getSessionForSubject,
   getSessionGoal as getSessionGoal2,
   getSessionHumanInputRequest,
@@ -11551,17 +12314,21 @@ import { githubAppBotIdentity as githubAppBotIdentity2 } from "@opengeni/github"
 import {
   acquireLease as acquireLease2,
   getSandboxSessionEnvelope as getSandboxSessionEnvelope2,
+  getSandbox as getSandbox2,
   loadWorkspaceEnvironmentForRun as loadWorkspaceEnvironmentForRun2,
   markWarmLeaseInstanceLost as markWarmLeaseInstanceLost2,
+  readActiveSandbox as readActiveSandbox2,
   readLease as readLease3,
   releaseLeaseHolder as releaseLeaseHolder2
 } from "@opengeni/db";
 import { appendAndPublishEvents as appendAndPublishEvents4 } from "@opengeni/events";
-import { HTTPException as HTTPException19 } from "hono/http-exception";
+import { HTTPException as HTTPException20 } from "hono/http-exception";
 import {
+  buildSelfhostedBackendSession,
   establishSandboxSessionFromEnvelope as establishSandboxSessionFromEnvelope3,
   isProviderSandboxNotFoundError as isProviderSandboxNotFoundError3,
   SandboxChannelAService,
+  NatsControlRpc as NatsControlRpc3,
   ChannelAConflictError,
   ChannelANotFoundError,
   ChannelAUnsupportedError,
@@ -11571,17 +12338,112 @@ import {
   withToolspaceTokenSession,
   withRunCredentialsSession
 } from "@opengeni/runtime/sandbox";
-import { wrapChannelABoxWithRouting } from "@opengeni/core";
+import { relayConfigFromSettings as relayConfigFromSettings3, wrapChannelABoxWithRouting } from "@opengeni/core";
 async function withChannelA(services, ctx, fn) {
   const { db, settings, bus } = services;
   const { accountId, workspaceId, session } = ctx;
   if (session.sandboxBackend === "none") {
-    throw new HTTPException19(409, { message: "sandbox not available" });
+    throw new HTTPException20(409, { message: "sandbox not available" });
   }
   const sandboxGroupId = session.sandboxGroupId;
   const requestId = crypto.randomUUID();
   const holderId = `direct:${requestId}`;
   const leaseTtlMs = settings.sandboxLeaseTtlMs;
+  const workspaceEnvironment = await loadWorkspaceEnvironmentForRun2(
+    db,
+    settings,
+    workspaceId,
+    session.environmentId
+  );
+  const settingsForSession = session.sandboxBackend !== settings.sandboxBackend ? { ...settings, sandboxBackend: session.sandboxBackend } : settings;
+  const environment = stableSandboxEnvironmentForRun2(
+    settingsForSession,
+    workspaceEnvironment?.values ?? {},
+    { workspaceId }
+  );
+  if (hasGitCredentialRepositorySelection2(session.resources)) {
+    applyGitAuthPointerEnvironment2(
+      environment,
+      hasGitHubRepositorySelection2(session.resources) ? githubAppBotIdentity2(settings) : null
+    );
+  }
+  const runEstablished = async (routed, lease) => {
+    const emit = async (events) => {
+      await appendAndPublishEvents4(
+        db,
+        bus,
+        workspaceId,
+        session.id,
+        events.map((e) => ({ type: e.type, payload: e.payload }))
+      );
+    };
+    const routingSession = routed.session;
+    const credentialSession = withRunCredentialsSession(routingSession, session.id);
+    const scopedSession = environment.OPENGENI_TOOLSPACE_TOKEN_FILE ? withToolspaceTokenSession(
+      credentialSession,
+      toolspaceTokenFileFromEnvironment(environment, session.id)
+    ) : credentialSession;
+    const service = new SandboxChannelAService({
+      session: scopedSession,
+      leaseEpoch: lease?.leaseEpoch ?? session.activeEpoch,
+      emit
+    });
+    return await fn({ service, lease, routingSession, requestId });
+  };
+  if (session.sandboxBackend === "selfhosted") {
+    let established2;
+    try {
+      const pointer = await readActiveSandbox2(db, workspaceId, session.id);
+      if (!pointer?.activeSandboxId) {
+        throw new HTTPException20(409, {
+          message: "machine-home session has no active Connected Machine"
+        });
+      }
+      const sandbox = await getSandbox2(db, workspaceId, pointer.activeSandboxId);
+      if (sandbox?.kind !== "selfhosted" || !sandbox.enrollmentId) {
+        throw new HTTPException20(409, {
+          message: "machine-home session points to an unavailable Connected Machine"
+        });
+      }
+      const built = await buildSelfhostedBackendSession({
+        workspaceId,
+        agentId: sandbox.enrollmentId,
+        relay: relayConfigFromSettings3(settings),
+        controlRpcFactory: () => new NatsControlRpc3(async () => bus.getRequestConnection()),
+        epoch: pointer.activeEpoch,
+        environment,
+        workingDir: pointer.workingDir,
+        timeoutMs: settings.sandboxSelfhostedControlTimeoutMs,
+        execTimeoutMs: settings.sandboxSelfhostedExecTimeoutMs
+      });
+      established2 = {
+        client: built.client,
+        session: built.session,
+        sessionState: { agentId: sandbox.enrollmentId },
+        instanceId: sandbox.enrollmentId,
+        backendId: "selfhosted"
+      };
+      const routed = wrapChannelABoxWithRouting(
+        { db, settings, bus },
+        {
+          accountId,
+          workspaceId,
+          sessionId: session.id,
+          pinnedSelfhosted: {
+            sandboxId: sandbox.id,
+            epoch: pointer.activeEpoch
+          },
+          directRequest: { requestId, holderId }
+        },
+        established2
+      );
+      return await runEstablished(routed, null);
+    } catch (error) {
+      throw mapChannelAError(error);
+    } finally {
+      await dropEstablishedHandle2(established2);
+    }
+  }
   const release = async () => {
     await releaseLeaseHolder2(db, {
       accountId,
@@ -11606,13 +12468,13 @@ async function withChannelA(services, ctx, fn) {
   });
   if (acquired.role === "blocked") {
     await release();
-    throw new HTTPException19(409, {
+    throw new HTTPException20(409, {
       message: `sandbox recovery ${acquired.lease.recovery.restore.status} at epoch ${acquired.lease.leaseEpoch}`
     });
   }
   if (acquired.role === "fenced") {
     await release();
-    throw new HTTPException19(409, {
+    throw new HTTPException20(409, {
       message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); retry`
     });
   }
@@ -11620,24 +12482,6 @@ async function withChannelA(services, ctx, fn) {
   let leaseSnapshot = acquired.lease;
   try {
     const envelope = await getSandboxSessionEnvelope2(db, workspaceId, session.id);
-    const workspaceEnvironment = await loadWorkspaceEnvironmentForRun2(
-      db,
-      settings,
-      workspaceId,
-      session.environmentId
-    );
-    const settingsForSession = session.sandboxBackend !== settings.sandboxBackend ? { ...settings, sandboxBackend: session.sandboxBackend } : settings;
-    const environment = stableSandboxEnvironmentForRun2(
-      settingsForSession,
-      workspaceEnvironment?.values ?? {},
-      { workspaceId }
-    );
-    if (hasGitCredentialRepositorySelection2(session.resources)) {
-      applyGitAuthPointerEnvironment2(
-        environment,
-        hasGitHubRepositorySelection2(session.resources) ? githubAppBotIdentity2(settings) : null
-      );
-    }
     if (acquired.role === "spawner") {
       const expectedEpoch = acquired.lease.leaseEpoch;
       try {
@@ -11658,14 +12502,14 @@ async function withChannelA(services, ctx, fn) {
         established = result.established;
         leaseSnapshot = result.lease;
       } catch (error) {
-        throw new HTTPException19(409, {
+        throw new HTTPException20(409, {
           message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})`
         });
       }
     } else {
       const live = await readLease3(db, workspaceId, sandboxGroupId);
       if (!live || live.liveness !== "warm" || live.leaseEpoch !== acquired.lease.leaseEpoch || live.instanceId === null) {
-        throw new HTTPException19(409, {
+        throw new HTTPException20(409, {
           message: `sandbox lease is not attachable; retry`
         });
       }
@@ -11696,23 +12540,12 @@ async function withChannelA(services, ctx, fn) {
             }
           ]);
         }
-        throw new HTTPException19(409, {
+        throw new HTTPException20(409, {
           message: `sandbox instance was lost; retry to restore it`
         });
       }
     }
-    const emit = async (events) => {
-      await appendAndPublishEvents4(
-        db,
-        bus,
-        workspaceId,
-        session.id,
-        // SessionEventType is a string enum at the contract; the producer parses
-        // the payload, so this cast is the same shape the worker emits.
-        events.map((e) => ({ type: e.type, payload: e.payload }))
-      );
-    };
-    const routedSession = wrapChannelABoxWithRouting(
+    const routed = wrapChannelABoxWithRouting(
       { db, settings, bus },
       {
         accountId,
@@ -11727,18 +12560,8 @@ async function withChannelA(services, ctx, fn) {
         directRequest: { requestId, holderId }
       },
       established
-    ).session;
-    const credentialSession = withRunCredentialsSession(routedSession, session.id);
-    const scopedSession = environment.OPENGENI_TOOLSPACE_TOKEN_FILE ? withToolspaceTokenSession(
-      credentialSession,
-      toolspaceTokenFileFromEnvironment(environment, session.id)
-    ) : credentialSession;
-    const service = new SandboxChannelAService({
-      session: scopedSession,
-      leaseEpoch: leaseSnapshot.leaseEpoch,
-      emit
-    });
-    return await fn({ service, lease: leaseSnapshot, routingSession: routedSession, requestId });
+    );
+    return await runEstablished(routed, leaseSnapshot);
   } catch (error) {
     throw mapChannelAError(error);
   } finally {
@@ -11747,17 +12570,17 @@ async function withChannelA(services, ctx, fn) {
   }
 }
 function mapChannelAError(error) {
-  if (error instanceof HTTPException19) return error;
+  if (error instanceof HTTPException20) return error;
   if (error instanceof ChannelAUnavailableError)
-    return new HTTPException19(503, { message: error.message });
+    return new HTTPException20(503, { message: error.message });
   if (error instanceof ChannelAValidationError)
-    return new HTTPException19(400, { message: error.message });
+    return new HTTPException20(400, { message: error.message });
   if (error instanceof ChannelANotFoundError)
-    return new HTTPException19(404, { message: error.message });
+    return new HTTPException20(404, { message: error.message });
   if (error instanceof ChannelAConflictError)
-    return new HTTPException19(409, { message: error.message });
+    return new HTTPException20(409, { message: error.message });
   if (error instanceof ChannelAUnsupportedError)
-    return new HTTPException19(409, { message: error.message });
+    return new HTTPException20(409, { message: error.message });
   return error;
 }
 async function dropEstablishedHandle2(established) {
@@ -11766,7 +12589,7 @@ async function dropEstablishedHandle2(established) {
 
 // src/routes/sessions.ts
 import { negotiateCapabilities } from "@opengeni/runtime/sandbox";
-import { HTTPException as HTTPException21 } from "hono/http-exception";
+import { HTTPException as HTTPException22 } from "hono/http-exception";
 import {
   requireAccessGrant as requireAccessGrant14,
   requireSessionAuthorization as requireSessionAuthorization2,
@@ -12276,7 +13099,7 @@ import {
   WorkspaceCaptureManifest,
   WorkspaceCaptureStats
 } from "@opengeni/contracts";
-import { HTTPException as HTTPException20 } from "hono/http-exception";
+import { HTTPException as HTTPException21 } from "hono/http-exception";
 var CAPTURE_INLINE_MANIFEST_MAX_BYTES = 2 * 1024 * 1024;
 var CAPTURE_INLINE_FILE_MAX_BYTES = 256 * 1024;
 var CAPTURE_SIGNED_URL_TTL_SECONDS = 300;
@@ -12371,15 +13194,15 @@ async function serveWorkspaceCapture(row, storage) {
 async function serveWorkspaceCaptureFile(row, path, storage) {
   const loaded = row ? await loadManifest(row, storage) : null;
   if (!loaded) {
-    throw new HTTPException20(404, { message: "capture not found" });
+    throw new HTTPException21(404, { message: "capture not found" });
   }
   const { manifest } = loaded;
   const file = manifest.files.find((f) => f.path === path);
   if (!file) {
-    throw new HTTPException20(404, { message: "path not in capture" });
+    throw new HTTPException21(404, { message: "path not in capture" });
   }
   if (file.deleted) {
-    throw new HTTPException20(404, { message: "file was deleted" });
+    throw new HTTPException21(404, { message: "file was deleted" });
   }
   const base = {
     path: file.path,
@@ -12442,6 +13265,11 @@ function registerSessionRoutes(app, deps) {
     routeEpoch: pty.routeEpoch
   });
   const adoptPtyProcess = async (ctx, handle, pty) => {
+    if (!handle.lease) {
+      throw new HTTPException22(409, {
+        message: "durable interactive terminals require a session-home provider lease"
+      });
+    }
     const process = await getRetainedProcess(db, {
       workspaceId: ctx.workspaceId,
       sessionId: ctx.session.id,
@@ -12450,7 +13278,7 @@ function registerSessionRoutes(app, deps) {
     if (!process || process.state !== "active" || process.ownerActorKind !== "direct" || process.accountId !== ctx.accountId || process.leaseId !== pty.leaseId || process.sandboxGroupId !== pty.sandboxGroupId || process.parentAdmissionId !== pty.openAdmissionId || process.leaseEpoch !== pty.leaseEpoch || process.providerBackend !== pty.providerBackend || process.providerInstanceId !== pty.providerInstanceId || process.routeKind !== pty.routeKind || process.routeTargetId !== pty.routeTargetId || process.routeEpoch !== pty.routeEpoch || process.providerSessionId !== pty.execSessionId || // Only a persistable home backend can currently be reconstructed by an
     // API request without consulting the mutable active pointer.
     process.routeTargetId !== null || handle.lease.id !== process.leaseId || handle.lease.sandboxGroupId !== process.sandboxGroupId || handle.lease.leaseEpoch !== process.leaseEpoch || handle.lease.backend !== process.providerBackend || handle.lease.instanceId !== process.providerInstanceId) {
-      throw new HTTPException21(409, {
+      throw new HTTPException22(409, {
         message: "pty retained-process identity is stale; reopen the terminal"
       });
     }
@@ -12643,17 +13471,17 @@ function registerSessionRoutes(app, deps) {
       });
     } catch (error) {
       if (error instanceof SessionListAccessError) {
-        throw new HTTPException21(403, { message: error.message });
+        throw new HTTPException22(403, { message: error.message });
       }
       if (error instanceof SessionListCursorExpiredError) {
-        throw new HTTPException21(410, { message: error.message });
+        throw new HTTPException22(410, { message: error.message });
       }
       if (error instanceof SessionListCursorError) {
-        throw new HTTPException21(400, { message: error.message });
+        throw new HTTPException22(400, { message: error.message });
       }
       if (error instanceof SessionListSnapshotLimitError) {
         c.header("Retry-After", "5");
-        throw new HTTPException21(429, { message: error.message });
+        throw new HTTPException22(429, { message: error.message });
       }
       throw error;
     }
@@ -12678,7 +13506,7 @@ function registerSessionRoutes(app, deps) {
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
     if (!z3.string().uuid().safeParse(sessionId).success) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     const session = await getSessionForSubject(
       db,
@@ -12688,7 +13516,7 @@ function registerSessionRoutes(app, deps) {
       relatedSessionAccessFor(c)
     );
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     return c.json(await withEffectivePolicy(deps, workspaceId, session));
   });
@@ -12697,11 +13525,11 @@ function registerSessionRoutes(app, deps) {
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
     if (!z3.string().uuid().safeParse(sessionId).success) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     const parsed = UpdateSessionPinRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException21(400, { message: "invalid session pin request" });
+      throw new HTTPException22(400, { message: "invalid session pin request" });
     }
     try {
       const session = await setSessionPin(db, {
@@ -12711,7 +13539,7 @@ function registerSessionRoutes(app, deps) {
         ...parsed.data
       });
       if (!session) {
-        throw new HTTPException21(404, { message: "session not found" });
+        throw new HTTPException22(404, { message: "session not found" });
       }
       return c.json(
         await withEffectivePolicy(
@@ -12722,7 +13550,7 @@ function registerSessionRoutes(app, deps) {
       );
     } catch (error) {
       if (error instanceof SessionPinAccessError) {
-        throw new HTTPException21(403, { message: error.message });
+        throw new HTTPException22(403, { message: error.message });
       }
       if (error instanceof SessionPinVersionConflictError) {
         return c.json(
@@ -12760,7 +13588,7 @@ function registerSessionRoutes(app, deps) {
     const body = await c.req.json();
     const target = typeof body.target === "string" ? body.target : "";
     if (!target) {
-      throw new HTTPException21(400, {
+      throw new HTTPException22(400, {
         message: 'target is required ("auto" or an account id)'
       });
     }
@@ -12775,7 +13603,7 @@ function registerSessionRoutes(app, deps) {
     );
     const ok = mutation.result;
     if (!ok) {
-      throw new HTTPException21(404, {
+      throw new HTTPException22(404, {
         message: "session or codex account not found"
       });
     }
@@ -12814,7 +13642,7 @@ function registerSessionRoutes(app, deps) {
       titleUpdate.relatedSessionAccess
     );
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     return c.json(await withEffectivePolicy(deps, workspaceId, session));
   });
@@ -12829,7 +13657,7 @@ function registerSessionRoutes(app, deps) {
         await c.req.json().catch(() => null)
       );
       if (!parsedServerId.success || !payload.success) {
-        throw new HTTPException21(400, { message: "invalid MCP approval-policy request" });
+        throw new HTTPException22(400, { message: "invalid MCP approval-policy request" });
       }
       await assertSessionExists(db, workspaceId, sessionId);
       return c.json(
@@ -12872,7 +13700,7 @@ function registerSessionRoutes(app, deps) {
     await assertSessionExists(db, workspaceId, sessionId);
     const goal = await getSessionGoalWithContinuation(db, workspaceId, sessionId);
     if (!goal) {
-      throw new HTTPException21(404, { message: "session goal not found" });
+      throw new HTTPException22(404, { message: "session goal not found" });
     }
     return c.json(goal);
   });
@@ -12884,10 +13712,10 @@ function registerSessionRoutes(app, deps) {
     const payload = UpdateSessionGoalRequest.parse(await c.req.json());
     const existing = await getSessionGoal2(db, workspaceId, sessionId);
     if (!existing) {
-      throw new HTTPException21(404, { message: "session goal not found" });
+      throw new HTTPException22(404, { message: "session goal not found" });
     }
     if (existing.status === "completed") {
-      throw new HTTPException21(409, {
+      throw new HTTPException22(409, {
         message: "session goal is completed; set a new goal instead"
       });
     }
@@ -12909,7 +13737,7 @@ function registerSessionRoutes(app, deps) {
       return c.json(await getSessionGoalWithContinuation(db, workspaceId, sessionId) ?? goal2);
     }
     if (existing.status !== "paused") {
-      throw new HTTPException21(409, {
+      throw new HTTPException22(409, {
         message: `session goal is ${existing.status}; only paused goals can be resumed`
       });
     }
@@ -12963,7 +13791,7 @@ function registerSessionRoutes(app, deps) {
     await assertSessionExists(db, workspaceId, sessionId);
     const clearBody = ClearSessionContextRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!clearBody.success) {
-      throw new HTTPException21(400, {
+      throw new HTTPException22(400, {
         message: "context clear requires an explicit { confirm: true }"
       });
     }
@@ -12973,7 +13801,7 @@ function registerSessionRoutes(app, deps) {
       sessionId
     }).catch((error) => {
       if (error instanceof SessionContextBusyError) {
-        throw new HTTPException21(409, { message: error.message });
+        throw new HTTPException22(409, { message: error.message });
       }
       throw error;
     });
@@ -13039,14 +13867,14 @@ function registerSessionRoutes(app, deps) {
       "events"
     );
     if (resultMode === "compact" && latestClass === void 0) {
-      throw new HTTPException21(400, {
+      throw new HTTPException22(400, {
         message: "resultMode=compact requires latest"
       });
     }
     if (latestClass && ["includeTypes", "excludeTypes", "includeClasses", "excludeClasses"].some(
       (name) => c.req.query(name) !== void 0
     )) {
-      throw new HTTPException21(400, {
+      throw new HTTPException22(400, {
         message: "latest cannot be combined with event filters"
       });
     }
@@ -13199,7 +14027,7 @@ function registerSessionRoutes(app, deps) {
     await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     const sessionId = c.req.param("sessionId");
     const snapshot = await getSessionQueueSnapshot2(db, workspaceId, sessionId);
-    if (!snapshot) throw new HTTPException21(404, { message: "session not found" });
+    if (!snapshot) throw new HTTPException22(404, { message: "session not found" });
     return c.json(projectQueueSnapshot(snapshot, sessionId, relatedSessionAccessFor(c)));
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/queue/:turnId/move", async (c) => {
@@ -13345,12 +14173,12 @@ function registerSessionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
     if (workspaceControlUtf8Bytes(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES) {
-      throw new HTTPException21(400, { message: "workspace-control actor is too large" });
+      throw new HTTPException22(400, { message: "workspace-control actor is too large" });
     }
     const sessionId = c.req.param("sessionId");
     const parsed = SessionControlRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException21(400, { message: "invalid session control request" });
+      throw new HTTPException22(400, { message: "invalid session control request" });
     }
     try {
       const response = await controlHumanSessionWorkstream2(
@@ -13442,7 +14270,7 @@ function registerSessionRoutes(app, deps) {
         clientEventId: event.clientEventId ?? null
       });
       if (accepted.action === "conflict") {
-        throw new HTTPException21(409, {
+        throw new HTTPException22(409, {
           message: `session is ${accepted.sessionStatus}; no unhandled approval is pending`
         });
       }
@@ -13472,14 +14300,14 @@ function registerSessionRoutes(app, deps) {
         });
       } catch (error) {
         if (error instanceof HumanInputResponseValidationError) {
-          throw new HTTPException21(error.code === "SKIP_NOT_ALLOWED" ? 409 : 422, {
+          throw new HTTPException22(error.code === "SKIP_NOT_ALLOWED" ? 409 : 422, {
             message: error.message
           });
         }
         throw error;
       }
       if (accepted.action === "not_found") {
-        throw new HTTPException21(404, { message: "human-input request not found" });
+        throw new HTTPException22(404, { message: "human-input request not found" });
       }
       await publishDurableSessionEvents2(bus, workspaceId, sessionId, accepted.events);
       if (accepted.workflowWakeRevision !== null) {
@@ -13493,7 +14321,7 @@ function registerSessionRoutes(app, deps) {
         });
       }
       if (accepted.action === "conflict") {
-        throw new HTTPException21(409, {
+        throw new HTTPException22(409, {
           message: `human-input request is ${accepted.request.status}`
         });
       }
@@ -13508,7 +14336,7 @@ function registerSessionRoutes(app, deps) {
     const rawStatus = c.req.query("status");
     const status = rawStatus ? HumanInputRequestStatus.safeParse(rawStatus) : null;
     if (status && !status.success) {
-      throw new HTTPException21(400, { message: "invalid human-input request status" });
+      throw new HTTPException22(400, { message: "invalid human-input request status" });
     }
     const requests = await listSessionHumanInputRequests(db, workspaceId, sessionId, {
       ...status?.success ? { status: status.data } : {}
@@ -13527,13 +14355,13 @@ function registerSessionRoutes(app, deps) {
         sessionId,
         c.req.param("requestId")
       );
-      if (!request) throw new HTTPException21(404, { message: "human-input request not found" });
+      if (!request) throw new HTTPException22(404, { message: "human-input request not found" });
       return c.json(request);
     }
   );
   function assertOwnershipEnabled() {
     if (!settings.sandboxOwnershipEnabled) {
-      throw new HTTPException21(404, {
+      throw new HTTPException22(404, {
         message: "sandbox ownership is not enabled for this deployment"
       });
     }
@@ -13548,9 +14376,9 @@ function registerSessionRoutes(app, deps) {
     const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:read");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
-    const session = await getSession4(db, workspaceId, sessionId);
+    const session = await getSession5(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     const lease = await readGroupLease(
       { db, settings },
@@ -13646,7 +14474,7 @@ function registerSessionRoutes(app, deps) {
     });
     let responseCapabilities = capabilities;
     if (capabilities.DesktopStream.transport !== null) {
-      const activeSandbox = session.activeSandboxId ? await getSandbox2(db, workspaceId, session.activeSandboxId) : null;
+      const activeSandbox = session.activeSandboxId ? await getSandbox3(db, workspaceId, session.activeSandboxId) : null;
       const wire = resolveActiveDesktopTransport(
         activeSandbox?.kind === "selfhosted",
         settings.sandboxDesktopInteractive !== false
@@ -13665,13 +14493,13 @@ function registerSessionRoutes(app, deps) {
       const grant = await requireAccessGrant14(c, deps, workspaceId, "stream:acknowledge");
       assertOwnershipEnabled();
       const sessionId = c.req.param("sessionId");
-      const session = await getSession4(db, workspaceId, sessionId);
+      const session = await getSession5(db, workspaceId, sessionId);
       if (!session) {
-        throw new HTTPException21(404, { message: "session not found" });
+        throw new HTTPException22(404, { message: "session not found" });
       }
       const parsed = AcknowledgeStreamRequest.safeParse(await c.req.json().catch(() => ({})));
       if (!parsed.success) {
-        throw new HTTPException21(400, {
+        throw new HTTPException22(400, {
           message: "invalid stream acknowledgment request"
         });
       }
@@ -13694,13 +14522,13 @@ function registerSessionRoutes(app, deps) {
     const grant = await requireAccessGrant14(c, deps, workspaceId, "stream:view");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
-    const session = await getSession4(db, workspaceId, sessionId);
+    const session = await getSession5(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     const parsed = AttachViewerRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException21(400, {
+      throw new HTTPException22(400, {
         message: "invalid viewer attach request"
       });
     }
@@ -13713,17 +14541,17 @@ function registerSessionRoutes(app, deps) {
         subjectId: grant.subjectId
       });
       if (!ack?.acknowledgedUnredacted) {
-        throw new HTTPException21(409, {
+        throw new HTTPException22(409, {
           message: "stream_acknowledgment_required"
         });
       }
       if (shared && !ack.acknowledgedShared) {
-        throw new HTTPException21(409, {
+        throw new HTTPException22(409, {
           message: "shared_acknowledgment_required"
         });
       }
     }
-    const activeSandbox = session.activeSandboxId ? await getSandbox2(db, workspaceId, session.activeSandboxId) : null;
+    const activeSandbox = session.activeSandboxId ? await getSandbox3(db, workspaceId, session.activeSandboxId) : null;
     const selfhostedActive = activeSandbox?.kind === "selfhosted";
     let stream = null;
     let terminal = null;
@@ -13825,13 +14653,13 @@ function registerSessionRoutes(app, deps) {
       const grant = await requireAccessGrant14(c, deps, workspaceId, "stream:view");
       assertOwnershipEnabled();
       const sessionId = c.req.param("sessionId");
-      const session = await getSession4(db, workspaceId, sessionId);
+      const session = await getSession5(db, workspaceId, sessionId);
       if (!session) {
-        throw new HTTPException21(404, { message: "session not found" });
+        throw new HTTPException22(404, { message: "session not found" });
       }
       const parsed = ViewerHeartbeatRequest.safeParse(await c.req.json().catch(() => ({})));
       if (!parsed.success) {
-        throw new HTTPException21(400, {
+        throw new HTTPException22(400, {
           message: "viewer heartbeat requires { leaseEpoch }"
         });
       }
@@ -13853,9 +14681,9 @@ function registerSessionRoutes(app, deps) {
     const grant = await requireAccessGrant14(c, deps, workspaceId, "stream:view");
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId");
-    const session = await getSession4(db, workspaceId, sessionId);
+    const session = await getSession5(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     await detachViewer(
       { db, settings },
@@ -13875,9 +14703,9 @@ function registerSessionRoutes(app, deps) {
       const grant = await requireAccessGrant14(c, deps, workspaceId, "stream:view");
       assertOwnershipEnabled();
       const sessionId = c.req.param("sessionId");
-      const session = await getSession4(db, workspaceId, sessionId);
+      const session = await getSession5(db, workspaceId, sessionId);
       if (!session) {
-        throw new HTTPException21(404, { message: "session not found" });
+        throw new HTTPException22(404, { message: "session not found" });
       }
       const result = await revokeViewer(db, {
         accountId: grant.accountId,
@@ -13897,9 +14725,9 @@ function registerSessionRoutes(app, deps) {
     const grant = await requireAccessGrant14(c, deps, workspaceId, permission);
     assertOwnershipEnabled();
     const sessionId = c.req.param("sessionId") ?? "";
-    const session = await getSession4(db, workspaceId, sessionId);
+    const session = await getSession5(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     return {
       accountId: grant.accountId,
@@ -13912,7 +14740,7 @@ function registerSessionRoutes(app, deps) {
     const raw = await c.req.json().catch(() => void 0);
     const result = schema.safeParse(raw ?? {});
     if (!result.success) {
-      throw new HTTPException21(400, { message: "invalid request body" });
+      throw new HTTPException22(400, { message: "invalid request body" });
     }
     return result.data;
   }
@@ -14020,9 +14848,9 @@ function registerSessionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId") ?? "";
     await requireAccessGrant14(c, deps, workspaceId, "files:read");
     const sessionId = c.req.param("sessionId") ?? "";
-    const session = await getSession4(db, workspaceId, sessionId);
+    const session = await getSession5(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     if (!objectStorage) {
       return c.json({ available: false });
@@ -14036,23 +14864,23 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId") ?? "";
     const path = c.req.query("path");
     if (!path) {
-      throw new HTTPException21(400, {
+      throw new HTTPException22(400, {
         message: "path query parameter is required"
       });
     }
-    const session = await getSession4(db, workspaceId, sessionId);
+    const session = await getSession5(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException21(404, { message: "session not found" });
+      throw new HTTPException22(404, { message: "session not found" });
     }
     if (!objectStorage) {
-      throw new HTTPException21(404, { message: "capture not found" });
+      throw new HTTPException22(404, { message: "capture not found" });
     }
     const revisionParam = c.req.query("revision");
     let row;
     if (revisionParam !== void 0 && revisionParam !== "") {
       const revision = Number(revisionParam);
       if (!Number.isInteger(revision) || revision < 0) {
-        throw new HTTPException21(400, {
+        throw new HTTPException22(400, {
           message: "revision must be a non-negative integer"
         });
       }
@@ -14076,12 +14904,17 @@ function registerSessionRoutes(app, deps) {
     const ctx = await channelAPreamble(c, "terminal:attach");
     const req = await parseChannelABody(c, PtyOpenRequest);
     if (ctx.session.sandboxBackend === "selfhosted" || ctx.session.activeSandboxId !== null) {
-      throw new HTTPException21(409, {
+      throw new HTTPException22(409, {
         message: "durable interactive terminals require the session-home provider route and are unavailable on active swaps or non-persistable routes; use synchronous exec or attach the session home sandbox"
       });
     }
     const ptyId = crypto.randomUUID();
     const out = await withChannelA({ db, settings, bus }, ctx, async (handle) => {
+      if (!handle.lease) {
+        throw new HTTPException22(409, {
+          message: "durable interactive terminals require a session-home provider lease"
+        });
+      }
       const { service } = handle;
       const opened = await service.ptyOpen(req, ptyId);
       const execSessionId = opened.execSessionId;
@@ -14095,7 +14928,7 @@ function registerSessionRoutes(app, deps) {
         if (execSessionId !== null && handle.routingSession.hasRetainedProcess(execSessionId)) {
           await drainOpenedPty(handle, execSessionId);
         }
-        throw new HTTPException21(409, {
+        throw new HTTPException22(409, {
           message: "interactive terminal did not acquire durable process authority"
         });
       }
@@ -14164,7 +14997,7 @@ function registerSessionRoutes(app, deps) {
       ptyId: req.ptyId
     });
     if (!pty) {
-      throw new HTTPException21(404, { message: "pty not found or closed" });
+      throw new HTTPException22(404, { message: "pty not found or closed" });
     }
     let seq = 1;
     await withChannelA({ db, settings, bus }, ctx, async (handle) => {
@@ -14200,7 +15033,7 @@ function registerSessionRoutes(app, deps) {
           await emitPtyExited(ctx, req.ptyId, terminal);
           return;
         }
-        throw new HTTPException21(409, {
+        throw new HTTPException22(409, {
           message: "pty identity changed while input was in flight; reopen the terminal"
         });
       }
@@ -14227,7 +15060,7 @@ function registerSessionRoutes(app, deps) {
       ptyId: req.ptyId
     });
     if (!pty) {
-      throw new HTTPException21(404, { message: "pty not found or closed" });
+      throw new HTTPException22(404, { message: "pty not found or closed" });
     }
     await withChannelA({ db, settings, bus }, ctx, async (handle) => {
       await adoptPtyProcess(ctx, handle, pty);
@@ -14242,7 +15075,7 @@ function registerSessionRoutes(app, deps) {
         rows: req.rows
       });
       if (!updated) {
-        throw new HTTPException21(409, {
+        throw new HTTPException22(409, {
           message: "pty identity changed while resize was in flight; reopen the terminal"
         });
       }
@@ -14267,7 +15100,7 @@ function registerSessionRoutes(app, deps) {
           processId: pty.retainedProcessId
         });
         if (!terminal || terminal.state === "active") {
-          throw new HTTPException21(409, {
+          throw new HTTPException22(409, {
             message: "pty close is pending exact provider exit proof; retry"
           });
         }
@@ -14359,19 +15192,19 @@ function sessionAuthorizationOperationForHttp(method, pathname, sessionId) {
 }
 function sessionAuthorizationHttpError(error) {
   if (error instanceof SessionAuthorizationDeniedError) {
-    return new HTTPException21(404, { message: "session not found" });
+    return new HTTPException22(404, { message: "session not found" });
   }
   if (error instanceof SessionAuthorizationUnavailableError) {
-    return new HTTPException21(503, { message: "session authorization is unavailable" });
+    return new HTTPException22(503, { message: "session authorization is unavailable" });
   }
-  if (error instanceof HTTPException21) return error;
+  if (error instanceof HTTPException22) return error;
   throw error;
 }
 function eventEnumValue(raw, schema, name, fallback) {
   if (raw === void 0) return fallback;
   const parsed = schema.safeParse(raw);
   if (!parsed.success) {
-    throw new HTTPException21(400, { message: `${name} is invalid` });
+    throw new HTTPException22(400, { message: `${name} is invalid` });
   }
   return parsed.data;
 }
@@ -14379,12 +15212,12 @@ function eventEnumList(raw, schema, name) {
   if (raw === void 0 || raw.trim() === "") return [];
   const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
   if (values.length > 100) {
-    throw new HTTPException21(400, { message: `${name} accepts at most 100 values` });
+    throw new HTTPException22(400, { message: `${name} accepts at most 100 values` });
   }
   return values.map((value) => {
     const parsed = schema.safeParse(value);
     if (!parsed.success) {
-      throw new HTTPException21(400, { message: `${name} contains an invalid value` });
+      throw new HTTPException22(400, { message: `${name} contains an invalid value` });
     }
     return parsed.data;
   });
@@ -14392,30 +15225,30 @@ function eventEnumList(raw, schema, name) {
 function sessionListQuery(query, allowCursor = true) {
   const parentSessionId = query.parentSessionId;
   if (parentSessionId !== void 0 && parentSessionId !== "null" && !z3.string().uuid().safeParse(parentSessionId).success) {
-    throw new HTTPException21(400, {
+    throw new HTTPException22(400, {
       message: 'parentSessionId must be a session id or the literal "null"'
     });
   }
   const rawCursor = allowCursor ? query.cursor : void 0;
   const cursor = rawCursor ? decodeSessionListCursor(rawCursor) : void 0;
   if (rawCursor && !cursor) {
-    throw new HTTPException21(400, { message: "cursor is invalid" });
+    throw new HTTPException22(400, { message: "cursor is invalid" });
   }
   const search = query.search?.trim();
   if (search && search.length > 200) {
-    throw new HTTPException21(400, {
+    throw new HTTPException22(400, {
       message: "search must be at most 200 characters"
     });
   }
   if (query.pinsOnly !== void 0 && query.pinsOnly !== "true") {
-    throw new HTTPException21(400, { message: 'pinsOnly must be the literal "true"' });
+    throw new HTTPException22(400, { message: 'pinsOnly must be the literal "true"' });
   }
   const pinsOnly = query.pinsOnly === "true";
   if (pinsOnly && !allowCursor) {
-    throw new HTTPException21(400, { message: 'pinsOnly requires view="page"' });
+    throw new HTTPException22(400, { message: 'pinsOnly requires view="page"' });
   }
   if (pinsOnly && (rawCursor || parentSessionId !== void 0 || search)) {
-    throw new HTTPException21(400, {
+    throw new HTTPException22(400, {
       message: "pinsOnly cannot be combined with cursor, parentSessionId, or search"
     });
   }
@@ -14475,7 +15308,7 @@ function sessionCreateErrorResponse(c, error) {
       422
     );
   }
-  if (error instanceof HTTPException21 && error.status === 422) {
+  if (error instanceof HTTPException22 && error.status === 422) {
     return c.json(
       {
         code: "SESSION_CREATE_REJECTED",
@@ -14546,7 +15379,7 @@ import {
   listSocialConnections as listSocialConnections3,
   listSocialPosts as listSocialPosts2
 } from "@opengeni/db";
-import { HTTPException as HTTPException22 } from "hono/http-exception";
+import { HTTPException as HTTPException23 } from "hono/http-exception";
 import { z as z5 } from "zod";
 import { requireAccessGrant as requireAccessGrant15 } from "@opengeni/core";
 function registerSocialRoutes(app, deps) {
@@ -14628,7 +15461,7 @@ function parseSince(raw) {
   }
   const since = new Date(raw);
   if (Number.isNaN(since.getTime())) {
-    throw new HTTPException22(422, { message: "since must be an ISO date-time" });
+    throw new HTTPException23(422, { message: "since must be an ISO date-time" });
   }
   return since;
 }
@@ -14639,7 +15472,7 @@ function parseConnectionIds(raw) {
   const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
   const parsed = z5.array(z5.string().uuid()).safeParse(values);
   if (!parsed.success) {
-    throw new HTTPException22(422, {
+    throw new HTTPException23(422, {
       message: "connectionIds must be a comma-separated list of UUIDs"
     });
   }
@@ -14649,12 +15482,12 @@ function parseConnectionIds(raw) {
 function socialHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException22(404, { message });
+    return new HTTPException23(404, { message });
   }
   if (message.includes("duplicate key")) {
-    return new HTTPException22(409, { message: "social connection or post already exists" });
+    return new HTTPException23(409, { message: "social connection or post already exists" });
   }
-  return new HTTPException22(500, { message });
+  return new HTTPException23(500, { message });
 }
 
 // src/routes/workspaces.ts
@@ -14697,7 +15530,7 @@ import {
   workspaceCodexSubscriptionActive
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
-import { HTTPException as HTTPException23 } from "hono/http-exception";
+import { HTTPException as HTTPException24 } from "hono/http-exception";
 import { hasPermission as hasPermission6, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
 import { requireLimit as requireLimit7 } from "@opengeni/core";
 import {
@@ -14965,7 +15798,7 @@ function registerWorkspaceRoutes(app, deps) {
     const payload = CreateWorkspaceRequest.parse(await c.req.json());
     const accountId = payload.accountId ?? context.defaultAccountId;
     if (!accountId) {
-      throw new HTTPException23(409, { message: "account selection is required" });
+      throw new HTTPException24(409, { message: "account selection is required" });
     }
     requireAccountPermission(context, accountId, "workspace:create");
     await requireLimit7(deps, { accountId, action: "workspace:create", quantity: 1 });
@@ -15008,7 +15841,7 @@ function registerWorkspaceRoutes(app, deps) {
     await requireAccessGrant16(c, deps, workspaceId, "workspace:admin");
     const parsed = UpdateWorkspaceSettingsRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException23(400, { message: "invalid workspace settings patch" });
+      throw new HTTPException24(400, { message: "invalid workspace settings patch" });
     }
     const workspace = await updateWorkspaceSettings(deps.db, workspaceId, parsed.data);
     return c.json(Workspace.parse(workspace));
@@ -15056,11 +15889,11 @@ function registerWorkspaceRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant16(c, deps, workspaceId, "workspace:admin");
     if (workspaceControlUtf8Bytes2(grant.subjectId) > WORKSPACE_CONTROL_ACTOR_MAX_BYTES2) {
-      throw new HTTPException23(400, { message: "workspace-control actor is too large" });
+      throw new HTTPException24(400, { message: "workspace-control actor is too large" });
     }
     const parsed = WorkspaceInferenceControlRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException23(400, { message: "invalid workspace inference-control request" });
+      throw new HTTPException24(400, { message: "invalid workspace inference-control request" });
     }
     return c.json(
       await controlHumanWorkspace(
@@ -15106,7 +15939,7 @@ function registerWorkspaceRoutes(app, deps) {
     if (payload.rigId) {
       const rig = await getRig(deps.db, workspaceId, payload.rigId);
       if (!rig) {
-        throw new HTTPException23(422, { message: `unknown rigId: ${payload.rigId}` });
+        throw new HTTPException24(422, { message: `unknown rigId: ${payload.rigId}` });
       }
     }
     const workspace = await setWorkspaceDefaultRig(deps.db, workspaceId, payload.rigId);
@@ -15152,7 +15985,7 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException23(500, { message: "failed to add member" });
+      throw new HTTPException24(500, { message: "failed to add member" });
     }
     return c.json(WorkspaceMember.parse(member), 201);
   });
@@ -15164,7 +15997,7 @@ function registerWorkspaceRoutes(app, deps) {
     const existing = await listWorkspaceMembers(deps.db, workspaceId);
     const current = existing.find((member2) => member2.subjectId === subjectId);
     if (!current) {
-      throw new HTTPException23(404, { message: "member not found" });
+      throw new HTTPException24(404, { message: "member not found" });
     }
     await grantWorkspaceAccess(deps.db, {
       accountId: grant.accountId,
@@ -15177,7 +16010,7 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException23(500, { message: "failed to update member" });
+      throw new HTTPException24(500, { message: "failed to update member" });
     }
     return c.json(WorkspaceMember.parse(member));
   });
@@ -15201,10 +16034,241 @@ function normalizeAgentInstructions(value) {
 function requireAccountPermission(context, accountId, permission) {
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException23(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException24(403, { message: `missing permission: ${permission}` });
   }
 }
 
+// src/routes/workspace-instruction-policies.ts
+import {
+  ActivateWorkspaceInstructionPolicyRequest,
+  CreateWorkspaceInstructionPolicyDraftRequest,
+  ImportLegacyWorkspaceInstructionPolicyDraftRequest,
+  RollbackWorkspaceInstructionPolicyRequest,
+  WorkspaceInstructionPolicyActivationResponse,
+  WorkspaceInstructionPolicyConflictResponse,
+  WorkspaceInstructionPolicyDiffRequest,
+  WorkspaceInstructionPolicyDiffResponse,
+  WorkspaceInstructionPolicyListQuery,
+  WorkspaceInstructionPolicyListResponse,
+  WorkspaceInstructionPolicyRevision
+} from "@opengeni/contracts";
+import { requireAccessGrant as requireAccessGrant17 } from "@opengeni/core";
+import {
+  activateWorkspaceInstructionPolicyRevision,
+  createWorkspaceInstructionPolicyDraft,
+  diffWorkspaceInstructionPolicyRevisions,
+  getWorkspaceInstructionPolicyRevision,
+  importLegacyWorkspaceInstructionPolicyDraft,
+  listWorkspaceInstructionPolicyRevisions,
+  rollbackWorkspaceInstructionPolicyRevision,
+  WorkspaceInstructionPolicyConflictError,
+  WorkspaceInstructionPolicyInvalidOperationError,
+  WorkspaceInstructionPolicyLegacyUnavailableError,
+  WorkspaceInstructionPolicyNotFoundError
+} from "@opengeni/db";
+import { HTTPException as HTTPException25 } from "hono/http-exception";
+import { z as z6 } from "zod";
+var WorkspaceInstructionPolicyRevisionId = z6.string().uuid();
+async function parseBody(context, schema) {
+  const parsed = schema.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) {
+    throw new HTTPException25(422, { message: "Invalid workspace instruction-policy request" });
+  }
+  return parsed.data;
+}
+function policyErrorResponse(context, error) {
+  if (error instanceof WorkspaceInstructionPolicyConflictError) {
+    return context.json(
+      WorkspaceInstructionPolicyConflictResponse.parse({
+        code: error.code,
+        message: error.message,
+        currentHead: error.currentHead
+      }),
+      409
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyNotFoundError) {
+    return context.json(
+      { code: "WORKSPACE_INSTRUCTION_POLICY_NOT_FOUND", message: error.message },
+      404
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyLegacyUnavailableError) {
+    return context.json(
+      { code: "WORKSPACE_INSTRUCTION_POLICY_LEGACY_UNAVAILABLE", message: error.message },
+      409
+    );
+  }
+  if (error instanceof WorkspaceInstructionPolicyInvalidOperationError) {
+    return context.json(
+      { code: "INVALID_WORKSPACE_INSTRUCTION_POLICY_OPERATION", message: error.message },
+      422
+    );
+  }
+  throw error;
+}
+function assertBoundedActor(subjectId) {
+  if (subjectId.trim().length < 1 || subjectId.length > 1024) {
+    throw new HTTPException25(400, { message: "Workspace instruction-policy actor is invalid" });
+  }
+}
+function parseRevisionId(context) {
+  const parsed = WorkspaceInstructionPolicyRevisionId.safeParse(context.req.param("revisionId"));
+  if (!parsed.success) {
+    throw new HTTPException25(422, { message: "Invalid workspace instruction-policy revision id" });
+  }
+  return parsed.data;
+}
+function registerWorkspaceInstructionPolicyRoutes(app, deps) {
+  const base = "/v1/workspaces/:workspaceId/instruction-policies";
+  app.get(base, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant17(context, deps, workspaceId, "workspace:read");
+    const parsed = WorkspaceInstructionPolicyListQuery.safeParse({
+      kind: context.req.query("kind"),
+      scope: context.req.query("scope"),
+      roleKey: context.req.query("roleKey"),
+      afterRevision: context.req.query("afterRevision"),
+      limit: context.req.query("limit")
+    });
+    if (!parsed.success) {
+      throw new HTTPException25(422, { message: "Invalid workspace instruction-policy query" });
+    }
+    return context.json(
+      WorkspaceInstructionPolicyListResponse.parse(
+        await listWorkspaceInstructionPolicyRevisions(deps.db, workspaceId, parsed.data)
+      )
+    );
+  });
+  app.post(`${base}/drafts`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant17(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const request = await parseBody(context, CreateWorkspaceInstructionPolicyDraftRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyRevision.parse(
+          await createWorkspaceInstructionPolicyDraft(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            createdBySubjectId: grant.subjectId,
+            kind: request.kind,
+            scope: request.scope,
+            roleKey: request.roleKey,
+            content: request.content,
+            provenanceSource: request.provenanceSource,
+            provenanceSourceId: request.provenanceSourceId,
+            supersedesRevisionId: request.supersedesRevisionId
+          })
+        ),
+        201
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+  app.post(`${base}/import-legacy`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant17(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const request = await parseBody(context, ImportLegacyWorkspaceInstructionPolicyDraftRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyRevision.parse(
+          await importLegacyWorkspaceInstructionPolicyDraft(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            createdBySubjectId: grant.subjectId,
+            supersedesRevisionId: request.supersedesRevisionId
+          })
+        ),
+        201
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+  app.get(`${base}/diff`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant17(context, deps, workspaceId, "workspace:read");
+    const parsed = WorkspaceInstructionPolicyDiffRequest.safeParse({
+      fromRevisionId: context.req.query("fromRevisionId"),
+      toRevisionId: context.req.query("toRevisionId")
+    });
+    if (!parsed.success) {
+      throw new HTTPException25(422, { message: "Invalid workspace instruction-policy diff query" });
+    }
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyDiffResponse.parse(
+          await diffWorkspaceInstructionPolicyRevisions(deps.db, workspaceId, parsed.data)
+        )
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+  app.post(`${base}/rollback`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant17(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const request = await parseBody(context, RollbackWorkspaceInstructionPolicyRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyActivationResponse.parse(
+          await rollbackWorkspaceInstructionPolicyRevision(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            targetRevisionId: request.targetRevisionId,
+            expectedCurrentRevisionId: request.expectedCurrentRevisionId,
+            actorSubjectId: grant.subjectId,
+            reason: request.reason
+          })
+        )
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+  app.get(`${base}/:revisionId`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant17(context, deps, workspaceId, "workspace:read");
+    const revisionId = parseRevisionId(context);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyRevision.parse(
+          await getWorkspaceInstructionPolicyRevision(deps.db, workspaceId, revisionId)
+        )
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+  app.post(`${base}/:revisionId/activate`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant17(context, deps, workspaceId, "workspace:admin");
+    assertBoundedActor(grant.subjectId);
+    const revisionId = parseRevisionId(context);
+    const request = await parseBody(context, ActivateWorkspaceInstructionPolicyRequest);
+    try {
+      return context.json(
+        WorkspaceInstructionPolicyActivationResponse.parse(
+          await activateWorkspaceInstructionPolicyRevision(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            revisionId,
+            expectedCurrentRevisionId: request.expectedCurrentRevisionId,
+            actorSubjectId: grant.subjectId,
+            reason: request.reason
+          })
+        )
+      );
+    } catch (error) {
+      return policyErrorResponse(context, error);
+    }
+  });
+}
+
 // src/app.ts
 import {
   mergeResourceRefs,
@@ -15235,7 +16299,7 @@ function createApp(deps) {
       documentId
     }) => {
       if (!objectStorage) {
-        throw new HTTPException24(503, {
+        throw new HTTPException26(503, {
           message: "object storage is not configured"
         });
       }
@@ -15412,6 +16476,11 @@ function createApp(deps) {
     const result = await runReadinessChecks(readinessChecks(deps), 2e3);
     return c.json(result, result.ok ? 200 : 503);
   });
+  app.get("/traffic-readyz", async (c) => {
+    const { db } = readinessChecks(deps);
+    const result = await runReadinessChecks({ db }, 2e3);
+    return c.json(result, result.ok ? 200 : 503);
+  });
   app.get(
     "/metrics",
     async (c) => c.text(await observability.prometheusMetrics(), 200, {
@@ -15458,7 +16527,7 @@ function createApp(deps) {
       boundedRequest = await boundedMcpRequest(c.req.raw);
     } catch (error) {
       if (error instanceof McpPayloadTooLargeError2) {
-        throw new HTTPException24(413, { message: "MCP request body exceeds the safety limit" });
+        throw new HTTPException26(413, { message: "MCP request body exceeds the safety limit" });
       }
       throw error;
     }
@@ -15467,7 +16536,7 @@ function createApp(deps) {
     const boundSessionId = grant.metadata?.sessionId;
     if (toolspaceGrant || typeof boundSessionId === "string") {
       if (typeof boundSessionId !== "string") {
-        throw new HTTPException24(404, { message: "session not found" });
+        throw new HTTPException26(404, { message: "session not found" });
       }
       try {
         await requireSessionAuthorization3(routeDeps, grant, {
@@ -15477,10 +16546,10 @@ function createApp(deps) {
         });
       } catch (error) {
         if (error instanceof SessionAuthorizationDeniedError2) {
-          throw new HTTPException24(404, { message: "session not found" });
+          throw new HTTPException26(404, { message: "session not found" });
         }
         if (error instanceof SessionAuthorizationUnavailableError2) {
-          throw new HTTPException24(503, { message: "session authorization is unavailable" });
+          throw new HTTPException26(503, { message: "session authorization is unavailable" });
         }
         throw error;
       }
@@ -15491,7 +16560,7 @@ function createApp(deps) {
         toolspace = await prepareToolspaceMcpSurface({ deps: routeDeps, grant });
       } catch (error) {
         if (error instanceof McpPayloadTooLargeError2) {
-          throw new HTTPException24(413, { message: "MCP tool list exceeds the safety limit" });
+          throw new HTTPException26(413, { message: "MCP tool list exceeds the safety limit" });
         }
         throw error;
       }
@@ -15520,6 +16589,7 @@ function createApp(deps) {
   registerGitHubRoutes(app, routeDeps);
   registerInstallRoutes(app, routeDeps);
   registerWorkspaceRoutes(app, routeDeps);
+  registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
@@ -15570,7 +16640,7 @@ function createApp(deps) {
   return app;
 }
 async function requireMcpAccessGrant(c, deps, workspaceId) {
-  const grant = await requireAccessGrant17(c, deps, workspaceId);
+  const grant = await requireAccessGrant18(c, deps, workspaceId);
   if (hasPermission7(grant.permissions, "workspace:read")) {
     return grant;
   }
@@ -15607,7 +16677,7 @@ function allowedCorsOrigin(pattern, origin) {
   return new RegExp(`^(?:${pattern})$`).test(origin);
 }
 function httpStatusForError(error) {
-  if (error instanceof HTTPException24) {
+  if (error instanceof HTTPException26) {
     return error.status;
   }
   if (error instanceof McpPayloadTooLargeError2) {
@@ -15635,7 +16705,7 @@ function publicErrorMessage(error, status) {
   if (status >= 500) {
     return "OpenGeni could not complete the request.";
   }
-  if (error instanceof HTTPException24) {
+  if (error instanceof HTTPException26) {
     return boundedPublicMessage(error.message) ?? "Request failed.";
   }
   if (error instanceof McpPayloadTooLargeError2) {
@@ -15671,22 +16741,20 @@ function readinessChecks(deps) {
 }
 async function runReadinessChecks(checks, timeoutMs) {
   const entries = await Promise.all(
-    Object.entries(checks).map(
-      async ([name, check]) => {
-        try {
-          await withTimeout(Promise.resolve().then(check), timeoutMs);
-          return [name, { ok: true }];
-        } catch (error) {
-          return [
-            name,
-            {
-              ok: false,
-              error: error instanceof Error ? error.message : String(error)
-            }
-          ];
-        }
+    Object.entries(checks).map(async ([name, check]) => {
+      try {
+        await withTimeout(Promise.resolve().then(check), timeoutMs);
+        return [name, { ok: true }];
+      } catch (error) {
+        return [
+          name,
+          {
+            ok: false,
+            error: error instanceof Error ? error.message : String(error)
+          }
+        ];
       }
-    )
+    })
   );
   const result = Object.fromEntries(entries);
   return {
@@ -15715,6 +16783,7 @@ async function withTimeout(promise, timeoutMs) {
 var routeLabelPatterns = [
   { pattern: /^\/healthz$/, label: "/healthz" },
   { pattern: /^\/readyz$/, label: "/readyz" },
+  { pattern: /^\/traffic-readyz$/, label: "/traffic-readyz" },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/connect\/start$/,
     label: "/v1/workspaces/:workspaceId/codex/connect/start"
@@ -16009,6 +17078,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/,
     label: "/v1/workspaces/:workspaceId/connections/oauth/start"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/slack-bot$/,
+    label: "/v1/workspaces/:workspaceId/connections/slack-bot"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/connections/:connectionId"
@@ -16106,4 +17179,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-DQWFAIPE.js.map
+//# sourceMappingURL=chunk-S2N4252E.js.map