@opengeni/api-router 0.5.0 → 0.5.2

package/dist/{chunk-DQ5TIRDZ.js → chunk-YY6OAEL6.js}

@@ -12,7 +12,7 @@ import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { HTTPException as HTTPException20 } from "hono/http-exception";
+import { HTTPException as HTTPException22 } from "hono/http-exception";
 import { hasPermission as hasPermission4, requireAccessGrant as requireAccessGrant16, requirePermission } from "@opengeni/core";
 
 // src/auth/managed-auth.ts
@@ -1836,6 +1836,9 @@ function isAuthExempt(c, settings) {
   if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json") {
     return true;
   }
+  if (path.startsWith("/v1/catalog-assets/")) {
+    return true;
+  }
   if (githubConnectPathPattern.test(path)) {
     return true;
   }
@@ -1964,6 +1967,91 @@ function registerCapabilityRoutes(app, deps) {
   });
 }
 
+// src/routes/catalog-assets.ts
+import { HTTPException as HTTPException3 } from "hono/http-exception";
+var CATALOG_ASSET_PREFIX = "catalog-assets/";
+var MAX_KEY_LENGTH = 512;
+var PRINTABLE_ASCII = /^[\x20-\x7e]+$/;
+var CONTENT_TYPE_BY_EXTENSION = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  svg: "image/svg+xml",
+  webp: "image/webp",
+  gif: "image/gif",
+  ico: "image/x-icon"
+};
+function registerCatalogAssetRoutes(app, deps) {
+  const { settings, objectStorage } = deps;
+  app.get("/v1/catalog-assets/*", async (c) => {
+    if (!settings.integrationsEnabled) {
+      throw new HTTPException3(404, { message: "integrations are not enabled for this deployment" });
+    }
+    if (!objectStorage) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const key = catalogAssetKeyFromPath(new URL(c.req.url).pathname);
+    if (!key) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const contentType = contentTypeForKey(key);
+    if (!contentType) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const object3 = await objectStorage.getObjectBytes(key);
+    if (!object3) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const etag = etagForKey(key);
+    const headers = {
+      "Cache-Control": "public, max-age=31536000, immutable",
+      ETag: etag,
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
+    };
+    if (ifNoneMatchSatisfied(c.req.header("if-none-match"), etag)) {
+      return c.body(null, 304, headers);
+    }
+    return c.body(new Uint8Array(object3.bytes), 200, { ...headers, "Content-Type": contentType });
+  });
+}
+function catalogAssetKeyFromPath(pathname) {
+  const prefix = "/v1/";
+  if (!pathname.startsWith(prefix)) {
+    return null;
+  }
+  let key;
+  try {
+    key = decodeURIComponent(pathname.slice(prefix.length));
+  } catch {
+    return null;
+  }
+  if (key.length === 0 || key.length > MAX_KEY_LENGTH || !key.startsWith(CATALOG_ASSET_PREFIX) || key.includes("..") || key.includes("\\") || key.includes("//") || !PRINTABLE_ASCII.test(key)) {
+    return null;
+  }
+  return key;
+}
+function contentTypeForKey(key) {
+  const match = /\.([a-zA-Z0-9]+)$/.exec(key);
+  const ext = match?.[1]?.toLowerCase();
+  return ext ? CONTENT_TYPE_BY_EXTENSION[ext] ?? null : null;
+}
+function etagForKey(key) {
+  const filename = key.slice(key.lastIndexOf("/") + 1);
+  const dot = filename.lastIndexOf(".");
+  const digest = dot === -1 ? filename : filename.slice(0, dot);
+  return `"${digest}"`;
+}
+function ifNoneMatchSatisfied(header, etag) {
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return header.split(",").map((value) => value.trim()).includes(etag);
+}
+
 // src/routes/codex.ts
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
 import {
@@ -1999,7 +2087,7 @@ import {
   CODEX_ROTATION_STRATEGIES
 } from "@opengeni/db";
 import { createSignedState as createSignedState2, readSignedState } from "@opengeni/github";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant2 } from "@opengeni/core";
 var CODEX_PROVIDER_LABEL = "Codex subscription \xB7 no credits";
 function codexAccountJson(row) {
@@ -2043,7 +2131,7 @@ function registerCodexRoutes(app, deps) {
     try {
       start = await startDeviceCode();
     } catch (error) {
-      throw new HTTPException3(502, { message: error instanceof CodexDeviceError ? error.message : "failed to start Codex device login" });
+      throw new HTTPException4(502, { message: error instanceof CodexDeviceError ? error.message : "failed to start Codex device login" });
     }
     const state = createSignedState2(githubStateSecret, { workspaceId, deviceAuthId: start.deviceAuthId, userCode: start.userCode });
     return c.json({ userCode: start.userCode, verificationUri: start.verificationUri, intervalSeconds: start.intervalSeconds, state });
@@ -2054,7 +2142,7 @@ function registerCodexRoutes(app, deps) {
     const { state } = await c.req.json();
     const payload = state ? readSignedState(state, githubStateSecret) : null;
     if (!payload || payload.workspaceId !== workspaceId || !payload.deviceAuthId || !payload.userCode) {
-      throw new HTTPException3(400, { message: "codex connect state is invalid or expired" });
+      throw new HTTPException4(400, { message: "codex connect state is invalid or expired" });
     }
     if (typeof payload.iat === "number" && Date.now() / 1e3 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS) {
       return c.json({ status: "expired" });
@@ -2063,7 +2151,7 @@ function registerCodexRoutes(app, deps) {
     try {
       poll = await pollDeviceCode({ deviceAuthId: payload.deviceAuthId, userCode: payload.userCode });
     } catch (error) {
-      throw new HTTPException3(502, { message: error instanceof CodexDeviceError ? error.message : "codex device poll failed" });
+      throw new HTTPException4(502, { message: error instanceof CodexDeviceError ? error.message : "codex device poll failed" });
     }
     if (poll.status === "pending") {
       return c.json({ status: "pending" });
@@ -2075,12 +2163,12 @@ function registerCodexRoutes(app, deps) {
     try {
       tokens = await exchangeDeviceCode({ authorizationCode: poll.authorizationCode, codeVerifier: poll.codeVerifier });
     } catch (error) {
-      throw new HTTPException3(502, { message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed" });
+      throw new HTTPException4(502, { message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed" });
     }
     const id = parseIdToken(tokens.idToken);
     const key = environmentsEncryptionKeyBytes2(settings);
     if (!key) {
-      throw new HTTPException3(500, { message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured" });
+      throw new HTTPException4(500, { message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured" });
     }
     const upserted = await upsertCodexSubscriptionCredential(db, {
       accountId: grant.accountId,
@@ -2174,7 +2262,7 @@ function registerCodexRoutes(app, deps) {
     const accountId = c.req.param("accountId");
     const activated = await setActiveCodexCredential(db, workspaceId, accountId);
     if (!activated) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     return c.json({ activated: true, accountId });
   });
@@ -2188,17 +2276,17 @@ function registerCodexRoutes(app, deps) {
     }
     if (typeof body.rotationStrategy === "string") {
       if (!CODEX_ROTATION_STRATEGIES.includes(body.rotationStrategy)) {
-        throw new HTTPException3(400, { message: "invalid rotation strategy" });
+        throw new HTTPException4(400, { message: "invalid rotation strategy" });
       }
       patch.rotationStrategy = body.rotationStrategy;
     }
     if (patch.rotationEnabled === void 0 && patch.rotationStrategy === void 0) {
-      throw new HTTPException3(400, { message: "no settings to update" });
+      throw new HTTPException4(400, { message: "no settings to update" });
     }
     await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
     const updated = await updateCodexRotationSettings(db, workspaceId, patch);
     if (!updated) {
-      throw new HTTPException3(404, { message: "codex rotation settings not found" });
+      throw new HTTPException4(404, { message: "codex rotation settings not found" });
     }
     return c.json({
       rotationEnabled: updated.rotationEnabled,
@@ -2214,12 +2302,12 @@ function registerCodexRoutes(app, deps) {
     const label = typeof body.label === "string" ? body.label : null;
     const renamed = await renameCodexAccount(db, workspaceId, accountId, label);
     if (!renamed) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     const row = accounts.find((account) => account.id === accountId);
     if (!row) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     return c.json(codexAccountJson(row));
   });
@@ -2241,7 +2329,7 @@ function registerCodexRoutes(app, deps) {
     await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
     const status = await getCodexCredentialStatus(db, workspaceId);
     if (!status?.credentialId) {
-      throw new HTTPException3(404, { message: "codex subscription is not connected" });
+      throw new HTTPException4(404, { message: "codex subscription is not connected" });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, status.credentialId);
     return c.json(codexUsageJson(payload));
@@ -2252,7 +2340,7 @@ function registerCodexRoutes(app, deps) {
     const accountId = c.req.param("accountId");
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     if (!accounts.some((account) => account.id === accountId)) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, accountId);
     return c.json(codexUsageJson(payload));
@@ -2297,7 +2385,7 @@ import {
   revokeConnection,
   updateConnection as updateConnection2
 } from "@opengeni/db";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 
 // src/integrations/oauth-client.ts
 import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
@@ -2321,7 +2409,19 @@ import { Buffer } from "buffer";
 import { createHash, randomBytes } from "crypto";
 import { lookup } from "dns/promises";
 import { isIP } from "net";
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
+
+// src/integrations/provider-domain.ts
+import { HTTPException as HTTPException5 } from "hono/http-exception";
+function canonicalProviderDomain(value) {
+  const canonical = value.trim().toLowerCase().replace(/^www\./, "");
+  if (!canonical) {
+    throw new HTTPException5(400, { message: "providerDomain must not be empty" });
+  }
+  return canonical;
+}
+
+// src/integrations/oauth-client.ts
 var oauthStateTtlMs = 10 * 60 * 1e3;
 async function startMcpOAuth(deps, context) {
   const { db, settings } = deps;
@@ -2333,7 +2433,7 @@ async function startMcpOAuth(deps, context) {
   const metadataUrl = `${baseUrl}/v1/integrations/oauth/client-metadata.json`;
   const existing = context.payload.connectionId ? await getConnectionMetadata(db, context.workspaceId, context.payload.connectionId, context.subjectId) : null;
   if (context.payload.connectionId && !existing) {
-    throw new HTTPException4(404, { message: "connection not found" });
+    throw new HTTPException6(404, { message: "connection not found" });
   }
   const discovery = await discoverMcpOAuth(resource, settings);
   const client = await registerOAuthClient(db, settings, discovery.as, metadataUrl, redirectUri);
@@ -2376,7 +2476,7 @@ async function startMcpOAuth(deps, context) {
 async function completeMcpOAuthCallback(deps, input) {
   const { db, settings } = deps;
   if (!input.state) {
-    throw new HTTPException4(400, { message: "missing OAuth state" });
+    throw new HTTPException6(400, { message: "missing OAuth state" });
   }
   const state = readOAuthState(input.state, settings);
   if (!input.code) {
@@ -2391,7 +2491,7 @@ async function completeMcpOAuthCallback(deps, input) {
     now: /* @__PURE__ */ new Date()
   });
   if (!consumed) {
-    throw new HTTPException4(400, { message: "OAuth state has already been used" });
+    throw new HTTPException6(400, { message: "OAuth state has already been used" });
   }
   try {
     const baseUrl = integrationBaseUrl(settings.publicBaseUrl, input.requestUrl);
@@ -2446,11 +2546,11 @@ async function completeMcpOAuthCallback(deps, input) {
       createdBySubjectId: state.subjectId
     });
     if (!connection) {
-      throw new HTTPException4(409, { message: "connection changed during OAuth reconnect; start again" });
+      throw new HTTPException6(409, { message: "connection changed during OAuth reconnect; start again" });
     }
-    return { redirectTo: callbackReturnPath(state.returnPath, "success", { connectionId: connection.id }) };
+    return { redirectTo: callbackReturnPath(state.returnPath, "success", { connectionId: connection.id, providerDomain: connection.providerDomain }) };
   } catch (error) {
-    if (error instanceof HTTPException4 && error.status >= 400 && error.status < 500) {
+    if (error instanceof HTTPException6 && error.status >= 400 && error.status < 500) {
       throw error;
     }
     return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "oauth_callback_failed" }) };
@@ -2462,7 +2562,7 @@ function integrationBaseUrl(publicBaseUrl, requestUrl) {
 function requireIntegrationsStateSecret(settings) {
   const secret = settings.integrationsStateSecret?.trim();
   if (!secret) {
-    throw new HTTPException4(503, { message: "integrations OAuth requires OPENGENI_INTEGRATIONS_STATE_SECRET" });
+    throw new HTTPException6(503, { message: "integrations OAuth requires OPENGENI_INTEGRATIONS_STATE_SECRET" });
   }
   return secret;
 }
@@ -2471,11 +2571,11 @@ async function discoverMcpOAuth(resource, settings) {
   const prm = await discoverProtectedResourceMetadata(resource, settings, challenge.resourceMetadata);
   const authorizationServer = prm.authorizationServers[0];
   if (!authorizationServer) {
-    throw new HTTPException4(422, { message: "MCP protected resource metadata did not advertise an authorization server" });
+    throw new HTTPException6(422, { message: "MCP protected resource metadata did not advertise an authorization server" });
   }
   const as = await discoverAuthorizationServerMetadata(authorizationServer, settings);
   if (!as.codeChallengeMethodsSupported.includes("S256")) {
-    throw new HTTPException4(422, { message: "authorization server does not support required PKCE S256" });
+    throw new HTTPException6(422, { message: "authorization server does not support required PKCE S256" });
   }
   return { challenge, prm, as };
 }
@@ -2496,7 +2596,7 @@ async function discoverProtectedResourceMetadata(resource, settings, advertisedU
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
-      if (error instanceof HTTPException4) {
+      if (error instanceof HTTPException6) {
         throw error;
       }
       return null;
@@ -2515,7 +2615,7 @@ async function discoverProtectedResourceMetadata(resource, settings, advertisedU
       ...stringValue(payload.resource) ? { resource: stringValue(payload.resource) } : {}
     };
   }
-  throw new HTTPException4(422, { message: "could not discover MCP protected resource metadata" });
+  throw new HTTPException6(422, { message: "could not discover MCP protected resource metadata" });
 }
 async function discoverAuthorizationServerMetadata(authorizationServer, settings) {
   const candidates = uniqueStrings([
@@ -2525,7 +2625,7 @@ async function discoverAuthorizationServerMetadata(authorizationServer, settings
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
-      if (error instanceof HTTPException4) {
+      if (error instanceof HTTPException6) {
         throw error;
       }
       return null;
@@ -2549,7 +2649,7 @@ async function discoverAuthorizationServerMetadata(authorizationServer, settings
       ...stringValue(payload.registration_endpoint) ? { registrationEndpoint: stringValue(payload.registration_endpoint) } : {}
     };
   }
-  throw new HTTPException4(422, { message: "could not discover OAuth authorization server metadata" });
+  throw new HTTPException6(422, { message: "could not discover OAuth authorization server metadata" });
 }
 async function registerOAuthClient(db, settings, as, metadataUrl, redirectUri) {
   const operator = operatorClientForAs(settings, as);
@@ -2577,7 +2677,7 @@ async function registerOAuthClient(db, settings, as, metadataUrl, redirectUri) {
     };
   }
   if (!as.registrationEndpoint) {
-    throw new HTTPException4(422, {
+    throw new HTTPException6(422, {
       message: "manual OAuth client credentials are required for this authorization server"
     });
   }
@@ -2597,7 +2697,7 @@ async function registerOAuthClient(db, settings, as, metadataUrl, redirectUri) {
   if (storedWinner.clientId !== dcr.clientId) {
     const winner = await loadIntegrationOAuthClient(db, settings, as.issuer);
     if (!winner) {
-      throw new HTTPException4(422, { message: "OAuth client registration could not be loaded after a registration race" });
+      throw new HTTPException6(422, { message: "OAuth client registration could not be loaded after a registration race" });
     }
     return dcrRegistrationFromStored(winner);
   }
@@ -2649,7 +2749,7 @@ function normalizedIssuerKey(value) {
 }
 async function dynamicClientRegistration(settings, as, redirectUri) {
   if (!as.registrationEndpoint) {
-    throw new HTTPException4(422, { message: "authorization server does not support dynamic client registration" });
+    throw new HTTPException6(422, { message: "authorization server does not support dynamic client registration" });
   }
   await assertOAuthFetchAllowed(as.registrationEndpoint, settings);
   const response = await fetchOAuth(as.registrationEndpoint, settings, {
@@ -2664,12 +2764,12 @@ async function dynamicClientRegistration(settings, as, redirectUri) {
     })
   });
   if (!response.ok) {
-    throw new HTTPException4(422, { message: `dynamic client registration failed with HTTP ${response.status}` });
+    throw new HTTPException6(422, { message: `dynamic client registration failed with HTTP ${response.status}` });
   }
   const payload = await response.json();
   const clientId = stringValue(payload.client_id);
   if (!clientId) {
-    throw new HTTPException4(422, { message: "dynamic client registration response did not include client_id" });
+    throw new HTTPException6(422, { message: "dynamic client registration response did not include client_id" });
   }
   const clientSecret = stringValue(payload.client_secret);
   return {
@@ -2698,12 +2798,12 @@ function buildAuthorizationUrl(input) {
 function readOAuthState(state, settings) {
   const payload = readSignedState2(state, requireIntegrationsStateSecret(settings));
   if (!payload) {
-    throw new HTTPException4(400, { message: "invalid or expired OAuth state" });
+    throw new HTTPException6(400, { message: "invalid or expired OAuth state" });
   }
   const nowSeconds = Math.floor(Date.now() / 1e3);
   const iat = numberValue(payload.iat);
   if (iat === void 0 || nowSeconds - iat > oauthStateTtlMs / 1e3 || nowSeconds < iat) {
-    throw new HTTPException4(400, { message: "invalid or expired OAuth state" });
+    throw new HTTPException6(400, { message: "invalid or expired OAuth state" });
   }
   const parsed = {
     accountId: requiredString(payload.accountId, "state.accountId"),
@@ -2745,7 +2845,7 @@ async function clientForState(db, settings, state) {
   if (state.clientRegistrationMethod === "dcr") {
     const stored = await loadIntegrationOAuthClient(db, settings, state.issuer);
     if (!stored || stored.clientId !== state.clientId) {
-      throw new HTTPException4(400, { message: "OAuth client registration is no longer available" });
+      throw new HTTPException6(400, { message: "OAuth client registration is no longer available" });
     }
     return {
       method: "dcr",
@@ -2758,7 +2858,7 @@ async function clientForState(db, settings, state) {
   }
   const entry = operatorClientEntryFor(settings, [state.issuer, state.authorizationServer]);
   if (!entry || entry.clientId !== state.clientId) {
-    throw new HTTPException4(400, { message: "operator OAuth client credentials are no longer available" });
+    throw new HTTPException6(400, { message: "operator OAuth client credentials are no longer available" });
   }
   return {
     method: "operator",
@@ -2845,27 +2945,24 @@ function callbackReturnPath(returnPath, status, params) {
 }
 function canonicalMcpResource(value) {
   if (!value) {
-    throw new HTTPException4(400, { message: "mcpUrl is required" });
+    throw new HTTPException6(400, { message: "mcpUrl is required" });
   }
   let url;
   try {
     url = new URL(value);
   } catch {
-    throw new HTTPException4(422, { message: "MCP resource URL is invalid" });
+    throw new HTTPException6(422, { message: "MCP resource URL is invalid" });
   }
   url.hash = "";
   return url.toString();
 }
-function canonicalProviderDomain(value) {
-  return value.trim().toLowerCase().replace(/^www\./, "");
-}
 function safeReturnPath(value) {
   if (!value.startsWith("/") || value.startsWith("//")) {
-    throw new HTTPException4(400, { message: "OAuth returnPath must be a relative path" });
+    throw new HTTPException6(400, { message: "OAuth returnPath must be a relative path" });
   }
   const parsed = new URL(value, "https://opengeni.local");
   if (parsed.origin !== "https://opengeni.local") {
-    throw new HTTPException4(400, { message: "OAuth returnPath must be a relative path" });
+    throw new HTTPException6(400, { message: "OAuth returnPath must be a relative path" });
   }
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
@@ -2887,39 +2984,39 @@ async function fetchOAuth(rawUrl, settings, init = {}, hop = 0) {
     return response;
   }
   if (hop >= 3) {
-    throw new HTTPException4(422, { message: "OAuth fetch exceeded maximum redirect hops" });
+    throw new HTTPException6(422, { message: "OAuth fetch exceeded maximum redirect hops" });
   }
   const location = response.headers.get("location");
   if (!location) {
-    throw new HTTPException4(422, { message: "OAuth fetch redirect was missing Location" });
+    throw new HTTPException6(422, { message: "OAuth fetch redirect was missing Location" });
   }
   let nextUrl;
   try {
     nextUrl = new URL(location, rawUrl).toString();
   } catch {
-    throw new HTTPException4(422, { message: "OAuth fetch redirect Location was invalid" });
+    throw new HTTPException6(422, { message: "OAuth fetch redirect Location was invalid" });
   }
   return await fetchOAuth(nextUrl, settings, init, hop + 1);
 }
 async function assertOAuthFetchAllowed(rawUrl, settings) {
   const url = new URL(rawUrl);
   if (!["https:", "http:"].includes(url.protocol)) {
-    throw new HTTPException4(422, { message: "OAuth discovery only supports http and https URLs" });
+    throw new HTTPException6(422, { message: "OAuth discovery only supports http and https URLs" });
   }
   if (settings.integrationsAllowPrivateNetworkTargets || ["local", "test"].includes(settings.environment)) {
     return;
   }
   if (url.protocol !== "https:") {
-    throw new HTTPException4(422, { message: "OAuth discovery targets must use https outside local/test" });
+    throw new HTTPException6(422, { message: "OAuth discovery targets must use https outside local/test" });
   }
   const hostname = url.hostname.toLowerCase();
   if (hostname === "localhost" || hostname.endsWith(".localhost")) {
-    throw new HTTPException4(422, { message: "OAuth discovery may not target localhost" });
+    throw new HTTPException6(422, { message: "OAuth discovery may not target localhost" });
   }
   const literal2 = isIP(hostname);
   const addresses = literal2 ? [hostname] : (await lookup(hostname, { all: true })).map((entry) => entry.address);
   if (addresses.some(isPrivateAddress)) {
-    throw new HTTPException4(422, { message: "OAuth discovery may not target private network addresses" });
+    throw new HTTPException6(422, { message: "OAuth discovery may not target private network addresses" });
   }
 }
 function parseWwwAuthenticate(header) {
@@ -2978,7 +3075,7 @@ function registrationMethod(value) {
   if (value === "operator" || value === "cimd" || value === "dcr") {
     return value;
   }
-  throw new HTTPException4(400, { message: "invalid OAuth state" });
+  throw new HTTPException6(400, { message: "invalid OAuth state" });
 }
 function expiresAtFromTokenResponse(payload) {
   const expiresAt = stringValue(payload.expires_at);
@@ -3013,7 +3110,7 @@ function numberValue(value) {
 function requiredString(value, field) {
   const result = stringValue(value);
   if (!result) {
-    throw new HTTPException4(400, { message: `invalid OAuth state: missing ${field}` });
+    throw new HTTPException6(400, { message: `invalid OAuth state: missing ${field}` });
   }
   return result;
 }
@@ -3023,7 +3120,7 @@ function registerConnectionRoutes(app, deps) {
   const { db, settings } = deps;
   function assertIntegrationsEnabled() {
     if (!settings.integrationsEnabled) {
-      throw new HTTPException5(404, { message: "integrations are not enabled for this deployment" });
+      throw new HTTPException7(404, { message: "integrations are not enabled for this deployment" });
     }
   }
   app.get("/v1/workspaces/:workspaceId/connections", async (c) => {
@@ -3043,7 +3140,7 @@ function registerConnectionRoutes(app, deps) {
       accountId: grant.accountId,
       workspaceId,
       subjectId,
-      providerDomain: payload.providerDomain,
+      providerDomain: canonicalProviderDomain(payload.providerDomain),
       kind: payload.kind,
       credentialEncrypted: encryptCredentialBundle(key, payload.credential),
       grantedScopes: payload.grantedScopes,
@@ -3058,7 +3155,7 @@ function registerConnectionRoutes(app, deps) {
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:read");
     const connection = await getConnectionMetadata2(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
     if (!connection) {
-      throw new HTTPException5(404, { message: "connection not found" });
+      throw new HTTPException7(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -3068,10 +3165,10 @@ function registerConnectionRoutes(app, deps) {
     const payload = UpdateConnectionRequest.parse(await c.req.json());
     if (payload.status !== void 0) {
       if (payload.status !== "active") {
-        throw new HTTPException5(400, { message: 'status can only be set to "active"; use DELETE to revoke' });
+        throw new HTTPException7(400, { message: 'status can only be set to "active"; use DELETE to revoke' });
       }
       if (payload.credential === void 0) {
-        throw new HTTPException5(400, { message: "reactivating a connection requires a new credential" });
+        throw new HTTPException7(400, { message: "reactivating a connection requires a new credential" });
       }
     }
     const key = payload.credential === void 0 ? null : requireEnvironmentEncryption3(settings);
@@ -3081,7 +3178,7 @@ function registerConnectionRoutes(app, deps) {
       connectionId: c.req.param("connectionId"),
       visibleToSubjectId: grant.subjectId,
       updatedBySubjectId: grant.subjectId,
-      ...payload.providerDomain !== void 0 ? { providerDomain: payload.providerDomain } : {},
+      ...payload.providerDomain !== void 0 ? { providerDomain: canonicalProviderDomain(payload.providerDomain) } : {},
       ...subjectId !== void 0 ? { subjectId } : {},
       ...payload.kind !== void 0 ? { kind: payload.kind } : {},
       ...payload.status !== void 0 ? { status: payload.status } : {},
@@ -3091,7 +3188,7 @@ function registerConnectionRoutes(app, deps) {
       ...payload.metadata !== void 0 ? { metadata: payload.metadata } : {}
     });
     if (!connection) {
-      throw new HTTPException5(404, { message: "connection not found" });
+      throw new HTTPException7(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -3100,7 +3197,7 @@ function registerConnectionRoutes(app, deps) {
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
     const connection = await revokeConnection(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
     if (!connection) {
-      throw new HTTPException5(404, { message: "connection not found" });
+      throw new HTTPException7(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -3110,7 +3207,7 @@ function registerConnectionRoutes(app, deps) {
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
     const parsed = OAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: parsed.error.issues[0]?.message ?? "invalid OAuth start request" });
+      throw new HTTPException7(400, { message: parsed.error.issues[0]?.message ?? "invalid OAuth start request" });
     }
     const payload = parsed.data;
     const result = await startMcpOAuth({ db, settings }, {
@@ -3149,7 +3246,7 @@ function writableSubjectId(requested, grantSubjectId) {
     return null;
   }
   if (requested !== grantSubjectId) {
-    throw new HTTPException5(403, { message: "cannot write a connection for another subject" });
+    throw new HTTPException7(403, { message: "cannot write a connection for another subject" });
   }
   return requested;
 }
@@ -3187,7 +3284,7 @@ import {
   searchDocuments as searchDocuments2
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant4 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage2, requireLimit as requireLimit2 } from "@opengeni/core";
 
@@ -3341,7 +3438,7 @@ function registerDocumentRoutes(app, deps) {
     await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException6(404, { message: "document base not found" });
+      throw new HTTPException8(404, { message: "document base not found" });
     }
     return c.json(DocumentBase.parse(base));
   });
@@ -3349,7 +3446,7 @@ function registerDocumentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException6(503, { message: "object storage is not configured" });
+      throw new HTTPException8(503, { message: "object storage is not configured" });
     }
     await requireLimit2(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
     const payload = AddDocumentRequest.parse(await c.req.json());
@@ -3399,19 +3496,19 @@ function registerDocumentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException6(503, { message: "object storage is not configured" });
+      throw new HTTPException8(503, { message: "object storage is not configured" });
     }
     await requireLimit2(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
     try {
       const document = await getDocument(db, workspaceId, c.req.param("documentId"));
       if (!document) {
-        throw new HTTPException6(404, { message: "document not found" });
+        throw new HTTPException8(404, { message: "document not found" });
       }
       if (document.status !== "failed") {
-        throw new HTTPException6(422, { message: "only failed documents can be retried" });
+        throw new HTTPException8(422, { message: "only failed documents can be retried" });
       }
       if (document.baseId !== c.req.param("baseId")) {
-        throw new HTTPException6(404, { message: "document not found" });
+        throw new HTTPException8(404, { message: "document not found" });
       }
       const queued = await queueDocumentForReindex(db, workspaceId, document.id);
       const indexed = await documentIndexer.indexDocument({ accountId: grant.accountId, workspaceId, documentId: document.id }) ?? queued;
@@ -3430,7 +3527,7 @@ function registerDocumentRoutes(app, deps) {
       }
       return c.json(Document.parse(indexed));
     } catch (error) {
-      if (error instanceof HTTPException6) {
+      if (error instanceof HTTPException8) {
         throw error;
       }
       throw documentHttpException(error);
@@ -3442,7 +3539,7 @@ function registerDocumentRoutes(app, deps) {
     const payload = DocumentSearchRequest.parse(await c.req.json());
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException6(404, { message: "document base not found" });
+      throw new HTTPException8(404, { message: "document base not found" });
     }
     return c.json({
       results: await searchDocuments2(db, {
@@ -3483,7 +3580,7 @@ function registerDocumentRoutes(app, deps) {
       limit: c.req.query("limit") ? Number(c.req.query("limit")) : void 0
     });
     if (!parsed.success) {
-      throw new HTTPException6(400, { message: "invalid knowledge memory query parameters" });
+      throw new HTTPException8(400, { message: "invalid knowledge memory query parameters" });
     }
     return c.json((await listKnowledgeMemories2(db, workspaceId, parsed.data)).map((memory) => KnowledgeMemory.parse(memory)));
   });
@@ -3492,7 +3589,7 @@ function registerDocumentRoutes(app, deps) {
     await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     const memory = await getKnowledgeMemory(db, workspaceId, c.req.param("memoryId"));
     if (!memory) {
-      throw new HTTPException6(404, { message: "knowledge memory not found" });
+      throw new HTTPException8(404, { message: "knowledge memory not found" });
     }
     return c.json(KnowledgeMemory.parse(memory));
   });
@@ -3533,12 +3630,12 @@ function registerDocumentRoutes(app, deps) {
 function documentHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException6(404, { message });
+    return new HTTPException8(404, { message });
   }
   if (message.includes("pending") || message.includes("failed") || message.includes("deleted")) {
-    return new HTTPException6(422, { message });
+    return new HTTPException8(422, { message });
   }
-  return new HTTPException6(500, { message });
+  return new HTTPException8(500, { message });
 }
 
 // src/routes/enrollments.ts
@@ -3564,7 +3661,7 @@ import {
   listEnrollments,
   revokeEnrollment
 } from "@opengeni/db";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant5 } from "@opengeni/core";
 
 // src/sandbox/enrollment.ts
@@ -3848,7 +3945,7 @@ function registerEnrollmentRoutes(app, deps) {
   const { settings, db } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException7(404, { message: "selfhosted enrollment is not enabled for this deployment" });
+      throw new HTTPException9(404, { message: "selfhosted enrollment is not enabled for this deployment" });
     }
   }
   const startLimiter = new TokenBucket({ capacity: 10, refillPerSecond: 0.5 });
@@ -3858,7 +3955,7 @@ function registerEnrollmentRoutes(app, deps) {
   function rateLimit(c, limiter) {
     const ip = clientIp(c);
     if (!limiter.take(ip)) {
-      throw new HTTPException7(429, { message: "too many requests; slow down" });
+      throw new HTTPException9(429, { message: "too many requests; slow down" });
     }
   }
   app.post("/v1/enrollments/device/start", async (c) => {
@@ -3866,12 +3963,12 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, startLimiter);
     const parsed = DeviceEnrollmentStartRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-start request" });
+      throw new HTTPException9(400, { message: "invalid device-start request" });
     }
     const body = parsed.data;
     const workspace = await getWorkspace(db, body.workspaceId);
     if (!workspace) {
-      throw new HTTPException7(404, { message: "workspace not found" });
+      throw new HTTPException9(404, { message: "workspace not found" });
     }
     const result = await startDeviceEnrollment({ db, settings }, {
       accountId: workspace.accountId,
@@ -3892,7 +3989,7 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, pollLimiter);
     const parsed = DeviceEnrollmentPollRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-poll request" });
+      throw new HTTPException9(400, { message: "invalid device-poll request" });
     }
     const result = await pollDeviceEnrollment({ db, settings }, { deviceCode: parsed.data.deviceCode });
     return c.json(result, 200);
@@ -3902,16 +3999,16 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, lookupLimiter);
     const parsed = DeviceEnrollmentLookupRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-lookup request" });
+      throw new HTTPException9(400, { message: "invalid device-lookup request" });
     }
     const record3 = await lookupDeviceEnrollment({ db, settings }, { userCode: parsed.data.userCode });
     if (!record3) {
-      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException9(404, { message: "no pending enrollment for that code" });
     }
     try {
       await requireAccessGrant5(c, deps, record3.workspaceId, "enrollments:read");
     } catch {
-      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException9(404, { message: "no pending enrollment for that code" });
     }
     return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record3)), 200);
   });
@@ -3920,7 +4017,7 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, exchangeLimiter);
     const parsed = EnrollTokenExchangeRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid enroll-token-exchange request" });
+      throw new HTTPException9(400, { message: "invalid enroll-token-exchange request" });
     }
     const body = parsed.data;
     const result = await exchangeEnrollToken({ db, settings }, {
@@ -3933,9 +4030,9 @@ function registerEnrollmentRoutes(app, deps) {
     });
     if (!result.ok) {
       if (result.reason === "disabled") {
-        throw new HTTPException7(503, { message: "enrollment credential plane is not configured" });
+        throw new HTTPException9(503, { message: "enrollment credential plane is not configured" });
       }
-      throw new HTTPException7(401, { message: "invalid or expired enroll token" });
+      throw new HTTPException9(401, { message: "invalid or expired enroll token" });
     }
     return c.json(EnrollTokenExchangeResponse.parse({ credentials: result.credentials }), 201);
   });
@@ -3945,7 +4042,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentApproveRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-approve request" });
+      throw new HTTPException9(400, { message: "invalid device-approve request" });
     }
     const body = parsed.data;
     const approved = await approveDeviceEnrollment({ db, settings }, {
@@ -3958,7 +4055,7 @@ function registerEnrollmentRoutes(app, deps) {
       approvedBySubjectLabel: grant.subjectLabel ?? null
     });
     if (!approved) {
-      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException9(404, { message: "no pending enrollment for that code" });
     }
     return c.json(DeviceEnrollmentApproveResponse.parse({
       approved: true,
@@ -3973,7 +4070,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentDenyRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-deny request" });
+      throw new HTTPException9(400, { message: "invalid device-deny request" });
     }
     const result = await denyDeviceEnrollment({ db, settings }, {
       accountId: grant.accountId,
@@ -3988,7 +4085,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = MintEnrollTokenRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid mint-enroll-token request" });
+      throw new HTTPException9(400, { message: "invalid mint-enroll-token request" });
     }
     const minted = await mintEnrollToken({ db, settings }, {
       accountId: grant.accountId,
@@ -3996,7 +4093,7 @@ function registerEnrollmentRoutes(app, deps) {
       allowScreenControl: parsed.data.allowScreenControl
     });
     if (!minted) {
-      throw new HTTPException7(503, { message: "enrollment credential plane is not configured" });
+      throw new HTTPException9(503, { message: "enrollment credential plane is not configured" });
     }
     return c.json(MintEnrollTokenResponse.parse(minted), 201);
   });
@@ -4080,7 +4177,7 @@ import {
   getEnrollment as getEnrollment2,
   readMachineMetricsSeries
 } from "@opengeni/db";
-import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant6 } from "@opengeni/core";
 import { buildFleetContextForSession as buildFleetContextForSession2, swapActiveSandbox as swapActiveSandbox2 } from "@opengeni/core";
 
@@ -4255,7 +4352,7 @@ function registerMachineRoutes(app, deps) {
   const { settings, db, bus } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException8(404, { message: "selfhosted machines are not enabled for this deployment" });
+      throw new HTTPException10(404, { message: "selfhosted machines are not enabled for this deployment" });
     }
   }
   app.get("/v1/workspaces/:workspaceId/machines", async (c) => {
@@ -4273,7 +4370,7 @@ function registerMachineRoutes(app, deps) {
     const enrollmentId = c.req.param("enrollmentId");
     const enrollment = await getEnrollment2(db, workspaceId, enrollmentId);
     if (!enrollment) {
-      throw new HTTPException8(404, { message: "machine not found in this workspace" });
+      throw new HTTPException10(404, { message: "machine not found in this workspace" });
     }
     const windowMs = SERIES_WINDOWS_MS[c.req.query("window") ?? ""] ?? DEFAULT_SERIES_WINDOW_MS;
     const since = new Date(Date.now() - windowMs);
@@ -4318,7 +4415,7 @@ import {
   setWorkspaceEnvironmentVariable as setWorkspaceEnvironmentVariable2,
   updateWorkspaceEnvironment
 } from "@opengeni/db";
-import { HTTPException as HTTPException9 } from "hono/http-exception";
+import { HTTPException as HTTPException11 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant7 } from "@opengeni/core";
 import {
   assertAllowedEnvironmentVariableName as assertAllowedEnvironmentVariableName2,
@@ -4342,21 +4439,21 @@ function registerEnvironmentRoutes(app, deps) {
     const payload = CreateWorkspaceEnvironmentRequest.parse(await c.req.json());
     const name = trimmedEnvironmentName(payload.name);
     if (payload.variables.length > MAX_VARIABLES_PER_ENVIRONMENT2) {
-      throw new HTTPException9(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
+      throw new HTTPException11(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
     }
     const variableNames = /* @__PURE__ */ new Set();
     for (const variable of payload.variables) {
       assertAllowedEnvironmentVariableName2(variable.name);
       if (variableNames.has(variable.name)) {
-        throw new HTTPException9(422, { message: `duplicate environment variable name: ${variable.name}` });
+        throw new HTTPException11(422, { message: `duplicate environment variable name: ${variable.name}` });
       }
       variableNames.add(variable.name);
     }
     if (await countWorkspaceEnvironments2(db, workspaceId) >= MAX_ENVIRONMENTS_PER_WORKSPACE2) {
-      throw new HTTPException9(422, { message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE2} environments` });
+      throw new HTTPException11(422, { message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE2} environments` });
     }
     if (await getWorkspaceEnvironmentByName2(db, workspaceId, name)) {
-      throw new HTTPException9(409, { message: `environment name is already in use: ${name}` });
+      throw new HTTPException11(409, { message: `environment name is already in use: ${name}` });
     }
     const created = await createWorkspaceEnvironment2(db, {
       accountId: grant.accountId,
@@ -4385,7 +4482,7 @@ function registerEnvironmentRoutes(app, deps) {
     if (name !== void 0 && name !== environment.name) {
       const existing = await getWorkspaceEnvironmentByName2(db, workspaceId, name);
       if (existing && existing.id !== environment.id) {
-        throw new HTTPException9(409, { message: `environment name is already in use: ${name}` });
+        throw new HTTPException11(409, { message: `environment name is already in use: ${name}` });
       }
     }
     const updated = await updateWorkspaceEnvironment(db, workspaceId, environment.id, {
@@ -4401,11 +4498,11 @@ function registerEnvironmentRoutes(app, deps) {
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const attachedTasks = await countScheduledTasksUsingEnvironment(db, workspaceId, environment.id);
     if (attachedTasks > 0) {
-      throw new HTTPException9(409, { message: `environment is attached to ${attachedTasks} scheduled task(s); detach first` });
+      throw new HTTPException11(409, { message: `environment is attached to ${attachedTasks} scheduled task(s); detach first` });
     }
     const activeSessions = await countActiveSessionsUsingEnvironment(db, workspaceId, environment.id);
     if (activeSessions > 0) {
-      throw new HTTPException9(409, { message: `environment is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first` });
+      throw new HTTPException11(409, { message: `environment is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first` });
     }
     await deleteWorkspaceEnvironment(db, workspaceId, environment.id);
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.deleted", environmentId: environment.id });
@@ -4420,7 +4517,7 @@ function registerEnvironmentRoutes(app, deps) {
     const payload = SetWorkspaceEnvironmentVariableRequest.parse(await c.req.json());
     const exists = environment.variables.some((variable) => variable.name === name);
     if (!exists && environment.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT2) {
-      throw new HTTPException9(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
+      throw new HTTPException11(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
     }
     const metadata = await setWorkspaceEnvironmentVariable2(db, {
       accountId: grant.accountId,
@@ -4439,7 +4536,7 @@ function registerEnvironmentRoutes(app, deps) {
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const deleted = await deleteWorkspaceEnvironmentVariable(db, workspaceId, environment.id, name);
     if (!deleted) {
-      throw new HTTPException9(404, { message: "environment variable not found" });
+      throw new HTTPException11(404, { message: "environment variable not found" });
     }
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.variable.deleted", environmentId: environment.id, variableName: name });
     return c.json({ ok: true });
@@ -4448,7 +4545,7 @@ function registerEnvironmentRoutes(app, deps) {
 function parseVariableName(raw) {
   const parsed = WorkspaceEnvironmentVariableName2.safeParse(raw);
   if (!parsed.success) {
-    throw new HTTPException9(422, { message: "environment variable names must match ^[A-Z][A-Z0-9_]*$" });
+    throw new HTTPException11(422, { message: "environment variable names must match ^[A-Z][A-Z0-9_]*$" });
   }
   assertAllowedEnvironmentVariableName2(parsed.data);
   return parsed.data;
@@ -4456,7 +4553,7 @@ function parseVariableName(raw) {
 function trimmedEnvironmentName(name) {
   const trimmed = name.trim();
   if (!trimmed) {
-    throw new HTTPException9(422, { message: "environment name is required" });
+    throw new HTTPException11(422, { message: "environment name is required" });
   }
   return trimmed;
 }
@@ -4476,7 +4573,7 @@ import {
   markFileUploadFailed,
   requireFile as requireFile2
 } from "@opengeni/db";
-import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant8 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
 function registerFileRoutes(app, deps) {
@@ -4485,12 +4582,12 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant8(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException12(503, { message: "object storage is not configured" });
     }
     const payload = CreateFileUploadRequest.parse(await c.req.json());
     await requireLimit3(deps, { accountId: grant.accountId, workspaceId, action: "file:upload", quantity: payload.sizeBytes });
     if (payload.sizeBytes > objectStorage.maxSinglePutSizeBytes) {
-      throw new HTTPException10(413, { message: `file exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes` });
+      throw new HTTPException12(413, { message: `file exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes` });
     }
     const fileId = crypto.randomUUID();
     const safeFilename = sanitizeFilename(payload.filename);
@@ -4526,33 +4623,33 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant8(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException12(503, { message: "object storage is not configured" });
     }
     const upload = await getFileUpload(db, workspaceId, c.req.param("uploadId"));
     if (!upload) {
-      throw new HTTPException10(404, { message: "file upload not found" });
+      throw new HTTPException12(404, { message: "file upload not found" });
     }
     if (upload.status !== "pending") {
-      throw new HTTPException10(409, { message: `file upload is ${upload.status}` });
+      throw new HTTPException12(409, { message: `file upload is ${upload.status}` });
     }
     if (upload.expiresAt.getTime() < Date.now()) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(409, { message: "file upload has expired" });
+      throw new HTTPException12(409, { message: "file upload has expired" });
     }
     const head = await objectStorage.headFile(upload.file).catch((error) => {
-      throw new HTTPException10(409, { message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}` });
+      throw new HTTPException12(409, { message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}` });
     });
     if (Number(head.ContentLength ?? -1) !== upload.file.sizeBytes) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(422, { message: "uploaded object size does not match file metadata" });
+      throw new HTTPException12(422, { message: "uploaded object size does not match file metadata" });
     }
     if (upload.file.contentType && head.ContentType && head.ContentType !== upload.file.contentType) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(422, { message: "uploaded object content type does not match file metadata" });
+      throw new HTTPException12(422, { message: "uploaded object content type does not match file metadata" });
     }
     if (upload.file.sha256 && head.Metadata?.sha256 !== upload.file.sha256) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(422, { message: "uploaded object checksum metadata does not match file metadata" });
+      throw new HTTPException12(422, { message: "uploaded object checksum metadata does not match file metadata" });
     }
     const file = await completeFileUpload(db, workspaceId, upload.id);
     await recordWorkspaceUsage3(deps, {
@@ -4573,7 +4670,7 @@ function registerFileRoutes(app, deps) {
     await requireAccessGrant8(c, deps, workspaceId, "files:read");
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException10(404, { message: "file not found" });
+      throw new HTTPException12(404, { message: "file not found" });
     }
     return c.json(FileAsset.parse(file));
   });
@@ -4581,14 +4678,14 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant8(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException12(503, { message: "object storage is not configured" });
     }
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException10(404, { message: "file not found" });
+      throw new HTTPException12(404, { message: "file not found" });
     }
     if (file.status !== "ready") {
-      throw new HTTPException10(409, { message: `file is ${file.status}` });
+      throw new HTTPException12(409, { message: `file is ${file.status}` });
     }
     const signed = await objectStorage.createGetUrl({ key: file.objectKey });
     return c.json(FileDownloadUrlResponse.parse({
@@ -4607,7 +4704,7 @@ function sanitizeFilename(filename) {
 import { CreateApiKeyRequest, CreateApiKeyResponse } from "@opengeni/contracts";
 import { createApiKey, listApiKeys, revokeApiKey } from "@opengeni/db";
 import { zValidator } from "@hono/zod-validator";
-import { HTTPException as HTTPException11 } from "hono/http-exception";
+import { HTTPException as HTTPException13 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant9 } from "@opengeni/core";
 import { requireLimit as requireLimit4 } from "@opengeni/core";
 function registerApiKeyRoutes(app, deps) {
@@ -4648,7 +4745,7 @@ function ensureDelegablePermissions(grantPermissions, requested) {
   }
   const missing = requested.filter((permission) => !grantPermissions.includes(permission));
   if (missing.length > 0) {
-    throw new HTTPException11(403, { message: `cannot delegate missing permissions: ${missing.join(", ")}` });
+    throw new HTTPException13(403, { message: `cannot delegate missing permissions: ${missing.join(", ")}` });
   }
 }
 function generateApiKeyToken() {
@@ -4680,7 +4777,7 @@ import {
   recordStripeWebhookEvent,
   upsertBillingCustomer
 } from "@opengeni/db";
-import { HTTPException as HTTPException12 } from "hono/http-exception";
+import { HTTPException as HTTPException14 } from "hono/http-exception";
 import Stripe from "stripe";
 import { requireAccessContext } from "@opengeni/core";
 function registerBillingRoutes(app, deps) {
@@ -4694,7 +4791,7 @@ function registerBillingRoutes(app, deps) {
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
     const workspaceId = c.req.query("workspaceId");
     if (workspaceId && !context.workspaceGrants.some((grant) => grant.accountId === accountId && grant.workspaceId === workspaceId)) {
-      throw new HTTPException12(403, { message: "missing workspace access for usage query" });
+      throw new HTTPException14(403, { message: "missing workspace access for usage query" });
     }
     return c.json({
       balance: await getBillingBalance(deps.db, accountId),
@@ -4712,12 +4809,12 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/billing/checkout", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException12(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException14(404, { message: "stripe billing is not enabled" });
     }
     const context = await requireAccessContext(c, deps);
     const parsed = CreateCheckoutRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException12(400, { message: parsed.error.issues[0]?.message ?? "invalid checkout request" });
+      throw new HTTPException14(400, { message: parsed.error.issues[0]?.message ?? "invalid checkout request" });
     }
     const body = parsed.data;
     const accountId = requireSelectedAccount(context, body.accountId, "billing:manage");
@@ -4738,7 +4835,7 @@ function registerBillingRoutes(app, deps) {
       idempotencyKey
     }), { idempotencyKey });
     if (!session.url) {
-      throw new HTTPException12(502, { message: "Stripe did not return a checkout URL" });
+      throw new HTTPException14(502, { message: "Stripe did not return a checkout URL" });
     }
     return c.json(CreateCheckoutResponse.parse({
       checkoutSessionId: session.id,
@@ -4747,18 +4844,18 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/webhooks/stripe", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException12(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException14(404, { message: "stripe billing is not enabled" });
     }
     const signature = c.req.header("stripe-signature");
     if (!signature) {
-      throw new HTTPException12(400, { message: "missing stripe-signature" });
+      throw new HTTPException14(400, { message: "missing stripe-signature" });
     }
     const payload = await c.req.text();
     let event;
     try {
       event = await stripeClient(deps).webhooks.constructEventAsync(payload, signature, deps.settings.stripeWebhookSecret);
     } catch (error) {
-      throw new HTTPException12(400, { message: error instanceof Error ? error.message : "invalid stripe signature" });
+      throw new HTTPException14(400, { message: error instanceof Error ? error.message : "invalid stripe signature" });
     }
     const firstSeen = await recordStripeWebhookEvent(deps.db, {
       id: event.id,
@@ -4776,7 +4873,7 @@ function registerBillingRoutes(app, deps) {
       await markStripeWebhookProcessed(deps.db, event.id);
       return c.json({ received: true });
     } catch (error) {
-      throw new HTTPException12(500, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException14(500, { message: error instanceof Error ? error.message : String(error) });
     }
   });
 }
@@ -4828,7 +4925,7 @@ function stripeCheckoutSessionCreateParams(input) {
 }
 function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   if (!publicBaseUrl) {
-    throw new HTTPException12(500, { message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe checkout" });
+    throw new HTTPException14(500, { message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe checkout" });
   }
   const base = new URL(publicBaseUrl);
   const fallback = new URL(fallbackPath, base).toString();
@@ -4837,7 +4934,7 @@ function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   }
   const parsed = new URL(candidate);
   if (parsed.origin !== base.origin) {
-    throw new HTTPException12(400, { message: `${field} must use the OpenGeni public origin` });
+    throw new HTTPException14(400, { message: `${field} must use the OpenGeni public origin` });
   }
   return parsed.toString();
 }
@@ -5069,7 +5166,7 @@ async function getOrCreateStripeCustomer(deps, stripe, context, accountId) {
   }
   const account = await getManagedAccount(deps.db, accountId);
   if (!account) {
-    throw new HTTPException12(404, { message: "account not found" });
+    throw new HTTPException14(404, { message: "account not found" });
   }
   const customer = await stripe.customers.create({
     name: account.name,
@@ -5095,17 +5192,17 @@ function stripeCustomerProvider(input) {
 function requireSelectedAccount(context, requested, permission) {
   const accountId = requested ?? context.defaultAccountId ?? void 0;
   if (!accountId) {
-    throw new HTTPException12(409, { message: "account selection is required" });
+    throw new HTTPException14(409, { message: "account selection is required" });
   }
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException12(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException14(403, { message: `missing permission: ${permission}` });
   }
   return accountId;
 }
 function stripeClient(deps) {
   if (!deps.settings.stripeSecretKey) {
-    throw new HTTPException12(500, { message: "Stripe secret key is not configured" });
+    throw new HTTPException14(500, { message: "Stripe secret key is not configured" });
   }
   return new Stripe(deps.settings.stripeSecretKey);
 }
@@ -5149,7 +5246,7 @@ import {
   verifySignedState
 } from "@opengeni/github";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { HTTPException as HTTPException13 } from "hono/http-exception";
+import { HTTPException as HTTPException15 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
 var githubStateCookie = "opengeni_github_state";
 function registerGitHubRoutes(app, deps) {
@@ -5177,15 +5274,15 @@ function registerGitHubRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const state = c.req.query("state");
     if (!state) {
-      throw new HTTPException13(400, { message: "missing GitHub installation state" });
+      throw new HTTPException15(400, { message: "missing GitHub installation state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || statePayload.workspaceId !== workspaceId) {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub installation state" });
     }
     const slug = settings.githubAppSlug?.trim();
     if (!slug) {
-      throw new HTTPException13(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: githubAppMissingSettings2(settings) }) });
+      throw new HTTPException15(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: githubAppMissingSettings2(settings) }) });
     }
     setGitHubStateCookie(c, deps, state);
     return c.redirect(`https://github.com/apps/${slug}/installations/new?state=${encodeURIComponent(state)}`);
@@ -5197,9 +5294,9 @@ function registerGitHubRoutes(app, deps) {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+        throw new HTTPException15(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
       }
-      throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException15(502, { message: error instanceof Error ? error.message : String(error) });
     }
   });
   app.post("/v1/workspaces/:workspaceId/github/repositories/sync", async (c) => {
@@ -5209,9 +5306,9 @@ function registerGitHubRoutes(app, deps) {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+        throw new HTTPException15(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
       }
-      throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException15(502, { message: error instanceof Error ? error.message : String(error) });
     }
   });
   app.post("/v1/workspaces/:workspaceId/github/app-manifest", async (c) => {
@@ -5243,10 +5340,10 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException13(400, { message: "missing GitHub manifest code" });
+      throw new HTTPException15(400, { message: "missing GitHub manifest code" });
     }
     if (!state || !verifySignedState(state, githubStateSecret)) {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub manifest state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub manifest state" });
     }
     try {
       const conversion = await convertGitHubAppManifest(code);
@@ -5257,7 +5354,7 @@ function registerGitHubRoutes(app, deps) {
       return c.html(githubSuccessHtml(envLines, installUrl));
     } catch (error) {
       const message = error instanceof GitHubAppApiError ? error.message : String(error);
-      throw new HTTPException13(502, { message });
+      throw new HTTPException15(502, { message });
     }
   });
   const handleGitHubInstallCallback = async (c) => {
@@ -5266,28 +5363,28 @@ function registerGitHubRoutes(app, deps) {
     const installationIdRaw = c.req.query("installation_id");
     const setupAction = c.req.query("setup_action") ?? null;
     if (!state) {
-      throw new HTTPException13(400, { message: "missing GitHub installation state" });
+      throw new HTTPException15(400, { message: "missing GitHub installation state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string") {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub installation state" });
     }
     requireGitHubStateCookie(c, state);
     const grant = await requireAccessGrant10(c, deps, statePayload.workspaceId, "github:manage");
     if (grant.accountId !== statePayload.accountId) {
-      throw new HTTPException13(403, { message: "GitHub installation state does not match this workspace" });
+      throw new HTTPException15(403, { message: "GitHub installation state does not match this workspace" });
     }
     if (setupAction === "request" && !installationIdRaw) {
       return c.html(githubSetupPendingHtml());
     }
     const installationId = parsePositiveInteger(installationIdRaw);
     if (installationId === null) {
-      throw new HTTPException13(400, { message: "missing or invalid GitHub installation_id" });
+      throw new HTTPException15(400, { message: "missing or invalid GitHub installation_id" });
     }
     if (!code) {
       const clientId = settings.githubClientId?.trim();
       if (!clientId) {
-        throw new HTTPException13(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: ["OPENGENI_GITHUB_CLIENT_ID"] }) });
+        throw new HTTPException15(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: ["OPENGENI_GITHUB_CLIENT_ID"] }) });
       }
       const oauthState = createSignedState4(githubStateSecret, {
         accountId: grant.accountId,
@@ -5314,15 +5411,15 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException13(400, { message: "missing GitHub OAuth code" });
+      throw new HTTPException15(400, { message: "missing GitHub OAuth code" });
     }
     if (!state) {
-      throw new HTTPException13(400, { message: "missing GitHub OAuth state" });
+      throw new HTTPException15(400, { message: "missing GitHub OAuth state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     const installationId = parsePositiveInteger(String(statePayload?.installationId ?? ""));
     if (!statePayload || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || installationId === null) {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub OAuth state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub OAuth state" });
     }
     requireGitHubStateCookie(c, state);
     return await completeGitHubInstallationBinding(deps, c, {
@@ -5335,19 +5432,19 @@ function registerGitHubRoutes(app, deps) {
 async function completeGitHubInstallationBinding(deps, c, input) {
   const { db, settings } = deps;
   if (!input.statePayload.workspaceId || !input.statePayload.accountId) {
-    throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
+    throw new HTTPException15(400, { message: "invalid or expired GitHub installation state" });
   }
   const grant = await requireAccessGrant10(c, deps, input.statePayload.workspaceId, "github:manage");
   if (grant.accountId !== input.statePayload.accountId) {
-    throw new HTTPException13(403, { message: "GitHub installation state does not match this workspace" });
+    throw new HTTPException15(403, { message: "GitHub installation state does not match this workspace" });
   }
   try {
     const installation = await verifyGitHubInstallationAccessForUser(settings, { code: input.code, installationId: input.installationId });
     if (!installation) {
-      throw new HTTPException13(404, { message: "GitHub App installation was not found for this app" });
+      throw new HTTPException15(404, { message: "GitHub App installation was not found for this app" });
     }
     if (installation.suspended) {
-      throw new HTTPException13(409, { message: "GitHub App installation is suspended" });
+      throw new HTTPException15(409, { message: "GitHub App installation is suspended" });
     }
     await upsertGitHubInstallation(db, {
       accountId: grant.accountId,
@@ -5360,13 +5457,13 @@ async function completeGitHubInstallationBinding(deps, c, input) {
     deleteCookie(c, githubStateCookie, { path: "/v1/github" });
     return c.html(githubSetupSuccessHtml(installation.accountLogin ?? `installation ${input.installationId}`, returnUrl));
   } catch (error) {
-    if (error instanceof HTTPException13) {
+    if (error instanceof HTTPException15) {
       throw error;
     }
     if (error instanceof GitHubAppConfigurationError2) {
-      throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+      throw new HTTPException15(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
     }
-    throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
+    throw new HTTPException15(502, { message: error instanceof Error ? error.message : String(error) });
   }
 }
 function setGitHubStateCookie(c, deps, state) {
@@ -5380,7 +5477,7 @@ function setGitHubStateCookie(c, deps, state) {
 }
 function requireGitHubStateCookie(c, state) {
   if (getCookie(c, githubStateCookie) !== state) {
-    throw new HTTPException13(400, { message: "invalid or expired GitHub installation browser state" });
+    throw new HTTPException15(400, { message: "invalid or expired GitHub installation browser state" });
   }
 }
 function isSecureRequest(c, deps) {
@@ -5447,7 +5544,7 @@ import {
   updatePackInstallationStatus
 } from "@opengeni/db";
 import { getDocumentBase as getDocumentBase2 } from "@opengeni/documents";
-import { HTTPException as HTTPException14 } from "hono/http-exception";
+import { HTTPException as HTTPException16 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant11 } from "@opengeni/core";
 import { requireLimit as requireLimit5 } from "@opengeni/core";
 import { validateEnvironmentAttachment } from "@opengeni/core";
@@ -5478,7 +5575,7 @@ function registerPackRoutes(app, deps) {
     const grant = await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const manifest = RegisterCapabilityPackRequest.parse(await c.req.json());
     if (isBuiltInCapabilityPack(manifest.id)) {
-      throw new HTTPException14(409, { message: `pack id ${manifest.id} is a built-in pack and cannot be replaced` });
+      throw new HTTPException16(409, { message: `pack id ${manifest.id} is a built-in pack and cannot be replaced` });
     }
     const { pack, created } = await registerWorkspacePack(db, {
       accountId: grant.accountId,
@@ -5492,10 +5589,10 @@ function registerPackRoutes(app, deps) {
     await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const packId = c.req.param("packId");
     if (isBuiltInCapabilityPack(packId)) {
-      throw new HTTPException14(409, { message: "built-in packs cannot be unregistered" });
+      throw new HTTPException16(409, { message: "built-in packs cannot be unregistered" });
     }
     if (!await getWorkspacePack(db, workspaceId, packId)) {
-      throw new HTTPException14(404, { message: "pack not found" });
+      throw new HTTPException16(404, { message: "pack not found" });
     }
     const installation = await getPackInstallation(db, workspaceId, packId);
     if (installation && installation.status === "active") {
@@ -5532,13 +5629,13 @@ function registerPackRoutes(app, deps) {
     const storedEnvironmentId = typeof existing?.metadata.environmentId === "string" ? existing.metadata.environmentId : void 0;
     const environmentId = payload.environmentId ?? storedEnvironmentId;
     if (pack.environment?.required && !environmentId) {
-      throw new HTTPException14(422, { message: "this pack requires an environment attachment; pass environmentId" });
+      throw new HTTPException16(422, { message: "this pack requires an environment attachment; pass environmentId" });
     }
     if (environmentId) {
       const environment = await validateEnvironmentAttachment({ settings, db }, grant, workspaceId, environmentId, { preauthorized: !payload.environmentId });
       const missing = (pack.environment?.requiredVariables ?? []).filter((name) => !environment.variables.some((variable) => variable.name === name));
       if (missing.length > 0) {
-        throw new HTTPException14(422, { message: `environment is missing required variable(s): ${missing.join(", ")}` });
+        throw new HTTPException16(422, { message: `environment is missing required variable(s): ${missing.join(", ")}` });
       }
     }
     const installation = await enablePackInstallation(db, {
@@ -5559,13 +5656,13 @@ function registerPackRoutes(app, deps) {
     const pack = await requirePack(db, workspaceId, MARKETING_SOCIAL_PACK_ID);
     const installation = await getPackInstallation(db, workspaceId, pack.id);
     if (installation?.status !== "active") {
-      throw new HTTPException14(409, { message: "enable the marketing social pack before creating its scheduled tasks" });
+      throw new HTTPException16(409, { message: "enable the marketing social pack before creating its scheduled tasks" });
     }
     const payload = MarketingDailyAnalysisTaskRequest.parse(await c.req.json());
     await requireLimit5(deps, { accountId: grant.accountId, workspaceId, action: "schedule:create", quantity: 1 });
     const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
     if (connections.length === 0) {
-      throw new HTTPException14(422, { message: "at least one connected social account is required" });
+      throw new HTTPException16(422, { message: "at least one connected social account is required" });
     }
     await validateDocumentBaseIds(db, workspaceId, payload.documentBaseIds);
     const agentConfig = buildMarketingDailyAnalysisAgentConfig({
@@ -5609,7 +5706,7 @@ function registerPackRoutes(app, deps) {
 async function requirePack(db, workspaceId, packId) {
   const pack = await resolveCapabilityPack(db, workspaceId, packId);
   if (!pack) {
-    throw new HTTPException14(404, { message: "pack not found" });
+    throw new HTTPException16(404, { message: "pack not found" });
   }
   return pack;
 }
@@ -5618,13 +5715,13 @@ async function resolveSocialConnections(db, workspaceId, connectionIds) {
   const connections = ids.length > 0 ? await Promise.all(ids.map(async (id) => {
     const connection = await getSocialConnection(db, workspaceId, id);
     if (!connection) {
-      throw new HTTPException14(422, { message: `unknown social connection: ${id}` });
+      throw new HTTPException16(422, { message: `unknown social connection: ${id}` });
     }
     return connection;
   })) : (await listSocialConnections2(db, workspaceId, 500)).filter((connection) => connection.status === "connected");
   const inactive = connections.find((connection) => connection.status !== "connected");
   if (inactive) {
-    throw new HTTPException14(422, { message: `social connection ${inactive.id} is ${inactive.status}` });
+    throw new HTTPException16(422, { message: `social connection ${inactive.id} is ${inactive.status}` });
   }
   return connections;
 }
@@ -5632,7 +5729,7 @@ async function validateDocumentBaseIds(db, workspaceId, documentBaseIds) {
   for (const baseId of [...new Set(documentBaseIds)]) {
     const base = await getDocumentBase2(db, workspaceId, baseId);
     if (!base) {
-      throw new HTTPException14(422, { message: `unknown document base: ${baseId}` });
+      throw new HTTPException16(422, { message: `unknown document base: ${baseId}` });
     }
   }
 }
@@ -5816,7 +5913,7 @@ import {
   releaseLeaseHolder
 } from "@opengeni/db";
 import { appendAndPublishEvents as appendAndPublishEvents3 } from "@opengeni/events";
-import { HTTPException as HTTPException15 } from "hono/http-exception";
+import { HTTPException as HTTPException17 } from "hono/http-exception";
 import {
   establishSandboxSessionFromEnvelope,
   serializeEstablishedSandboxEnvelope,
@@ -5831,7 +5928,7 @@ async function withChannelA(services, ctx, fn) {
   const { db, settings, bus } = services;
   const { accountId, workspaceId, session, subjectId } = ctx;
   if (session.sandboxBackend === "none") {
-    throw new HTTPException15(409, { message: "sandbox not available" });
+    throw new HTTPException17(409, { message: "sandbox not available" });
   }
   const sandboxGroupId = session.sandboxGroupId;
   const viewerId = crypto.randomUUID();
@@ -5859,7 +5956,7 @@ async function withChannelA(services, ctx, fn) {
   });
   if (acquired.role === "fenced") {
     await release();
-    throw new HTTPException15(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); retry` });
+    throw new HTTPException17(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); retry` });
   }
   let established;
   let leaseSnapshot = acquired.lease;
@@ -5882,7 +5979,7 @@ async function withChannelA(services, ctx, fn) {
         });
       } catch (error) {
         await failWarmingToCold(db, { accountId, workspaceId, sandboxGroupId, expectedEpoch });
-        throw new HTTPException15(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
+        throw new HTTPException17(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
       }
       const resumeEnvelope = await serializeEstablishedSandboxEnvelope(established) ?? envelope ?? null;
       const committed = await commitWarmingToWarm(db, {
@@ -5897,7 +5994,7 @@ async function withChannelA(services, ctx, fn) {
         leaseTtlMs
       });
       if (!committed.committed || !committed.lease) {
-        throw new HTTPException15(409, { message: `sandbox lease superseded (epoch ${expectedEpoch}); retry` });
+        throw new HTTPException17(409, { message: `sandbox lease superseded (epoch ${expectedEpoch}); retry` });
       }
       leaseSnapshot = committed.lease;
     } else {
@@ -5936,11 +6033,11 @@ async function withChannelA(services, ctx, fn) {
   }
 }
 function mapChannelAError(error) {
-  if (error instanceof HTTPException15) return error;
-  if (error instanceof ChannelAValidationError) return new HTTPException15(400, { message: error.message });
-  if (error instanceof ChannelANotFoundError) return new HTTPException15(404, { message: error.message });
-  if (error instanceof ChannelAConflictError) return new HTTPException15(409, { message: error.message });
-  if (error instanceof ChannelAUnsupportedError) return new HTTPException15(409, { message: error.message });
+  if (error instanceof HTTPException17) return error;
+  if (error instanceof ChannelAValidationError) return new HTTPException17(400, { message: error.message });
+  if (error instanceof ChannelANotFoundError) return new HTTPException17(404, { message: error.message });
+  if (error instanceof ChannelAConflictError) return new HTTPException17(409, { message: error.message });
+  if (error instanceof ChannelAUnsupportedError) return new HTTPException17(409, { message: error.message });
   return error;
 }
 async function dropEstablishedHandle(established) {
@@ -5949,7 +6046,7 @@ async function dropEstablishedHandle(established) {
 
 // src/routes/sessions.ts
 import { negotiateCapabilities } from "@opengeni/runtime/sandbox";
-import { HTTPException as HTTPException17 } from "hono/http-exception";
+import { HTTPException as HTTPException19 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant13 } from "@opengeni/core";
 
 // src/sandbox/viewer.ts
@@ -5971,7 +6068,7 @@ import {
   SandboxLeaseSupersededError as SandboxLeaseSupersededError2
 } from "@opengeni/db";
 import { appendAndPublishEvents as appendAndPublishEvents4 } from "@opengeni/events";
-import { HTTPException as HTTPException16 } from "hono/http-exception";
+import { HTTPException as HTTPException18 } from "hono/http-exception";
 import {
   DESKTOP_STREAM_PORT,
   ensureDisplayStack,
@@ -6033,7 +6130,7 @@ async function attachViewer(services, input) {
   });
   if (acquired.role === "fenced") {
     await release();
-    throw new HTTPException16(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); re-read capabilities and re-attach` });
+    throw new HTTPException18(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); re-read capabilities and re-attach` });
   }
   if (acquired.role === "spawner") {
     const expectedEpoch = acquired.lease.leaseEpoch;
@@ -6074,12 +6171,12 @@ async function attachViewer(services, input) {
       };
     } catch (error) {
       if (error instanceof SandboxLeaseSupersededError2) {
-        throw new HTTPException16(409, { message: `sandbox lease superseded (epoch ${error.leaseEpoch}); re-read capabilities and re-attach` });
+        throw new HTTPException18(409, { message: `sandbox lease superseded (epoch ${error.leaseEpoch}); re-read capabilities and re-attach` });
       }
       await failWarmingToCold2(db, { accountId, workspaceId, sandboxGroupId, expectedEpoch });
       await release();
-      if (error instanceof HTTPException16) throw error;
-      throw new HTTPException16(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
+      if (error instanceof HTTPException18) throw error;
+      throw new HTTPException18(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
     } finally {
       await dropEstablishedHandle2(established);
     }
@@ -6546,7 +6643,7 @@ function registerSessionRoutes(app, deps) {
     await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     const session = await getSession4(db, workspaceId, c.req.param("sessionId"));
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     return c.json(session);
   });
@@ -6557,12 +6654,12 @@ function registerSessionRoutes(app, deps) {
     const body = await c.req.json();
     const target = typeof body.target === "string" ? body.target : "";
     if (!target) {
-      throw new HTTPException17(400, { message: 'target is required ("auto" or an account id)' });
+      throw new HTTPException19(400, { message: 'target is required ("auto" or an account id)' });
     }
     const pinned = target === "auto" ? null : target;
     const ok = await setSessionCodexPin(db, workspaceId, sessionId, pinned);
     if (!ok) {
-      throw new HTTPException17(404, { message: "session or codex account not found" });
+      throw new HTTPException19(404, { message: "session or codex account not found" });
     }
     return c.json({ pinned: target === "auto" ? "auto" : target });
   });
@@ -6575,7 +6672,7 @@ function registerSessionRoutes(app, deps) {
     await updateSessionTitle2({ db, bus }, workspaceId, sessionId, payload.title, "user");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     return c.json(session);
   });
@@ -6586,7 +6683,7 @@ function registerSessionRoutes(app, deps) {
     await assertSessionExists(db, workspaceId, sessionId);
     const goal = await getSessionGoal2(db, workspaceId, sessionId);
     if (!goal) {
-      throw new HTTPException17(404, { message: "session goal not found" });
+      throw new HTTPException19(404, { message: "session goal not found" });
     }
     return c.json(goal);
   });
@@ -6598,10 +6695,10 @@ function registerSessionRoutes(app, deps) {
     const payload = UpdateSessionGoalRequest.parse(await c.req.json());
     const existing = await getSessionGoal2(db, workspaceId, sessionId);
     if (!existing) {
-      throw new HTTPException17(404, { message: "session goal not found" });
+      throw new HTTPException19(404, { message: "session goal not found" });
     }
     if (existing.status === "completed") {
-      throw new HTTPException17(409, { message: "session goal is completed; set a new goal instead" });
+      throw new HTTPException19(409, { message: "session goal is completed; set a new goal instead" });
     }
     if (payload.status === "paused") {
       const { goal: goal2, changed: changed2 } = await setSessionGoalStatus2(db, workspaceId, sessionId, {
@@ -6625,7 +6722,7 @@ function registerSessionRoutes(app, deps) {
       return c.json(goal2);
     }
     if (existing.status !== "paused") {
-      throw new HTTPException17(409, { message: `session goal is ${existing.status}; only paused goals can be resumed` });
+      throw new HTTPException19(409, { message: `session goal is ${existing.status}; only paused goals can be resumed` });
     }
     const { goal, changed } = await setSessionGoalStatus2(db, workspaceId, sessionId, { status: "active" });
     if (changed) {
@@ -6650,11 +6747,11 @@ function registerSessionRoutes(app, deps) {
     await assertSessionExists(db, workspaceId, sessionId);
     const clearBody = ClearSessionContextRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!clearBody.success) {
-      throw new HTTPException17(400, { message: "context clear requires an explicit { confirm: true }" });
+      throw new HTTPException19(400, { message: "context clear requires an explicit { confirm: true }" });
     }
     const session = await requireSession3(db, workspaceId, sessionId);
     if (session.status === "queued" || session.status === "running" || session.status === "requires_action") {
-      throw new HTTPException17(409, { message: `session is ${session.status}; cannot clear context mid-turn \u2014 stop the turn first` });
+      throw new HTTPException19(409, { message: `session is ${session.status}; cannot clear context mid-turn \u2014 stop the turn first` });
     }
     const result = await clearSessionContext(db, { accountId: grant.accountId, workspaceId, sessionId });
     await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
@@ -6731,7 +6828,7 @@ function registerSessionRoutes(app, deps) {
     const resources = payload.resources !== void 0 ? normalizeResources(payload.resources) : existing.resources;
     const tools = payload.tools !== void 0 ? validateToolRefs(payload.tools, runtimeSettings) : existing.tools;
     if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
-      throw new HTTPException17(503, { message: "object storage is not configured" });
+      throw new HTTPException19(503, { message: "object storage is not configured" });
     }
     await validateFileResources(db, workspaceId, resources);
     await validateGitHubRepositorySelection(db, workspaceId, [...session.resources, ...resources]);
@@ -6801,7 +6898,7 @@ function registerSessionRoutes(app, deps) {
     }
     const session = await requireSession3(db, workspaceId, sessionId);
     if (event.type === "user.approvalDecision" && session.status !== "requires_action") {
-      throw new HTTPException17(409, { message: `session is ${session.status}; no approval is pending` });
+      throw new HTTPException19(409, { message: `session is ${session.status}; no approval is pending` });
     }
     const eventsToAppend = [{
       type: event.type,
@@ -6811,7 +6908,7 @@ function registerSessionRoutes(app, deps) {
     const appended = await appendAndPublishEvents5(db, bus, workspaceId, sessionId, eventsToAppend);
     const accepted = appended[0];
     if (!accepted) {
-      throw new HTTPException17(500, { message: "failed to append client event" });
+      throw new HTTPException19(500, { message: "failed to append client event" });
     }
     const workflowId = workflowIdForSession2(sessionId);
     if (event.type === "user.approvalDecision") {
@@ -6829,7 +6926,7 @@ function registerSessionRoutes(app, deps) {
   });
   function assertOwnershipEnabled() {
     if (!settings.sandboxOwnershipEnabled) {
-      throw new HTTPException17(404, { message: "sandbox ownership is not enabled for this deployment" });
+      throw new HTTPException19(404, { message: "sandbox ownership is not enabled for this deployment" });
     }
   }
   async function resolveSharedExposure(workspaceId, session) {
@@ -6844,7 +6941,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const lease = await readGroupLease({ db, settings }, { workspaceId, sandboxGroupId: session.sandboxGroupId });
     const { shared, sharedSessionIds } = await resolveSharedExposure(workspaceId, session);
@@ -6939,11 +7036,11 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const parsed = AcknowledgeStreamRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException17(400, { message: "invalid stream acknowledgment request" });
+      throw new HTTPException19(400, { message: "invalid stream acknowledgment request" });
     }
     const recorded = await recordStreamAcknowledgment(db, {
       accountId: grant.accountId,
@@ -6962,21 +7059,21 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const parsed = AttachViewerRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException17(400, { message: "invalid viewer attach request" });
+      throw new HTTPException19(400, { message: "invalid viewer attach request" });
     }
     const wantDesktop = parsed.data.desktop ?? false;
     const { shared } = await resolveSharedExposure(workspaceId, session);
     if (wantDesktop) {
       const ack = await getStreamAcknowledgment(db, { workspaceId, sandboxGroupId: session.sandboxGroupId, subjectId: grant.subjectId });
       if (!ack?.acknowledgedUnredacted) {
-        throw new HTTPException17(409, { message: "stream_acknowledgment_required" });
+        throw new HTTPException19(409, { message: "stream_acknowledgment_required" });
       }
       if (shared && !ack.acknowledgedShared) {
-        throw new HTTPException17(409, { message: "shared_acknowledgment_required" });
+        throw new HTTPException19(409, { message: "shared_acknowledgment_required" });
       }
     }
     const activeSandbox = session.activeSandboxId ? await getSandbox2(db, workspaceId, session.activeSandboxId) : null;
@@ -7075,11 +7172,11 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const parsed = ViewerHeartbeatRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException17(400, { message: "viewer heartbeat requires { leaseEpoch }" });
+      throw new HTTPException19(400, { message: "viewer heartbeat requires { leaseEpoch }" });
     }
     const alive = await heartbeatViewer({ db, settings }, {
       accountId: grant.accountId,
@@ -7097,7 +7194,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     await detachViewer({ db, settings }, {
       accountId: grant.accountId,
@@ -7114,7 +7211,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const result = await revokeViewer(db, {
       accountId: grant.accountId,
@@ -7132,7 +7229,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId") ?? "";
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     return { accountId: grant.accountId, workspaceId, session, subjectId: grant.subjectId };
   }
@@ -7140,7 +7237,7 @@ function registerSessionRoutes(app, deps) {
     const raw = await c.req.json().catch(() => void 0);
     const result = schema.safeParse(raw ?? {});
     if (!result.success) {
-      throw new HTTPException17(400, { message: "invalid request body" });
+      throw new HTTPException19(400, { message: "invalid request body" });
     }
     return result.data;
   }
@@ -7245,10 +7342,10 @@ function registerSessionRoutes(app, deps) {
     const req = await parseChannelABody(c, PtyWriteRequest);
     const pty = await getOpenPtySession(db, ctx.workspaceId, req.ptyId);
     if (!pty) {
-      throw new HTTPException17(404, { message: "pty not found or closed" });
+      throw new HTTPException19(404, { message: "pty not found or closed" });
     }
     if (pty.execSessionId === null) {
-      throw new HTTPException17(409, { message: "interactive terminal unsupported on this backend" });
+      throw new HTTPException19(409, { message: "interactive terminal unsupported on this backend" });
     }
     let seq = 1;
     await withChannelA({ db, settings, bus }, ctx, async ({ service }) => {
@@ -7266,7 +7363,7 @@ function registerSessionRoutes(app, deps) {
     const req = await parseChannelABody(c, PtyResizeRequest);
     const pty = await getOpenPtySession(db, ctx.workspaceId, req.ptyId);
     if (!pty) {
-      throw new HTTPException17(404, { message: "pty not found or closed" });
+      throw new HTTPException19(404, { message: "pty not found or closed" });
     }
     if (pty.execSessionId !== null) {
       await withChannelA({ db, settings, bus }, ctx, ({ service }) => service.ptyResize(req, pty.execSessionId));
@@ -7336,7 +7433,7 @@ import {
   listSocialConnections as listSocialConnections3,
   listSocialPosts as listSocialPosts2
 } from "@opengeni/db";
-import { HTTPException as HTTPException18 } from "hono/http-exception";
+import { HTTPException as HTTPException20 } from "hono/http-exception";
 import { z as z2 } from "zod";
 import { requireAccessGrant as requireAccessGrant14 } from "@opengeni/core";
 function registerSocialRoutes(app, deps) {
@@ -7408,7 +7505,7 @@ function parseSince(raw) {
   }
   const since = new Date(raw);
   if (Number.isNaN(since.getTime())) {
-    throw new HTTPException18(422, { message: "since must be an ISO date-time" });
+    throw new HTTPException20(422, { message: "since must be an ISO date-time" });
   }
   return since;
 }
@@ -7419,7 +7516,7 @@ function parseConnectionIds(raw) {
   const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
   const parsed = z2.array(z2.string().uuid()).safeParse(values);
   if (!parsed.success) {
-    throw new HTTPException18(422, { message: "connectionIds must be a comma-separated list of UUIDs" });
+    throw new HTTPException20(422, { message: "connectionIds must be a comma-separated list of UUIDs" });
   }
   const ids = parsed.data;
   return [...new Set(ids)];
@@ -7427,12 +7524,12 @@ function parseConnectionIds(raw) {
 function socialHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException18(404, { message });
+    return new HTTPException20(404, { message });
   }
   if (message.includes("duplicate key")) {
-    return new HTTPException18(409, { message: "social connection or post already exists" });
+    return new HTTPException20(409, { message: "social connection or post already exists" });
   }
-  return new HTTPException18(500, { message });
+  return new HTTPException20(500, { message });
 }
 
 // src/routes/workspaces.ts
@@ -7460,7 +7557,7 @@ import {
   requireWorkspace,
   updateWorkspace
 } from "@opengeni/db";
-import { HTTPException as HTTPException19 } from "hono/http-exception";
+import { HTTPException as HTTPException21 } from "hono/http-exception";
 import { hasPermission as hasPermission3, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant15 } from "@opengeni/core";
 import { requireLimit as requireLimit7 } from "@opengeni/core";
 import { assertWorkspaceDeletable, assertWorkspaceMemberRemovable, resolveMemberSubjectId } from "@opengeni/core";
@@ -7482,7 +7579,7 @@ function registerWorkspaceRoutes(app, deps) {
     const payload = CreateWorkspaceRequest.parse(await c.req.json());
     const accountId = payload.accountId ?? context.defaultAccountId;
     if (!accountId) {
-      throw new HTTPException19(409, { message: "account selection is required" });
+      throw new HTTPException21(409, { message: "account selection is required" });
     }
     requireAccountPermission(context, accountId, "workspace:create");
     await requireLimit7(deps, { accountId, action: "workspace:create", quantity: 1 });
@@ -7558,7 +7655,7 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException19(500, { message: "failed to add member" });
+      throw new HTTPException21(500, { message: "failed to add member" });
     }
     return c.json(WorkspaceMember.parse(member), 201);
   });
@@ -7570,7 +7667,7 @@ function registerWorkspaceRoutes(app, deps) {
     const existing = await listWorkspaceMembers(deps.db, workspaceId);
     const current = existing.find((member2) => member2.subjectId === subjectId);
     if (!current) {
-      throw new HTTPException19(404, { message: "member not found" });
+      throw new HTTPException21(404, { message: "member not found" });
     }
     await grantWorkspaceAccess(deps.db, {
       accountId: grant.accountId,
@@ -7583,7 +7680,7 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException19(500, { message: "failed to update member" });
+      throw new HTTPException21(500, { message: "failed to update member" });
     }
     return c.json(WorkspaceMember.parse(member));
   });
@@ -7607,7 +7704,7 @@ function normalizeAgentInstructions(value) {
 function requireAccountPermission(context, accountId, permission) {
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException19(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException21(403, { message: `missing permission: ${permission}` });
   }
 }
 
@@ -7634,7 +7731,7 @@ function createApp(deps) {
   const documentIndexer = deps.documentIndexer ?? {
     indexDocument: async ({ accountId, workspaceId, documentId }) => {
       if (!objectStorage) {
-        throw new HTTPException20(503, { message: "object storage is not configured" });
+        throw new HTTPException22(503, { message: "object storage is not configured" });
       }
       return await indexDocumentNow(deps.db, objectStorage, workspaceId, documentId, getDocumentServices(), {
         beforeEmbed: async ({ chunkCount }) => {
@@ -7795,6 +7892,7 @@ function createApp(deps) {
   registerSocialRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
+  registerCatalogAssetRoutes(app, routeDeps);
   registerEnrollmentRoutes(app, routeDeps);
   registerMachineRoutes(app, routeDeps);
   registerEnvironmentRoutes(app, routeDeps);
@@ -7835,7 +7933,7 @@ function allowedCorsOrigin(pattern, origin) {
   return new RegExp(`^(?:${pattern})$`).test(origin);
 }
 function httpStatusForError(error) {
-  if (error instanceof HTTPException20) {
+  if (error instanceof HTTPException22) {
     return error.status;
   }
   return 500;
@@ -7958,6 +8056,7 @@ var routeLabelPatterns = [
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections$/, label: "/v1/workspaces/:workspaceId/connections" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/, label: "/v1/workspaces/:workspaceId/connections/oauth/start" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/, label: "/v1/workspaces/:workspaceId/connections/:connectionId" },
+  { pattern: /^\/v1\/catalog-assets\/.+$/, label: "/v1/catalog-assets/*" },
   { pattern: /^\/v1\/integrations\/oauth\/callback$/, label: "/v1/integrations/oauth/callback" },
   { pattern: /^\/v1\/integrations\/oauth\/client-metadata\.json$/, label: "/v1/integrations/oauth/client-metadata.json" },
   { pattern: /^\/v1\/enrollments\/device\/start$/, label: "/v1/enrollments/device/start" },
@@ -7997,4 +8096,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession3 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-DQ5TIRDZ.js.map
+//# sourceMappingURL=chunk-YY6OAEL6.js.map