@opengeni/api-router 1.4.0 → 1.4.2

package/dist/{chunk-KKEXIBQG.js → chunk-F3LQ6VWR.js}

@@ -6612,7 +6612,11 @@ import {
   ModelUnavailableError,
   ScheduledTaskTargetAccessChange
 } from "@opengeni/contracts";
-import { isDatabaseConnectionLoss, WorkspaceControlBusyError } from "@opengeni/db";
+import {
+  isDatabaseConnectionLoss,
+  nestedPostgresSqlState as nestedPostgresSqlState4,
+  WorkspaceControlBusyError
+} from "@opengeni/db";
 import { HTTPException as HTTPException20 } from "hono/http-exception";
 var ApiHttpError = class extends HTTPException20 {
   code;
@@ -6679,6 +6683,21 @@ function databaseUnavailableHttpError(error, method) {
     details: { code: DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE }
   });
 }
+var DATABASE_CONTENTION_ERROR_DETAIL_CODE = "DATABASE_CONTENTION";
+function databaseContentionHttpError(error, method, options = {}) {
+  if (error instanceof ApiHttpError) return null;
+  if (error instanceof HTTPException20 && error.status < 500) return null;
+  const sqlState = nestedPostgresSqlState4(error);
+  if (sqlState !== "40P01" && sqlState !== "40001") return null;
+  const safeMethod = method === "GET" || method === "HEAD" || method === "OPTIONS";
+  return new ApiHttpError(503, {
+    code: "upstream_unavailable",
+    message: "Opengeni hit transient database contention. Retry shortly.",
+    retryable: true,
+    outcomeUnknown: options.outcomeUnknown ?? !safeMethod,
+    details: { code: DATABASE_CONTENTION_ERROR_DETAIL_CODE, sqlState }
+  });
+}
 function agentConfigHttpError(error) {
   const cause = error instanceof AgentConfigError ? error : error instanceof HTTPException20 && error.cause instanceof AgentConfigError ? error.cause : null;
   if (!cause) return null;
@@ -11828,7 +11847,7 @@ import {
   confirmLegacyInstruction,
   getKnowledgeEntry,
   listKnowledgeEntries,
-  nestedPostgresSqlState as nestedPostgresSqlState4,
+  nestedPostgresSqlState as nestedPostgresSqlState5,
   saveKnowledgeEntry,
   saveAgentInstruction,
   getAgentInstruction,
@@ -11874,7 +11893,7 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
           ]
         };
       }
-      const state = nestedPostgresSqlState4(error);
+      const state = nestedPostgresSqlState5(error);
       const message = surface === "instruction" ? state === "40001" ? "This instruction changed. Read its current content and baseline, then retry the same intended edit against that exact state." : state === "23505" ? "This instruction operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The instruction change is unavailable in this task's scope or Agent learning policy. Off disables authoring, not the task. Do not ask for approval to continue." : state === "22023" || state === "23514" ? `Invalid instruction change. Read the current instruction, use append for a new rule, or edit with one localized exact oldText match to update or remove text. Agents cannot replace the complete instruction. Each supplied text and the resulting instruction must stay within ${WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters, the same limit as the human editor.` : "Workspace instructions are temporarily unavailable. Retry the same operation ID only if the prior change may have succeeded." : state === "40001" ? "This entry changed. Read its current revision and retry your correction with the current version." : state === "23505" ? "This operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The entry, reference, or write is unavailable in this task's scope and Agent learning policy. Off disables saving, not your task. Do not ask for an approval to continue." : state === "22023" || state === "23514" ? "Invalid Knowledge entry or relationship. Check the referenced IDs and revision before retrying." : "Knowledge is temporarily unavailable. Your task can continue; retry the same operation ID if saving may have succeeded.";
       return {
         isError: true,
@@ -12419,7 +12438,7 @@ import { HTTPException as HTTPException22 } from "hono/http-exception";
 import {
   getScheduledScopedRigVersionMetadata,
   loadWorkspaceEnvironmentForRun,
-  nestedPostgresSqlState as nestedPostgresSqlState5
+  nestedPostgresSqlState as nestedPostgresSqlState6
 } from "@opengeni/db";
 async function loadSessionAttachVariableSetValues(db, settings, input) {
   const { accountId, workspaceId, session, subjectId } = input;
@@ -12469,7 +12488,7 @@ async function loadSessionAttachVariableSetValues(db, settings, input) {
         variableSetId,
         source
       });
-      if (nestedPostgresSqlState5(error) === "42501") {
+      if (nestedPostgresSqlState6(error) === "42501") {
         throw new ApiHttpError(403, {
           code: "forbidden",
           message: source === "sandbox_environment_default" ? "A default Variable Set of this session's Sandbox Environment is not available to this session." : "A Variable Set selected for this session is not available to this session.",
@@ -12483,7 +12502,7 @@ async function loadSessionAttachVariableSetValues(db, settings, input) {
   return values;
 }
 function logAttachFailure(message, error, context) {
-  const sqlState = nestedPostgresSqlState5(error);
+  const sqlState = nestedPostgresSqlState6(error);
   console.warn(`[session-attach] ${message}`, {
     ...context,
     ...sqlState ? { sqlState } : {},
@@ -16907,7 +16926,10 @@ import {
 } from "@opengeni/db/organization-integration-policy";
 import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { parseIntegrationsOauthClientsJson } from "@opengeni/config";
+import {
+  findIntegrationsOauthClient,
+  parseIntegrationsOauthClientsJson
+} from "@opengeni/config";
 import {
   OAuthStartResponse,
   selectCanonicalPersonalSlackConnection
@@ -18513,7 +18535,6 @@ function operatorClientForAs(settings, as) {
   };
 }
 function operatorClientEntryFor(settings, candidates) {
-  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
   const candidateOrigins = candidates.flatMap((candidate) => {
     try {
       return [new URL(candidate).origin];
@@ -18530,22 +18551,10 @@ function operatorClientEntryFor(settings, candidates) {
       return resolved;
     }
   }
-  const configured2 = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
-  const exactKeys = uniqueStrings(
-    candidates.flatMap((candidate) => [candidate, normalizedIssuerKey(candidate)])
+  return findIntegrationsOauthClient(
+    parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson),
+    candidates
   );
-  for (const key of exactKeys) {
-    const entry2 = configured2[key];
-    if (entry2) {
-      return entry2;
-    }
-  }
-  for (const [key, entry2] of Object.entries(configured2)) {
-    if (normalizedCandidates.has(normalizedIssuerKey(key))) {
-      return entry2;
-    }
-  }
-  return null;
 }
 function gmailOAuthClientConfigured(settings) {
   const entry2 = operatorClientEntryFor(settings, ["https://accounts.google.com"]);
@@ -74277,7 +74286,7 @@ import {
   getOrganizationIntegrationPolicy,
   updateOrganizationIntegrationPolicy
 } from "@opengeni/db/organization-integration-policy";
-import { nestedPostgresSqlState as nestedPostgresSqlState6 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState7 } from "@opengeni/db";
 import { HTTPException as HTTPException46 } from "hono/http-exception";
 import { z as z32 } from "zod";
 async function authorizeOrganizationIntegrationAdministration(context, deps, accountId, mutation) {
@@ -74306,7 +74315,7 @@ async function policyResponse(readOrWrite) {
     return await readOrWrite();
   } catch (error) {
     if (error instanceof HTTPException46) throw error;
-    const state = nestedPostgresSqlState6(error);
+    const state = nestedPostgresSqlState7(error);
     if (state === "42501") {
       throw new HTTPException46(403, { message: "Organization administration required" });
     }
@@ -81229,7 +81238,7 @@ import {
   listAgentLearningOverrides,
   listKnowledgeEntryHistory,
   listKnowledgeReviewBatches,
-  nestedPostgresSqlState as nestedPostgresSqlState7,
+  nestedPostgresSqlState as nestedPostgresSqlState8,
   restoreKnowledgeEntry,
   reviewKnowledgeEntry,
   saveAgentLearningSettings,
@@ -81283,7 +81292,7 @@ function knowledgeHttpError(error) {
     throw new HTTPException57(422, {
       message: error.issues[0]?.message ?? "Invalid Knowledge request"
     });
-  const state = nestedPostgresSqlState7(error);
+  const state = nestedPostgresSqlState8(error);
   if (state === "40001" || state === "23505")
     throw new HTTPException57(409, { message: "This item changed. Refresh it and try again." });
   if (state === "42501")
@@ -95559,7 +95568,7 @@ import {
   getPrReviewAppRegistrationSecret,
   listPrReviewAppRegistrations as listPrReviewAppRegistrations3,
   listPrReviewRepositoryBindings as listPrReviewRepositoryBindings2,
-  nestedPostgresSqlState as nestedPostgresSqlState9,
+  nestedPostgresSqlState as nestedPostgresSqlState10,
   recordAuditEvent as recordAuditEvent12,
   updatePrReviewAppRegistration,
   updatePrReviewRepositoryBinding
@@ -95775,7 +95784,7 @@ import {
   getAutomationSourceSecret as getAutomationSourceSecret2,
   listPrReviewAppRegistrations as listPrReviewAppRegistrations2,
   listPrReviewRepositoryBindings,
-  nestedPostgresSqlState as nestedPostgresSqlState8,
+  nestedPostgresSqlState as nestedPostgresSqlState9,
   PrReviewDispatchAuthorityError,
   recordAuditEvent as recordAuditEvent11,
   resolveManagedGitHubPrReviewRoute,
@@ -96816,7 +96825,7 @@ function registerPrReviewGitHubRoutes(app, deps) {
       if (error instanceof PrReviewDispatchAuthorityError) {
         throw new HTTPException76(409, { message: error.message });
       }
-      if (nestedPostgresSqlState8(error) === "23505") {
+      if (nestedPostgresSqlState9(error) === "23505") {
         throw new HTTPException76(409, {
           message: "One of these repositories is already connected to Opengeni Lens in another workspace"
         });
@@ -97561,7 +97570,7 @@ async function mapPrReviewUniqueConflict(operation, message) {
   try {
     return await operation;
   } catch (error) {
-    if (nestedPostgresSqlState9(error) === "23505") {
+    if (nestedPostgresSqlState10(error) === "23505") {
       throw new HTTPException77(409, { message });
     }
     throw error;
@@ -100676,7 +100685,7 @@ import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from
 import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
 import * as sessionPreviewSchema from "@opengeni/db/schema";
 import { SessionMessageSearchRequest } from "@opengeni/contracts";
-import { scheduledSessionIds } from "@opengeni/db";
+import { requireWorkspace as requireWorkspace3, scheduledSessionIds } from "@opengeni/db";
 import { isVerifiedDelegatedHumanAuthorization as isVerifiedDelegatedHumanAuthorization4, withSiteSessionOrigin as withSiteSessionOrigin3 } from "@opengeni/core";
 import { freezeSessionRealtimeConnectionAccounts } from "@opengeni/core";
 import {
@@ -100922,6 +100931,7 @@ async function createGatewayRealtimeConnectionSecret(input) {
     getSessionRealtimeContinuityEntries3(input.db, input.workspaceId, input.sessionId),
     mintGatewayClientSecret({
       apiKey,
+      source: resolved.source,
       upstreamModelId: resolved.upstreamModelId,
       fetchImpl: input.fetchImpl ?? fetch
     })
@@ -100950,13 +100960,14 @@ async function mintGatewayClientSecret(input) {
   } catch {
     throw new GatewayRealtimeBrokerError(
       "provider_error",
-      "AI Gateway realtime token request failed"
+      "The voice provider could not be reached. Try again."
     );
   }
   if (!response.ok) {
+    const rejected = response.status === 401 || response.status === 403;
     throw new GatewayRealtimeBrokerError(
-      response.status === 401 || response.status === 403 ? "credential_unavailable" : "provider_error",
-      response.status === 401 || response.status === 403 ? "AI Gateway credentials were rejected" : "AI Gateway realtime token request failed",
+      rejected ? "credential_unavailable" : "provider_error",
+      rejected ? input.source === "managed" ? "Opengeni voice is temporarily unavailable. Try another voice model." : "Your AI Gateway key was rejected. Update it in workspace settings." : "The voice provider could not start a call. Try again.",
       response.status
     );
   }
@@ -102321,18 +102332,26 @@ function registerSessionRoutes(app, deps) {
     if (!session) {
       throw new HTTPException88(404, { message: "session not found" });
     }
-    const activity = await backgroundCommandActivityForSessions(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      sessionIds: [sessionId]
-    });
-    const scheduleTargets = hasPermission23(grant.permissions, "scheduled_tasks:run") && hasPermission23(grant.permissions, "sessions:control") ? await scheduledSessionIds(db, workspaceId, [sessionId]) : /* @__PURE__ */ new Set();
+    const [activity, scheduleTargets, policy] = await Promise.all([
+      backgroundCommandActivityForSessions(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        sessionIds: [sessionId]
+      }),
+      hasPermission23(grant.permissions, "scheduled_tasks:run") && hasPermission23(grant.permissions, "sessions:control") ? scheduledSessionIds(db, workspaceId, [sessionId]) : Promise.resolve(/* @__PURE__ */ new Set()),
+      loadEffectivePolicyContext(deps, workspaceId, grant.subjectId, [session])
+    ]);
     return c.json(
-      await withEffectivePolicy(deps, workspaceId, grant.subjectId, {
-        ...session,
-        hasSchedules: scheduleTargets.has(sessionId),
-        ...activity.get(sessionId) ? { backgroundCommandActivity: activity.get(sessionId) } : {}
-      })
+      sessionWithEffectiveToolPolicy2(
+        {
+          ...session,
+          hasSchedules: scheduleTargets.has(sessionId),
+          ...activity.get(sessionId) ? { backgroundCommandActivity: activity.get(sessionId) } : {}
+        },
+        policy.workspaceServerIds,
+        policy.workspaceDefaultServerIds,
+        policy.effectiveToolsContext
+      )
     );
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/model-context", async (c) => {
@@ -103146,23 +103165,31 @@ function registerSessionRoutes(app, deps) {
         });
       }
       try {
-        const result = await withWorkspaceSessionActivityRls(db, workspaceId, async (scopedDb) => {
-          await beforeCommit?.(scopedDb);
-          return syncSessionRealtimeLedgerInTransaction(
-            scopedDb,
-            {
-              workspaceId,
-              sessionId,
-              realtimeId,
-              ownerSubjectId: grant.subjectId,
-              ...parsed.data,
-              controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
-            },
-            captureLinked ? {
-              afterDelegationAdmission: async ({ turnId }) => captureLinked(scopedDb, sessionId, turnId)
-            } : {}
-          );
-        });
+        const result = await withWorkspaceSessionActivityRls(
+          db,
+          workspaceId,
+          async (scopedDb) => {
+            await beforeCommit?.(scopedDb);
+            return syncSessionRealtimeLedgerInTransaction(
+              scopedDb,
+              {
+                workspaceId,
+                sessionId,
+                realtimeId,
+                ownerSubjectId: grant.subjectId,
+                ...parsed.data,
+                controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
+              },
+              captureLinked ? {
+                afterDelegationAdmission: async ({ turnId }) => captureLinked(scopedDb, sessionId, turnId)
+              } : {}
+            );
+          },
+          void 0,
+          // External reauthorization takes the organization-membership lock,
+          // which precedes the tenancy fence and the canonical session prefix.
+          Boolean(beforeCommit)
+        );
         await publishRealtimeMutation(grant.accountId, workspaceId, sessionId, result);
         c.header("cache-control", "private, no-store");
         return c.json({ accepted: result.accepted, outbound: result.outbound });
@@ -105806,11 +105833,16 @@ function codexRealtimeHttpFailure(error) {
       return { status: 409, code: "conflict", retryable: false };
   }
 }
+var SESSION_REALTIME_USER_MESSAGES = {
+  REALTIME_ACTIVE: "Voice is already on for this session in another tab or window. End it there, or try again in a minute.",
+  CONTROL_NOT_ACTIVE: "Resume this session to start voice.",
+  SESSION_CANCELLED: "This session was cancelled, so voice can't start."
+};
 function sessionRealtimeHttpError(error) {
   if (error instanceof HTTPException88) return error;
   if (error instanceof SessionRealtimeConflictError) {
     return new HTTPException88(error.code === "REALTIME_NOT_FOUND" ? 404 : 409, {
-      message: error.message,
+      message: SESSION_REALTIME_USER_MESSAGES[error.code] ?? error.message,
       cause: error
     });
   }
@@ -106588,9 +106620,17 @@ function commandConflictResponse(c, error) {
   throw error;
 }
 async function loadEffectivePolicyContext(deps, workspaceId, subjectId, sessions) {
+  const workspaceRead = requireWorkspace3(deps.db, workspaceId);
+  void workspaceRead.catch(() => void 0);
   const [policy, effectiveToolsContext] = await Promise.all([
-    workspaceSessionToolPolicyContext(deps.db, workspaceId, deps.settings, subjectId),
-    workspaceSessionEffectiveToolsContext2(deps, workspaceId, subjectId, sessions)
+    workspaceSessionToolPolicyContext(
+      deps.db,
+      workspaceId,
+      deps.settings,
+      subjectId,
+      workspaceRead
+    ),
+    workspaceSessionEffectiveToolsContext2(deps, workspaceId, subjectId, sessions, workspaceRead)
   ]);
   return { ...policy, effectiveToolsContext };
 }
@@ -107134,9 +107174,9 @@ import {
   replayWorkspaceGatewayCustomModelCreate,
   replayWorkspaceOpenRouterCustomModelCreate,
   listWorkspacesForSubject as listWorkspacesForSubject2,
-  nestedPostgresSqlState as nestedPostgresSqlState11,
+  nestedPostgresSqlState as nestedPostgresSqlState12,
   removeWorkspaceMember,
-  requireWorkspace as requireWorkspace3,
+  requireWorkspace as requireWorkspace4,
   updateWorkspaceSettings,
   getRig,
   setWorkspaceDefaultRig,
@@ -107185,7 +107225,7 @@ import {
 } from "@opengeni/core";
 
 // src/workspace-deletion.ts
-import { deleteWorkspaceIfQuiescent, nestedPostgresSqlState as nestedPostgresSqlState10 } from "@opengeni/db";
+import { deleteWorkspaceIfQuiescent, nestedPostgresSqlState as nestedPostgresSqlState11 } from "@opengeni/db";
 import { HTTPException as HTTPException91 } from "hono/http-exception";
 
 // src/workspace-delete-observability.ts
@@ -107275,7 +107315,7 @@ async function deleteWorkspaceForRequest(deps, input) {
       ...observer ? { observer } : {}
     });
   } catch (error) {
-    const state = nestedPostgresSqlState10(error);
+    const state = nestedPostgresSqlState11(error);
     if (state === "42501") {
       throw new HTTPException91(403, { message: "organization administration is not authorized" });
     }
@@ -107429,7 +107469,7 @@ function registerWorkspaceRoutes(app, deps) {
     ];
     if (readableWorkspaceIds.length > 0) {
       const workspaces = await Promise.all(
-        readableWorkspaceIds.map((workspaceId) => requireWorkspace3(deps.db, workspaceId))
+        readableWorkspaceIds.map((workspaceId) => requireWorkspace4(deps.db, workspaceId))
       );
       return c.json(workspaces.map((workspace) => Workspace.parse(workspace)));
     }
@@ -107546,7 +107586,7 @@ function registerWorkspaceRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant39(c, deps, workspaceId, "workspace:read");
-    return c.json(Workspace.parse(await requireWorkspace3(deps.db, workspaceId)));
+    return c.json(Workspace.parse(await requireWorkspace4(deps.db, workspaceId)));
   });
   app.patch("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -107608,14 +107648,14 @@ function registerWorkspaceRoutes(app, deps) {
         deps.db,
         workspaceId,
         parsed.data,
-        { requireWorkspace: requireWorkspace3, updateWorkspaceSettings },
+        { requireWorkspace: requireWorkspace4, updateWorkspaceSettings },
         {
           controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs2()
         }
       );
       return c.json(Workspace.parse(workspace));
     } catch (error) {
-      if (nestedPostgresSqlState11(error) === "0A000") {
+      if (nestedPostgresSqlState12(error) === "0A000") {
         throw new HTTPException92(409, {
           message: "Memory settings moved to Settings > Agent learning. Refresh the app to change them."
         });
@@ -107811,7 +107851,7 @@ function registerWorkspaceRoutes(app, deps) {
       if (error instanceof WorkspaceGatewayCustomModelLimitError || error instanceof WorkspaceGatewayCustomModelHistoryLimitError) {
         throw new HTTPException92(422, { message: error.message });
       }
-      if (nestedPostgresSqlState11(error) === "23505") {
+      if (nestedPostgresSqlState12(error) === "23505") {
         throw new HTTPException92(422, {
           message: "Gateway custom model already exists"
         });
@@ -107940,7 +107980,7 @@ function registerWorkspaceRoutes(app, deps) {
       if (error instanceof WorkspaceOpenRouterCustomModelLimitError || error instanceof WorkspaceOpenRouterCustomModelHistoryLimitError) {
         throw new HTTPException92(422, { message: error.message });
       }
-      if (nestedPostgresSqlState11(error) === "23505") {
+      if (nestedPostgresSqlState12(error) === "23505") {
         throw new HTTPException92(422, {
           message: "OpenRouter custom model already exists"
         });
@@ -108020,17 +108060,18 @@ function registerWorkspaceRoutes(app, deps) {
     }).filter(
       (model, _index, offered) => offered.some((candidate) => candidate.id === AZURE_LIVE_MODEL_ID) ? model.id === AZURE_LIVE_MODEL_ID : true
     );
-    const hasCredits = managedCandidates.length > 0 && await createRealtimeVoiceBilling2({
+    const creditStanding = managedCandidates.length > 0 ? await createRealtimeVoiceBilling2({
       db: deps.db,
       settings: deps.settings
-    }).hasSpendableCredits(grant.accountId);
+    }).creditStanding(grant.accountId) : "none";
+    const hasCredits = creditStanding === "spendable";
     const models = [
       ...managedCandidates.map((model, index) => ({
         ...model,
         provider: "OpenGeni",
         ...hasCredits ? { available: true, unavailableReason: null, unavailableCode: null } : {
           available: false,
-          unavailableReason: "Add Opengeni credits to use live voice",
+          unavailableReason: creditStanding === "promotional_only" ? "Promotional credits don't cover live voice. Add credits to use it." : "Add Opengeni credits to use live voice",
           unavailableCode: "insufficient_credits"
         },
         recommended: index === 0
@@ -108378,7 +108419,7 @@ function rethrowWorkspaceMemberCandidateError(error) {
       message: "the workspace must keep at least one administrator"
     });
   }
-  const sqlState = nestedPostgresSqlState11(error);
+  const sqlState = nestedPostgresSqlState12(error);
   if (sqlState === "P0002") {
     throw new HTTPException92(404, { message: "workspace not found" });
   }
@@ -108443,7 +108484,7 @@ import {
   getWorkspace as getWorkspace6,
   getWorkspaceUsage,
   grantWorkspaceCredits,
-  nestedPostgresSqlState as nestedPostgresSqlState12,
+  nestedPostgresSqlState as nestedPostgresSqlState13,
   setMemberAllowance,
   setWorkspaceAllowance,
   withAccountRls as withAccountRls3,
@@ -108578,7 +108619,7 @@ async function lifecycle2(operation) {
   } catch (error) {
     if (error instanceof UsageAllowanceVersionConflictError)
       throw new HTTPException93(409, { message: error.message });
-    const state = nestedPostgresSqlState12(error);
+    const state = nestedPostgresSqlState13(error);
     if (state === "40001" || state === "23505")
       throw new HTTPException93(409, { message: "Allowance version or operation conflicts" });
     if (state === "42501")
@@ -110329,7 +110370,7 @@ import {
 } from "@opengeni/core";
 import {
   availableSlackBotConnectionMetadata as availableSlackBotConnectionMetadata2,
-  nestedPostgresSqlState as nestedPostgresSqlState13,
+  nestedPostgresSqlState as nestedPostgresSqlState14,
   readOrganizationSlackBotAccess,
   setOrganizationSlackBotAccess,
   sharedOrganizationSlackBots as sharedOrganizationSlackBots2
@@ -110359,7 +110400,7 @@ function registerSlackBotAccessRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (nestedPostgresSqlState13(error) === "42501")
+      if (nestedPostgresSqlState14(error) === "42501")
         throw new HTTPException99(404, { message: "Local bot installation unavailable" });
       throw error;
     }
@@ -110413,7 +110454,7 @@ function registerSlackBotAccessRoutes(app, deps) {
       return context.json(OpenGeniSlackBotOrganizationAccess.parse(result));
     } catch (error) {
       if (error instanceof HTTPException99) throw error;
-      if (nestedPostgresSqlState13(error) === "42501")
+      if (nestedPostgresSqlState14(error) === "42501")
         throw new HTTPException99(403, {
           message: "Organization administrator and a verified local bot installation required"
         });
@@ -110610,7 +110651,7 @@ import {
   getWorkspaceArtifact as getWorkspaceArtifact3,
   getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef3,
   listWorkspaceArtifacts as listWorkspaceArtifacts2,
-  nestedPostgresSqlState as nestedPostgresSqlState14,
+  nestedPostgresSqlState as nestedPostgresSqlState15,
   publishWorkspaceArtifactVersion as publishWorkspaceArtifactVersion2,
   rollbackWorkspaceArtifact as rollbackWorkspaceArtifact2,
   setWorkspaceArtifactStatus as setWorkspaceArtifactStatus2,
@@ -110657,7 +110698,7 @@ function workspaceArtifactErrorResponse(context, error) {
       422
     );
   }
-  if (nestedPostgresSqlState14(error) === "23505") {
+  if (nestedPostgresSqlState15(error) === "23505") {
     return context.json(
       {
         code: "WORKSPACE_ARTIFACT_CONFLICT",
@@ -111041,7 +111082,7 @@ import {
   getGeneratedImageArtifact as getGeneratedImageArtifact2,
   getSessionAuthorityProjection as getSessionAuthorityProjection3,
   listArtifactCatalogCandidates,
-  nestedPostgresSqlState as nestedPostgresSqlState15,
+  nestedPostgresSqlState as nestedPostgresSqlState16,
   updateArtifactPin,
   withSessionRlsActorContext as withSessionRlsActorContext9
 } from "@opengeni/db";
@@ -111176,7 +111217,7 @@ function registerArtifactCatalogRoutes(app, deps) {
           }
         );
       } catch (error) {
-        if (nestedPostgresSqlState15(error) === "42501")
+        if (nestedPostgresSqlState16(error) === "42501")
           throw new HTTPException103(404, { message: "Artifact not found" });
         throw error;
       }
@@ -114896,11 +114937,11 @@ import {
   getOrganizationPrivateSessionSettings,
   getSelfOrganizationInvitation,
   getOrganizationRetentionPolicy,
-  requireWorkspace as requireWorkspace4,
+  requireWorkspace as requireWorkspace5,
   listOrganizationAdministrationMembers,
   listOrganizationInvitations,
   listSelfOrganizationInvitations,
-  nestedPostgresSqlState as nestedPostgresSqlState16,
+  nestedPostgresSqlState as nestedPostgresSqlState17,
   prepareOrganizationUserSetupDelivery,
   revokeOrganizationInvitation,
   settleOrganizationUserSetupDelivery,
@@ -114949,7 +114990,7 @@ async function requireOrganizationKeyWorkspaceDeletion(context, deps, organizati
       message: "deleting an organization workspace requires an organization owner session or an organization API key with workspace:admin"
     });
   }
-  const workspace = await requireWorkspace4(deps.db, workspaceId).catch(() => null);
+  const workspace = await requireWorkspace5(deps.db, workspaceId).catch(() => null);
   if (!workspace || workspace.accountId !== organizationId2) {
     throw new HTTPException112(404, { message: "workspace not found" });
   }
@@ -115017,7 +115058,7 @@ function parseId(schema, value, label) {
   return parsed.data;
 }
 function rethrowMembershipError(error, resourceLimitMessage) {
-  const sqlState = nestedPostgresSqlState16(error);
+  const sqlState = nestedPostgresSqlState17(error);
   if (sqlState === "54000" && resourceLimitMessage) {
     throw new HTTPException112(409, {
       message: resourceLimitMessage
@@ -115123,7 +115164,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         })
       );
     } catch (error) {
-      if (nestedPostgresSqlState16(error) === "42501") {
+      if (nestedPostgresSqlState17(error) === "42501") {
         throw new HTTPException112(403, {
           message: "organization membership is not active"
         });
@@ -116266,7 +116307,7 @@ import {
   completeSelfServiceOrganizationSetup,
   completeOrganizationUserSetup,
   getSelfServiceOrganizationOnboardingState,
-  nestedPostgresSqlState as nestedPostgresSqlState17,
+  nestedPostgresSqlState as nestedPostgresSqlState18,
   preflightOrganizationUserSetup,
   previewOrganizationUserSetup,
   recordOrganizationSignupUseCase
@@ -116324,14 +116365,14 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
           useCase: parsed.data.useCase
         }).catch((error) => {
           console.warn("[api] could not record the signup use case", {
-            sqlState: nestedPostgresSqlState17(error) ?? null
+            sqlState: nestedPostgresSqlState18(error) ?? null
           });
         });
       }
       return context.json(completed);
     } catch (error) {
       recordOrganizationSetupOutcome(deps.observability, "failed");
-      const sqlState = nestedPostgresSqlState17(error);
+      const sqlState = nestedPostgresSqlState18(error);
       if (sqlState === "22023") {
         throw new HTTPException115(422, {
           message: "invalid organization setup request"
@@ -116411,7 +116452,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
         )
       );
     } catch (error) {
-      const sqlState = nestedPostgresSqlState17(error);
+      const sqlState = nestedPostgresSqlState18(error);
       if (sqlState === "22023") {
         throw new HTTPException115(422, {
           message: "invalid account setup request"
@@ -116532,7 +116573,7 @@ import {
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError15,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError3
 } from "@opengeni/core";
-import { nestedPostgresSqlState as nestedPostgresSqlState18, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState19, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
 import { HTTPException as HTTPException116 } from "hono/http-exception";
 import { z as z62 } from "zod";
 async function body2(context, schema) {
@@ -116547,10 +116588,10 @@ function lifecycleError(error) {
   if (error instanceof SessionAuthorizationUnavailableError15) {
     throw new HTTPException116(503, { message: "session authorization unavailable" });
   }
-  if (nestedPostgresSqlState18(error) === "42501") {
+  if (nestedPostgresSqlState19(error) === "42501") {
     throw new HTTPException116(403, { message: "user-resource authority denied" });
   }
-  if (nestedPostgresSqlState18(error) === "22023") {
+  if (nestedPostgresSqlState19(error) === "22023") {
     throw new HTTPException116(422, { message: "invalid user-resource request" });
   }
   throw error;
@@ -123141,6 +123182,10 @@ function createAppComposition(deps) {
       "X-OpenGeni-Access-Key",
       "X-OpenGeni-Api-Contract",
       "X-OpenGeni-Actor-Epoch",
+      // Resumable voice-input chunk integrity/timing (cross-origin embeds).
+      "X-OpenGeni-Chunk-Duration-Milliseconds",
+      "X-OpenGeni-Chunk-Sha256",
+      "X-OpenGeni-Chunk-Start-Milliseconds",
       "X-OpenGeni-Correlation-Id",
       "X-OpenGeni-Session-Csrf",
       // Session scope for a session proxy; the API itself ignores it.
@@ -124240,13 +124285,13 @@ function createAppComposition(deps) {
         latencyMode: rawError.latencyMode,
         allowedLatencyModes: [...rawError.allowedLatencyModes]
       }
-    }) : null) ?? requestBodyValidationHttpError(rawError) ?? invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ?? databaseUnavailableHttpError(rawError, c.req.method) ?? rawError;
+    }) : null) ?? requestBodyValidationHttpError(rawError) ?? invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ?? databaseUnavailableHttpError(rawError, c.req.method) ?? databaseContentionHttpError(rawError, c.req.method) ?? rawError;
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
     const code = compactionLock ? compactionLock.code : apiError?.code ?? errorCodeForStatus(status);
     if (status >= 500) logHttpFailure(c, status, code, rawError);
-    if (apiError?.details?.code === DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE) {
+    if (apiError?.details?.code === DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE || apiError?.details?.code === DATABASE_CONTENTION_ERROR_DETAIL_CODE) {
       c.header("retry-after", "1");
     }
     const envelope = ErrorEnvelope.parse({
@@ -124467,6 +124512,8 @@ function assertConfiguredCodemodeSessionProxyPath(session, path, method) {
   }
 }
 function codemodeHttpError(error) {
+  const contention = databaseContentionHttpError(error, "POST", { outcomeUnknown: false });
+  if (contention) return contention;
   if (error instanceof SiteSessionPathError) {
     return new HTTPException118(404, { message: error.message, cause: error });
   }
@@ -125706,4 +125753,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-KKEXIBQG.js.map
+//# sourceMappingURL=chunk-F3LQ6VWR.js.map