@opengeni/api-router 1.1.0 → 1.2.0

package/dist/app.js

@@ -28,7 +28,7 @@ import {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession,
   workspaceActorContextExempt
-} from "./chunk-A4J3LBH6.js";
+} from "./chunk-BAZXDFT2.js";
 import "./chunk-OGQDXVXY.js";
 export {
   API_MAX_REQUEST_BODY_BYTES,

package/dist/{chunk-A4J3LBH6.js → chunk-BAZXDFT2.js}

@@ -3803,8 +3803,8 @@ async function sendIntegrationEndpointTest(input) {
 // src/routes/workspace-integrations.ts
 import { HTTPException as HTTPException14 } from "hono/http-exception";
 import { z as z10 } from "zod";
-function newIntegrationSecret(prefix) {
-  return `${prefix}_${randomBytes2(32).toString("base64url")}`;
+function newIntegrationSecret(prefix2) {
+  return `${prefix2}_${randomBytes2(32).toString("base64url")}`;
 }
 function iso(value) {
   return value ? value.toISOString() : null;
@@ -4378,13 +4378,13 @@ function registerApiKeyRoutes(app, deps) {
         quantity: 1
       });
       const token = generateApiKeyToken();
-      const prefix = token.slice(0, 14);
+      const prefix2 = token.slice(0, 14);
       const apiKey = await createApiKey(deps.db, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
         name: body3.name,
         description: body3.description ?? null,
-        prefix,
+        prefix: prefix2,
         keyHash: await sha256Hex(token),
         permissions,
         expiresAt: body3.expiresAt ? new Date(body3.expiresAt) : null
@@ -5843,6 +5843,7 @@ function projectClientModel(model) {
     id: model.id,
     label: model.label,
     ...model.shortLabel ? { shortLabel: model.shortLabel } : {},
+    ...model.logoUrl ? { logoUrl: model.logoUrl } : {},
     ...publicProvider,
     ...source === void 0 ? {} : { source },
     api: model.api,
@@ -15383,8 +15384,8 @@ function boundedState(value) {
 function pkceChallenge(verifier) {
   return createHash4("sha256").update(verifier, "ascii").digest("base64url");
 }
-function opaque(prefix) {
-  return `${prefix}${randomBytes5(32).toString("base64url")}`;
+function opaque(prefix2) {
+  return `${prefix2}${randomBytes5(32).toString("base64url")}`;
 }
 function tokenHash(value) {
   return createHash4("sha256").update(value, "utf8").digest("hex");
@@ -21620,21 +21621,21 @@ function projectScheduledTaskUtf8(value, maxBytes) {
     return { value, originalBytes, deliveredBytes: originalBytes, truncated: false };
   }
   let marker = "";
-  let prefix = "";
+  let prefix2 = "";
   let omittedBytes = originalBytes;
   for (let attempt = 0; attempt < 4; attempt += 1) {
     marker = `\u2026[${omittedBytes} UTF-8 bytes omitted]`;
     if (Buffer.byteLength(marker, "utf8") > byteLimit) {
       marker = utf8Prefix2(marker, byteLimit);
-      prefix = "";
+      prefix2 = "";
       break;
     }
-    prefix = utf8Prefix2(value, byteLimit - Buffer.byteLength(marker, "utf8"));
-    const nextOmitted = originalBytes - Buffer.byteLength(prefix, "utf8");
+    prefix2 = utf8Prefix2(value, byteLimit - Buffer.byteLength(marker, "utf8"));
+    const nextOmitted = originalBytes - Buffer.byteLength(prefix2, "utf8");
     if (nextOmitted === omittedBytes) break;
     omittedBytes = nextOmitted;
   }
-  const projected = `${prefix}${marker}`;
+  const projected = `${prefix2}${marker}`;
   return {
     value: projected,
     originalBytes,
@@ -25081,8 +25082,8 @@ function sniffSlackReactionImageMime(bytes) {
   return null;
 }
 function hasMarkupPrefix(bytes) {
-  const prefix = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, Math.min(bytes.byteLength, 256))).replace(/^\uFEFF/u, "").trimStart().toLowerCase();
-  return prefix.startsWith("<svg") || prefix.startsWith("<html") || prefix.startsWith("<!doctype") || prefix.startsWith("<?xml");
+  const prefix2 = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(0, Math.min(bytes.byteLength, 256))).replace(/^\uFEFF/u, "").trimStart().toLowerCase();
+  return prefix2.startsWith("<svg") || prefix2.startsWith("<html") || prefix2.startsWith("<!doctype") || prefix2.startsWith("<?xml");
 }
 function isCompletePng(bytes) {
   const signature = [137, 80, 78, 71, 13, 10, 26, 10];
@@ -38568,14 +38569,9 @@ var ACTION_CATALOG = [
     "method": "GET",
     "path": "/v1/organizations/:accountId/insights/calls",
     "request": [],
-    "response": []
-  },
-  {
-    "id": "GET /v1/organizations/:accountId/insights/usage",
-    "method": "GET",
-    "path": "/v1/organizations/:accountId/insights/usage",
-    "request": [],
-    "response": []
+    "response": [
+      "InsightsCallsResponse"
+    ]
   },
   {
     "id": "GET /v1/organizations/:organizationId/codex/accounts",
@@ -38728,14 +38724,9 @@ var ACTION_CATALOG = [
     "method": "GET",
     "path": "/v1/workspaces/:workspaceId/insights/calls",
     "request": [],
-    "response": []
-  },
-  {
-    "id": "GET /v1/workspaces/:workspaceId/insights/usage",
-    "method": "GET",
-    "path": "/v1/workspaces/:workspaceId/insights/usage",
-    "request": [],
-    "response": []
+    "response": [
+      "InsightsCallsResponse"
+    ]
   },
   {
     "id": "GET /v1/workspaces/:workspaceId/instruction-policies/:revisionId",
@@ -39296,6 +39287,15 @@ var ACTION_CATALOG = [
       "GetOrganizationCredentialProviderResponse"
     ]
   },
+  {
+    "id": "getOrganizationInsightsUsage",
+    "method": "GET",
+    "path": "/v1/organizations/:accountId/insights/usage",
+    "request": [],
+    "response": [
+      "InsightsUsageResponse"
+    ]
+  },
   {
     "id": "getOrganizationIntegrationCatalog",
     "method": "GET",
@@ -39751,6 +39751,15 @@ var ACTION_CATALOG = [
       "WorkspaceInsightsResponse"
     ]
   },
+  {
+    "id": "getWorkspaceInsightsUsage",
+    "method": "GET",
+    "path": "/v1/workspaces/:workspaceId/insights/usage",
+    "request": [],
+    "response": [
+      "InsightsUsageResponse"
+    ]
+  },
   {
     "id": "getWorkspaceLearningHistory",
     "method": "GET",
@@ -73499,13 +73508,13 @@ function registerCatalogAssetRoutes(app, deps) {
   });
 }
 function catalogAssetKeyFromPath(pathname) {
-  const prefix = "/v1/";
-  if (!pathname.startsWith(prefix)) {
+  const prefix2 = "/v1/";
+  if (!pathname.startsWith(prefix2)) {
     return null;
   }
   let key;
   try {
-    key = decodeURIComponent(pathname.slice(prefix.length));
+    key = decodeURIComponent(pathname.slice(prefix2.length));
   } catch {
     return null;
   }
@@ -82445,8 +82454,8 @@ function registerVariableSetRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/variable-sets",
     "/v1/workspaces/:workspaceId/environments"
   ];
-  for (const prefix of prefixes) {
-    app.get(`${prefix}`, async (c) => {
+  for (const prefix2 of prefixes) {
+    app.get(`${prefix2}`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant20(c, deps, workspaceId);
       requirePermission4(grant, "variable-sets:list");
@@ -82459,14 +82468,14 @@ function registerVariableSetRoutes(app, deps) {
         })
       );
     });
-    app.post(`${prefix}`, async (c) => {
+    app.post(`${prefix2}`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
       requirePermission4(grant, "variable-sets:write");
       const key = requireVariableSetEncryption2(settings);
       const payload = await parseRequestJson(c, CreateVariableSetRequest);
-      if (prefix.endsWith("/environments") && payload.scope !== "workspace") {
+      if (prefix2.endsWith("/environments") && payload.scope !== "workspace") {
         throw new HTTPException61(422, {
           message: "the legacy environments route only creates workspace-scoped variable sets"
         });
@@ -82530,8 +82539,8 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json(created, 201);
     });
-    if (prefix.endsWith("/variable-sets")) {
-      app.post(`${prefix}/resolve-attachments`, async (c) => {
+    if (prefix2.endsWith("/variable-sets")) {
+      app.post(`${prefix2}/resolve-attachments`, async (c) => {
         const workspaceId = c.req.param("workspaceId");
         const grant = await requireAccessGrant20(c, deps, workspaceId);
         requirePermission4(grant, "variable-sets:attach");
@@ -82549,15 +82558,15 @@ function registerVariableSetRoutes(app, deps) {
         return c.json(ResolveVariableSetAttachmentsResponse.parse({ variableSets }));
       });
     }
-    app.get(`${prefix}/:variableSetId`, async (c) => {
+    app.get(`${prefix2}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant20(c, deps, workspaceId);
       requirePermission4(grant, "variable-sets:read");
       requirePermission4(grant, "secrets:list");
       return c.json(await requireVariableSetForApi(db, grant, c.req.param("variableSetId")));
     });
-    if (prefix.endsWith("/variable-sets")) {
-      app.get(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+    if (prefix2.endsWith("/variable-sets")) {
+      app.get(`${prefix2}/:variableSetId/variables/:name`, async (c) => {
         const workspaceId = c.req.param("workspaceId");
         const grant = await requireAccessGrant20(c, deps, workspaceId);
         requirePermission4(grant, "variable-sets:read");
@@ -82581,7 +82590,7 @@ function registerVariableSetRoutes(app, deps) {
         return c.json(secret);
       });
     }
-    app.patch(`${prefix}/:variableSetId`, async (c) => {
+    app.patch(`${prefix2}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -82629,7 +82638,7 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json(updated);
     });
-    app.delete(`${prefix}/:variableSetId`, async (c) => {
+    app.delete(`${prefix2}/:variableSetId`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -82666,7 +82675,7 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json({ ok: true });
     });
-    app.put(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+    app.put(`${prefix2}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -82705,7 +82714,7 @@ function registerVariableSetRoutes(app, deps) {
       });
       return c.json(metadata);
     });
-    app.delete(`${prefix}/:variableSetId/variables/:name`, async (c) => {
+    app.delete(`${prefix2}/:variableSetId/variables/:name`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const authorization = await requireAccessGrantAuthorization15(c, deps, workspaceId);
       const grant = authorization.grant;
@@ -83021,10 +83030,43 @@ import {
   OrganizationUsageWorkspacePageQuery
 } from "@opengeni/contracts";
 import { OrganizationModelUsageQuery } from "@opengeni/contracts/organization-model-usage";
-import { configuredEntitlements } from "@opengeni/config";
+import { configuredEntitlements, promotionalCreditScope } from "@opengeni/config";
+
+// src/credit-promotion-snapshot.ts
+import { PromotionalCreditScope } from "@opengeni/contracts";
+var prefix = "opengeni_credit_scope_";
+var countKey = `${prefix}v1`;
+function creditScopeMetadata(scope) {
+  if (!scope) return {};
+  const encoded = JSON.stringify(PromotionalCreditScope.parse(scope));
+  const chunks = encoded.match(/[\s\S]{1,400}/g);
+  if (chunks.length > 24)
+    throw new Error("Promotional credit policy exceeds checkout metadata limits");
+  return Object.fromEntries([
+    [countKey, String(chunks.length)],
+    ...chunks.map((chunk, index) => [`${prefix}${index}`, chunk])
+  ]);
+}
+function creditScopeFromMetadata(metadata) {
+  if (!metadata || !Object.keys(metadata).some((key) => key.startsWith(prefix))) return void 0;
+  const count = Number(metadata[countKey]);
+  if (!Number.isInteger(count) || count < 1 || count > 24) {
+    throw new Error("Invalid promotional credit snapshot");
+  }
+  let encoded = "";
+  for (let index = 0; index < count; index++) {
+    const chunk = metadata[`${prefix}${index}`];
+    if (!chunk) throw new Error("Incomplete promotional credit snapshot");
+    encoded += chunk;
+  }
+  return PromotionalCreditScope.parse(JSON.parse(encoded));
+}
+
+// src/routes/billing.ts
 import {
   applyCreditLedgerEntry,
   getBillingBalance,
+  readCreditPromotionPolicy,
   getBillingCustomer,
   getCreditLedgerEntry,
   hasCreditLedgerEntry,
@@ -83034,6 +83076,7 @@ import {
   getOrganizationUsageSummary,
   getOrganizationUsageWorkspacePage,
   withSessionRlsActorContext as withSessionRlsActorContext8,
+  withRlsContext as withRlsContext2,
   getManagedAccount as getManagedAccount2,
   markStripeWebhookProcessed,
   recordStripeWebhookEvent,
@@ -83139,6 +83182,12 @@ function registerBillingRoutes(app, deps) {
     const accountId = requireSelectedAccount(context, body3.accountId, "billing:manage");
     const stripe = stripeClient(deps);
     const promotion = body3.promotionCode ? await resolveCheckoutPromotionCode(stripe, body3.promotionCode) : null;
+    const promotionalScope = promotion ? promotionalCreditScope(
+      {
+        creditPromotionPolicy: await readCreditPromotionPolicy(deps.db) ?? deps.settings.creditPromotionPolicy
+      },
+      promotion.couponId
+    ) : void 0;
     const amountCents = body3.amountUsd !== void 0 ? usdToCents(body3.amountUsd) : promotion?.amountOffCents ?? null;
     if (amountCents === null) {
       throw new HTTPException64(422, {
@@ -83150,6 +83199,11 @@ function registerBillingRoutes(app, deps) {
         message: "Credits must be between $5 and $10,000."
       });
     }
+    if (promotionalScope && (!promotion?.amountOffCents || amountCents !== promotion.amountOffCents)) {
+      throw new HTTPException64(422, {
+        message: "Redeem this offer for its exact credit amount. Buy additional credits separately."
+      });
+    }
     const amountMicros = centsToMicros(amountCents);
     const customerId = await getOrCreateStripeCustomer(deps, stripe, context, accountId);
     const idempotencyKey = `checkout:${accountId}:${amountMicros}:${crypto.randomUUID()}`;
@@ -83167,8 +83221,10 @@ function registerBillingRoutes(app, deps) {
           successUrl: body3.successUrl,
           cancelUrl: body3.cancelUrl,
           idempotencyKey,
+          promotionalScope,
           ...promotion ? {
             promotionCodeId: promotion.id,
+            couponId: promotion.couponId,
             fullyDiscounted: promotion.percentOff === 100 || (promotion.amountOffCents ?? 0) >= amountCents
           } : {}
         }),
@@ -83187,7 +83243,8 @@ function registerBillingRoutes(app, deps) {
       CreateCheckoutResponse.parse({
         checkoutSessionId: session.id,
         url: session.url,
-        amountUsd: amountCents / 100
+        amountUsd: amountCents / 100,
+        promotionalScope
       })
     );
   });
@@ -83231,6 +83288,7 @@ function registerBillingRoutes(app, deps) {
           state: entry2 ? "granted" : "pending",
           amountMicros: entry2?.amountMicros ?? credit.amountMicros,
           currency: "usd",
+          promotionalScope: creditScopeFromMetadata(session.metadata),
           free: entry2 ? entry2.sourceType === "stripe_checkout_coupon" : isFreeCouponCheckout(session)
         },
         balance: entry2 ? await getBillingBalance(deps.db, accountId) : null
@@ -83330,7 +83388,7 @@ function stripeCheckoutSessionCreateParams(input) {
   return {
     mode: "payment",
     // Stripe takes either a code field on its page or one discount up front.
-    ...input.promotionCodeId ? { discounts: [{ promotion_code: input.promotionCodeId }] } : { allow_promotion_codes: true },
+    ...input.promotionCodeId ? { discounts: [{ promotion_code: input.promotionCodeId }] } : { allow_promotion_codes: false },
     customer: input.customerId,
     customer_update: {
       address: "auto",
@@ -83359,6 +83417,8 @@ function stripeCheckoutSessionCreateParams(input) {
       }
     ],
     metadata: {
+      ...creditScopeMetadata(input.promotionalScope),
+      ...input.couponId ? { opengeni_credit_offer_id: input.couponId } : {},
       opengeni_account_id: input.accountId,
       opengeni_credit_amount_usd: (input.amountCents / 100).toFixed(2),
       opengeni_credit_micros: String(input.amountMicros),
@@ -83500,6 +83560,10 @@ async function grantCheckoutSessionCredits(deps, session, source) {
   }
   const credit = decision.credit;
   const freeCouponCheckout = isFreeCouponCheckout(session);
+  const promotionalScope = creditScopeFromMetadata(session.metadata);
+  if (promotionalScope && !freeCouponCheckout) {
+    throw new Error("Scoped promotional credits require a fully discounted checkout");
+  }
   if (!await getManagedAccount2(deps.db, credit.accountId)) {
     console.info(
       "[api] stripe webhook ignored a checkout session for an account not in this deployment",
@@ -83526,10 +83590,13 @@ async function grantCheckoutSessionCredits(deps, session, source) {
     accountId: credit.accountId,
     type: freeCouponCheckout ? "grant" : "credit_topup",
     amountMicros: credit.amountMicros,
+    eligibleModelIds: promotionalScope?.eligibleModelIds,
     sourceType: freeCouponCheckout ? "stripe_checkout_coupon" : "stripe_checkout_session",
     sourceId: session.id,
     idempotencyKey: credit.idempotencyKey,
     metadata: {
+      ...promotionalScope ? { creditOfferLabel: promotionalScope.label } : {},
+      creditOfferId: session.metadata?.opengeni_credit_offer_id ?? null,
       stripeEventId: source.stripeEventId,
       stripePaymentIntentId: typeof session.payment_intent === "string" ? session.payment_intent : session.payment_intent?.id ?? null,
       stripePackageId: credit.packageId,
@@ -83555,7 +83622,12 @@ async function resolveCheckoutPromotionCode(stripe, code) {
     throw new HTTPException64(422, { message: "That code isn't valid or has expired." });
   }
   const amountOffCents = coupon.amount_off && coupon.currency === "usd" ? coupon.amount_off : coupon.currency_options?.usd?.amount_off ?? null;
-  return { id: promotionCode.id, amountOffCents, percentOff: coupon.percent_off ?? null };
+  return {
+    id: promotionCode.id,
+    couponId: coupon.id,
+    amountOffCents,
+    percentOff: coupon.percent_off ?? null
+  };
 }
 async function mirrorPaymentIntentCustomer(deps, event) {
   const intent = event.data.object;
@@ -83637,18 +83709,26 @@ async function releaseDisputedCredits(deps, stripe, event) {
     return;
   }
   const holdIdempotencyKey = `stripe:dispute_hold:${dispute.id}`;
-  if (!await hasCreditLedgerEntry(deps.db, accountId, holdIdempotencyKey)) {
-    return;
-  }
   const debitMicros = await creditAdjustmentMicros(deps, metadata, dispute.amount);
-  await applyCreditLedgerEntry(deps.db, {
-    accountId,
-    type: "credit_dispute_release",
-    amountMicros: debitMicros,
-    sourceType: "stripe_dispute",
-    sourceId: dispute.id,
-    idempotencyKey: `stripe:dispute_release:${dispute.id}`,
-    metadata: { stripeDisputeId: dispute.id, stripeEventType: event.type }
+  await withRlsContext2(deps.db, { accountId }, async (tx) => {
+    await applyCreditLedgerEntry(tx, {
+      accountId,
+      type: "credit_dispute_hold",
+      amountMicros: -debitMicros,
+      sourceType: "stripe_dispute",
+      sourceId: dispute.id,
+      idempotencyKey: holdIdempotencyKey,
+      metadata: { stripeDisputeId: dispute.id, stripeEventType: event.type }
+    });
+    await applyCreditLedgerEntry(tx, {
+      accountId,
+      type: "credit_dispute_release",
+      amountMicros: debitMicros,
+      sourceType: "stripe_dispute",
+      sourceId: dispute.id,
+      idempotencyKey: `stripe:dispute_release:${dispute.id}`,
+      metadata: { stripeDisputeId: dispute.id, stripeEventType: event.type }
+    });
   });
 }
 async function creditAdjustmentMicros(deps, metadata, amountCents) {
@@ -91702,9 +91782,9 @@ async function requireGitHubManageGrant(c, deps, workspaceId, expectedState) {
   }
 }
 function allCookieValues(c, name) {
-  const prefix = `${name}=`;
-  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix)).map((part) => {
-    const raw = part.slice(prefix.length);
+  const prefix2 = `${name}=`;
+  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix2)).map((part) => {
+    const raw = part.slice(prefix2.length);
     try {
       return decodeURIComponent(raw);
     } catch {
@@ -96472,12 +96552,12 @@ function requireStateCookie(c, state) {
   }
 }
 function allCookieValues2(c, name) {
-  const prefix = `${name}=`;
-  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix)).map((part) => {
+  const prefix2 = `${name}=`;
+  return (c.req.header("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(prefix2)).map((part) => {
     try {
-      return decodeURIComponent(part.slice(prefix.length));
+      return decodeURIComponent(part.slice(prefix2.length));
     } catch {
-      return part.slice(prefix.length);
+      return part.slice(prefix2.length);
     }
   });
 }
@@ -100099,9 +100179,9 @@ function openGeniRealtimeInstructions(additional) {
   const trimmed = additional?.trim();
   if (!trimmed) return OPENGENI_REALTIME_BASE_INSTRUCTIONS;
   const heading = "\n\n## Additional realtime guidance\nFollow the guidance below for this conversation unless it conflicts with the operating, delegation, safety, permission, or context-handling rules above.\n";
-  const prefix = `${OPENGENI_REALTIME_BASE_INSTRUCTIONS}${heading}`;
-  const remaining = REALTIME_INSTRUCTIONS_MAX_BYTES - Buffer.byteLength(prefix, "utf8");
-  return `${prefix}${takeUtf8Head(trimmed, Math.max(0, remaining))}`;
+  const prefix2 = `${OPENGENI_REALTIME_BASE_INSTRUCTIONS}${heading}`;
+  const remaining = REALTIME_INSTRUCTIONS_MAX_BYTES - Buffer.byteLength(prefix2, "utf8");
+  return `${prefix2}${takeUtf8Head(trimmed, Math.max(0, remaining))}`;
 }
 function takeUtf8Head(value, maximumBytes) {
   if (Buffer.byteLength(value, "utf8") <= maximumBytes) return value;
@@ -106311,6 +106391,8 @@ import {
 import { loadWorkspaceCodexModelAvailability } from "@opengeni/core";
 import {
   allWorkspacePermissions,
+  getBillingBalance as getBillingBalance2,
+  spendableCreditMicros,
   createWorkspace,
   ensureWorkspaceByExternalIdentity,
   findWorkspaceByExternalIdentity as findWorkspaceByExternalIdentity2,
@@ -106905,25 +106987,31 @@ function registerWorkspaceRoutes(app, deps) {
       organizationOpenRouterCustomModels: organizationProviders.openrouter.models
     });
     const workspaceSettings = workspace?.settings ?? {};
+    const creditBalance = deps.settings.billingMode === "stripe" ? await getBillingBalance2(deps.db, grant.accountId) : void 0;
     const defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
       settings: workspaceCatalogSettings,
       accountId: grant.accountId,
       workspaceSettings,
       selections
     });
+    const catalog = projectWorkspaceModelCatalog(selections, {
+      defaultSelection,
+      creditsSelection: creditsDefaultSessionModel({
+        settings: workspaceCatalogSettings,
+        selections,
+        workspaceSettings
+      })
+    });
+    if (creditBalance) {
+      for (const model of catalog.models) {
+        if (model.cost !== "credits") continue;
+        model.creditFunding = creditBalance.promotionalCredits?.some(
+          (credit) => credit.remainingMicros > 0 && credit.eligibleModelIds.includes(model.id)
+        ) ? "promotional" : spendableCreditMicros(creditBalance, model.id) > 0 ? "general" : "unavailable";
+      }
+    }
     c.header("cache-control", "private, no-store");
-    return c.json(
-      WorkspaceModelCatalogResponse2.parse(
-        projectWorkspaceModelCatalog(selections, {
-          defaultSelection,
-          creditsSelection: creditsDefaultSessionModel({
-            settings: workspaceCatalogSettings,
-            selections,
-            workspaceSettings
-          })
-        })
-      )
-    );
+    return c.json(WorkspaceModelCatalogResponse2.parse(catalog));
   });
   app.get("/v1/workspaces/:workspaceId/gateway-custom-models", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -111974,7 +112062,7 @@ import {
   hasEditableArtifactSessionLink as hasEditableArtifactSessionLink2,
   hasWorkspaceArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor,
-  withRlsContext as withRlsContext2
+  withRlsContext as withRlsContext3
 } from "@opengeni/db";
 import { HTTPException as HTTPException106 } from "hono/http-exception";
 import { z as z54 } from "zod";
@@ -112005,7 +112093,7 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
           const linked = kind === "editable" ? await hasEditableArtifactSessionLink2(deps.db, scope, sessionId, artifactId2) : await hasWorkspaceArtifactSessionLink(deps.db, workspaceId, sessionId, artifactId2);
           if (!linked) throw new HTTPException106(404, { message: "Artifact association not found" });
           if (kind === "editable") {
-            const decision = await withRlsContext2(
+            const decision = await withRlsContext3(
               deps.db,
               scope,
               (tx) => transactionallyAuthorizeEditableArtifactActor(tx, {
@@ -113138,8 +113226,8 @@ function setTransactionCookie(context, deps, transactionId, transactionSecret) {
 }
 function requireTransactionSecret(context, transactionId) {
   const value = getCookie(context, MANAGED_AUTH_LOGIN_TRANSACTION_COOKIE);
-  const prefix = `${transactionId}.`;
-  const secret = value?.startsWith(prefix) ? value.slice(prefix.length) : null;
+  const prefix2 = `${transactionId}.`;
+  const secret = value?.startsWith(prefix2) ? value.slice(prefix2.length) : null;
   if (!secret || !/^[A-Za-z0-9_-]{43}$/.test(secret)) {
     throw managedAuthApiError(401, "invalid_transaction");
   }
@@ -113739,6 +113827,7 @@ function registerCanonicalHumanIdentityRoutes(app, deps) {
 }
 
 // src/routes/organization-memberships.ts
+import { signupCreditModelIds } from "@opengeni/config";
 import {
   lookupExternalIdentityForRequest,
   cancelExternalWorkspaceMemberGrantForRequest,
@@ -113985,6 +114074,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
             subjectId,
             subjectLabel: session.user.email || session.user.name,
             ...payload,
+            trialCreditModelIds: signupCreditModelIds(deps.settings),
             trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
           })
         ),
@@ -115156,6 +115246,7 @@ function registerOrganizationRecoveryRoutes(app, deps, services = productionServ
 }
 
 // src/routes/managed-onboarding.ts
+import { signupCreditModelIds as signupCreditModelIds2 } from "@opengeni/config";
 import {
   CompleteSelfServiceOrganizationSetupRequest,
   CompleteSelfServiceOrganizationSetupResponse,
@@ -115216,6 +115307,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
           organizationName,
           operationId: parsed.data.operationId,
           requestFingerprint,
+          trialCreditModelIds: signupCreditModelIds2(deps.settings),
           trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
         })
       );
@@ -116531,14 +116623,14 @@ function resolveSlackWorkspaceRoute(input) {
       source: "thread"
     };
   }
-  const prefix = AUTHORED_BY_INVOKER.has(input.entry.triggerKind) ? parseSlackWorkspacePrefix(splitSlackLeadingMention(input.entry.text, input.botUserId).rest) : null;
-  if (prefix) {
-    const named = matchCandidate(candidates, prefix.requested);
+  const prefix2 = AUTHORED_BY_INVOKER.has(input.entry.triggerKind) ? parseSlackWorkspacePrefix(splitSlackLeadingMention(input.entry.text, input.botUserId).rest) : null;
+  if (prefix2) {
+    const named = matchCandidate(candidates, prefix2.requested);
     if (named === "ambiguous" || !named) {
       return {
         kind: "denied",
         reason: "no_access_to_named",
-        requested: prefix.requested,
+        requested: prefix2.requested,
         candidates
       };
     }
@@ -122415,10 +122507,10 @@ function createAppComposition(deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     const url = new URL(c.req.url);
-    const prefix = `/v1/workspaces/${workspaceId}/codemode/sdk`;
+    const prefix2 = `/v1/workspaces/${workspaceId}/codemode/sdk`;
     let forwarded;
     try {
-      const path = url.pathname.slice(prefix.length) + url.search;
+      const path = url.pathname.slice(prefix2.length) + url.search;
       forwarded = await codemodeSessionRequest(routeDeps, grant, c.req.raw, path, (session) => {
         assertConfiguredCodemodeSessionProxyPath(session, path, c.req.method);
         const proxyTools = configuredCodemodeSessionProxyTools(routeDeps.settings, session);
@@ -124045,4 +124137,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-A4J3LBH6.js.map
+//# sourceMappingURL=chunk-BAZXDFT2.js.map