@opengeni/api-router 0.5.1 → 0.5.3

package/dist/{chunk-DQ5TIRDZ.js → chunk-3HIA43CC.js}

@@ -12,7 +12,7 @@ import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { HTTPException as HTTPException20 } from "hono/http-exception";
+import { HTTPException as HTTPException22 } from "hono/http-exception";
 import { hasPermission as hasPermission4, requireAccessGrant as requireAccessGrant16, requirePermission } from "@opengeni/core";
 
 // src/auth/managed-auth.ts
@@ -1836,6 +1836,9 @@ function isAuthExempt(c, settings) {
   if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json") {
     return true;
   }
+  if (path.startsWith("/v1/catalog-assets/")) {
+    return true;
+  }
   if (githubConnectPathPattern.test(path)) {
     return true;
   }
@@ -1964,6 +1967,91 @@ function registerCapabilityRoutes(app, deps) {
   });
 }
 
+// src/routes/catalog-assets.ts
+import { HTTPException as HTTPException3 } from "hono/http-exception";
+var CATALOG_ASSET_PREFIX = "catalog-assets/";
+var MAX_KEY_LENGTH = 512;
+var PRINTABLE_ASCII = /^[\x20-\x7e]+$/;
+var CONTENT_TYPE_BY_EXTENSION = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  svg: "image/svg+xml",
+  webp: "image/webp",
+  gif: "image/gif",
+  ico: "image/x-icon"
+};
+function registerCatalogAssetRoutes(app, deps) {
+  const { settings, objectStorage } = deps;
+  app.get("/v1/catalog-assets/*", async (c) => {
+    if (!settings.integrationsEnabled) {
+      throw new HTTPException3(404, { message: "integrations are not enabled for this deployment" });
+    }
+    if (!objectStorage) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const key = catalogAssetKeyFromPath(new URL(c.req.url).pathname);
+    if (!key) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const contentType = contentTypeForKey(key);
+    if (!contentType) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const object3 = await objectStorage.getObjectBytes(key);
+    if (!object3) {
+      throw new HTTPException3(404, { message: "asset not found" });
+    }
+    const etag = etagForKey(key);
+    const headers = {
+      "Cache-Control": "public, max-age=31536000, immutable",
+      ETag: etag,
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox"
+    };
+    if (ifNoneMatchSatisfied(c.req.header("if-none-match"), etag)) {
+      return c.body(null, 304, headers);
+    }
+    return c.body(new Uint8Array(object3.bytes), 200, { ...headers, "Content-Type": contentType });
+  });
+}
+function catalogAssetKeyFromPath(pathname) {
+  const prefix = "/v1/";
+  if (!pathname.startsWith(prefix)) {
+    return null;
+  }
+  let key;
+  try {
+    key = decodeURIComponent(pathname.slice(prefix.length));
+  } catch {
+    return null;
+  }
+  if (key.length === 0 || key.length > MAX_KEY_LENGTH || !key.startsWith(CATALOG_ASSET_PREFIX) || key.includes("..") || key.includes("\\") || key.includes("//") || !PRINTABLE_ASCII.test(key)) {
+    return null;
+  }
+  return key;
+}
+function contentTypeForKey(key) {
+  const match = /\.([a-zA-Z0-9]+)$/.exec(key);
+  const ext = match?.[1]?.toLowerCase();
+  return ext ? CONTENT_TYPE_BY_EXTENSION[ext] ?? null : null;
+}
+function etagForKey(key) {
+  const filename = key.slice(key.lastIndexOf("/") + 1);
+  const dot = filename.lastIndexOf(".");
+  const digest = dot === -1 ? filename : filename.slice(0, dot);
+  return `"${digest}"`;
+}
+function ifNoneMatchSatisfied(header, etag) {
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return header.split(",").map((value) => value.trim()).includes(etag);
+}
+
 // src/routes/codex.ts
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2 } from "@opengeni/config";
 import {
@@ -1999,7 +2087,7 @@ import {
   CODEX_ROTATION_STRATEGIES
 } from "@opengeni/db";
 import { createSignedState as createSignedState2, readSignedState } from "@opengeni/github";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant2 } from "@opengeni/core";
 var CODEX_PROVIDER_LABEL = "Codex subscription \xB7 no credits";
 function codexAccountJson(row) {
@@ -2043,7 +2131,7 @@ function registerCodexRoutes(app, deps) {
     try {
       start = await startDeviceCode();
     } catch (error) {
-      throw new HTTPException3(502, { message: error instanceof CodexDeviceError ? error.message : "failed to start Codex device login" });
+      throw new HTTPException4(502, { message: error instanceof CodexDeviceError ? error.message : "failed to start Codex device login" });
     }
     const state = createSignedState2(githubStateSecret, { workspaceId, deviceAuthId: start.deviceAuthId, userCode: start.userCode });
     return c.json({ userCode: start.userCode, verificationUri: start.verificationUri, intervalSeconds: start.intervalSeconds, state });
@@ -2054,7 +2142,7 @@ function registerCodexRoutes(app, deps) {
     const { state } = await c.req.json();
     const payload = state ? readSignedState(state, githubStateSecret) : null;
     if (!payload || payload.workspaceId !== workspaceId || !payload.deviceAuthId || !payload.userCode) {
-      throw new HTTPException3(400, { message: "codex connect state is invalid or expired" });
+      throw new HTTPException4(400, { message: "codex connect state is invalid or expired" });
     }
     if (typeof payload.iat === "number" && Date.now() / 1e3 - payload.iat > CODEX_DEVICE_EXPIRY_SECONDS) {
       return c.json({ status: "expired" });
@@ -2063,7 +2151,7 @@ function registerCodexRoutes(app, deps) {
     try {
       poll = await pollDeviceCode({ deviceAuthId: payload.deviceAuthId, userCode: payload.userCode });
     } catch (error) {
-      throw new HTTPException3(502, { message: error instanceof CodexDeviceError ? error.message : "codex device poll failed" });
+      throw new HTTPException4(502, { message: error instanceof CodexDeviceError ? error.message : "codex device poll failed" });
     }
     if (poll.status === "pending") {
       return c.json({ status: "pending" });
@@ -2075,12 +2163,12 @@ function registerCodexRoutes(app, deps) {
     try {
       tokens = await exchangeDeviceCode({ authorizationCode: poll.authorizationCode, codeVerifier: poll.codeVerifier });
     } catch (error) {
-      throw new HTTPException3(502, { message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed" });
+      throw new HTTPException4(502, { message: error instanceof CodexDeviceError ? error.message : "codex token exchange failed" });
     }
     const id = parseIdToken(tokens.idToken);
     const key = environmentsEncryptionKeyBytes2(settings);
     if (!key) {
-      throw new HTTPException3(500, { message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured" });
+      throw new HTTPException4(500, { message: "OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured" });
     }
     const upserted = await upsertCodexSubscriptionCredential(db, {
       accountId: grant.accountId,
@@ -2174,7 +2262,7 @@ function registerCodexRoutes(app, deps) {
     const accountId = c.req.param("accountId");
     const activated = await setActiveCodexCredential(db, workspaceId, accountId);
     if (!activated) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     return c.json({ activated: true, accountId });
   });
@@ -2188,17 +2276,17 @@ function registerCodexRoutes(app, deps) {
     }
     if (typeof body.rotationStrategy === "string") {
       if (!CODEX_ROTATION_STRATEGIES.includes(body.rotationStrategy)) {
-        throw new HTTPException3(400, { message: "invalid rotation strategy" });
+        throw new HTTPException4(400, { message: "invalid rotation strategy" });
       }
       patch.rotationStrategy = body.rotationStrategy;
     }
     if (patch.rotationEnabled === void 0 && patch.rotationStrategy === void 0) {
-      throw new HTTPException3(400, { message: "no settings to update" });
+      throw new HTTPException4(400, { message: "no settings to update" });
     }
     await ensureCodexRotationSettings(db, grant.accountId, workspaceId);
     const updated = await updateCodexRotationSettings(db, workspaceId, patch);
     if (!updated) {
-      throw new HTTPException3(404, { message: "codex rotation settings not found" });
+      throw new HTTPException4(404, { message: "codex rotation settings not found" });
     }
     return c.json({
       rotationEnabled: updated.rotationEnabled,
@@ -2214,12 +2302,12 @@ function registerCodexRoutes(app, deps) {
     const label = typeof body.label === "string" ? body.label : null;
     const renamed = await renameCodexAccount(db, workspaceId, accountId, label);
     if (!renamed) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     const row = accounts.find((account) => account.id === accountId);
     if (!row) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     return c.json(codexAccountJson(row));
   });
@@ -2241,7 +2329,7 @@ function registerCodexRoutes(app, deps) {
     await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
     const status = await getCodexCredentialStatus(db, workspaceId);
     if (!status?.credentialId) {
-      throw new HTTPException3(404, { message: "codex subscription is not connected" });
+      throw new HTTPException4(404, { message: "codex subscription is not connected" });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, status.credentialId);
     return c.json(codexUsageJson(payload));
@@ -2252,7 +2340,7 @@ function registerCodexRoutes(app, deps) {
     const accountId = c.req.param("accountId");
     const accounts = await listCodexAccountStatuses(db, workspaceId);
     if (!accounts.some((account) => account.id === accountId)) {
-      throw new HTTPException3(404, { message: "codex account not found" });
+      throw new HTTPException4(404, { message: "codex account not found" });
     }
     const payload = await fetchCodexUsageForAccount(db, settings, workspaceId, accountId);
     return c.json(codexUsageJson(payload));
@@ -2297,7 +2385,7 @@ import {
   revokeConnection,
   updateConnection as updateConnection2
 } from "@opengeni/db";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 
 // src/integrations/oauth-client.ts
 import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
@@ -2321,21 +2409,46 @@ import { Buffer } from "buffer";
 import { createHash, randomBytes } from "crypto";
 import { lookup } from "dns/promises";
 import { isIP } from "net";
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
+
+// src/integrations/provider-domain.ts
+import { HTTPException as HTTPException5 } from "hono/http-exception";
+function canonicalProviderDomain(value) {
+  const canonical = value.trim().toLowerCase().replace(/^www\./, "");
+  if (!canonical) {
+    throw new HTTPException5(400, { message: "providerDomain must not be empty" });
+  }
+  return canonical;
+}
+
+// src/integrations/oauth-client.ts
 var oauthStateTtlMs = 10 * 60 * 1e3;
+var OAuthCallbackStageError = class extends Error {
+  constructor(stage2, reason, cause) {
+    super(errorMessage(cause));
+    this.stage = stage2;
+    this.reason = reason;
+    this.cause = cause;
+    this.name = "OAuthCallbackStageError";
+  }
+  stage;
+  reason;
+  cause;
+};
 async function startMcpOAuth(deps, context) {
   const { db, settings } = deps;
-  const resource = canonicalMcpResource(context.payload.mcpUrl ?? context.payload.resource);
-  const providerDomain = canonicalProviderDomain(context.payload.providerDomain ?? new URL(resource).hostname);
+  const mcpUrl = canonicalMcpResource(context.payload.mcpUrl ?? context.payload.resource);
+  const providerDomain = canonicalProviderDomain(context.payload.providerDomain ?? new URL(mcpUrl).hostname);
   const returnPath = safeReturnPath(context.payload.returnPath ?? "/integrations");
   const baseUrl = integrationBaseUrl(settings.publicBaseUrl, context.requestUrl);
   const redirectUri = `${baseUrl}/v1/integrations/oauth/callback`;
   const metadataUrl = `${baseUrl}/v1/integrations/oauth/client-metadata.json`;
   const existing = context.payload.connectionId ? await getConnectionMetadata(db, context.workspaceId, context.payload.connectionId, context.subjectId) : null;
   if (context.payload.connectionId && !existing) {
-    throw new HTTPException4(404, { message: "connection not found" });
+    throw new HTTPException6(404, { message: "connection not found" });
   }
-  const discovery = await discoverMcpOAuth(resource, settings);
+  const discovery = await discoverMcpOAuth(mcpUrl, settings);
+  const resource = discovery.prm.resource ? canonicalOAuthResource(discovery.prm.resource) : mcpUrl;
   const client = await registerOAuthClient(db, settings, discovery.as, metadataUrl, redirectUri);
   const verifier = randomPkceVerifier();
   const authorizeScopes = chooseAuthorizeScopes(context.payload.requestedScopes, discovery.challenge.scope, discovery.prm.scopesSupported);
@@ -2345,6 +2458,7 @@ async function startMcpOAuth(deps, context) {
     workspaceId: context.workspaceId,
     subjectId: context.subjectId,
     providerDomain,
+    mcpUrl,
     resource,
     requestedScopes: uniqueStrings(context.payload.requestedScopes ?? []),
     authorizeScopes,
@@ -2374,24 +2488,33 @@ async function startMcpOAuth(deps, context) {
   });
 }
 async function completeMcpOAuthCallback(deps, input) {
-  const { db, settings } = deps;
+  const { db, settings, observability } = deps;
+  let state = null;
   if (!input.state) {
-    throw new HTTPException4(400, { message: "missing OAuth state" });
-  }
-  const state = readOAuthState(input.state, settings);
-  if (!input.code) {
-    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "missing_code" }) };
+    const error = new OAuthCallbackStageError("state_verify", "state_invalid", new Error("missing OAuth state"));
+    logOAuthCallbackFailure(observability, error, state);
+    return { redirectTo: callbackReturnPath("/integrations", "error", { reason: error.reason }) };
   }
-  const consumed = await consumeIntegrationOAuthStateNonce(db, {
-    accountId: state.accountId,
-    workspaceId: state.workspaceId,
-    subjectId: state.subjectId,
-    nonce: state.nonce,
-    expiresAt: new Date(state.iat * 1e3 + oauthStateTtlMs),
-    now: /* @__PURE__ */ new Date()
-  });
-  if (!consumed) {
-    throw new HTTPException4(400, { message: "OAuth state has already been used" });
+  try {
+    state = readOAuthState(input.state, settings);
+    if (!input.code) {
+      return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "missing_code" }) };
+    }
+    const consumed = await consumeIntegrationOAuthStateNonce(db, {
+      accountId: state.accountId,
+      workspaceId: state.workspaceId,
+      subjectId: state.subjectId,
+      nonce: state.nonce,
+      expiresAt: new Date(state.iat * 1e3 + oauthStateTtlMs),
+      now: /* @__PURE__ */ new Date()
+    });
+    if (!consumed) {
+      throw new HTTPException6(400, { message: "OAuth state has already been used" });
+    }
+  } catch (error) {
+    const staged = new OAuthCallbackStageError("state_verify", "state_invalid", error);
+    logOAuthCallbackFailure(observability, staged, state);
+    return { redirectTo: callbackReturnPath(state?.returnPath ?? "/integrations", "error", { reason: staged.reason }) };
   }
   try {
     const baseUrl = integrationBaseUrl(settings.publicBaseUrl, input.requestUrl);
@@ -2399,28 +2522,30 @@ async function completeMcpOAuthCallback(deps, input) {
     const key = requireEnvironmentEncryption2(settings);
     const verifier = decryptEnvironmentValue(key, state.encryptedPkceVerifier);
     const client = await clientForState(db, settings, state);
-    const token = await exchangeAuthorizationCode(settings, {
+    const token = await stage("token_exchange", "token_exchange_failed", () => exchangeAuthorizationCode(settings, {
       code: input.code,
       verifier,
       redirectUri,
       resource: state.resource,
       tokenEndpoint: state.tokenEndpoint,
       client
-    });
-    const tools = await verifyMcpToolsList(settings, state.resource, token);
+    }));
+    const verification = await verifyMcpToolsListNonFatal(observability, settings, state, token);
     const scopes = grantedScopes(token.scopeText, state.authorizeScopes);
     const credential = credentialBundle(token, state, client);
     const metadata = {
       resource: state.resource,
+      mcpUrl: state.mcpUrl,
       authorizationServer: state.authorizationServer,
       authorizationServerIssuer: state.issuer,
       tokenEndpoint: state.tokenEndpoint,
       clientId: client.clientId,
       clientRegistrationMethod: state.clientRegistrationMethod,
-      mcpTools: tools
+      mcpToolsVerification: verification.metadata,
+      ...verification.tools ? { mcpTools: verification.tools } : {}
     };
     const credentialEncrypted = encryptEnvironmentValue3(key, JSON.stringify(credential));
-    const connection = state.connectionId ? await updateConnection(db, {
+    const connection = await stage("persist", "persist_failed", () => state.connectionId ? updateConnection(db, {
       workspaceId: state.workspaceId,
       connectionId: state.connectionId,
       visibleToSubjectId: state.subjectId,
@@ -2433,7 +2558,7 @@ async function completeMcpOAuthCallback(deps, input) {
       expiresAt: token.expiresAt,
       metadata,
       updatedBySubjectId: state.subjectId
-    }) : await createConnection(db, {
+    }) : createConnection(db, {
       accountId: state.accountId,
       workspaceId: state.workspaceId,
       subjectId: null,
@@ -2444,16 +2569,21 @@ async function completeMcpOAuthCallback(deps, input) {
       expiresAt: token.expiresAt,
       metadata,
       createdBySubjectId: state.subjectId
-    });
+    }));
     if (!connection) {
-      throw new HTTPException4(409, { message: "connection changed during OAuth reconnect; start again" });
+      throw new HTTPException6(409, { message: "connection changed during OAuth reconnect; start again" });
     }
-    return { redirectTo: callbackReturnPath(state.returnPath, "success", { connectionId: connection.id }) };
+    return {
+      redirectTo: callbackReturnPath(state.returnPath, "success", {
+        connectionId: connection.id,
+        providerDomain: connection.providerDomain,
+        ...verification.metadata.status === "failed" ? { verification: "failed" } : {}
+      })
+    };
   } catch (error) {
-    if (error instanceof HTTPException4 && error.status >= 400 && error.status < 500) {
-      throw error;
-    }
-    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "oauth_callback_failed" }) };
+    const staged = error instanceof OAuthCallbackStageError ? error : new OAuthCallbackStageError("persist", "persist_failed", error);
+    logOAuthCallbackFailure(observability, staged, state);
+    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: staged.reason }) };
   }
 }
 function integrationBaseUrl(publicBaseUrl, requestUrl) {
@@ -2462,7 +2592,7 @@ function integrationBaseUrl(publicBaseUrl, requestUrl) {
 function requireIntegrationsStateSecret(settings) {
   const secret = settings.integrationsStateSecret?.trim();
   if (!secret) {
-    throw new HTTPException4(503, { message: "integrations OAuth requires OPENGENI_INTEGRATIONS_STATE_SECRET" });
+    throw new HTTPException6(503, { message: "integrations OAuth requires OPENGENI_INTEGRATIONS_STATE_SECRET" });
   }
   return secret;
 }
@@ -2471,11 +2601,11 @@ async function discoverMcpOAuth(resource, settings) {
   const prm = await discoverProtectedResourceMetadata(resource, settings, challenge.resourceMetadata);
   const authorizationServer = prm.authorizationServers[0];
   if (!authorizationServer) {
-    throw new HTTPException4(422, { message: "MCP protected resource metadata did not advertise an authorization server" });
+    throw new HTTPException6(422, { message: "MCP protected resource metadata did not advertise an authorization server" });
   }
   const as = await discoverAuthorizationServerMetadata(authorizationServer, settings);
   if (!as.codeChallengeMethodsSupported.includes("S256")) {
-    throw new HTTPException4(422, { message: "authorization server does not support required PKCE S256" });
+    throw new HTTPException6(422, { message: "authorization server does not support required PKCE S256" });
   }
   return { challenge, prm, as };
 }
@@ -2496,7 +2626,7 @@ async function discoverProtectedResourceMetadata(resource, settings, advertisedU
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
-      if (error instanceof HTTPException4) {
+      if (error instanceof HTTPException6) {
         throw error;
       }
       return null;
@@ -2515,7 +2645,7 @@ async function discoverProtectedResourceMetadata(resource, settings, advertisedU
       ...stringValue(payload.resource) ? { resource: stringValue(payload.resource) } : {}
     };
   }
-  throw new HTTPException4(422, { message: "could not discover MCP protected resource metadata" });
+  throw new HTTPException6(422, { message: "could not discover MCP protected resource metadata" });
 }
 async function discoverAuthorizationServerMetadata(authorizationServer, settings) {
   const candidates = uniqueStrings([
@@ -2525,7 +2655,7 @@ async function discoverAuthorizationServerMetadata(authorizationServer, settings
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
-      if (error instanceof HTTPException4) {
+      if (error instanceof HTTPException6) {
         throw error;
       }
       return null;
@@ -2549,7 +2679,7 @@ async function discoverAuthorizationServerMetadata(authorizationServer, settings
       ...stringValue(payload.registration_endpoint) ? { registrationEndpoint: stringValue(payload.registration_endpoint) } : {}
     };
   }
-  throw new HTTPException4(422, { message: "could not discover OAuth authorization server metadata" });
+  throw new HTTPException6(422, { message: "could not discover OAuth authorization server metadata" });
 }
 async function registerOAuthClient(db, settings, as, metadataUrl, redirectUri) {
   const operator = operatorClientForAs(settings, as);
@@ -2577,7 +2707,7 @@ async function registerOAuthClient(db, settings, as, metadataUrl, redirectUri) {
     };
   }
   if (!as.registrationEndpoint) {
-    throw new HTTPException4(422, {
+    throw new HTTPException6(422, {
       message: "manual OAuth client credentials are required for this authorization server"
     });
   }
@@ -2597,7 +2727,7 @@ async function registerOAuthClient(db, settings, as, metadataUrl, redirectUri) {
   if (storedWinner.clientId !== dcr.clientId) {
     const winner = await loadIntegrationOAuthClient(db, settings, as.issuer);
     if (!winner) {
-      throw new HTTPException4(422, { message: "OAuth client registration could not be loaded after a registration race" });
+      throw new HTTPException6(422, { message: "OAuth client registration could not be loaded after a registration race" });
     }
     return dcrRegistrationFromStored(winner);
   }
@@ -2649,7 +2779,7 @@ function normalizedIssuerKey(value) {
 }
 async function dynamicClientRegistration(settings, as, redirectUri) {
   if (!as.registrationEndpoint) {
-    throw new HTTPException4(422, { message: "authorization server does not support dynamic client registration" });
+    throw new HTTPException6(422, { message: "authorization server does not support dynamic client registration" });
   }
   await assertOAuthFetchAllowed(as.registrationEndpoint, settings);
   const response = await fetchOAuth(as.registrationEndpoint, settings, {
@@ -2664,12 +2794,12 @@ async function dynamicClientRegistration(settings, as, redirectUri) {
     })
   });
   if (!response.ok) {
-    throw new HTTPException4(422, { message: `dynamic client registration failed with HTTP ${response.status}` });
+    throw new HTTPException6(422, { message: `dynamic client registration failed with HTTP ${response.status}` });
   }
   const payload = await response.json();
   const clientId = stringValue(payload.client_id);
   if (!clientId) {
-    throw new HTTPException4(422, { message: "dynamic client registration response did not include client_id" });
+    throw new HTTPException6(422, { message: "dynamic client registration response did not include client_id" });
   }
   const clientSecret = stringValue(payload.client_secret);
   return {
@@ -2698,19 +2828,21 @@ function buildAuthorizationUrl(input) {
 function readOAuthState(state, settings) {
   const payload = readSignedState2(state, requireIntegrationsStateSecret(settings));
   if (!payload) {
-    throw new HTTPException4(400, { message: "invalid or expired OAuth state" });
+    throw new HTTPException6(400, { message: "invalid or expired OAuth state" });
   }
   const nowSeconds = Math.floor(Date.now() / 1e3);
   const iat = numberValue(payload.iat);
   if (iat === void 0 || nowSeconds - iat > oauthStateTtlMs / 1e3 || nowSeconds < iat) {
-    throw new HTTPException4(400, { message: "invalid or expired OAuth state" });
+    throw new HTTPException6(400, { message: "invalid or expired OAuth state" });
   }
+  const resource = requiredString(payload.resource, "state.resource");
   const parsed = {
     accountId: requiredString(payload.accountId, "state.accountId"),
     workspaceId: requiredString(payload.workspaceId, "state.workspaceId"),
     subjectId: requiredString(payload.subjectId, "state.subjectId"),
     providerDomain: requiredString(payload.providerDomain, "state.providerDomain"),
-    resource: requiredString(payload.resource, "state.resource"),
+    mcpUrl: stringValue(payload.mcpUrl) ?? resource,
+    resource,
     requestedScopes: stringArray(payload.requestedScopes),
     authorizeScopes: stringArray(payload.authorizeScopes),
     encryptedPkceVerifier: requiredString(payload.encryptedPkceVerifier, "state.encryptedPkceVerifier"),
@@ -2745,7 +2877,7 @@ async function clientForState(db, settings, state) {
   if (state.clientRegistrationMethod === "dcr") {
     const stored = await loadIntegrationOAuthClient(db, settings, state.issuer);
     if (!stored || stored.clientId !== state.clientId) {
-      throw new HTTPException4(400, { message: "OAuth client registration is no longer available" });
+      throw new HTTPException6(400, { message: "OAuth client registration is no longer available" });
     }
     return {
       method: "dcr",
@@ -2758,7 +2890,7 @@ async function clientForState(db, settings, state) {
   }
   const entry = operatorClientEntryFor(settings, [state.issuer, state.authorizationServer]);
   if (!entry || entry.clientId !== state.clientId) {
-    throw new HTTPException4(400, { message: "operator OAuth client credentials are no longer available" });
+    throw new HTTPException6(400, { message: "operator OAuth client credentials are no longer available" });
   }
   return {
     method: "operator",
@@ -2786,7 +2918,8 @@ async function exchangeAuthorizationCode(settings, input) {
   }
   const response = await fetchOAuth(input.tokenEndpoint, settings, { method: "POST", headers, body });
   if (!response.ok) {
-    throw new Error(`OAuth token endpoint returned HTTP ${response.status}`);
+    const oauthError = await oauthErrorFromResponse(response);
+    throw new OAuthCallbackStageError("token_exchange", oauthError ?? "token_exchange_failed", new Error(`OAuth token endpoint returned HTTP ${response.status}`));
   }
   const payload = await response.json();
   const accessToken = stringValue(payload.access_token);
@@ -2802,6 +2935,72 @@ async function exchangeAuthorizationCode(settings, input) {
     ...stringValue(payload.scope) ? { scopeText: stringValue(payload.scope) } : {}
   };
 }
+async function stage(stage2, fallbackReason, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    if (error instanceof OAuthCallbackStageError) {
+      throw error;
+    }
+    throw new OAuthCallbackStageError(stage2, fallbackReason, error);
+  }
+}
+function logOAuthCallbackFailure(observability, error, state) {
+  observability?.error("MCP OAuth callback failed", {
+    "opengeni.oauth.stage": error.stage,
+    "opengeni.oauth.reason": error.reason,
+    "opengeni.oauth.provider_domain": state?.providerDomain,
+    "opengeni.oauth.resource_host": state ? safeHost(state.resource) : void 0,
+    "opengeni.oauth.authorization_server": state?.authorizationServer,
+    "opengeni.oauth.issuer": state?.issuer,
+    "opengeni.oauth.client_registration_method": state?.clientRegistrationMethod,
+    error: sanitizedError(error.cause)
+  });
+}
+function logOAuthVerificationWarning(observability, error, state) {
+  observability?.warn("MCP OAuth tools/list verification failed after token exchange", {
+    "opengeni.oauth.stage": error.stage,
+    "opengeni.oauth.reason": error.reason,
+    "opengeni.oauth.provider_domain": state.providerDomain,
+    "opengeni.oauth.resource_host": safeHost(state.resource),
+    "opengeni.oauth.mcp_host": safeHost(state.mcpUrl),
+    "opengeni.oauth.authorization_server": state.authorizationServer,
+    "opengeni.oauth.issuer": state.issuer,
+    "opengeni.oauth.client_registration_method": state.clientRegistrationMethod,
+    error: sanitizedError(error.cause)
+  });
+}
+function sanitizedError(error) {
+  if (error instanceof HTTPException6) {
+    return `HTTPException ${error.status}: ${error.message}`;
+  }
+  if (error instanceof Error) {
+    return `${error.name}: ${error.message}`;
+  }
+  return String(error);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function safeHost(rawUrl) {
+  try {
+    return new URL(rawUrl).host;
+  } catch {
+    return void 0;
+  }
+}
+async function oauthErrorFromResponse(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    return null;
+  }
+  const payload = await response.clone().json().catch(() => null);
+  const error = stringValue(payload?.error);
+  if (!error || !/^[a-zA-Z0-9_.-]{1,80}$/.test(error)) {
+    return null;
+  }
+  return error;
+}
 async function verifyMcpToolsList(settings, resource, token) {
   await assertOAuthFetchAllowed(resource, settings);
   const client = new Client2({ name: "opengeni-integration-verify", version: "0.1.0" }, { capabilities: {} });
@@ -2822,6 +3021,29 @@ async function verifyMcpToolsList(settings, resource, token) {
     await client.close().catch(() => void 0);
   }
 }
+async function verifyMcpToolsListNonFatal(observability, settings, state, token) {
+  try {
+    const tools = await stage("tools_list", "tools_list_failed", () => verifyMcpToolsList(settings, state.mcpUrl, token));
+    return {
+      metadata: {
+        status: "ok",
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        toolCount: tools.length
+      },
+      tools
+    };
+  } catch (error) {
+    const staged = error instanceof OAuthCallbackStageError ? error : new OAuthCallbackStageError("tools_list", "tools_list_failed", error);
+    logOAuthVerificationWarning(observability, staged, state);
+    return {
+      metadata: {
+        status: "failed",
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        reason: staged.reason
+      }
+    };
+  }
+}
 function credentialBundle(token, state, client) {
   return {
     access_token: token.accessToken,
@@ -2829,6 +3051,7 @@ function credentialBundle(token, state, client) {
     token_type: token.tokenType,
     ...token.expiresAt ? { expires_at: token.expiresAt.toISOString() } : {},
     resource: state.resource,
+    mcp_url: state.mcpUrl,
     ...token.scopeText ? { scope: token.scopeText } : state.authorizeScopes.length ? { scope: state.authorizeScopes.join(" ") } : {},
     token_endpoint: state.tokenEndpoint,
     client_id: client.clientId,
@@ -2845,27 +3068,40 @@ function callbackReturnPath(returnPath, status, params) {
 }
 function canonicalMcpResource(value) {
   if (!value) {
-    throw new HTTPException4(400, { message: "mcpUrl is required" });
+    throw new HTTPException6(400, { message: "mcpUrl is required" });
   }
   let url;
   try {
     url = new URL(value);
   } catch {
-    throw new HTTPException4(422, { message: "MCP resource URL is invalid" });
+    throw new HTTPException6(422, { message: "MCP resource URL is invalid" });
   }
   url.hash = "";
   return url.toString();
 }
-function canonicalProviderDomain(value) {
-  return value.trim().toLowerCase().replace(/^www\./, "");
+function canonicalOAuthResource(value) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new HTTPException6(422, { message: "MCP protected resource metadata advertised an invalid resource" });
+  }
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol === "http:" || url.protocol === "https:") {
+      url.hash = "";
+      return url.toString();
+    }
+    return trimmed;
+  } catch {
+    throw new HTTPException6(422, { message: "MCP protected resource metadata advertised an invalid resource" });
+  }
 }
 function safeReturnPath(value) {
   if (!value.startsWith("/") || value.startsWith("//")) {
-    throw new HTTPException4(400, { message: "OAuth returnPath must be a relative path" });
+    throw new HTTPException6(400, { message: "OAuth returnPath must be a relative path" });
   }
   const parsed = new URL(value, "https://opengeni.local");
   if (parsed.origin !== "https://opengeni.local") {
-    throw new HTTPException4(400, { message: "OAuth returnPath must be a relative path" });
+    throw new HTTPException6(400, { message: "OAuth returnPath must be a relative path" });
   }
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;
 }
@@ -2887,39 +3123,39 @@ async function fetchOAuth(rawUrl, settings, init = {}, hop = 0) {
     return response;
   }
   if (hop >= 3) {
-    throw new HTTPException4(422, { message: "OAuth fetch exceeded maximum redirect hops" });
+    throw new HTTPException6(422, { message: "OAuth fetch exceeded maximum redirect hops" });
   }
   const location = response.headers.get("location");
   if (!location) {
-    throw new HTTPException4(422, { message: "OAuth fetch redirect was missing Location" });
+    throw new HTTPException6(422, { message: "OAuth fetch redirect was missing Location" });
   }
   let nextUrl;
   try {
     nextUrl = new URL(location, rawUrl).toString();
   } catch {
-    throw new HTTPException4(422, { message: "OAuth fetch redirect Location was invalid" });
+    throw new HTTPException6(422, { message: "OAuth fetch redirect Location was invalid" });
   }
   return await fetchOAuth(nextUrl, settings, init, hop + 1);
 }
 async function assertOAuthFetchAllowed(rawUrl, settings) {
   const url = new URL(rawUrl);
   if (!["https:", "http:"].includes(url.protocol)) {
-    throw new HTTPException4(422, { message: "OAuth discovery only supports http and https URLs" });
+    throw new HTTPException6(422, { message: "OAuth discovery only supports http and https URLs" });
   }
   if (settings.integrationsAllowPrivateNetworkTargets || ["local", "test"].includes(settings.environment)) {
     return;
   }
   if (url.protocol !== "https:") {
-    throw new HTTPException4(422, { message: "OAuth discovery targets must use https outside local/test" });
+    throw new HTTPException6(422, { message: "OAuth discovery targets must use https outside local/test" });
   }
   const hostname = url.hostname.toLowerCase();
   if (hostname === "localhost" || hostname.endsWith(".localhost")) {
-    throw new HTTPException4(422, { message: "OAuth discovery may not target localhost" });
+    throw new HTTPException6(422, { message: "OAuth discovery may not target localhost" });
   }
   const literal2 = isIP(hostname);
   const addresses = literal2 ? [hostname] : (await lookup(hostname, { all: true })).map((entry) => entry.address);
   if (addresses.some(isPrivateAddress)) {
-    throw new HTTPException4(422, { message: "OAuth discovery may not target private network addresses" });
+    throw new HTTPException6(422, { message: "OAuth discovery may not target private network addresses" });
   }
 }
 function parseWwwAuthenticate(header) {
@@ -2978,7 +3214,7 @@ function registrationMethod(value) {
   if (value === "operator" || value === "cimd" || value === "dcr") {
     return value;
   }
-  throw new HTTPException4(400, { message: "invalid OAuth state" });
+  throw new HTTPException6(400, { message: "invalid OAuth state" });
 }
 function expiresAtFromTokenResponse(payload) {
   const expiresAt = stringValue(payload.expires_at);
@@ -3013,17 +3249,17 @@ function numberValue(value) {
 function requiredString(value, field) {
   const result = stringValue(value);
   if (!result) {
-    throw new HTTPException4(400, { message: `invalid OAuth state: missing ${field}` });
+    throw new HTTPException6(400, { message: `invalid OAuth state: missing ${field}` });
   }
   return result;
 }
 
 // src/routes/connections.ts
 function registerConnectionRoutes(app, deps) {
-  const { db, settings } = deps;
+  const { db, settings, observability } = deps;
   function assertIntegrationsEnabled() {
     if (!settings.integrationsEnabled) {
-      throw new HTTPException5(404, { message: "integrations are not enabled for this deployment" });
+      throw new HTTPException7(404, { message: "integrations are not enabled for this deployment" });
     }
   }
   app.get("/v1/workspaces/:workspaceId/connections", async (c) => {
@@ -3043,7 +3279,7 @@ function registerConnectionRoutes(app, deps) {
       accountId: grant.accountId,
       workspaceId,
       subjectId,
-      providerDomain: payload.providerDomain,
+      providerDomain: canonicalProviderDomain(payload.providerDomain),
       kind: payload.kind,
       credentialEncrypted: encryptCredentialBundle(key, payload.credential),
       grantedScopes: payload.grantedScopes,
@@ -3058,7 +3294,7 @@ function registerConnectionRoutes(app, deps) {
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:read");
     const connection = await getConnectionMetadata2(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
     if (!connection) {
-      throw new HTTPException5(404, { message: "connection not found" });
+      throw new HTTPException7(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -3068,10 +3304,10 @@ function registerConnectionRoutes(app, deps) {
     const payload = UpdateConnectionRequest.parse(await c.req.json());
     if (payload.status !== void 0) {
       if (payload.status !== "active") {
-        throw new HTTPException5(400, { message: 'status can only be set to "active"; use DELETE to revoke' });
+        throw new HTTPException7(400, { message: 'status can only be set to "active"; use DELETE to revoke' });
       }
       if (payload.credential === void 0) {
-        throw new HTTPException5(400, { message: "reactivating a connection requires a new credential" });
+        throw new HTTPException7(400, { message: "reactivating a connection requires a new credential" });
       }
     }
     const key = payload.credential === void 0 ? null : requireEnvironmentEncryption3(settings);
@@ -3081,7 +3317,7 @@ function registerConnectionRoutes(app, deps) {
       connectionId: c.req.param("connectionId"),
       visibleToSubjectId: grant.subjectId,
       updatedBySubjectId: grant.subjectId,
-      ...payload.providerDomain !== void 0 ? { providerDomain: payload.providerDomain } : {},
+      ...payload.providerDomain !== void 0 ? { providerDomain: canonicalProviderDomain(payload.providerDomain) } : {},
       ...subjectId !== void 0 ? { subjectId } : {},
       ...payload.kind !== void 0 ? { kind: payload.kind } : {},
       ...payload.status !== void 0 ? { status: payload.status } : {},
@@ -3091,7 +3327,7 @@ function registerConnectionRoutes(app, deps) {
       ...payload.metadata !== void 0 ? { metadata: payload.metadata } : {}
     });
     if (!connection) {
-      throw new HTTPException5(404, { message: "connection not found" });
+      throw new HTTPException7(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -3100,7 +3336,7 @@ function registerConnectionRoutes(app, deps) {
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
     const connection = await revokeConnection(db, workspaceId, c.req.param("connectionId"), grant.subjectId);
     if (!connection) {
-      throw new HTTPException5(404, { message: "connection not found" });
+      throw new HTTPException7(404, { message: "connection not found" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -3110,10 +3346,10 @@ function registerConnectionRoutes(app, deps) {
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
     const parsed = OAuthStartRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException5(400, { message: parsed.error.issues[0]?.message ?? "invalid OAuth start request" });
+      throw new HTTPException7(400, { message: parsed.error.issues[0]?.message ?? "invalid OAuth start request" });
     }
     const payload = parsed.data;
-    const result = await startMcpOAuth({ db, settings }, {
+    const result = await startMcpOAuth({ db, settings, observability }, {
       accountId: grant.accountId,
       workspaceId,
       subjectId: grant.subjectId,
@@ -3124,7 +3360,7 @@ function registerConnectionRoutes(app, deps) {
   });
   app.get("/v1/integrations/oauth/callback", async (c) => {
     assertIntegrationsEnabled();
-    const result = await completeMcpOAuthCallback({ db, settings }, {
+    const result = await completeMcpOAuthCallback({ db, settings, observability }, {
       code: c.req.query("code"),
       state: c.req.query("state"),
       requestUrl: c.req.url
@@ -3149,7 +3385,7 @@ function writableSubjectId(requested, grantSubjectId) {
     return null;
   }
   if (requested !== grantSubjectId) {
-    throw new HTTPException5(403, { message: "cannot write a connection for another subject" });
+    throw new HTTPException7(403, { message: "cannot write a connection for another subject" });
   }
   return requested;
 }
@@ -3187,7 +3423,7 @@ import {
   searchDocuments as searchDocuments2
 } from "@opengeni/documents";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant4 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage2, requireLimit as requireLimit2 } from "@opengeni/core";
 
@@ -3341,7 +3577,7 @@ function registerDocumentRoutes(app, deps) {
     await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException6(404, { message: "document base not found" });
+      throw new HTTPException8(404, { message: "document base not found" });
     }
     return c.json(DocumentBase.parse(base));
   });
@@ -3349,7 +3585,7 @@ function registerDocumentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException6(503, { message: "object storage is not configured" });
+      throw new HTTPException8(503, { message: "object storage is not configured" });
     }
     await requireLimit2(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
     const payload = AddDocumentRequest.parse(await c.req.json());
@@ -3399,19 +3635,19 @@ function registerDocumentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant4(c, deps, workspaceId, "documents:manage");
     if (!objectStorage) {
-      throw new HTTPException6(503, { message: "object storage is not configured" });
+      throw new HTTPException8(503, { message: "object storage is not configured" });
     }
     await requireLimit2(deps, { accountId: grant.accountId, workspaceId, action: "document:index", quantity: 0 });
     try {
       const document = await getDocument(db, workspaceId, c.req.param("documentId"));
       if (!document) {
-        throw new HTTPException6(404, { message: "document not found" });
+        throw new HTTPException8(404, { message: "document not found" });
       }
       if (document.status !== "failed") {
-        throw new HTTPException6(422, { message: "only failed documents can be retried" });
+        throw new HTTPException8(422, { message: "only failed documents can be retried" });
       }
       if (document.baseId !== c.req.param("baseId")) {
-        throw new HTTPException6(404, { message: "document not found" });
+        throw new HTTPException8(404, { message: "document not found" });
       }
       const queued = await queueDocumentForReindex(db, workspaceId, document.id);
       const indexed = await documentIndexer.indexDocument({ accountId: grant.accountId, workspaceId, documentId: document.id }) ?? queued;
@@ -3430,7 +3666,7 @@ function registerDocumentRoutes(app, deps) {
       }
       return c.json(Document.parse(indexed));
     } catch (error) {
-      if (error instanceof HTTPException6) {
+      if (error instanceof HTTPException8) {
         throw error;
       }
       throw documentHttpException(error);
@@ -3442,7 +3678,7 @@ function registerDocumentRoutes(app, deps) {
     const payload = DocumentSearchRequest.parse(await c.req.json());
     const base = await getDocumentBase(db, workspaceId, c.req.param("baseId"));
     if (!base) {
-      throw new HTTPException6(404, { message: "document base not found" });
+      throw new HTTPException8(404, { message: "document base not found" });
     }
     return c.json({
       results: await searchDocuments2(db, {
@@ -3483,7 +3719,7 @@ function registerDocumentRoutes(app, deps) {
       limit: c.req.query("limit") ? Number(c.req.query("limit")) : void 0
     });
     if (!parsed.success) {
-      throw new HTTPException6(400, { message: "invalid knowledge memory query parameters" });
+      throw new HTTPException8(400, { message: "invalid knowledge memory query parameters" });
     }
     return c.json((await listKnowledgeMemories2(db, workspaceId, parsed.data)).map((memory) => KnowledgeMemory.parse(memory)));
   });
@@ -3492,7 +3728,7 @@ function registerDocumentRoutes(app, deps) {
     await requireAccessGrant4(c, deps, workspaceId, "documents:search");
     const memory = await getKnowledgeMemory(db, workspaceId, c.req.param("memoryId"));
     if (!memory) {
-      throw new HTTPException6(404, { message: "knowledge memory not found" });
+      throw new HTTPException8(404, { message: "knowledge memory not found" });
     }
     return c.json(KnowledgeMemory.parse(memory));
   });
@@ -3533,12 +3769,12 @@ function registerDocumentRoutes(app, deps) {
 function documentHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException6(404, { message });
+    return new HTTPException8(404, { message });
   }
   if (message.includes("pending") || message.includes("failed") || message.includes("deleted")) {
-    return new HTTPException6(422, { message });
+    return new HTTPException8(422, { message });
   }
-  return new HTTPException6(500, { message });
+  return new HTTPException8(500, { message });
 }
 
 // src/routes/enrollments.ts
@@ -3564,7 +3800,7 @@ import {
   listEnrollments,
   revokeEnrollment
 } from "@opengeni/db";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { HTTPException as HTTPException9 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant5 } from "@opengeni/core";
 
 // src/sandbox/enrollment.ts
@@ -3848,7 +4084,7 @@ function registerEnrollmentRoutes(app, deps) {
   const { settings, db } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException7(404, { message: "selfhosted enrollment is not enabled for this deployment" });
+      throw new HTTPException9(404, { message: "selfhosted enrollment is not enabled for this deployment" });
     }
   }
   const startLimiter = new TokenBucket({ capacity: 10, refillPerSecond: 0.5 });
@@ -3858,7 +4094,7 @@ function registerEnrollmentRoutes(app, deps) {
   function rateLimit(c, limiter) {
     const ip = clientIp(c);
     if (!limiter.take(ip)) {
-      throw new HTTPException7(429, { message: "too many requests; slow down" });
+      throw new HTTPException9(429, { message: "too many requests; slow down" });
     }
   }
   app.post("/v1/enrollments/device/start", async (c) => {
@@ -3866,12 +4102,12 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, startLimiter);
     const parsed = DeviceEnrollmentStartRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-start request" });
+      throw new HTTPException9(400, { message: "invalid device-start request" });
     }
     const body = parsed.data;
     const workspace = await getWorkspace(db, body.workspaceId);
     if (!workspace) {
-      throw new HTTPException7(404, { message: "workspace not found" });
+      throw new HTTPException9(404, { message: "workspace not found" });
     }
     const result = await startDeviceEnrollment({ db, settings }, {
       accountId: workspace.accountId,
@@ -3892,7 +4128,7 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, pollLimiter);
     const parsed = DeviceEnrollmentPollRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-poll request" });
+      throw new HTTPException9(400, { message: "invalid device-poll request" });
     }
     const result = await pollDeviceEnrollment({ db, settings }, { deviceCode: parsed.data.deviceCode });
     return c.json(result, 200);
@@ -3902,16 +4138,16 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, lookupLimiter);
     const parsed = DeviceEnrollmentLookupRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-lookup request" });
+      throw new HTTPException9(400, { message: "invalid device-lookup request" });
     }
     const record3 = await lookupDeviceEnrollment({ db, settings }, { userCode: parsed.data.userCode });
     if (!record3) {
-      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException9(404, { message: "no pending enrollment for that code" });
     }
     try {
       await requireAccessGrant5(c, deps, record3.workspaceId, "enrollments:read");
     } catch {
-      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException9(404, { message: "no pending enrollment for that code" });
     }
     return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record3)), 200);
   });
@@ -3920,7 +4156,7 @@ function registerEnrollmentRoutes(app, deps) {
     rateLimit(c, exchangeLimiter);
     const parsed = EnrollTokenExchangeRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid enroll-token-exchange request" });
+      throw new HTTPException9(400, { message: "invalid enroll-token-exchange request" });
     }
     const body = parsed.data;
     const result = await exchangeEnrollToken({ db, settings }, {
@@ -3933,9 +4169,9 @@ function registerEnrollmentRoutes(app, deps) {
     });
     if (!result.ok) {
       if (result.reason === "disabled") {
-        throw new HTTPException7(503, { message: "enrollment credential plane is not configured" });
+        throw new HTTPException9(503, { message: "enrollment credential plane is not configured" });
       }
-      throw new HTTPException7(401, { message: "invalid or expired enroll token" });
+      throw new HTTPException9(401, { message: "invalid or expired enroll token" });
     }
     return c.json(EnrollTokenExchangeResponse.parse({ credentials: result.credentials }), 201);
   });
@@ -3945,7 +4181,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentApproveRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-approve request" });
+      throw new HTTPException9(400, { message: "invalid device-approve request" });
     }
     const body = parsed.data;
     const approved = await approveDeviceEnrollment({ db, settings }, {
@@ -3958,7 +4194,7 @@ function registerEnrollmentRoutes(app, deps) {
       approvedBySubjectLabel: grant.subjectLabel ?? null
     });
     if (!approved) {
-      throw new HTTPException7(404, { message: "no pending enrollment for that code" });
+      throw new HTTPException9(404, { message: "no pending enrollment for that code" });
     }
     return c.json(DeviceEnrollmentApproveResponse.parse({
       approved: true,
@@ -3973,7 +4209,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = DeviceEnrollmentDenyRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid device-deny request" });
+      throw new HTTPException9(400, { message: "invalid device-deny request" });
     }
     const result = await denyDeviceEnrollment({ db, settings }, {
       accountId: grant.accountId,
@@ -3988,7 +4224,7 @@ function registerEnrollmentRoutes(app, deps) {
     assertSelfhostedEnabled();
     const parsed = MintEnrollTokenRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException7(400, { message: "invalid mint-enroll-token request" });
+      throw new HTTPException9(400, { message: "invalid mint-enroll-token request" });
     }
     const minted = await mintEnrollToken({ db, settings }, {
       accountId: grant.accountId,
@@ -3996,7 +4232,7 @@ function registerEnrollmentRoutes(app, deps) {
       allowScreenControl: parsed.data.allowScreenControl
     });
     if (!minted) {
-      throw new HTTPException7(503, { message: "enrollment credential plane is not configured" });
+      throw new HTTPException9(503, { message: "enrollment credential plane is not configured" });
     }
     return c.json(MintEnrollTokenResponse.parse(minted), 201);
   });
@@ -4080,7 +4316,7 @@ import {
   getEnrollment as getEnrollment2,
   readMachineMetricsSeries
 } from "@opengeni/db";
-import { HTTPException as HTTPException8 } from "hono/http-exception";
+import { HTTPException as HTTPException10 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant6 } from "@opengeni/core";
 import { buildFleetContextForSession as buildFleetContextForSession2, swapActiveSandbox as swapActiveSandbox2 } from "@opengeni/core";
 
@@ -4255,7 +4491,7 @@ function registerMachineRoutes(app, deps) {
   const { settings, db, bus } = deps;
   function assertSelfhostedEnabled() {
     if (!settings.sandboxSelfhostedEnabled) {
-      throw new HTTPException8(404, { message: "selfhosted machines are not enabled for this deployment" });
+      throw new HTTPException10(404, { message: "selfhosted machines are not enabled for this deployment" });
     }
   }
   app.get("/v1/workspaces/:workspaceId/machines", async (c) => {
@@ -4273,7 +4509,7 @@ function registerMachineRoutes(app, deps) {
     const enrollmentId = c.req.param("enrollmentId");
     const enrollment = await getEnrollment2(db, workspaceId, enrollmentId);
     if (!enrollment) {
-      throw new HTTPException8(404, { message: "machine not found in this workspace" });
+      throw new HTTPException10(404, { message: "machine not found in this workspace" });
     }
     const windowMs = SERIES_WINDOWS_MS[c.req.query("window") ?? ""] ?? DEFAULT_SERIES_WINDOW_MS;
     const since = new Date(Date.now() - windowMs);
@@ -4318,7 +4554,7 @@ import {
   setWorkspaceEnvironmentVariable as setWorkspaceEnvironmentVariable2,
   updateWorkspaceEnvironment
 } from "@opengeni/db";
-import { HTTPException as HTTPException9 } from "hono/http-exception";
+import { HTTPException as HTTPException11 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant7 } from "@opengeni/core";
 import {
   assertAllowedEnvironmentVariableName as assertAllowedEnvironmentVariableName2,
@@ -4342,21 +4578,21 @@ function registerEnvironmentRoutes(app, deps) {
     const payload = CreateWorkspaceEnvironmentRequest.parse(await c.req.json());
     const name = trimmedEnvironmentName(payload.name);
     if (payload.variables.length > MAX_VARIABLES_PER_ENVIRONMENT2) {
-      throw new HTTPException9(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
+      throw new HTTPException11(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
     }
     const variableNames = /* @__PURE__ */ new Set();
     for (const variable of payload.variables) {
       assertAllowedEnvironmentVariableName2(variable.name);
       if (variableNames.has(variable.name)) {
-        throw new HTTPException9(422, { message: `duplicate environment variable name: ${variable.name}` });
+        throw new HTTPException11(422, { message: `duplicate environment variable name: ${variable.name}` });
       }
       variableNames.add(variable.name);
     }
     if (await countWorkspaceEnvironments2(db, workspaceId) >= MAX_ENVIRONMENTS_PER_WORKSPACE2) {
-      throw new HTTPException9(422, { message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE2} environments` });
+      throw new HTTPException11(422, { message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE2} environments` });
     }
     if (await getWorkspaceEnvironmentByName2(db, workspaceId, name)) {
-      throw new HTTPException9(409, { message: `environment name is already in use: ${name}` });
+      throw new HTTPException11(409, { message: `environment name is already in use: ${name}` });
     }
     const created = await createWorkspaceEnvironment2(db, {
       accountId: grant.accountId,
@@ -4385,7 +4621,7 @@ function registerEnvironmentRoutes(app, deps) {
     if (name !== void 0 && name !== environment.name) {
       const existing = await getWorkspaceEnvironmentByName2(db, workspaceId, name);
       if (existing && existing.id !== environment.id) {
-        throw new HTTPException9(409, { message: `environment name is already in use: ${name}` });
+        throw new HTTPException11(409, { message: `environment name is already in use: ${name}` });
       }
     }
     const updated = await updateWorkspaceEnvironment(db, workspaceId, environment.id, {
@@ -4401,11 +4637,11 @@ function registerEnvironmentRoutes(app, deps) {
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const attachedTasks = await countScheduledTasksUsingEnvironment(db, workspaceId, environment.id);
     if (attachedTasks > 0) {
-      throw new HTTPException9(409, { message: `environment is attached to ${attachedTasks} scheduled task(s); detach first` });
+      throw new HTTPException11(409, { message: `environment is attached to ${attachedTasks} scheduled task(s); detach first` });
     }
     const activeSessions = await countActiveSessionsUsingEnvironment(db, workspaceId, environment.id);
     if (activeSessions > 0) {
-      throw new HTTPException9(409, { message: `environment is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first` });
+      throw new HTTPException11(409, { message: `environment is attached to ${activeSessions} active session(s); wait for them to finish or cancel them first` });
     }
     await deleteWorkspaceEnvironment(db, workspaceId, environment.id);
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.deleted", environmentId: environment.id });
@@ -4420,7 +4656,7 @@ function registerEnvironmentRoutes(app, deps) {
     const payload = SetWorkspaceEnvironmentVariableRequest.parse(await c.req.json());
     const exists = environment.variables.some((variable) => variable.name === name);
     if (!exists && environment.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT2) {
-      throw new HTTPException9(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
+      throw new HTTPException11(422, { message: `an environment supports at most ${MAX_VARIABLES_PER_ENVIRONMENT2} variables` });
     }
     const metadata = await setWorkspaceEnvironmentVariable2(db, {
       accountId: grant.accountId,
@@ -4439,7 +4675,7 @@ function registerEnvironmentRoutes(app, deps) {
     const environment = await requireEnvironmentForApi(db, workspaceId, c.req.param("environmentId"));
     const deleted = await deleteWorkspaceEnvironmentVariable(db, workspaceId, environment.id, name);
     if (!deleted) {
-      throw new HTTPException9(404, { message: "environment variable not found" });
+      throw new HTTPException11(404, { message: "environment variable not found" });
     }
     await recordEnvironmentAuditEvent2(db, { grant, action: "environment.variable.deleted", environmentId: environment.id, variableName: name });
     return c.json({ ok: true });
@@ -4448,7 +4684,7 @@ function registerEnvironmentRoutes(app, deps) {
 function parseVariableName(raw) {
   const parsed = WorkspaceEnvironmentVariableName2.safeParse(raw);
   if (!parsed.success) {
-    throw new HTTPException9(422, { message: "environment variable names must match ^[A-Z][A-Z0-9_]*$" });
+    throw new HTTPException11(422, { message: "environment variable names must match ^[A-Z][A-Z0-9_]*$" });
   }
   assertAllowedEnvironmentVariableName2(parsed.data);
   return parsed.data;
@@ -4456,7 +4692,7 @@ function parseVariableName(raw) {
 function trimmedEnvironmentName(name) {
   const trimmed = name.trim();
   if (!trimmed) {
-    throw new HTTPException9(422, { message: "environment name is required" });
+    throw new HTTPException11(422, { message: "environment name is required" });
   }
   return trimmed;
 }
@@ -4476,7 +4712,7 @@ import {
   markFileUploadFailed,
   requireFile as requireFile2
 } from "@opengeni/db";
-import { HTTPException as HTTPException10 } from "hono/http-exception";
+import { HTTPException as HTTPException12 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant8 } from "@opengeni/core";
 import { recordWorkspaceUsage as recordWorkspaceUsage3, requireLimit as requireLimit3 } from "@opengeni/core";
 function registerFileRoutes(app, deps) {
@@ -4485,12 +4721,12 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant8(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException12(503, { message: "object storage is not configured" });
     }
     const payload = CreateFileUploadRequest.parse(await c.req.json());
     await requireLimit3(deps, { accountId: grant.accountId, workspaceId, action: "file:upload", quantity: payload.sizeBytes });
     if (payload.sizeBytes > objectStorage.maxSinglePutSizeBytes) {
-      throw new HTTPException10(413, { message: `file exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes` });
+      throw new HTTPException12(413, { message: `file exceeds single PUT limit of ${objectStorage.maxSinglePutSizeBytes} bytes` });
     }
     const fileId = crypto.randomUUID();
     const safeFilename = sanitizeFilename(payload.filename);
@@ -4526,33 +4762,33 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant8(c, deps, workspaceId, "files:upload");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException12(503, { message: "object storage is not configured" });
     }
     const upload = await getFileUpload(db, workspaceId, c.req.param("uploadId"));
     if (!upload) {
-      throw new HTTPException10(404, { message: "file upload not found" });
+      throw new HTTPException12(404, { message: "file upload not found" });
     }
     if (upload.status !== "pending") {
-      throw new HTTPException10(409, { message: `file upload is ${upload.status}` });
+      throw new HTTPException12(409, { message: `file upload is ${upload.status}` });
     }
     if (upload.expiresAt.getTime() < Date.now()) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(409, { message: "file upload has expired" });
+      throw new HTTPException12(409, { message: "file upload has expired" });
     }
     const head = await objectStorage.headFile(upload.file).catch((error) => {
-      throw new HTTPException10(409, { message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}` });
+      throw new HTTPException12(409, { message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}` });
     });
     if (Number(head.ContentLength ?? -1) !== upload.file.sizeBytes) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(422, { message: "uploaded object size does not match file metadata" });
+      throw new HTTPException12(422, { message: "uploaded object size does not match file metadata" });
     }
     if (upload.file.contentType && head.ContentType && head.ContentType !== upload.file.contentType) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(422, { message: "uploaded object content type does not match file metadata" });
+      throw new HTTPException12(422, { message: "uploaded object content type does not match file metadata" });
     }
     if (upload.file.sha256 && head.Metadata?.sha256 !== upload.file.sha256) {
       await markFileUploadFailed(db, workspaceId, upload.id, upload.file.id);
-      throw new HTTPException10(422, { message: "uploaded object checksum metadata does not match file metadata" });
+      throw new HTTPException12(422, { message: "uploaded object checksum metadata does not match file metadata" });
     }
     const file = await completeFileUpload(db, workspaceId, upload.id);
     await recordWorkspaceUsage3(deps, {
@@ -4573,7 +4809,7 @@ function registerFileRoutes(app, deps) {
     await requireAccessGrant8(c, deps, workspaceId, "files:read");
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException10(404, { message: "file not found" });
+      throw new HTTPException12(404, { message: "file not found" });
     }
     return c.json(FileAsset.parse(file));
   });
@@ -4581,14 +4817,14 @@ function registerFileRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant8(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
-      throw new HTTPException10(503, { message: "object storage is not configured" });
+      throw new HTTPException12(503, { message: "object storage is not configured" });
     }
     const file = await requireFile2(db, workspaceId, c.req.param("fileId")).catch(() => null);
     if (!file) {
-      throw new HTTPException10(404, { message: "file not found" });
+      throw new HTTPException12(404, { message: "file not found" });
     }
     if (file.status !== "ready") {
-      throw new HTTPException10(409, { message: `file is ${file.status}` });
+      throw new HTTPException12(409, { message: `file is ${file.status}` });
     }
     const signed = await objectStorage.createGetUrl({ key: file.objectKey });
     return c.json(FileDownloadUrlResponse.parse({
@@ -4607,7 +4843,7 @@ function sanitizeFilename(filename) {
 import { CreateApiKeyRequest, CreateApiKeyResponse } from "@opengeni/contracts";
 import { createApiKey, listApiKeys, revokeApiKey } from "@opengeni/db";
 import { zValidator } from "@hono/zod-validator";
-import { HTTPException as HTTPException11 } from "hono/http-exception";
+import { HTTPException as HTTPException13 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant9 } from "@opengeni/core";
 import { requireLimit as requireLimit4 } from "@opengeni/core";
 function registerApiKeyRoutes(app, deps) {
@@ -4648,7 +4884,7 @@ function ensureDelegablePermissions(grantPermissions, requested) {
   }
   const missing = requested.filter((permission) => !grantPermissions.includes(permission));
   if (missing.length > 0) {
-    throw new HTTPException11(403, { message: `cannot delegate missing permissions: ${missing.join(", ")}` });
+    throw new HTTPException13(403, { message: `cannot delegate missing permissions: ${missing.join(", ")}` });
   }
 }
 function generateApiKeyToken() {
@@ -4680,7 +4916,7 @@ import {
   recordStripeWebhookEvent,
   upsertBillingCustomer
 } from "@opengeni/db";
-import { HTTPException as HTTPException12 } from "hono/http-exception";
+import { HTTPException as HTTPException14 } from "hono/http-exception";
 import Stripe from "stripe";
 import { requireAccessContext } from "@opengeni/core";
 function registerBillingRoutes(app, deps) {
@@ -4694,7 +4930,7 @@ function registerBillingRoutes(app, deps) {
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
     const workspaceId = c.req.query("workspaceId");
     if (workspaceId && !context.workspaceGrants.some((grant) => grant.accountId === accountId && grant.workspaceId === workspaceId)) {
-      throw new HTTPException12(403, { message: "missing workspace access for usage query" });
+      throw new HTTPException14(403, { message: "missing workspace access for usage query" });
     }
     return c.json({
       balance: await getBillingBalance(deps.db, accountId),
@@ -4712,12 +4948,12 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/billing/checkout", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException12(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException14(404, { message: "stripe billing is not enabled" });
     }
     const context = await requireAccessContext(c, deps);
     const parsed = CreateCheckoutRequest.safeParse(await c.req.json());
     if (!parsed.success) {
-      throw new HTTPException12(400, { message: parsed.error.issues[0]?.message ?? "invalid checkout request" });
+      throw new HTTPException14(400, { message: parsed.error.issues[0]?.message ?? "invalid checkout request" });
     }
     const body = parsed.data;
     const accountId = requireSelectedAccount(context, body.accountId, "billing:manage");
@@ -4738,7 +4974,7 @@ function registerBillingRoutes(app, deps) {
       idempotencyKey
     }), { idempotencyKey });
     if (!session.url) {
-      throw new HTTPException12(502, { message: "Stripe did not return a checkout URL" });
+      throw new HTTPException14(502, { message: "Stripe did not return a checkout URL" });
     }
     return c.json(CreateCheckoutResponse.parse({
       checkoutSessionId: session.id,
@@ -4747,18 +4983,18 @@ function registerBillingRoutes(app, deps) {
   });
   app.post("/v1/webhooks/stripe", async (c) => {
     if (deps.settings.billingMode !== "stripe") {
-      throw new HTTPException12(404, { message: "stripe billing is not enabled" });
+      throw new HTTPException14(404, { message: "stripe billing is not enabled" });
     }
     const signature = c.req.header("stripe-signature");
     if (!signature) {
-      throw new HTTPException12(400, { message: "missing stripe-signature" });
+      throw new HTTPException14(400, { message: "missing stripe-signature" });
     }
     const payload = await c.req.text();
     let event;
     try {
       event = await stripeClient(deps).webhooks.constructEventAsync(payload, signature, deps.settings.stripeWebhookSecret);
     } catch (error) {
-      throw new HTTPException12(400, { message: error instanceof Error ? error.message : "invalid stripe signature" });
+      throw new HTTPException14(400, { message: error instanceof Error ? error.message : "invalid stripe signature" });
     }
     const firstSeen = await recordStripeWebhookEvent(deps.db, {
       id: event.id,
@@ -4776,7 +5012,7 @@ function registerBillingRoutes(app, deps) {
       await markStripeWebhookProcessed(deps.db, event.id);
       return c.json({ received: true });
     } catch (error) {
-      throw new HTTPException12(500, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException14(500, { message: error instanceof Error ? error.message : String(error) });
     }
   });
 }
@@ -4828,7 +5064,7 @@ function stripeCheckoutSessionCreateParams(input) {
 }
 function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   if (!publicBaseUrl) {
-    throw new HTTPException12(500, { message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe checkout" });
+    throw new HTTPException14(500, { message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe checkout" });
   }
   const base = new URL(publicBaseUrl);
   const fallback = new URL(fallbackPath, base).toString();
@@ -4837,7 +5073,7 @@ function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
   }
   const parsed = new URL(candidate);
   if (parsed.origin !== base.origin) {
-    throw new HTTPException12(400, { message: `${field} must use the OpenGeni public origin` });
+    throw new HTTPException14(400, { message: `${field} must use the OpenGeni public origin` });
   }
   return parsed.toString();
 }
@@ -5069,7 +5305,7 @@ async function getOrCreateStripeCustomer(deps, stripe, context, accountId) {
   }
   const account = await getManagedAccount(deps.db, accountId);
   if (!account) {
-    throw new HTTPException12(404, { message: "account not found" });
+    throw new HTTPException14(404, { message: "account not found" });
   }
   const customer = await stripe.customers.create({
     name: account.name,
@@ -5095,17 +5331,17 @@ function stripeCustomerProvider(input) {
 function requireSelectedAccount(context, requested, permission) {
   const accountId = requested ?? context.defaultAccountId ?? void 0;
   if (!accountId) {
-    throw new HTTPException12(409, { message: "account selection is required" });
+    throw new HTTPException14(409, { message: "account selection is required" });
   }
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException12(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException14(403, { message: `missing permission: ${permission}` });
   }
   return accountId;
 }
 function stripeClient(deps) {
   if (!deps.settings.stripeSecretKey) {
-    throw new HTTPException12(500, { message: "Stripe secret key is not configured" });
+    throw new HTTPException14(500, { message: "Stripe secret key is not configured" });
   }
   return new Stripe(deps.settings.stripeSecretKey);
 }
@@ -5149,7 +5385,7 @@ import {
   verifySignedState
 } from "@opengeni/github";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { HTTPException as HTTPException13 } from "hono/http-exception";
+import { HTTPException as HTTPException15 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
 var githubStateCookie = "opengeni_github_state";
 function registerGitHubRoutes(app, deps) {
@@ -5177,15 +5413,15 @@ function registerGitHubRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const state = c.req.query("state");
     if (!state) {
-      throw new HTTPException13(400, { message: "missing GitHub installation state" });
+      throw new HTTPException15(400, { message: "missing GitHub installation state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || statePayload.workspaceId !== workspaceId) {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub installation state" });
     }
     const slug = settings.githubAppSlug?.trim();
     if (!slug) {
-      throw new HTTPException13(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: githubAppMissingSettings2(settings) }) });
+      throw new HTTPException15(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: githubAppMissingSettings2(settings) }) });
     }
     setGitHubStateCookie(c, deps, state);
     return c.redirect(`https://github.com/apps/${slug}/installations/new?state=${encodeURIComponent(state)}`);
@@ -5197,9 +5433,9 @@ function registerGitHubRoutes(app, deps) {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+        throw new HTTPException15(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
       }
-      throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException15(502, { message: error instanceof Error ? error.message : String(error) });
     }
   });
   app.post("/v1/workspaces/:workspaceId/github/repositories/sync", async (c) => {
@@ -5209,9 +5445,9 @@ function registerGitHubRoutes(app, deps) {
       return c.json({ repositories: await listWorkspaceGitHubRepositories(deps, workspaceId) });
     } catch (error) {
       if (error instanceof GitHubAppConfigurationError2) {
-        throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+        throw new HTTPException15(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
       }
-      throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
+      throw new HTTPException15(502, { message: error instanceof Error ? error.message : String(error) });
     }
   });
   app.post("/v1/workspaces/:workspaceId/github/app-manifest", async (c) => {
@@ -5243,10 +5479,10 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException13(400, { message: "missing GitHub manifest code" });
+      throw new HTTPException15(400, { message: "missing GitHub manifest code" });
     }
     if (!state || !verifySignedState(state, githubStateSecret)) {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub manifest state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub manifest state" });
     }
     try {
       const conversion = await convertGitHubAppManifest(code);
@@ -5257,7 +5493,7 @@ function registerGitHubRoutes(app, deps) {
       return c.html(githubSuccessHtml(envLines, installUrl));
     } catch (error) {
       const message = error instanceof GitHubAppApiError ? error.message : String(error);
-      throw new HTTPException13(502, { message });
+      throw new HTTPException15(502, { message });
     }
   });
   const handleGitHubInstallCallback = async (c) => {
@@ -5266,28 +5502,28 @@ function registerGitHubRoutes(app, deps) {
     const installationIdRaw = c.req.query("installation_id");
     const setupAction = c.req.query("setup_action") ?? null;
     if (!state) {
-      throw new HTTPException13(400, { message: "missing GitHub installation state" });
+      throw new HTTPException15(400, { message: "missing GitHub installation state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     if (!statePayload || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string") {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub installation state" });
     }
     requireGitHubStateCookie(c, state);
     const grant = await requireAccessGrant10(c, deps, statePayload.workspaceId, "github:manage");
     if (grant.accountId !== statePayload.accountId) {
-      throw new HTTPException13(403, { message: "GitHub installation state does not match this workspace" });
+      throw new HTTPException15(403, { message: "GitHub installation state does not match this workspace" });
     }
     if (setupAction === "request" && !installationIdRaw) {
       return c.html(githubSetupPendingHtml());
     }
     const installationId = parsePositiveInteger(installationIdRaw);
     if (installationId === null) {
-      throw new HTTPException13(400, { message: "missing or invalid GitHub installation_id" });
+      throw new HTTPException15(400, { message: "missing or invalid GitHub installation_id" });
     }
     if (!code) {
       const clientId = settings.githubClientId?.trim();
       if (!clientId) {
-        throw new HTTPException13(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: ["OPENGENI_GITHUB_CLIENT_ID"] }) });
+        throw new HTTPException15(409, { message: JSON.stringify({ message: "GitHub App is not configured", missing: ["OPENGENI_GITHUB_CLIENT_ID"] }) });
       }
       const oauthState = createSignedState4(githubStateSecret, {
         accountId: grant.accountId,
@@ -5314,15 +5550,15 @@ function registerGitHubRoutes(app, deps) {
     const code = c.req.query("code");
     const state = c.req.query("state");
     if (!code) {
-      throw new HTTPException13(400, { message: "missing GitHub OAuth code" });
+      throw new HTTPException15(400, { message: "missing GitHub OAuth code" });
     }
     if (!state) {
-      throw new HTTPException13(400, { message: "missing GitHub OAuth state" });
+      throw new HTTPException15(400, { message: "missing GitHub OAuth state" });
     }
     const statePayload = readSignedState3(state, githubStateSecret);
     const installationId = parsePositiveInteger(String(statePayload?.installationId ?? ""));
     if (!statePayload || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || installationId === null) {
-      throw new HTTPException13(400, { message: "invalid or expired GitHub OAuth state" });
+      throw new HTTPException15(400, { message: "invalid or expired GitHub OAuth state" });
     }
     requireGitHubStateCookie(c, state);
     return await completeGitHubInstallationBinding(deps, c, {
@@ -5335,19 +5571,19 @@ function registerGitHubRoutes(app, deps) {
 async function completeGitHubInstallationBinding(deps, c, input) {
   const { db, settings } = deps;
   if (!input.statePayload.workspaceId || !input.statePayload.accountId) {
-    throw new HTTPException13(400, { message: "invalid or expired GitHub installation state" });
+    throw new HTTPException15(400, { message: "invalid or expired GitHub installation state" });
   }
   const grant = await requireAccessGrant10(c, deps, input.statePayload.workspaceId, "github:manage");
   if (grant.accountId !== input.statePayload.accountId) {
-    throw new HTTPException13(403, { message: "GitHub installation state does not match this workspace" });
+    throw new HTTPException15(403, { message: "GitHub installation state does not match this workspace" });
   }
   try {
     const installation = await verifyGitHubInstallationAccessForUser(settings, { code: input.code, installationId: input.installationId });
     if (!installation) {
-      throw new HTTPException13(404, { message: "GitHub App installation was not found for this app" });
+      throw new HTTPException15(404, { message: "GitHub App installation was not found for this app" });
     }
     if (installation.suspended) {
-      throw new HTTPException13(409, { message: "GitHub App installation is suspended" });
+      throw new HTTPException15(409, { message: "GitHub App installation is suspended" });
     }
     await upsertGitHubInstallation(db, {
       accountId: grant.accountId,
@@ -5360,13 +5596,13 @@ async function completeGitHubInstallationBinding(deps, c, input) {
     deleteCookie(c, githubStateCookie, { path: "/v1/github" });
     return c.html(githubSetupSuccessHtml(installation.accountLogin ?? `installation ${input.installationId}`, returnUrl));
   } catch (error) {
-    if (error instanceof HTTPException13) {
+    if (error instanceof HTTPException15) {
       throw error;
     }
     if (error instanceof GitHubAppConfigurationError2) {
-      throw new HTTPException13(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
+      throw new HTTPException15(409, { message: JSON.stringify({ message: error.message, missing: error.missing }) });
     }
-    throw new HTTPException13(502, { message: error instanceof Error ? error.message : String(error) });
+    throw new HTTPException15(502, { message: error instanceof Error ? error.message : String(error) });
   }
 }
 function setGitHubStateCookie(c, deps, state) {
@@ -5380,7 +5616,7 @@ function setGitHubStateCookie(c, deps, state) {
 }
 function requireGitHubStateCookie(c, state) {
   if (getCookie(c, githubStateCookie) !== state) {
-    throw new HTTPException13(400, { message: "invalid or expired GitHub installation browser state" });
+    throw new HTTPException15(400, { message: "invalid or expired GitHub installation browser state" });
   }
 }
 function isSecureRequest(c, deps) {
@@ -5447,7 +5683,7 @@ import {
   updatePackInstallationStatus
 } from "@opengeni/db";
 import { getDocumentBase as getDocumentBase2 } from "@opengeni/documents";
-import { HTTPException as HTTPException14 } from "hono/http-exception";
+import { HTTPException as HTTPException16 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant11 } from "@opengeni/core";
 import { requireLimit as requireLimit5 } from "@opengeni/core";
 import { validateEnvironmentAttachment } from "@opengeni/core";
@@ -5478,7 +5714,7 @@ function registerPackRoutes(app, deps) {
     const grant = await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const manifest = RegisterCapabilityPackRequest.parse(await c.req.json());
     if (isBuiltInCapabilityPack(manifest.id)) {
-      throw new HTTPException14(409, { message: `pack id ${manifest.id} is a built-in pack and cannot be replaced` });
+      throw new HTTPException16(409, { message: `pack id ${manifest.id} is a built-in pack and cannot be replaced` });
     }
     const { pack, created } = await registerWorkspacePack(db, {
       accountId: grant.accountId,
@@ -5492,10 +5728,10 @@ function registerPackRoutes(app, deps) {
     await requireAccessGrant11(c, deps, workspaceId, "workspace:admin");
     const packId = c.req.param("packId");
     if (isBuiltInCapabilityPack(packId)) {
-      throw new HTTPException14(409, { message: "built-in packs cannot be unregistered" });
+      throw new HTTPException16(409, { message: "built-in packs cannot be unregistered" });
     }
     if (!await getWorkspacePack(db, workspaceId, packId)) {
-      throw new HTTPException14(404, { message: "pack not found" });
+      throw new HTTPException16(404, { message: "pack not found" });
     }
     const installation = await getPackInstallation(db, workspaceId, packId);
     if (installation && installation.status === "active") {
@@ -5532,13 +5768,13 @@ function registerPackRoutes(app, deps) {
     const storedEnvironmentId = typeof existing?.metadata.environmentId === "string" ? existing.metadata.environmentId : void 0;
     const environmentId = payload.environmentId ?? storedEnvironmentId;
     if (pack.environment?.required && !environmentId) {
-      throw new HTTPException14(422, { message: "this pack requires an environment attachment; pass environmentId" });
+      throw new HTTPException16(422, { message: "this pack requires an environment attachment; pass environmentId" });
     }
     if (environmentId) {
       const environment = await validateEnvironmentAttachment({ settings, db }, grant, workspaceId, environmentId, { preauthorized: !payload.environmentId });
       const missing = (pack.environment?.requiredVariables ?? []).filter((name) => !environment.variables.some((variable) => variable.name === name));
       if (missing.length > 0) {
-        throw new HTTPException14(422, { message: `environment is missing required variable(s): ${missing.join(", ")}` });
+        throw new HTTPException16(422, { message: `environment is missing required variable(s): ${missing.join(", ")}` });
       }
     }
     const installation = await enablePackInstallation(db, {
@@ -5559,13 +5795,13 @@ function registerPackRoutes(app, deps) {
     const pack = await requirePack(db, workspaceId, MARKETING_SOCIAL_PACK_ID);
     const installation = await getPackInstallation(db, workspaceId, pack.id);
     if (installation?.status !== "active") {
-      throw new HTTPException14(409, { message: "enable the marketing social pack before creating its scheduled tasks" });
+      throw new HTTPException16(409, { message: "enable the marketing social pack before creating its scheduled tasks" });
     }
     const payload = MarketingDailyAnalysisTaskRequest.parse(await c.req.json());
     await requireLimit5(deps, { accountId: grant.accountId, workspaceId, action: "schedule:create", quantity: 1 });
     const connections = await resolveSocialConnections(db, workspaceId, payload.connectionIds);
     if (connections.length === 0) {
-      throw new HTTPException14(422, { message: "at least one connected social account is required" });
+      throw new HTTPException16(422, { message: "at least one connected social account is required" });
     }
     await validateDocumentBaseIds(db, workspaceId, payload.documentBaseIds);
     const agentConfig = buildMarketingDailyAnalysisAgentConfig({
@@ -5609,7 +5845,7 @@ function registerPackRoutes(app, deps) {
 async function requirePack(db, workspaceId, packId) {
   const pack = await resolveCapabilityPack(db, workspaceId, packId);
   if (!pack) {
-    throw new HTTPException14(404, { message: "pack not found" });
+    throw new HTTPException16(404, { message: "pack not found" });
   }
   return pack;
 }
@@ -5618,13 +5854,13 @@ async function resolveSocialConnections(db, workspaceId, connectionIds) {
   const connections = ids.length > 0 ? await Promise.all(ids.map(async (id) => {
     const connection = await getSocialConnection(db, workspaceId, id);
     if (!connection) {
-      throw new HTTPException14(422, { message: `unknown social connection: ${id}` });
+      throw new HTTPException16(422, { message: `unknown social connection: ${id}` });
     }
     return connection;
   })) : (await listSocialConnections2(db, workspaceId, 500)).filter((connection) => connection.status === "connected");
   const inactive = connections.find((connection) => connection.status !== "connected");
   if (inactive) {
-    throw new HTTPException14(422, { message: `social connection ${inactive.id} is ${inactive.status}` });
+    throw new HTTPException16(422, { message: `social connection ${inactive.id} is ${inactive.status}` });
   }
   return connections;
 }
@@ -5632,7 +5868,7 @@ async function validateDocumentBaseIds(db, workspaceId, documentBaseIds) {
   for (const baseId of [...new Set(documentBaseIds)]) {
     const base = await getDocumentBase2(db, workspaceId, baseId);
     if (!base) {
-      throw new HTTPException14(422, { message: `unknown document base: ${baseId}` });
+      throw new HTTPException16(422, { message: `unknown document base: ${baseId}` });
     }
   }
 }
@@ -5816,7 +6052,7 @@ import {
   releaseLeaseHolder
 } from "@opengeni/db";
 import { appendAndPublishEvents as appendAndPublishEvents3 } from "@opengeni/events";
-import { HTTPException as HTTPException15 } from "hono/http-exception";
+import { HTTPException as HTTPException17 } from "hono/http-exception";
 import {
   establishSandboxSessionFromEnvelope,
   serializeEstablishedSandboxEnvelope,
@@ -5831,7 +6067,7 @@ async function withChannelA(services, ctx, fn) {
   const { db, settings, bus } = services;
   const { accountId, workspaceId, session, subjectId } = ctx;
   if (session.sandboxBackend === "none") {
-    throw new HTTPException15(409, { message: "sandbox not available" });
+    throw new HTTPException17(409, { message: "sandbox not available" });
   }
   const sandboxGroupId = session.sandboxGroupId;
   const viewerId = crypto.randomUUID();
@@ -5859,7 +6095,7 @@ async function withChannelA(services, ctx, fn) {
   });
   if (acquired.role === "fenced") {
     await release();
-    throw new HTTPException15(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); retry` });
+    throw new HTTPException17(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); retry` });
   }
   let established;
   let leaseSnapshot = acquired.lease;
@@ -5882,7 +6118,7 @@ async function withChannelA(services, ctx, fn) {
         });
       } catch (error) {
         await failWarmingToCold(db, { accountId, workspaceId, sandboxGroupId, expectedEpoch });
-        throw new HTTPException15(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
+        throw new HTTPException17(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
       }
       const resumeEnvelope = await serializeEstablishedSandboxEnvelope(established) ?? envelope ?? null;
       const committed = await commitWarmingToWarm(db, {
@@ -5897,7 +6133,7 @@ async function withChannelA(services, ctx, fn) {
         leaseTtlMs
       });
       if (!committed.committed || !committed.lease) {
-        throw new HTTPException15(409, { message: `sandbox lease superseded (epoch ${expectedEpoch}); retry` });
+        throw new HTTPException17(409, { message: `sandbox lease superseded (epoch ${expectedEpoch}); retry` });
       }
       leaseSnapshot = committed.lease;
     } else {
@@ -5936,11 +6172,11 @@ async function withChannelA(services, ctx, fn) {
   }
 }
 function mapChannelAError(error) {
-  if (error instanceof HTTPException15) return error;
-  if (error instanceof ChannelAValidationError) return new HTTPException15(400, { message: error.message });
-  if (error instanceof ChannelANotFoundError) return new HTTPException15(404, { message: error.message });
-  if (error instanceof ChannelAConflictError) return new HTTPException15(409, { message: error.message });
-  if (error instanceof ChannelAUnsupportedError) return new HTTPException15(409, { message: error.message });
+  if (error instanceof HTTPException17) return error;
+  if (error instanceof ChannelAValidationError) return new HTTPException17(400, { message: error.message });
+  if (error instanceof ChannelANotFoundError) return new HTTPException17(404, { message: error.message });
+  if (error instanceof ChannelAConflictError) return new HTTPException17(409, { message: error.message });
+  if (error instanceof ChannelAUnsupportedError) return new HTTPException17(409, { message: error.message });
   return error;
 }
 async function dropEstablishedHandle(established) {
@@ -5949,7 +6185,7 @@ async function dropEstablishedHandle(established) {
 
 // src/routes/sessions.ts
 import { negotiateCapabilities } from "@opengeni/runtime/sandbox";
-import { HTTPException as HTTPException17 } from "hono/http-exception";
+import { HTTPException as HTTPException19 } from "hono/http-exception";
 import { requireAccessGrant as requireAccessGrant13 } from "@opengeni/core";
 
 // src/sandbox/viewer.ts
@@ -5971,7 +6207,7 @@ import {
   SandboxLeaseSupersededError as SandboxLeaseSupersededError2
 } from "@opengeni/db";
 import { appendAndPublishEvents as appendAndPublishEvents4 } from "@opengeni/events";
-import { HTTPException as HTTPException16 } from "hono/http-exception";
+import { HTTPException as HTTPException18 } from "hono/http-exception";
 import {
   DESKTOP_STREAM_PORT,
   ensureDisplayStack,
@@ -6033,7 +6269,7 @@ async function attachViewer(services, input) {
   });
   if (acquired.role === "fenced") {
     await release();
-    throw new HTTPException16(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); re-read capabilities and re-attach` });
+    throw new HTTPException18(409, { message: `sandbox lease superseded (epoch ${acquired.lease.leaseEpoch}); re-read capabilities and re-attach` });
   }
   if (acquired.role === "spawner") {
     const expectedEpoch = acquired.lease.leaseEpoch;
@@ -6074,12 +6310,12 @@ async function attachViewer(services, input) {
       };
     } catch (error) {
       if (error instanceof SandboxLeaseSupersededError2) {
-        throw new HTTPException16(409, { message: `sandbox lease superseded (epoch ${error.leaseEpoch}); re-read capabilities and re-attach` });
+        throw new HTTPException18(409, { message: `sandbox lease superseded (epoch ${error.leaseEpoch}); re-read capabilities and re-attach` });
       }
       await failWarmingToCold2(db, { accountId, workspaceId, sandboxGroupId, expectedEpoch });
       await release();
-      if (error instanceof HTTPException16) throw error;
-      throw new HTTPException16(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
+      if (error instanceof HTTPException18) throw error;
+      throw new HTTPException18(409, { message: `sandbox not available (${error instanceof Error ? error.message : "spawn failed"})` });
     } finally {
       await dropEstablishedHandle2(established);
     }
@@ -6546,7 +6782,7 @@ function registerSessionRoutes(app, deps) {
     await requireAccessGrant13(c, deps, workspaceId, "sessions:read");
     const session = await getSession4(db, workspaceId, c.req.param("sessionId"));
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     return c.json(session);
   });
@@ -6557,12 +6793,12 @@ function registerSessionRoutes(app, deps) {
     const body = await c.req.json();
     const target = typeof body.target === "string" ? body.target : "";
     if (!target) {
-      throw new HTTPException17(400, { message: 'target is required ("auto" or an account id)' });
+      throw new HTTPException19(400, { message: 'target is required ("auto" or an account id)' });
     }
     const pinned = target === "auto" ? null : target;
     const ok = await setSessionCodexPin(db, workspaceId, sessionId, pinned);
     if (!ok) {
-      throw new HTTPException17(404, { message: "session or codex account not found" });
+      throw new HTTPException19(404, { message: "session or codex account not found" });
     }
     return c.json({ pinned: target === "auto" ? "auto" : target });
   });
@@ -6575,7 +6811,7 @@ function registerSessionRoutes(app, deps) {
     await updateSessionTitle2({ db, bus }, workspaceId, sessionId, payload.title, "user");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     return c.json(session);
   });
@@ -6586,7 +6822,7 @@ function registerSessionRoutes(app, deps) {
     await assertSessionExists(db, workspaceId, sessionId);
     const goal = await getSessionGoal2(db, workspaceId, sessionId);
     if (!goal) {
-      throw new HTTPException17(404, { message: "session goal not found" });
+      throw new HTTPException19(404, { message: "session goal not found" });
     }
     return c.json(goal);
   });
@@ -6598,10 +6834,10 @@ function registerSessionRoutes(app, deps) {
     const payload = UpdateSessionGoalRequest.parse(await c.req.json());
     const existing = await getSessionGoal2(db, workspaceId, sessionId);
     if (!existing) {
-      throw new HTTPException17(404, { message: "session goal not found" });
+      throw new HTTPException19(404, { message: "session goal not found" });
     }
     if (existing.status === "completed") {
-      throw new HTTPException17(409, { message: "session goal is completed; set a new goal instead" });
+      throw new HTTPException19(409, { message: "session goal is completed; set a new goal instead" });
     }
     if (payload.status === "paused") {
       const { goal: goal2, changed: changed2 } = await setSessionGoalStatus2(db, workspaceId, sessionId, {
@@ -6625,7 +6861,7 @@ function registerSessionRoutes(app, deps) {
       return c.json(goal2);
     }
     if (existing.status !== "paused") {
-      throw new HTTPException17(409, { message: `session goal is ${existing.status}; only paused goals can be resumed` });
+      throw new HTTPException19(409, { message: `session goal is ${existing.status}; only paused goals can be resumed` });
     }
     const { goal, changed } = await setSessionGoalStatus2(db, workspaceId, sessionId, { status: "active" });
     if (changed) {
@@ -6650,11 +6886,11 @@ function registerSessionRoutes(app, deps) {
     await assertSessionExists(db, workspaceId, sessionId);
     const clearBody = ClearSessionContextRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!clearBody.success) {
-      throw new HTTPException17(400, { message: "context clear requires an explicit { confirm: true }" });
+      throw new HTTPException19(400, { message: "context clear requires an explicit { confirm: true }" });
     }
     const session = await requireSession3(db, workspaceId, sessionId);
     if (session.status === "queued" || session.status === "running" || session.status === "requires_action") {
-      throw new HTTPException17(409, { message: `session is ${session.status}; cannot clear context mid-turn \u2014 stop the turn first` });
+      throw new HTTPException19(409, { message: `session is ${session.status}; cannot clear context mid-turn \u2014 stop the turn first` });
     }
     const result = await clearSessionContext(db, { accountId: grant.accountId, workspaceId, sessionId });
     await appendAndPublishEvents5(db, bus, workspaceId, sessionId, [{
@@ -6731,7 +6967,7 @@ function registerSessionRoutes(app, deps) {
     const resources = payload.resources !== void 0 ? normalizeResources(payload.resources) : existing.resources;
     const tools = payload.tools !== void 0 ? validateToolRefs(payload.tools, runtimeSettings) : existing.tools;
     if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
-      throw new HTTPException17(503, { message: "object storage is not configured" });
+      throw new HTTPException19(503, { message: "object storage is not configured" });
     }
     await validateFileResources(db, workspaceId, resources);
     await validateGitHubRepositorySelection(db, workspaceId, [...session.resources, ...resources]);
@@ -6801,7 +7037,7 @@ function registerSessionRoutes(app, deps) {
     }
     const session = await requireSession3(db, workspaceId, sessionId);
     if (event.type === "user.approvalDecision" && session.status !== "requires_action") {
-      throw new HTTPException17(409, { message: `session is ${session.status}; no approval is pending` });
+      throw new HTTPException19(409, { message: `session is ${session.status}; no approval is pending` });
     }
     const eventsToAppend = [{
       type: event.type,
@@ -6811,7 +7047,7 @@ function registerSessionRoutes(app, deps) {
     const appended = await appendAndPublishEvents5(db, bus, workspaceId, sessionId, eventsToAppend);
     const accepted = appended[0];
     if (!accepted) {
-      throw new HTTPException17(500, { message: "failed to append client event" });
+      throw new HTTPException19(500, { message: "failed to append client event" });
     }
     const workflowId = workflowIdForSession2(sessionId);
     if (event.type === "user.approvalDecision") {
@@ -6829,7 +7065,7 @@ function registerSessionRoutes(app, deps) {
   });
   function assertOwnershipEnabled() {
     if (!settings.sandboxOwnershipEnabled) {
-      throw new HTTPException17(404, { message: "sandbox ownership is not enabled for this deployment" });
+      throw new HTTPException19(404, { message: "sandbox ownership is not enabled for this deployment" });
     }
   }
   async function resolveSharedExposure(workspaceId, session) {
@@ -6844,7 +7080,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const lease = await readGroupLease({ db, settings }, { workspaceId, sandboxGroupId: session.sandboxGroupId });
     const { shared, sharedSessionIds } = await resolveSharedExposure(workspaceId, session);
@@ -6939,11 +7175,11 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const parsed = AcknowledgeStreamRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException17(400, { message: "invalid stream acknowledgment request" });
+      throw new HTTPException19(400, { message: "invalid stream acknowledgment request" });
     }
     const recorded = await recordStreamAcknowledgment(db, {
       accountId: grant.accountId,
@@ -6962,21 +7198,21 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const parsed = AttachViewerRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException17(400, { message: "invalid viewer attach request" });
+      throw new HTTPException19(400, { message: "invalid viewer attach request" });
     }
     const wantDesktop = parsed.data.desktop ?? false;
     const { shared } = await resolveSharedExposure(workspaceId, session);
     if (wantDesktop) {
       const ack = await getStreamAcknowledgment(db, { workspaceId, sandboxGroupId: session.sandboxGroupId, subjectId: grant.subjectId });
       if (!ack?.acknowledgedUnredacted) {
-        throw new HTTPException17(409, { message: "stream_acknowledgment_required" });
+        throw new HTTPException19(409, { message: "stream_acknowledgment_required" });
       }
       if (shared && !ack.acknowledgedShared) {
-        throw new HTTPException17(409, { message: "shared_acknowledgment_required" });
+        throw new HTTPException19(409, { message: "shared_acknowledgment_required" });
       }
     }
     const activeSandbox = session.activeSandboxId ? await getSandbox2(db, workspaceId, session.activeSandboxId) : null;
@@ -7075,11 +7311,11 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const parsed = ViewerHeartbeatRequest.safeParse(await c.req.json().catch(() => ({})));
     if (!parsed.success) {
-      throw new HTTPException17(400, { message: "viewer heartbeat requires { leaseEpoch }" });
+      throw new HTTPException19(400, { message: "viewer heartbeat requires { leaseEpoch }" });
     }
     const alive = await heartbeatViewer({ db, settings }, {
       accountId: grant.accountId,
@@ -7097,7 +7333,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     await detachViewer({ db, settings }, {
       accountId: grant.accountId,
@@ -7114,7 +7350,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId");
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     const result = await revokeViewer(db, {
       accountId: grant.accountId,
@@ -7132,7 +7368,7 @@ function registerSessionRoutes(app, deps) {
     const sessionId = c.req.param("sessionId") ?? "";
     const session = await getSession4(db, workspaceId, sessionId);
     if (!session) {
-      throw new HTTPException17(404, { message: "session not found" });
+      throw new HTTPException19(404, { message: "session not found" });
     }
     return { accountId: grant.accountId, workspaceId, session, subjectId: grant.subjectId };
   }
@@ -7140,7 +7376,7 @@ function registerSessionRoutes(app, deps) {
     const raw = await c.req.json().catch(() => void 0);
     const result = schema.safeParse(raw ?? {});
     if (!result.success) {
-      throw new HTTPException17(400, { message: "invalid request body" });
+      throw new HTTPException19(400, { message: "invalid request body" });
     }
     return result.data;
   }
@@ -7245,10 +7481,10 @@ function registerSessionRoutes(app, deps) {
     const req = await parseChannelABody(c, PtyWriteRequest);
     const pty = await getOpenPtySession(db, ctx.workspaceId, req.ptyId);
     if (!pty) {
-      throw new HTTPException17(404, { message: "pty not found or closed" });
+      throw new HTTPException19(404, { message: "pty not found or closed" });
     }
     if (pty.execSessionId === null) {
-      throw new HTTPException17(409, { message: "interactive terminal unsupported on this backend" });
+      throw new HTTPException19(409, { message: "interactive terminal unsupported on this backend" });
     }
     let seq = 1;
     await withChannelA({ db, settings, bus }, ctx, async ({ service }) => {
@@ -7266,7 +7502,7 @@ function registerSessionRoutes(app, deps) {
     const req = await parseChannelABody(c, PtyResizeRequest);
     const pty = await getOpenPtySession(db, ctx.workspaceId, req.ptyId);
     if (!pty) {
-      throw new HTTPException17(404, { message: "pty not found or closed" });
+      throw new HTTPException19(404, { message: "pty not found or closed" });
     }
     if (pty.execSessionId !== null) {
       await withChannelA({ db, settings, bus }, ctx, ({ service }) => service.ptyResize(req, pty.execSessionId));
@@ -7336,7 +7572,7 @@ import {
   listSocialConnections as listSocialConnections3,
   listSocialPosts as listSocialPosts2
 } from "@opengeni/db";
-import { HTTPException as HTTPException18 } from "hono/http-exception";
+import { HTTPException as HTTPException20 } from "hono/http-exception";
 import { z as z2 } from "zod";
 import { requireAccessGrant as requireAccessGrant14 } from "@opengeni/core";
 function registerSocialRoutes(app, deps) {
@@ -7408,7 +7644,7 @@ function parseSince(raw) {
   }
   const since = new Date(raw);
   if (Number.isNaN(since.getTime())) {
-    throw new HTTPException18(422, { message: "since must be an ISO date-time" });
+    throw new HTTPException20(422, { message: "since must be an ISO date-time" });
   }
   return since;
 }
@@ -7419,7 +7655,7 @@ function parseConnectionIds(raw) {
   const values = raw.split(",").map((value) => value.trim()).filter(Boolean);
   const parsed = z2.array(z2.string().uuid()).safeParse(values);
   if (!parsed.success) {
-    throw new HTTPException18(422, { message: "connectionIds must be a comma-separated list of UUIDs" });
+    throw new HTTPException20(422, { message: "connectionIds must be a comma-separated list of UUIDs" });
   }
   const ids = parsed.data;
   return [...new Set(ids)];
@@ -7427,12 +7663,12 @@ function parseConnectionIds(raw) {
 function socialHttpException(error) {
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
-    return new HTTPException18(404, { message });
+    return new HTTPException20(404, { message });
   }
   if (message.includes("duplicate key")) {
-    return new HTTPException18(409, { message: "social connection or post already exists" });
+    return new HTTPException20(409, { message: "social connection or post already exists" });
   }
-  return new HTTPException18(500, { message });
+  return new HTTPException20(500, { message });
 }
 
 // src/routes/workspaces.ts
@@ -7460,7 +7696,7 @@ import {
   requireWorkspace,
   updateWorkspace
 } from "@opengeni/db";
-import { HTTPException as HTTPException19 } from "hono/http-exception";
+import { HTTPException as HTTPException21 } from "hono/http-exception";
 import { hasPermission as hasPermission3, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant15 } from "@opengeni/core";
 import { requireLimit as requireLimit7 } from "@opengeni/core";
 import { assertWorkspaceDeletable, assertWorkspaceMemberRemovable, resolveMemberSubjectId } from "@opengeni/core";
@@ -7482,7 +7718,7 @@ function registerWorkspaceRoutes(app, deps) {
     const payload = CreateWorkspaceRequest.parse(await c.req.json());
     const accountId = payload.accountId ?? context.defaultAccountId;
     if (!accountId) {
-      throw new HTTPException19(409, { message: "account selection is required" });
+      throw new HTTPException21(409, { message: "account selection is required" });
     }
     requireAccountPermission(context, accountId, "workspace:create");
     await requireLimit7(deps, { accountId, action: "workspace:create", quantity: 1 });
@@ -7558,7 +7794,7 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException19(500, { message: "failed to add member" });
+      throw new HTTPException21(500, { message: "failed to add member" });
     }
     return c.json(WorkspaceMember.parse(member), 201);
   });
@@ -7570,7 +7806,7 @@ function registerWorkspaceRoutes(app, deps) {
     const existing = await listWorkspaceMembers(deps.db, workspaceId);
     const current = existing.find((member2) => member2.subjectId === subjectId);
     if (!current) {
-      throw new HTTPException19(404, { message: "member not found" });
+      throw new HTTPException21(404, { message: "member not found" });
     }
     await grantWorkspaceAccess(deps.db, {
       accountId: grant.accountId,
@@ -7583,7 +7819,7 @@ function registerWorkspaceRoutes(app, deps) {
     const members = await listWorkspaceMembers(deps.db, workspaceId);
     const member = members.find((candidate) => candidate.subjectId === subjectId);
     if (!member) {
-      throw new HTTPException19(500, { message: "failed to update member" });
+      throw new HTTPException21(500, { message: "failed to update member" });
     }
     return c.json(WorkspaceMember.parse(member));
   });
@@ -7607,7 +7843,7 @@ function normalizeAgentInstructions(value) {
 function requireAccountPermission(context, accountId, permission) {
   const grant = context.accountGrants.find((candidate) => candidate.accountId === accountId);
   if (!grant || !grant.permissions.includes(permission) && !grant.permissions.includes("account:admin")) {
-    throw new HTTPException19(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException21(403, { message: `missing permission: ${permission}` });
   }
 }
 
@@ -7634,7 +7870,7 @@ function createApp(deps) {
   const documentIndexer = deps.documentIndexer ?? {
     indexDocument: async ({ accountId, workspaceId, documentId }) => {
       if (!objectStorage) {
-        throw new HTTPException20(503, { message: "object storage is not configured" });
+        throw new HTTPException22(503, { message: "object storage is not configured" });
       }
       return await indexDocumentNow(deps.db, objectStorage, workspaceId, documentId, getDocumentServices(), {
         beforeEmbed: async ({ chunkCount }) => {
@@ -7795,6 +8031,7 @@ function createApp(deps) {
   registerSocialRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
+  registerCatalogAssetRoutes(app, routeDeps);
   registerEnrollmentRoutes(app, routeDeps);
   registerMachineRoutes(app, routeDeps);
   registerEnvironmentRoutes(app, routeDeps);
@@ -7835,7 +8072,7 @@ function allowedCorsOrigin(pattern, origin) {
   return new RegExp(`^(?:${pattern})$`).test(origin);
 }
 function httpStatusForError(error) {
-  if (error instanceof HTTPException20) {
+  if (error instanceof HTTPException22) {
     return error.status;
   }
   return 500;
@@ -7958,6 +8195,7 @@ var routeLabelPatterns = [
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections$/, label: "/v1/workspaces/:workspaceId/connections" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/, label: "/v1/workspaces/:workspaceId/connections/oauth/start" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/, label: "/v1/workspaces/:workspaceId/connections/:connectionId" },
+  { pattern: /^\/v1\/catalog-assets\/.+$/, label: "/v1/catalog-assets/*" },
   { pattern: /^\/v1\/integrations\/oauth\/callback$/, label: "/v1/integrations/oauth/callback" },
   { pattern: /^\/v1\/integrations\/oauth\/client-metadata\.json$/, label: "/v1/integrations/oauth/client-metadata.json" },
   { pattern: /^\/v1\/enrollments\/device\/start$/, label: "/v1/enrollments/device/start" },
@@ -7997,4 +8235,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession3 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-DQ5TIRDZ.js.map
+//# sourceMappingURL=chunk-3HIA43CC.js.map