@opengeni/api-router 1.0.2 → 1.2.0

package/dist/{chunk-6TZ5LG3O.js → chunk-BAZXDFT2.js}

@@ -3803,8 +3803,8 @@ async function sendIntegrationEndpointTest(input) {
 // src/routes/workspace-integrations.ts
 import { HTTPException as HTTPException14 } from "hono/http-exception";
 import { z as z10 } from "zod";
-function newIntegrationSecret(prefix) {
-  return `${prefix}_${randomBytes2(32).toString("base64url")}`;
+function newIntegrationSecret(prefix2) {
+  return `${prefix2}_${randomBytes2(32).toString("base64url")}`;
 }
 function iso(value) {
   return value ? value.toISOString() : null;
@@ -4378,13 +4378,13 @@ function registerApiKeyRoutes(app, deps) {
         quantity: 1
       });
       const token = generateApiKeyToken();
-      const prefix = token.slice(0, 14);
+      const prefix2 = token.slice(0, 14);
       const apiKey = await createApiKey(deps.db, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         name: body3.name,
         description: body3.description ?? null,
-        prefix,
+        prefix: prefix2,
         keyHash: await sha256Hex(token),
         permissions,
         expiresAt: body3.expiresAt ? new Date(body3.expiresAt) : null
@@ -5843,6 +5843,7 @@ function projectClientModel(model) {
     id: model.id,
     label: model.label,
     ...model.shortLabel ? { shortLabel: model.shortLabel } : {},
+    ...model.logoUrl ? { logoUrl: model.logoUrl } : {},
     ...publicProvider,
     ...source === void 0 ? {} : { source },
     api: model.api,
@@ -9756,6 +9757,7 @@ import {
   setSessionChannel
 } from "@opengeni/db";
 import { createHash as createHash15, randomUUID as randomUUID5 } from "crypto";
+import { assertGoalResumeAllowed } from "@opengeni/core";
 
 // src/sandbox/enrollment.ts
 import { createPublicKey, randomBytes as randomBytes3, verify } from "crypto";
@@ -14802,7 +14804,7 @@ var PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/u;
 var WORKSPACE_MCP_PATH = /^\/v1\/workspaces\/([0-9a-f-]{36})\/mcp(?:\/(docs|files))?$/u;
 var ORGANIZATION_MCP_PATH = "/v1/mcp";
 function registerMcpOAuthRoutes(app, deps) {
-  app.get("/.well-known/oauth-authorization-server", (c) => {
+  const authorizationServerMetadata = (c) => {
     requireMcpOAuthEnabled(deps);
     const issuer = mcpOAuthIssuer(deps);
     c.header("cache-control", "public, max-age=300");
@@ -14820,7 +14822,9 @@ function registerMcpOAuthRoutes(app, deps) {
         authorization_response_iss_parameter_supported: true
       })
     );
-  });
+  };
+  app.get("/.well-known/oauth-authorization-server", authorizationServerMetadata);
+  app.get("/.well-known/oauth-authorization-server/*", authorizationServerMetadata);
   app.get("/.well-known/oauth-protected-resource/*", (c) => {
     requireMcpOAuthEnabled(deps);
     const pathname = new URL(c.req.url).pathname.replace(
@@ -15242,7 +15246,7 @@ function mcpOAuthConsentToolIdentities(catalog) {
   return catalog.entries.map((entry2) => entry2.identity);
 }
 function isMcpOAuthPublicProtocolPath(pathname) {
-  return pathname === "/.well-known/oauth-authorization-server" || pathname.startsWith("/.well-known/oauth-protected-resource/") || pathname === "/oauth/register" || pathname === "/oauth/authorize" || pathname === "/oauth/token";
+  return pathname === "/.well-known/oauth-authorization-server" || pathname.startsWith("/.well-known/oauth-authorization-server/") || pathname.startsWith("/.well-known/oauth-protected-resource/") || pathname === "/oauth/register" || pathname === "/oauth/authorize" || pathname === "/oauth/token";
 }
 function mcpOAuthAuthenticateHeader(deps, pathname) {
   return `Bearer resource_metadata="${mcpOAuthIssuer(deps)}/.well-known/oauth-protected-resource${pathname}", scope="${MCP_OAUTH_SCOPE}"`;
@@ -15380,8 +15384,8 @@ function boundedState(value) {
 function pkceChallenge(verifier) {
   return createHash4("sha256").update(verifier, "ascii").digest("base64url");
 }
-function opaque(prefix) {
-  return `${prefix}${randomBytes5(32).toString("base64url")}`;
+function opaque(prefix2) {
+  return `${prefix2}${randomBytes5(32).toString("base64url")}`;
 }
 function tokenHash(value) {
   return createHash4("sha256").update(value, "utf8").digest("hex");
@@ -21617,21 +21621,21 @@ function projectScheduledTaskUtf8(value, maxBytes) {
     return { value, originalBytes, deliveredBytes: originalBytes, truncated: false };
   }
   let marker = "";
-  let prefix = "";
+  let prefix2 = "";
   let omittedBytes = originalBytes;
   for (let attempt = 0; attempt < 4; attempt += 1) {
     marker = `\u2026[${omittedBytes} UTF-8 bytes omitted]`;
     if (Buffer.byteLength(marker, "utf8") > byteLimit) {
       marker = utf8Prefix2(marker, byteLimit);
-      prefix = "";
+      prefix2 = "";
       break;
     }
-    prefix = utf8Prefix2(value, byteLimit - Buffer.byteLength(marker, "utf8"));
-    const nextOmitted = originalBytes - Buffer.byteLength(prefix, "utf8");
+    prefix2 = utf8Prefix2(value, byteLimit - Buffer.byteLength(marker, "utf8"));
+    const nextOmitted = originalBytes - Buffer.byteLength(prefix2, "utf8");
     if (nextOmitted === omittedBytes) break;
     omittedBytes = nextOmitted;
   }
-  const projected = `${prefix}${marker}`;
+  const projected = `${prefix2}${marker}`;
   return {
     value: projected,
     originalBytes,
@@ -25078,8 +25082,8 @@ function sniffSlackReactionImageMime(bytes) {
   return null;
 }
 function hasMarkupPrefix(bytes) {
-  const prefix = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, Math.min(bytes.byteLength, 256))).replace(/^\uFEFF/u, "").trimStart().toLowerCase();
-  return prefix.startsWith("<svg") || prefix.startsWith("<html") || prefix.startsWith("<!doctype") || prefix.startsWith("<?xml");
+  const prefix2 = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, Math.min(bytes.byteLength, 256))).replace(/^\uFEFF/u, "").trimStart().toLowerCase();
+  return prefix2.startsWith("<svg") || prefix2.startsWith("<html") || prefix2.startsWith("<!doctype") || prefix2.startsWith("<?xml");
 }
 function isCompletePng(bytes) {
   const signature = [137, 80, 78, 71, 13, 10, 26, 10];
@@ -33429,6 +33433,7 @@ function registerGoalTools(server, deps, grant, sessionId, json2) {
         sessionId,
         {
           status: "active",
+          beforeResume: (tx, session, causalTurn) => assertGoalResumeAllowed({ ...deps, db: tx }, session, causalTurn),
           event: { type: "goal.resumed", actor: "agent" }
         }
       );
@@ -38564,14 +38569,9 @@ var ACTION_CATALOG = [
     "method": "GET",
     "path": "/v1/organizations/:accountId/insights/calls",
     "request": [],
-    "response": []
-  },
-  {
-    "id": "GET /v1/organizations/:accountId/insights/usage",
-    "method": "GET",
-    "path": "/v1/organizations/:accountId/insights/usage",
-    "request": [],
-    "response": []
+    "response": [
+      "InsightsCallsResponse"
+    ]
   },
   {
     "id": "GET /v1/organizations/:organizationId/codex/accounts",
@@ -38724,14 +38724,9 @@ var ACTION_CATALOG = [
     "method": "GET",
     "path": "/v1/workspaces/:workspaceId/insights/calls",
     "request": [],
-    "response": []
-  },
-  {
-    "id": "GET /v1/workspaces/:workspaceId/insights/usage",
-    "method": "GET",
-    "path": "/v1/workspaces/:workspaceId/insights/usage",
-    "request": [],
-    "response": []
+    "response": [
+      "InsightsCallsResponse"
+    ]
   },
   {
     "id": "GET /v1/workspaces/:workspaceId/instruction-policies/:revisionId",
@@ -39292,6 +39287,15 @@ var ACTION_CATALOG = [
       "GetOrganizationCredentialProviderResponse"
     ]
   },
+  {
+    "id": "getOrganizationInsightsUsage",
+    "method": "GET",
+    "path": "/v1/organizations/:accountId/insights/usage",
+    "request": [],
+    "response": [
+      "InsightsUsageResponse"
+    ]
+  },
   {
     "id": "getOrganizationIntegrationCatalog",
     "method": "GET",
@@ -39747,6 +39751,15 @@ var ACTION_CATALOG = [
       "WorkspaceInsightsResponse"
     ]
   },
+  {
+    "id": "getWorkspaceInsightsUsage",
+    "method": "GET",
+    "path": "/v1/workspaces/:workspaceId/insights/usage",
+    "request": [],
+    "response": [
+      "InsightsUsageResponse"
+    ]
+  },
   {
     "id": "getWorkspaceLearningHistory",
     "method": "GET",
@@ -42907,6 +42920,17 @@ var ACTION_CATALOG = [
       "PrReviewAppRegistration"
     ]
   },
+  {
+    "id": "updateArtifactPin",
+    "method": "PUT",
+    "path": "/v1/workspaces/:workspaceId/artifact-catalog/:kind/:artifactId/pin",
+    "request": [
+      "ArtifactCatalogKind"
+    ],
+    "response": [
+      "ArtifactPinResponse"
+    ]
+  },
   {
     "id": "updateBrowserIdentity",
     "method": "PATCH",
@@ -73484,13 +73508,13 @@ function registerCatalogAssetRoutes(app, deps) {
   });
 }
 function catalogAssetKeyFromPath(pathname) {
-  const prefix = "/v1/";
-  if (!pathname.startsWith(prefix)) {
+  const prefix2 = "/v1/";
+  if (!pathname.startsWith(prefix2)) {
     return null;
   }
   let key;
   try {
-    key = decodeURIComponent(pathname.slice(prefix.length));
+    key = decodeURIComponent(pathname.slice(prefix2.length));
   } catch {
     return null;
   }
@@ -82430,8 +82454,8 @@ function registerVariableSetRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/variable-sets",
     "/v1/workspaces/:workspaceId/environments"
   ];
-  for (const prefix of prefixes) {
-    app.get(`${prefix}`, async (c) => {
+  for (const prefix2 of prefixes) {
+    app.get(`${prefix2}`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant20(c, deps, workspaceId);
       requirePermission4(grant, "variable-sets:list");
@@ -82444,14 +82468,14 @@ function registerVariableSetRoutes(app, deps) {
         })
       );
     });
-    app.post(`${prefix}`, async (c) => {
+    app.post(`${prefix2}`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
       requirePermission4(grant, "variable-sets:write");
       const key = requireVariableSetEncryption2(settings);
       const payload = await parseRequestJson(c, CreateVariableSetRequest);
-      if (prefix.endsWith("/environments") && payload.scope !== "workspace") {
+      if (prefix2.endsWith("/environments") && payload.scope !== "workspace") {
         throw new HTTPException61(422, {
           message: "the legacy environments route only creates workspace-scoped variable sets"
         });
@@ -82515,8 +82539,8 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json(created, 201);
     });
-    if (prefix.endsWith("/variable-sets")) {
-      app.post(`${prefix}/resolve-attachments`, async (c) => {
+    if (prefix2.endsWith("/variable-sets")) {
+      app.post(`${prefix2}/resolve-attachments`, async (c) => {
         const workspaceId = c.req.param("workspaceId");
         const grant = await requireAccessGrant20(c, deps, workspaceId);
         requirePermission4(grant, "variable-sets:attach");
@@ -82534,15 +82558,15 @@ function registerVariableSetRoutes(app, deps) {
         return c.json(ResolveVariableSetAttachmentsResponse.parse({ variableSets }));
       });
     }
-    app.get(`${prefix}/:variableSetId`, async (c) => {
+    app.get(`${prefix2}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant20(c, deps, workspaceId);
       requirePermission4(grant, "variable-sets:read");
       requirePermission4(grant, "secrets:list");
       return c.json(await requireVariableSetForApi(db, grant, c.req.param("variableSetId")));
     });
-    if (prefix.endsWith("/variable-sets")) {
-      app.get(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+    if (prefix2.endsWith("/variable-sets")) {
+      app.get(`${prefix2}/:variableSetId/variables/:name`, async (c) => {
         const workspaceId = c.req.param("workspaceId");
         const grant = await requireAccessGrant20(c, deps, workspaceId);
         requirePermission4(grant, "variable-sets:read");
@@ -82566,7 +82590,7 @@ function registerVariableSetRoutes(app, deps) {
         return c.json(secret);
       });
     }
-    app.patch(`${prefix}/:variableSetId`, async (c) => {
+    app.patch(`${prefix2}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -82614,7 +82638,7 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json(updated);
     });
-    app.delete(`${prefix}/:variableSetId`, async (c) => {
+    app.delete(`${prefix2}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -82651,7 +82675,7 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json({ ok: true });
     });
-    app.put(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+    app.put(`${prefix2}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -82690,7 +82714,7 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json(metadata);
     });
-    app.delete(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+    app.delete(`${prefix2}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -83006,10 +83030,43 @@ import {
   OrganizationUsageWorkspacePageQuery
 } from "@opengeni/contracts";
 import { OrganizationModelUsageQuery } from "@opengeni/contracts/organization-model-usage";
-import { configuredEntitlements } from "@opengeni/config";
+import { configuredEntitlements, promotionalCreditScope } from "@opengeni/config";
+
+// src/credit-promotion-snapshot.ts
+import { PromotionalCreditScope } from "@opengeni/contracts";
+var prefix = "opengeni_credit_scope_";
+var countKey = `${prefix}v1`;
+function creditScopeMetadata(scope) {
+  if (!scope) return {};
+  const encoded = JSON.stringify(PromotionalCreditScope.parse(scope));
+  const chunks = encoded.match(/[\s\S]{1,400}/g);
+  if (chunks.length > 24)
+    throw new Error("Promotional credit policy exceeds checkout metadata limits");
+  return Object.fromEntries([
+    [countKey, String(chunks.length)],
+    ...chunks.map((chunk, index) => [`${prefix}${index}`, chunk])
+  ]);
+}
+function creditScopeFromMetadata(metadata) {
+  if (!metadata || !Object.keys(metadata).some((key) => key.startsWith(prefix))) return void 0;
+  const count = Number(metadata[countKey]);
+  if (!Number.isInteger(count) || count < 1 || count > 24) {
+    throw new Error("Invalid promotional credit snapshot");
+  }
+  let encoded = "";
+  for (let index = 0; index < count; index++) {
+    const chunk = metadata[`${prefix}${index}`];
+    if (!chunk) throw new Error("Incomplete promotional credit snapshot");
+    encoded += chunk;
+  }
+  return PromotionalCreditScope.parse(JSON.parse(encoded));
+}
+
+// src/routes/billing.ts
 import {
   applyCreditLedgerEntry,
   getBillingBalance,
+  readCreditPromotionPolicy,
   getBillingCustomer,
   getCreditLedgerEntry,
   hasCreditLedgerEntry,
@@ -83019,6 +83076,7 @@ import {
   getOrganizationUsageSummary,
   getOrganizationUsageWorkspacePage,
   withSessionRlsActorContext as withSessionRlsActorContext8,
+  withRlsContext as withRlsContext2,
   getManagedAccount as getManagedAccount2,
   markStripeWebhookProcessed,
   recordStripeWebhookEvent,
@@ -83124,6 +83182,12 @@ function registerBillingRoutes(app, deps) {
     const accountId = requireSelectedAccount(context, body3.accountId, "billing:manage");
     const stripe = stripeClient(deps);
     const promotion = body3.promotionCode ? await resolveCheckoutPromotionCode(stripe, body3.promotionCode) : null;
+    const promotionalScope = promotion ? promotionalCreditScope(
+      {
+        creditPromotionPolicy: await readCreditPromotionPolicy(deps.db) ?? deps.settings.creditPromotionPolicy
+      },
+      promotion.couponId
+    ) : void 0;
     const amountCents = body3.amountUsd !== void 0 ? usdToCents(body3.amountUsd) : promotion?.amountOffCents ?? null;
     if (amountCents === null) {
       throw new HTTPException64(422, {
@@ -83135,6 +83199,11 @@ function registerBillingRoutes(app, deps) {
         message: "Credits must be between $5 and $10,000."
       });
     }
+    if (promotionalScope && (!promotion?.amountOffCents || amountCents !== promotion.amountOffCents)) {
+      throw new HTTPException64(422, {
+        message: "Redeem this offer for its exact credit amount. Buy additional credits separately."
+      });
+    }
     const amountMicros = centsToMicros(amountCents);
     const customerId = await getOrCreateStripeCustomer(deps, stripe, context, accountId);
     const idempotencyKey = `checkout:${accountId}:${amountMicros}:${crypto.randomUUID()}`;
@@ -83152,8 +83221,10 @@ function registerBillingRoutes(app, deps) {
           successUrl: body3.successUrl,
           cancelUrl: body3.cancelUrl,
           idempotencyKey,
+          promotionalScope,
           ...promotion ? {
             promotionCodeId: promotion.id,
+            couponId: promotion.couponId,
             fullyDiscounted: promotion.percentOff === 100 || (promotion.amountOffCents ?? 0) >= amountCents
           } : {}
         }),
@@ -83172,7 +83243,8 @@ function registerBillingRoutes(app, deps) {
       CreateCheckoutResponse.parse({
         checkoutSessionId: session.id,
         url: session.url,
-        amountUsd: amountCents / 100
+        amountUsd: amountCents / 100,
+        promotionalScope
       })
     );
   });
@@ -83216,6 +83288,7 @@ function registerBillingRoutes(app, deps) {
           state: entry2 ? "granted" : "pending",
           amountMicros: entry2?.amountMicros ?? credit.amountMicros,
           currency: "usd",
+          promotionalScope: creditScopeFromMetadata(session.metadata),
           free: entry2 ? entry2.sourceType === "stripe_checkout_coupon" : isFreeCouponCheckout(session)
         },
         balance: entry2 ? await getBillingBalance(deps.db, accountId) : null
@@ -83315,7 +83388,7 @@ function stripeCheckoutSessionCreateParams(input) {
   return {
     mode: "payment",
     // Stripe takes either a code field on its page or one discount up front.
-    ...input.promotionCodeId ? { discounts: [{ promotion_code: input.promotionCodeId }] } : { allow_promotion_codes: true },
+    ...input.promotionCodeId ? { discounts: [{ promotion_code: input.promotionCodeId }] } : { allow_promotion_codes: false },
     customer: input.customerId,
     customer_update: {
       address: "auto",
@@ -83344,6 +83417,8 @@ function stripeCheckoutSessionCreateParams(input) {
       }
     ],
     metadata: {
+      ...creditScopeMetadata(input.promotionalScope),
+      ...input.couponId ? { opengeni_credit_offer_id: input.couponId } : {},
       opengeni_account_id: input.accountId,
       opengeni_credit_amount_usd: (input.amountCents / 100).toFixed(2),
       opengeni_credit_micros: String(input.amountMicros),
@@ -83485,6 +83560,10 @@ async function grantCheckoutSessionCredits(deps, session, source) {
   }
   const credit = decision.credit;
   const freeCouponCheckout = isFreeCouponCheckout(session);
+  const promotionalScope = creditScopeFromMetadata(session.metadata);
+  if (promotionalScope && !freeCouponCheckout) {
+    throw new Error("Scoped promotional credits require a fully discounted checkout");
+  }
   if (!await getManagedAccount2(deps.db, credit.accountId)) {
     console.info(
       "[api] stripe webhook ignored a checkout session for an account not in this deployment",
@@ -83511,10 +83590,13 @@ async function grantCheckoutSessionCredits(deps, session, source) {
     accountId: credit.accountId,
     type: freeCouponCheckout ? "grant" : "credit_topup",
     amountMicros: credit.amountMicros,
+    eligibleModelIds: promotionalScope?.eligibleModelIds,
     sourceType: freeCouponCheckout ? "stripe_checkout_coupon" : "stripe_checkout_session",
     sourceId: session.id,
     idempotencyKey: credit.idempotencyKey,
     metadata: {
+      ...promotionalScope ? { creditOfferLabel: promotionalScope.label } : {},
+      creditOfferId: session.metadata?.opengeni_credit_offer_id ?? null,
       stripeEventId: source.stripeEventId,
       stripePaymentIntentId: typeof session.payment_intent === "string" ? session.payment_intent : session.payment_intent?.id ?? null,
       stripePackageId: credit.packageId,
@@ -83540,7 +83622,12 @@ async function resolveCheckoutPromotionCode(stripe, code) {
     throw new HTTPException64(422, { message: "That code isn't valid or has expired." });
   }
   const amountOffCents = coupon.amount_off && coupon.currency === "usd" ? coupon.amount_off : coupon.currency_options?.usd?.amount_off ?? null;
-  return { id: promotionCode.id, amountOffCents, percentOff: coupon.percent_off ?? null };
+  return {
+    id: promotionCode.id,
+    couponId: coupon.id,
+    amountOffCents,
+    percentOff: coupon.percent_off ?? null
+  };
 }
 async function mirrorPaymentIntentCustomer(deps, event) {
   const intent = event.data.object;
@@ -83622,18 +83709,26 @@ async function releaseDisputedCredits(deps, stripe, event) {
     return;
   }
   const holdIdempotencyKey = `stripe:dispute_hold:${dispute.id}`;
-  if (!await hasCreditLedgerEntry(deps.db, accountId, holdIdempotencyKey)) {
-    return;
-  }
   const debitMicros = await creditAdjustmentMicros(deps, metadata, dispute.amount);
-  await applyCreditLedgerEntry(deps.db, {
-    accountId,
-    type: "credit_dispute_release",
-    amountMicros: debitMicros,
-    sourceType: "stripe_dispute",
-    sourceId: dispute.id,
-    idempotencyKey: `stripe:dispute_release:${dispute.id}`,
-    metadata: { stripeDisputeId: dispute.id, stripeEventType: event.type }
+  await withRlsContext2(deps.db, { accountId }, async (tx) => {
+    await applyCreditLedgerEntry(tx, {
+      accountId,
+      type: "credit_dispute_hold",
+      amountMicros: -debitMicros,
+      sourceType: "stripe_dispute",
+      sourceId: dispute.id,
+      idempotencyKey: holdIdempotencyKey,
+      metadata: { stripeDisputeId: dispute.id, stripeEventType: event.type }
+    });
+    await applyCreditLedgerEntry(tx, {
+      accountId,
+      type: "credit_dispute_release",
+      amountMicros: debitMicros,
+      sourceType: "stripe_dispute",
+      sourceId: dispute.id,
+      idempotencyKey: `stripe:dispute_release:${dispute.id}`,
+      metadata: { stripeDisputeId: dispute.id, stripeEventType: event.type }
+    });
   });
 }
 async function creditAdjustmentMicros(deps, metadata, amountCents) {
@@ -91687,9 +91782,9 @@ async function requireGitHubManageGrant(c, deps, workspaceId, expectedState) {
   }
 }
 function allCookieValues(c, name) {
-  const prefix = `${name}=`;
-  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix)).map((part) => {
-    const raw = part.slice(prefix.length);
+  const prefix2 = `${name}=`;
+  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix2)).map((part) => {
+    const raw = part.slice(prefix2.length);
     try {
       return decodeURIComponent(raw);
     } catch {
@@ -96457,12 +96552,12 @@ function requireStateCookie(c, state) {
   }
 }
 function allCookieValues2(c, name) {
-  const prefix = `${name}=`;
-  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix)).map((part) => {
+  const prefix2 = `${name}=`;
+  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix2)).map((part) => {
     try {
-      return decodeURIComponent(part.slice(prefix.length));
+      return decodeURIComponent(part.slice(prefix2.length));
     } catch {
-      return part.slice(prefix.length);
+      return part.slice(prefix2.length);
     }
   });
 }
@@ -99677,6 +99772,7 @@ function registerScheduledTaskRoutes(app, deps) {
 
 // src/routes/sessions.ts
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
+import { assertGoalResumeAllowed as assertGoalResumeAllowed2, GoalResumeBlockedError } from "@opengeni/core";
 import { UnsupportedLatencyModeError } from "@opengeni/config";
 import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
 import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
@@ -100083,9 +100179,9 @@ function openGeniRealtimeInstructions(additional) {
   const trimmed = additional?.trim();
   if (!trimmed) return OPENGENI_REALTIME_BASE_INSTRUCTIONS;
   const heading = "\n\n## Additional realtime guidance\nFollow the guidance below for this conversation unless it conflicts with the operating, delegation, safety, permission, or context-handling rules above.\n";
-  const prefix = `${OPENGENI_REALTIME_BASE_INSTRUCTIONS}${heading}`;
-  const remaining = REALTIME_INSTRUCTIONS_MAX_BYTES - Buffer.byteLength(prefix, "utf8");
-  return `${prefix}${takeUtf8Head(trimmed, Math.max(0, remaining))}`;
+  const prefix2 = `${OPENGENI_REALTIME_BASE_INSTRUCTIONS}${heading}`;
+  const remaining = REALTIME_INSTRUCTIONS_MAX_BYTES - Buffer.byteLength(prefix2, "utf8");
+  return `${prefix2}${takeUtf8Head(trimmed, Math.max(0, remaining))}`;
 }
 function takeUtf8Head(value, maximumBytes) {
   if (Buffer.byteLength(value, "utf8") <= maximumBytes) return value;
@@ -103151,6 +103247,14 @@ function registerSessionRoutes(app, deps) {
       sessionId,
       {
         status: "active",
+        beforeResume: (tx, session, causalTurn) => assertGoalResumeAllowed2({ ...deps, db: tx }, session, causalTurn).catch(
+          (error) => {
+            if (error instanceof GoalResumeBlockedError) {
+              throw new HTTPException88(422, { message: error.message, cause: error });
+            }
+            throw error;
+          }
+        ),
         event: { type: "goal.resumed", actor: "api" }
       }
     );
@@ -105149,7 +105253,7 @@ function sessionTenancyHttpError(error) {
   if (error instanceof SessionTenancyNotActivatedError) {
     return new ApiHttpError(409, {
       code: "conflict",
-      message: "Session tenancy is not activated for this organization.",
+      message: "Only-me chats are not enabled for this organization.",
       retryable: false,
       details: { reason: "not_activated" }
     });
@@ -106287,6 +106391,8 @@ import {
 import { loadWorkspaceCodexModelAvailability } from "@opengeni/core";
 import {
   allWorkspacePermissions,
+  getBillingBalance as getBillingBalance2,
+  spendableCreditMicros,
   createWorkspace,
   ensureWorkspaceByExternalIdentity,
   findWorkspaceByExternalIdentity as findWorkspaceByExternalIdentity2,
@@ -106881,25 +106987,31 @@ function registerWorkspaceRoutes(app, deps) {
       organizationOpenRouterCustomModels: organizationProviders.openrouter.models
     });
     const workspaceSettings = workspace?.settings ?? {};
+    const creditBalance = deps.settings.billingMode === "stripe" ? await getBillingBalance2(deps.db, grant.accountId) : void 0;
     const defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
       settings: workspaceCatalogSettings,
       accountId: grant.accountId,
       workspaceSettings,
       selections
     });
+    const catalog = projectWorkspaceModelCatalog(selections, {
+      defaultSelection,
+      creditsSelection: creditsDefaultSessionModel({
+        settings: workspaceCatalogSettings,
+        selections,
+        workspaceSettings
+      })
+    });
+    if (creditBalance) {
+      for (const model of catalog.models) {
+        if (model.cost !== "credits") continue;
+        model.creditFunding = creditBalance.promotionalCredits?.some(
+          (credit) => credit.remainingMicros > 0 && credit.eligibleModelIds.includes(model.id)
+        ) ? "promotional" : spendableCreditMicros(creditBalance, model.id) > 0 ? "general" : "unavailable";
+      }
+    }
     c.header("cache-control", "private, no-store");
-    return c.json(
-      WorkspaceModelCatalogResponse2.parse(
-        projectWorkspaceModelCatalog(selections, {
-          defaultSelection,
-          creditsSelection: creditsDefaultSessionModel({
-            settings: workspaceCatalogSettings,
-            selections,
-            workspaceSettings
-          })
-        })
-      )
-    );
+    return c.json(WorkspaceModelCatalogResponse2.parse(catalog));
   });
   app.get("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -110062,6 +110174,8 @@ import {
   ArtifactCatalogKind as ArtifactCatalogKind2,
   ArtifactCatalogListQuery,
   ArtifactCatalogListResponse,
+  ArtifactPinResponse,
+  UpdateArtifactPinRequest,
   retainedArtifactReferenceFromFile as retainedArtifactReferenceFromFile3,
   retainedGeneratedImageReferenceFromFile as retainedGeneratedImageReferenceFromFile2
 } from "@opengeni/contracts";
@@ -110082,9 +110196,12 @@ import {
   getGeneratedImageArtifact as getGeneratedImageArtifact2,
   getSessionAuthorityProjection as getSessionAuthorityProjection3,
   listArtifactCatalogCandidates,
+  nestedPostgresSqlState as nestedPostgresSqlState14,
+  updateArtifactPin,
   withSessionRlsActorContext as withSessionRlsActorContext9
 } from "@opengeni/db";
 import { HTTPException as HTTPException102 } from "hono/http-exception";
+import { z as z53 } from "zod";
 
 // src/artifact-catalog-cursor.ts
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash29, randomBytes as randomBytes12 } from "crypto";
@@ -110098,7 +110215,8 @@ var Cursor = z52.object({
   after: z52.object({
     key: z52.string().max(4096),
     kind: ArtifactCatalogKind,
-    id: z52.string().min(1).max(128)
+    id: z52.string().min(1).max(128),
+    pinned: z52.boolean().optional()
   }).strict()
 }).strict();
 function artifactCatalogCursorCodec(secret, binding) {
@@ -110146,9 +110264,82 @@ var iso2 = (value) => new Date(value).toISOString();
 var position = (row) => ({
   key: row.sort_key,
   kind: row.kind,
-  id: row.id
+  id: row.id,
+  pinned: row.pinned ?? false
 });
 function registerArtifactCatalogRoutes(app, deps) {
+  app.put("/v1/workspaces/:workspaceId/artifact-catalog/:kind/:artifactId/pin", async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization36(
+      context,
+      deps,
+      workspaceId,
+      "artifacts:publish"
+    );
+    const grant = authorization.grant;
+    if (!hasPermission27(grant.permissions, "artifacts:publish"))
+      throw new HTTPException102(403, { message: "Artifact publish access required" });
+    const kind = ArtifactCatalogKind2.safeParse(context.req.param("kind"));
+    const body3 = UpdateArtifactPinRequest.safeParse(await context.req.json().catch(() => null));
+    const requestedId = context.req.param("artifactId");
+    if (!kind.success || !body3.success || !(editableKinds.has(kind.data) ? /^[0-9a-f]{32}$/.test(requestedId) : z53.string().uuid().safeParse(requestedId).success))
+      throw new HTTPException102(422, { message: "Invalid artifact pin request" });
+    const artifactId2 = editableKinds.has(kind.data) ? requestedId : requestedId.toLowerCase();
+    const fileKind = kind.data === "file" || kind.data === "image";
+    if (!hasPermission27(grant.permissions, fileKind ? "files:read" : "artifacts:read"))
+      throw new HTTPException102(403, { message: "Artifact read access required" });
+    const actor = fileKind ? await fileOwnerContextForAccess5(deps, authorization, "files:read") : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
+    context.header("cache-control", "private, no-store");
+    return withSessionRlsActorContext9(actor, async () => {
+      if (editableKinds.has(kind.data)) {
+        if (!deps.editableArtifacts)
+          throw new HTTPException102(503, { message: "Editable artifacts are unavailable" });
+        try {
+          const scope = editableArtifactScope2({ accountId: grant.accountId, workspaceId });
+          const artifact = await deps.editableArtifacts.readArtifact({
+            scope,
+            actor: editableArtifactActorForGrant(grant, "0000000000000001"),
+            artifactId: editableArtifactId3(artifactId2)
+          });
+          if (artifact.scope.accountId !== scope.accountId || artifact.scope.workspaceId !== scope.workspaceId || artifact.id !== artifactId2 || artifact.modality !== kind.data)
+            throw new HTTPException102(404, { message: "Artifact not found" });
+        } catch (error) {
+          if (isInvisibleListCandidate(error))
+            throw new HTTPException102(404, { message: "Artifact not found" });
+          throw editableArtifactHttpError(error);
+        }
+      }
+      if (fileKind) {
+        const subjectId = await fileAuthoritySubjectIdForGrant(deps, grant);
+        const [file] = await getFilesForSubject3(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId,
+          fileIds: [artifactId2]
+        });
+        if (!file || file.status !== "ready")
+          throw new HTTPException102(404, { message: "Artifact not found" });
+      }
+      try {
+        await updateArtifactPin(
+          deps.db,
+          { accountId: grant.accountId, workspaceId },
+          {
+            kind: kind.data,
+            artifactId: artifactId2,
+            pinned: body3.data.pinned
+          }
+        );
+      } catch (error) {
+        if (nestedPostgresSqlState14(error) === "42501")
+          throw new HTTPException102(404, { message: "Artifact not found" });
+        throw error;
+      }
+      return context.json(
+        ArtifactPinResponse.parse({ kind: kind.data, artifactId: artifactId2, pinned: body3.data.pinned })
+      );
+    });
+  });
   app.get("/v1/workspaces/:workspaceId/artifact-catalog", async (context) => {
     const workspaceId = context.req.param("workspaceId");
     const authorization = await requireAccessGrantAuthorization36(context, deps, workspaceId);
@@ -110282,7 +110473,8 @@ async function projectCandidate(deps, grant, row, fileSubject) {
     title: row.title,
     status: row.status,
     createdAt: iso2(row.created_at),
-    updatedAt: iso2(row.updated_at)
+    updatedAt: iso2(row.updated_at),
+    ...row.pinned !== void 0 ? { pinned: row.pinned } : {}
   };
   if (row.version_id) item.versionId = row.version_id;
   if (editableKinds.has(row.kind)) {
@@ -111870,12 +112062,12 @@ import {
   hasEditableArtifactSessionLink as hasEditableArtifactSessionLink2,
   hasWorkspaceArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor,
-  withRlsContext as withRlsContext2
+  withRlsContext as withRlsContext3
 } from "@opengeni/db";
 import { HTTPException as HTTPException106 } from "hono/http-exception";
-import { z as z53 } from "zod";
-var SessionId2 = z53.string().uuid();
-var EditableArtifactId = z53.string().regex(/^(?!0{32}$)[0-9a-f]{32}$/u);
+import { z as z54 } from "zod";
+var SessionId2 = z54.string().uuid();
+var EditableArtifactId = z54.string().regex(/^(?!0{32}$)[0-9a-f]{32}$/u);
 function registerSessionArtifactAssociationRoutes(app, deps) {
   app.get(
     "/v1/workspaces/:workspaceId/sessions/:sessionId/artifact-associations/:artifactId",
@@ -111901,7 +112093,7 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
           const linked = kind === "editable" ? await hasEditableArtifactSessionLink2(deps.db, scope, sessionId, artifactId2) : await hasWorkspaceArtifactSessionLink(deps.db, workspaceId, sessionId, artifactId2);
           if (!linked) throw new HTTPException106(404, { message: "Artifact association not found" });
           if (kind === "editable") {
-            const decision = await withRlsContext2(
+            const decision = await withRlsContext3(
               deps.db,
               scope,
               (tx) => transactionallyAuthorizeEditableArtifactActor(tx, {
@@ -112099,7 +112291,7 @@ import {
   getCanonicalHumanIdentityProjection as getCanonicalHumanIdentityProjection3
 } from "@opengeni/db/canonical-human-identities";
 import { HTTPException as HTTPException110 } from "hono/http-exception";
-import { z as z56 } from "zod";
+import { z as z57 } from "zod";
 
 // src/routes/managed-sign-in-methods.ts
 import {
@@ -112123,7 +112315,7 @@ import { getManagedAuthSessionSetSnapshot as getManagedAuthSessionSetSnapshot2 }
 import { getCanonicalHumanIdentityProjection as getCanonicalHumanIdentityProjection2 } from "@opengeni/db/canonical-human-identities";
 import { getCookie as getCookie2 } from "hono/cookie";
 import { HTTPException as HTTPException109 } from "hono/http-exception";
-import { z as z55 } from "zod";
+import { z as z56 } from "zod";
 
 // src/routes/managed-auth-session-sets.ts
 import { assertManagedUserAdmission as assertManagedUserAdmission2, getManagedSession as getManagedSession3 } from "@opengeni/core";
@@ -112189,12 +112381,12 @@ import {
 import { ensureManagedAccessForUser as ensureManagedAccessForUser2, getSession as getSession10 } from "@opengeni/db";
 import { deleteCookie as deleteCookie3, getCookie, setCookie as setCookie3 } from "hono/cookie";
 import { HTTPException as HTTPException108 } from "hono/http-exception";
-import { z as z54 } from "zod";
-var ManagedAuthSocialStartReceipt = z54.object({
-  version: z54.literal(1),
-  requestDigest: z54.string().regex(/^[0-9a-f]{64}$/u),
-  url: z54.string().url().max(4096),
-  stateCookie: z54.string().min(1).max(4096)
+import { z as z55 } from "zod";
+var ManagedAuthSocialStartReceipt = z55.object({
+  version: z55.literal(1),
+  requestDigest: z55.string().regex(/^[0-9a-f]{64}$/u),
+  url: z55.string().url().max(4096),
+  stateCookie: z55.string().min(1).max(4096)
 }).strict();
 function registerManagedAuthSessionSetRoutes(app, deps) {
   const noStore = async (context, next) => {
@@ -113034,8 +113226,8 @@ function setTransactionCookie(context, deps, transactionId, transactionSecret) {
 }
 function requireTransactionSecret(context, transactionId) {
   const value = getCookie(context, MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE);
-  const prefix = `${transactionId}.`;
-  const secret = value?.startsWith(prefix) ? value.slice(prefix.length) : null;
+  const prefix2 = `${transactionId}.`;
+  const secret = value?.startsWith(prefix2) ? value.slice(prefix2.length) : null;
   if (!secret || !/^[A-Za-z0-9_-]{43}$/.test(secret)) {
     throw managedAuthApiError(401, "invalid_transaction");
   }
@@ -113130,23 +113322,23 @@ function setCookieHeaders(headers) {
 }
 
 // src/routes/managed-sign-in-methods.ts
-var ConnectState = z55.object({
-  opengeniSignInMethod: z55.object({
-    intentId: z55.string().uuid(),
-    provider: z55.enum(["google", "github"])
+var ConnectState = z56.object({
+  opengeniSignInMethod: z56.object({
+    intentId: z56.string().uuid(),
+    provider: z56.enum(["google", "github"])
   }),
-  link: z55.object({ userId: z55.string().min(1), email: z55.string().email() }),
-  callbackURL: z55.string().url(),
-  errorURL: z55.string().url()
+  link: z56.object({ userId: z56.string().min(1), email: z56.string().email() }),
+  callbackURL: z56.string().url(),
+  errorURL: z56.string().url()
 });
-var ConnectIntent = z55.object({
-  authUserId: z55.string().min(1),
-  authSessionId: z55.string().min(1),
-  expectedIdentityId: z55.string().uuid(),
-  actorFence: z55.object({
-    authorityHash: z55.string().regex(/^[0-9a-f]{64}$/),
-    actorEpoch: z55.string().regex(/^[1-9][0-9]*$/),
-    requestId: z55.string().uuid()
+var ConnectIntent = z56.object({
+  authUserId: z56.string().min(1),
+  authSessionId: z56.string().min(1),
+  expectedIdentityId: z56.string().uuid(),
+  actorFence: z56.object({
+    authorityHash: z56.string().regex(/^[0-9a-f]{64}$/),
+    actorEpoch: z56.string().regex(/^[1-9][0-9]*$/),
+    requestId: z56.string().uuid()
   }).optional()
 });
 async function rows(deps, query) {
@@ -113466,7 +113658,7 @@ async function handleManagedSignInConnectCallback(context, deps, provider) {
 
 // src/routes/canonical-human-identities.ts
 import { managedAuthSecretRequestDigest as managedAuthSecretRequestDigest3 } from "@opengeni/core/managed-auth-session-sets";
-var BindingId = z56.string().uuid();
+var BindingId = z57.string().uuid();
 async function requestIdentity(context, deps) {
   return await requireCanonicalHumanRequestIdentity2(context, {
     db: deps.db,
@@ -113635,6 +113827,7 @@ function registerCanonicalHumanIdentityRoutes(app, deps) {
 }
 
 // src/routes/organization-memberships.ts
+import { signupCreditModelIds } from "@opengeni/config";
 import {
   lookupExternalIdentityForRequest,
   cancelExternalWorkspaceMemberGrantForRequest,
@@ -113702,7 +113895,7 @@ import {
   listOrganizationAdministrationMembers,
   listOrganizationInvitations,
   listSelfOrganizationInvitations,
-  nestedPostgresSqlState as nestedPostgresSqlState14,
+  nestedPostgresSqlState as nestedPostgresSqlState15,
   prepareOrganizationUserSetupDelivery,
   revokeOrganizationInvitation,
   settleOrganizationUserSetupDelivery,
@@ -113716,11 +113909,11 @@ import {
   updateOrganizationRetentionPolicy
 } from "@opengeni/db";
 import { HTTPException as HTTPException111 } from "hono/http-exception";
-import { z as z57 } from "zod";
-var OrganizationId2 = z57.string().uuid();
-var WorkspaceId = z57.string().uuid();
-var MembershipId = z57.string().uuid();
-var InvitationId = z57.string().uuid();
+import { z as z58 } from "zod";
+var OrganizationId2 = z58.string().uuid();
+var WorkspaceId = z58.string().uuid();
+var MembershipId = z58.string().uuid();
+var InvitationId = z58.string().uuid();
 async function requirePrivateSessionAdministrator(context, deps, organizationId2) {
   const agent = agentActingAsPerson(
     context,
@@ -113819,7 +114012,7 @@ function parseId(schema, value, label) {
   return parsed.data;
 }
 function rethrowMembershipError(error, resourceLimitMessage) {
-  const sqlState = nestedPostgresSqlState14(error);
+  const sqlState = nestedPostgresSqlState15(error);
   if (sqlState === "54000" && resourceLimitMessage) {
     throw new HTTPException111(409, {
       message: resourceLimitMessage
@@ -113881,6 +114074,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
             subjectId,
             subjectLabel: session.user.email || session.user.name,
             ...payload,
+            trialCreditModelIds: signupCreditModelIds(deps.settings),
             trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
           })
         ),
@@ -113924,7 +114118,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         })
       );
     } catch (error) {
-      if (nestedPostgresSqlState14(error) === "42501") {
+      if (nestedPostgresSqlState15(error) === "42501") {
         throw new HTTPException111(403, {
           message: "organization membership is not active"
         });
@@ -114232,11 +114426,6 @@ function registerOrganizationMembershipRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (nestedPostgresSqlState14(error) === "55000") {
-        throw new HTTPException111(409, {
-          message: "private-session readiness is not activated for this organization"
-        });
-      }
       rethrowMembershipError(error);
     }
   });
@@ -114584,13 +114773,13 @@ import {
   SessionListCursorExpiredError as SessionListCursorExpiredError2
 } from "@opengeni/db";
 import { HTTPException as HTTPException112 } from "hono/http-exception";
-import { z as z58 } from "zod";
+import { z as z59 } from "zod";
 var ORGANIZATION_SESSION_LIST_MAX_WORKSPACE_READS = 25;
-var OrganizationId3 = z58.string().uuid();
-var OrganizationSessionListCursorEnvelope = z58.object({
-  workspaceId: z58.string().uuid(),
-  cursor: z58.string().min(1).nullable(),
-  pinnedOffset: z58.number().int().nonnegative().max(1e4).optional()
+var OrganizationId3 = z59.string().uuid();
+var OrganizationSessionListCursorEnvelope = z59.object({
+  workspaceId: z59.string().uuid(),
+  cursor: z59.string().min(1).nullable(),
+  pinnedOffset: z59.number().int().nonnegative().max(1e4).optional()
 }).strict();
 function encodeOrganizationSessionListCursor(cursor) {
   return Buffer.from(JSON.stringify(cursor)).toString("base64url");
@@ -114818,9 +115007,9 @@ import {
   startOrganizationRecoveryOperation
 } from "@opengeni/db";
 import { HTTPException as HTTPException113 } from "hono/http-exception";
-import { z as z59 } from "zod";
-var OrganizationId4 = z59.string().uuid();
-var RecoveryOperationId = z59.string().uuid();
+import { z as z60 } from "zod";
+var OrganizationId4 = z60.string().uuid();
+var RecoveryOperationId = z60.string().uuid();
 var productionServices = {
   requireCanonicalHumanRequestIdentity: requireCanonicalHumanRequestIdentity3,
   getManagedAuthRequestActorAdmissionStamp,
@@ -115057,6 +115246,7 @@ function registerOrganizationRecoveryRoutes(app, deps, services = productionServ
 }
 
 // src/routes/managed-onboarding.ts
+import { signupCreditModelIds as signupCreditModelIds2 } from "@opengeni/config";
 import {
   CompleteSelfServiceOrganizationSetupRequest,
   CompleteSelfServiceOrganizationSetupResponse,
@@ -115071,7 +115261,7 @@ import {
   completeSelfServiceOrganizationSetup,
   completeOrganizationUserSetup,
   getSelfServiceOrganizationOnboardingState,
-  nestedPostgresSqlState as nestedPostgresSqlState15,
+  nestedPostgresSqlState as nestedPostgresSqlState16,
   preflightOrganizationUserSetup,
   previewOrganizationUserSetup,
   recordOrganizationSignupUseCase
@@ -115117,6 +115307,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
           organizationName,
           operationId: parsed.data.operationId,
           requestFingerprint,
+          trialCreditModelIds: signupCreditModelIds2(deps.settings),
           trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
         })
       );
@@ -115128,14 +115319,14 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
           useCase: parsed.data.useCase
         }).catch((error) => {
           console.warn("[api] could not record the signup use case", {
-            sqlState: nestedPostgresSqlState15(error) ?? null
+            sqlState: nestedPostgresSqlState16(error) ?? null
           });
         });
       }
       return context.json(completed);
     } catch (error) {
       recordOrganizationSetupOutcome(deps.observability, "failed");
-      const sqlState = nestedPostgresSqlState15(error);
+      const sqlState = nestedPostgresSqlState16(error);
       if (sqlState === "22023") {
         throw new HTTPException114(422, {
           message: "invalid organization setup request"
@@ -115215,7 +115406,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
         )
       );
     } catch (error) {
-      const sqlState = nestedPostgresSqlState15(error);
+      const sqlState = nestedPostgresSqlState16(error);
       if (sqlState === "22023") {
         throw new HTTPException114(422, {
           message: "invalid account setup request"
@@ -115336,9 +115527,9 @@ import {
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError15,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError3
 } from "@opengeni/core";
-import { nestedPostgresSqlState as nestedPostgresSqlState16, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState17, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
 import { HTTPException as HTTPException115 } from "hono/http-exception";
-import { z as z60 } from "zod";
+import { z as z61 } from "zod";
 async function body2(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) throw new HTTPException115(422, { message: "invalid user-resource request" });
@@ -115351,10 +115542,10 @@ function lifecycleError(error) {
   if (error instanceof SessionAuthorizationUnavailableError15) {
     throw new HTTPException115(503, { message: "session authorization unavailable" });
   }
-  if (nestedPostgresSqlState16(error) === "42501") {
+  if (nestedPostgresSqlState17(error) === "42501") {
     throw new HTTPException115(403, { message: "user-resource authority denied" });
   }
-  if (nestedPostgresSqlState16(error) === "22023") {
+  if (nestedPostgresSqlState17(error) === "22023") {
     throw new HTTPException115(422, { message: "invalid user-resource request" });
   }
   throw error;
@@ -115395,7 +115586,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   });
   app.post(`${base}/:authorityId/grants`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const authorityId = z60.string().uuid().safeParse(context.req.param("authorityId"));
+    const authorityId = z61.string().uuid().safeParse(context.req.param("authorityId"));
     if (!authorityId.success) throw new HTTPException115(422, { message: "invalid authority id" });
     const request = await body2(context, IssueUserResourceGrantRequest);
     const access = await requireAccessGrantAuthorization39(
@@ -115425,7 +115616,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   app.delete(`${base}/grants/:grantId`, async (context) => {
     const query = RevokeUserResourceGrantQuery.safeParse({ scope: context.req.query("scope") });
     if (!query.success) throw new HTTPException115(422, { message: "explicit scope=user required" });
-    const grantId = z60.string().uuid().safeParse(context.req.param("grantId"));
+    const grantId = z61.string().uuid().safeParse(context.req.param("grantId"));
     if (!grantId.success) throw new HTTPException115(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization39(
@@ -116432,14 +116623,14 @@ function resolveSlackWorkspaceRoute(input) {
       source: "thread"
     };
   }
-  const prefix = AUTHORED_BY_INVOKER.has(input.entry.triggerKind) ? parseSlackWorkspacePrefix(splitSlackLeadingMention(input.entry.text, input.botUserId).rest) : null;
-  if (prefix) {
-    const named = matchCandidate(candidates, prefix.requested);
+  const prefix2 = AUTHORED_BY_INVOKER.has(input.entry.triggerKind) ? parseSlackWorkspacePrefix(splitSlackLeadingMention(input.entry.text, input.botUserId).rest) : null;
+  if (prefix2) {
+    const named = matchCandidate(candidates, prefix2.requested);
     if (named === "ambiguous" || !named) {
       return {
         kind: "denied",
         reason: "no_access_to_named",
-        requested: prefix.requested,
+        requested: prefix2.requested,
         candidates
       };
     }
@@ -122068,7 +122259,8 @@ function createAppComposition(deps) {
       await next();
       return;
     }
-    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
+    const permission = c.req.method === "PUT" && /^\/v1\/workspaces\/[^/]+\/artifact-catalog\/[^/]+\/[^/]+\/pin$/.test(c.req.path) ? "artifacts:publish" : void 0;
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId, permission);
     await withAccessGrantSessionRlsContext(routeDeps, grant, next);
   });
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
@@ -122315,10 +122507,10 @@ function createAppComposition(deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     const url = new URL(c.req.url);
-    const prefix = `/v1/workspaces/${workspaceId}/codemode/sdk`;
+    const prefix2 = `/v1/workspaces/${workspaceId}/codemode/sdk`;
     let forwarded;
     try {
-      const path = url.pathname.slice(prefix.length) + url.search;
+      const path = url.pathname.slice(prefix2.length) + url.search;
       forwarded = await codemodeSessionRequest(routeDeps, grant, c.req.raw, path, (session) => {
         assertConfiguredCodemodeSessionProxyPath(session, path, c.req.method);
         const proxyTools = configuredCodemodeSessionProxyTools(routeDeps.settings, session);
@@ -122938,7 +123130,7 @@ async function withTimeout(promise, timeoutMs) {
 }
 var routeLabelPatterns = [
   {
-    pattern: /^\/\.well-known\/oauth-authorization-server$/,
+    pattern: /^\/\.well-known\/oauth-authorization-server(?:\/.*)?$/,
     label: "/.well-known/oauth-authorization-server"
   },
   {
@@ -123945,4 +124137,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-6TZ5LG3O.js.map
+//# sourceMappingURL=chunk-BAZXDFT2.js.map