@opengeni/api-router 1.4.0 → 1.4.4

package/dist/http/api-error.d.ts

@@ -37,6 +37,20 @@ export declare const DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE = "DATABASE_UNAVAILA
  * must reconcile by its own idempotency key before resending.
  */
 export declare function databaseUnavailableHttpError(error: unknown, method: string): ApiHttpError | null;
+/** `details.code` of the retryable 503 for a deadlock/serialization victim. */
+export declare const DATABASE_CONTENTION_ERROR_DETAIL_CODE = "DATABASE_CONTENTION";
+/**
+ * PostgreSQL aborted the request's transaction as a deadlock (40P01) or
+ * serialization (40001) victim after any in-process retry was exhausted. The
+ * aborted transaction committed nothing, so this is transient contention, not
+ * an internal error. A read is safe to repeat. For a mutation the default is
+ * `outcomeUnknown` because an earlier transaction of the same request may have
+ * committed; a route whose only write is the aborted idempotent transaction
+ * passes `outcomeUnknown: false`.
+ */
+export declare function databaseContentionHttpError(error: unknown, method: string, options?: {
+    outcomeUnknown?: boolean;
+}): ApiHttpError | null;
 /**
  * A typed agent-configuration failure (capability unavailable, conflict,
  * widening, not enabled). Rendered as 422 validation_failed with the specific

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump,
   withAccessGrantSessionRlsContext
-} from "./chunk-KKEXIBQG.js";
+} from "./chunk-F3LQ6VWR.js";
 import "./chunk-OGQDXVXY.js";
 
 // src/index.ts

package/dist/mcp/scheduled-task-view.d.ts

@@ -83,8 +83,8 @@ export declare function scheduledTaskMcpSummary(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -220,8 +220,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -405,8 +405,8 @@ export declare function boundScheduledTaskDetailMcp(task: ScheduledTask): {
     runMode: "existing_session" | "new_session_per_run" | "reusable_session";
     overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
     action: {
-        readonly sourceId?: never;
         kind: "agent_turn";
+        sourceId?: never;
         sourceGeneration?: never;
         sourceLifecycleGeneration?: never;
         destination?: never;
@@ -597,8 +597,8 @@ export declare function boundScheduledTaskMcpPage(input: {
         runMode: "existing_session" | "new_session_per_run" | "reusable_session";
         overlapPolicy: "allow_concurrent" | "buffer_one" | "skip";
         action: {
-            readonly sourceId?: never;
             kind: "agent_turn";
+            sourceId?: never;
             sourceGeneration?: never;
             sourceLifecycleGeneration?: never;
             destination?: never;

package/dist/routes/sessions.d.ts

@@ -1,11 +1,13 @@
 import { ClientSessionEvent, SessionScopeSubjectId, SteerSessionMessageRequest, type SessionStatus, type WorkClaimSubjectFilter, type SessionGoalRevision, type SessionAuthorizationOperation } from "@opengeni/contracts";
 import { decodeSessionListCursor, type SessionDiscoveryCursor } from "@opengeni/db";
 import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
 import type { ApiRouteDeps } from "@opengeni/core";
 import { type ViewerServices } from "../sandbox/viewer.js";
 type SessionRouteDeps = ApiRouteDeps & Pick<ViewerServices, "establishSandboxSession">;
 export declare function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void;
 export declare function goalProposalMatchesExpectedRevision(revision: Pick<SessionGoalRevision, "baseObjectiveRevision">, expectedObjectiveRevision: number): boolean;
+export declare function sessionRealtimeHttpError(error: unknown): HTTPException;
 /**
  * Map every mounted session-addressed HTTP path to the host-neutral operation
  * the embedding port authorizes. Returning null is deliberately fail-closed in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "1.4.0",
+  "version": "1.4.4",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,25 +43,25 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "2.14.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "1.4.0",
-    "@opengeni/artifact-tool": "1.4.0",
-    "@opengeni/capabilities": "1.4.0",
-    "@opengeni/codemode": "1.4.0",
-    "@opengeni/codex": "1.4.0",
-    "@opengeni/config": "1.4.0",
-    "@opengeni/contracts": "1.4.0",
-    "@opengeni/core": "1.4.0",
-    "@opengeni/db": "1.4.0",
-    "@opengeni/documents": "1.4.0",
-    "@opengeni/events": "1.4.0",
-    "@opengeni/github": "1.4.0",
-    "@opengeni/interaction": "1.4.0",
-    "@opengeni/network": "1.4.0",
-    "@opengeni/observability": "1.4.0",
-    "@opengeni/runtime": "1.4.0",
-    "@opengeni/storage": "1.4.0",
-    "@opengeni/tool-gateway": "1.4.0",
-    "@opengeni/xai-subscription": "1.4.0",
+    "@opengeni/agent-proto": "1.4.4",
+    "@opengeni/artifact-tool": "1.4.4",
+    "@opengeni/capabilities": "1.4.4",
+    "@opengeni/codemode": "1.4.4",
+    "@opengeni/codex": "1.4.4",
+    "@opengeni/config": "1.4.4",
+    "@opengeni/contracts": "1.4.4",
+    "@opengeni/core": "1.4.4",
+    "@opengeni/db": "1.4.4",
+    "@opengeni/documents": "1.4.4",
+    "@opengeni/events": "1.4.4",
+    "@opengeni/github": "1.4.4",
+    "@opengeni/interaction": "1.4.4",
+    "@opengeni/network": "1.4.4",
+    "@opengeni/observability": "1.4.4",
+    "@opengeni/runtime": "1.4.4",
+    "@opengeni/storage": "1.4.4",
+    "@opengeni/tool-gateway": "1.4.4",
+    "@opengeni/xai-subscription": "1.4.4",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -99,7 +99,9 @@ import {
   ApiHttpError,
   agentConfigHttpError,
   allowanceExhaustedHttpError,
+  DATABASE_CONTENTION_ERROR_DETAIL_CODE,
   DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE,
+  databaseContentionHttpError,
   databaseUnavailableHttpError,
   modelUnavailableHttpError,
   scheduledTaskTargetAccessHttpError,
@@ -661,6 +663,10 @@ export function createAppComposition(deps: AppDependencies): {
       "X-OpenGeni-Access-Key",
       "X-OpenGeni-Api-Contract",
       "X-OpenGeni-Actor-Epoch",
+      // Resumable voice-input chunk integrity/timing (cross-origin embeds).
+      "X-OpenGeni-Chunk-Duration-Milliseconds",
+      "X-OpenGeni-Chunk-Sha256",
+      "X-OpenGeni-Chunk-Start-Milliseconds",
       "X-OpenGeni-Correlation-Id",
       "X-OpenGeni-Session-Csrf",
       // Session scope for a session proxy; the API itself ignores it.
@@ -1958,6 +1964,7 @@ export function createAppComposition(deps: AppDependencies): {
           requestBodyValidationHttpError(rawError) ??
           invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ??
           databaseUnavailableHttpError(rawError, c.req.method) ??
+          databaseContentionHttpError(rawError, c.req.method) ??
           rawError);
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
@@ -1966,7 +1973,10 @@ export function createAppComposition(deps: AppDependencies): {
       ? compactionLock.code
       : (apiError?.code ?? errorCodeForStatus(status));
     if (status >= 500) logHttpFailure(c, status, code, rawError);
-    if (apiError?.details?.code === DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE) {
+    if (
+      apiError?.details?.code === DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE ||
+      apiError?.details?.code === DATABASE_CONTENTION_ERROR_DETAIL_CODE
+    ) {
       c.header("retry-after", "1");
     }
     const envelope = ErrorEnvelope.parse({
@@ -2274,6 +2284,12 @@ export function assertConfiguredCodemodeSessionProxyPath(
 }
 
 function codemodeHttpError(error: unknown): HTTPException {
+  // The journal admission is one idempotent transaction keyed by the
+  // caller-owned operation id and is already retried in-process; every other
+  // step is a read. An exhausted 40P01/40001 victim therefore committed
+  // nothing and the client may resubmit the same operation id.
+  const contention = databaseContentionHttpError(error, "POST", { outcomeUnknown: false });
+  if (contention) return contention;
   if (error instanceof SiteSessionPathError) {
     // The proxied Site/SDK surface is an explicit allowlist; a route outside
     // it (tool policy, visibility, forks, Steer, control, ...) does not exist

package/src/gateway-realtime.ts

@@ -72,6 +72,7 @@ export async function createGatewayRealtimeConnectionSecret(input: {
     getSessionRealtimeContinuityEntries(input.db, input.workspaceId, input.sessionId),
     mintGatewayClientSecret({
       apiKey,
+      source: resolved.source,
       upstreamModelId: resolved.upstreamModelId,
       fetchImpl: input.fetchImpl ?? fetch,
     }),
@@ -86,6 +87,7 @@ export async function createGatewayRealtimeConnectionSecret(input: {
 
 async function mintGatewayClientSecret(input: {
   apiKey: string;
+  source: "managed" | "workspace";
   upstreamModelId: string;
   fetchImpl: typeof fetch;
 }): Promise<{ token: string; url: string; expiresAt: number | null }> {
@@ -105,17 +107,19 @@ async function mintGatewayClientSecret(input: {
   } catch {
     throw new GatewayRealtimeBrokerError(
       "provider_error",
-      "AI Gateway realtime token request failed",
+      "The voice provider could not be reached. Try again.",
     );
   }
   if (!response.ok) {
+    const rejected = response.status === 401 || response.status === 403;
+    // User-facing: say what to do, never which deployment credential failed.
     throw new GatewayRealtimeBrokerError(
-      response.status === 401 || response.status === 403
-        ? "credential_unavailable"
-        : "provider_error",
-      response.status === 401 || response.status === 403
-        ? "AI Gateway credentials were rejected"
-        : "AI Gateway realtime token request failed",
+      rejected ? "credential_unavailable" : "provider_error",
+      rejected
+        ? input.source === "managed"
+          ? "Opengeni voice is temporarily unavailable. Try another voice model."
+          : "Your AI Gateway key was rejected. Update it in workspace settings."
+        : "The voice provider could not start a call. Try again.",
       response.status,
     );
   }

package/src/http/api-error.ts

@@ -5,7 +5,11 @@ import {
   ScheduledTaskTargetAccessChange,
   type ErrorCode,
 } from "@opengeni/contracts";
-import { isDatabaseConnectionLoss, WorkspaceControlBusyError } from "@opengeni/db";
+import {
+  isDatabaseConnectionLoss,
+  nestedPostgresSqlState,
+  WorkspaceControlBusyError,
+} from "@opengeni/db";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import { HTTPException } from "hono/http-exception";
 
@@ -116,6 +120,37 @@ export function databaseUnavailableHttpError(error: unknown, method: string): Ap
   });
 }
 
+/** `details.code` of the retryable 503 for a deadlock/serialization victim. */
+export const DATABASE_CONTENTION_ERROR_DETAIL_CODE = "DATABASE_CONTENTION";
+
+/**
+ * PostgreSQL aborted the request's transaction as a deadlock (40P01) or
+ * serialization (40001) victim after any in-process retry was exhausted. The
+ * aborted transaction committed nothing, so this is transient contention, not
+ * an internal error. A read is safe to repeat. For a mutation the default is
+ * `outcomeUnknown` because an earlier transaction of the same request may have
+ * committed; a route whose only write is the aborted idempotent transaction
+ * passes `outcomeUnknown: false`.
+ */
+export function databaseContentionHttpError(
+  error: unknown,
+  method: string,
+  options: { outcomeUnknown?: boolean } = {},
+): ApiHttpError | null {
+  if (error instanceof ApiHttpError) return null;
+  if (error instanceof HTTPException && error.status < 500) return null;
+  const sqlState = nestedPostgresSqlState(error);
+  if (sqlState !== "40P01" && sqlState !== "40001") return null;
+  const safeMethod = method === "GET" || method === "HEAD" || method === "OPTIONS";
+  return new ApiHttpError(503, {
+    code: "upstream_unavailable",
+    message: "Opengeni hit transient database contention. Retry shortly.",
+    retryable: true,
+    outcomeUnknown: options.outcomeUnknown ?? !safeMethod,
+    details: { code: DATABASE_CONTENTION_ERROR_DETAIL_CODE, sqlState },
+  });
+}
+
 /**
  * A typed agent-configuration failure (capability unavailable, conflict,
  * widening, not enabled). Rendered as 422 validation_failed with the specific

package/src/integrations/oauth-client.ts

@@ -7,7 +7,11 @@ import {
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-import { parseIntegrationsOauthClientsJson, type Settings } from "@opengeni/config";
+import {
+  findIntegrationsOauthClient,
+  parseIntegrationsOauthClientsJson,
+  type Settings,
+} from "@opengeni/config";
 import {
   OAuthStartResponse,
   selectCanonicalPersonalSlackConnection,
@@ -1799,7 +1803,6 @@ function operatorClientEntryFor(
   settings: Settings,
   candidates: string[],
 ): ReturnType<typeof parseIntegrationsOauthClientsJson>[string] | null {
-  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
   const candidateOrigins = candidates.flatMap((candidate) => {
     try {
       return [new URL(candidate).origin];
@@ -1816,22 +1819,10 @@ function operatorClientEntryFor(
       return resolved;
     }
   }
-  const configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
-  const exactKeys = uniqueStrings(
-    candidates.flatMap((candidate) => [candidate, normalizedIssuerKey(candidate)]),
+  return findIntegrationsOauthClient(
+    parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson),
+    candidates,
   );
-  for (const key of exactKeys) {
-    const entry = configured[key];
-    if (entry) {
-      return entry;
-    }
-  }
-  for (const [key, entry] of Object.entries(configured)) {
-    if (normalizedCandidates.has(normalizedIssuerKey(key))) {
-      return entry;
-    }
-  }
-  return null;
 }
 
 /** Secret-free readiness for the exact registered client used by Gmail setup. */

package/src/routes/sessions.ts

@@ -7,7 +7,7 @@ import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
 import * as sessionPreviewSchema from "@opengeni/db/schema";
 import { and, eq, sql } from "drizzle-orm";
 import { SessionMessageSearchRequest } from "@opengeni/contracts";
-import { scheduledSessionIds } from "@opengeni/db";
+import { requireWorkspace, scheduledSessionIds } from "@opengeni/db";
 import { isVerifiedDelegatedHumanAuthorization, withSiteSessionOrigin } from "@opengeni/core";
 import { freezeSessionRealtimeConnectionAccounts } from "@opengeni/core";
 import {
@@ -1192,22 +1192,34 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     if (!session) {
       throw new HTTPException(404, { message: "session not found" });
     }
-    const activity = await backgroundCommandActivityForSessions(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      sessionIds: [sessionId],
-    });
-    const scheduleTargets =
+    // Independent reads of the already-authorized session: the effective
+    // policy context depends only on the session row, not on the activity or
+    // schedule annotations, so all three are read concurrently.
+    const [activity, scheduleTargets, policy] = await Promise.all([
+      backgroundCommandActivityForSessions(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        sessionIds: [sessionId],
+      }),
       hasPermission(grant.permissions, "scheduled_tasks:run") &&
       hasPermission(grant.permissions, "sessions:control")
-        ? await scheduledSessionIds(db, workspaceId, [sessionId])
-        : new Set<string>();
+        ? scheduledSessionIds(db, workspaceId, [sessionId])
+        : Promise.resolve(new Set<string>()),
+      loadEffectivePolicyContext(deps, workspaceId, grant.subjectId, [session]),
+    ]);
     return c.json(
-      await withEffectivePolicy(deps, workspaceId, grant.subjectId, {
-        ...session,
-        hasSchedules: scheduleTargets.has(sessionId),
-        ...(activity.get(sessionId) ? { backgroundCommandActivity: activity.get(sessionId) } : {}),
-      }),
+      sessionWithEffectiveToolPolicy(
+        {
+          ...session,
+          hasSchedules: scheduleTargets.has(sessionId),
+          ...(activity.get(sessionId)
+            ? { backgroundCommandActivity: activity.get(sessionId) }
+            : {}),
+        },
+        policy.workspaceServerIds,
+        policy.workspaceDefaultServerIds,
+        policy.effectiveToolsContext,
+      ),
     );
   });
 
@@ -2057,29 +2069,37 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         });
       }
       try {
-        const result = await withWorkspaceSessionActivityRls(db, workspaceId, async (scopedDb) => {
-          // Acquire origin authority before inference/session locks. A deferred
-          // realtime session has no initial worker turn; capture its exact
-          // linked actor when the ledger actually admits ordinary agent work.
-          await beforeCommit?.(scopedDb as unknown as Database);
-          return syncSessionRealtimeLedgerInTransaction(
-            scopedDb,
-            {
-              workspaceId,
-              sessionId,
-              realtimeId,
-              ownerSubjectId: grant.subjectId,
-              ...parsed.data,
-              controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
-            },
-            captureLinked
-              ? {
-                  afterDelegationAdmission: async ({ turnId }) =>
-                    captureLinked(scopedDb as unknown as Database, sessionId, turnId),
-                }
-              : {},
-          );
-        });
+        const result = await withWorkspaceSessionActivityRls(
+          db,
+          workspaceId,
+          async (scopedDb) => {
+            // Acquire origin authority before inference/session locks. A deferred
+            // realtime session has no initial worker turn; capture its exact
+            // linked actor when the ledger actually admits ordinary agent work.
+            await beforeCommit?.(scopedDb as unknown as Database);
+            return syncSessionRealtimeLedgerInTransaction(
+              scopedDb,
+              {
+                workspaceId,
+                sessionId,
+                realtimeId,
+                ownerSubjectId: grant.subjectId,
+                ...parsed.data,
+                controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
+              },
+              captureLinked
+                ? {
+                    afterDelegationAdmission: async ({ turnId }) =>
+                      captureLinked(scopedDb as unknown as Database, sessionId, turnId),
+                  }
+                : {},
+            );
+          },
+          undefined,
+          // External reauthorization takes the organization-membership lock,
+          // which precedes the tenancy fence and the canonical session prefix.
+          Boolean(beforeCommit),
+        );
         await publishRealtimeMutation(grant.accountId, workspaceId, sessionId, result);
         c.header("cache-control", "private, no-store");
         return c.json({ accepted: result.accepted, outbound: result.outbound });
@@ -5181,11 +5201,19 @@ function codexRealtimeHttpFailure(error: CodexRealtimeBrokerError): {
   }
 }
 
-function sessionRealtimeHttpError(error: unknown): HTTPException {
+/** Conflicts a person can hit by starting voice; the browser shows these verbatim. */
+const SESSION_REALTIME_USER_MESSAGES: Partial<Record<string, string>> = {
+  REALTIME_ACTIVE:
+    "Voice is already on for this session in another tab or window. End it there, or try again in a minute.",
+  CONTROL_NOT_ACTIVE: "Resume this session to start voice.",
+  SESSION_CANCELLED: "This session was cancelled, so voice can't start.",
+};
+
+export function sessionRealtimeHttpError(error: unknown): HTTPException {
   if (error instanceof HTTPException) return error;
   if (error instanceof SessionRealtimeConflictError) {
     return new HTTPException(error.code === "REALTIME_NOT_FOUND" ? 404 : 409, {
-      message: error.message,
+      message: SESSION_REALTIME_USER_MESSAGES[error.code] ?? error.message,
       cause: error,
     });
   }
@@ -6205,9 +6233,18 @@ async function loadEffectivePolicyContext(
   subjectId: string,
   sessions: readonly Session[],
 ): Promise<EffectivePolicyContext> {
+  // Both projections read the same workspace row; hydrate it once.
+  const workspaceRead = requireWorkspace(deps.db, workspaceId);
+  void workspaceRead.catch(() => undefined);
   const [policy, effectiveToolsContext] = await Promise.all([
-    workspaceSessionToolPolicyContext(deps.db, workspaceId, deps.settings, subjectId),
-    workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectId, sessions),
+    workspaceSessionToolPolicyContext(
+      deps.db,
+      workspaceId,
+      deps.settings,
+      subjectId,
+      workspaceRead,
+    ),
+    workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectId, sessions, workspaceRead),
   ]);
   return { ...policy, effectiveToolsContext };
 }

package/src/routes/workspaces.ts

@@ -980,12 +980,14 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
           ? model.id === AZURE_LIVE_MODEL_ID
           : true,
       );
-    const hasCredits =
-      managedCandidates.length > 0 &&
-      (await createRealtimeVoiceBilling({
-        db: deps.db,
-        settings: deps.settings,
-      }).hasSpendableCredits(grant.accountId));
+    const creditStanding =
+      managedCandidates.length > 0
+        ? await createRealtimeVoiceBilling({
+            db: deps.db,
+            settings: deps.settings,
+          }).creditStanding(grant.accountId)
+        : "none";
+    const hasCredits = creditStanding === "spendable";
     const models = [
       ...managedCandidates.map((model, index) => ({
         ...model,
@@ -994,7 +996,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
           ? { available: true, unavailableReason: null, unavailableCode: null }
           : {
               available: false,
-              unavailableReason: "Add Opengeni credits to use live voice",
+              unavailableReason:
+                creditStanding === "promotional_only"
+                  ? "Promotional credits don't cover live voice. Add credits to use it."
+                  : "Add Opengeni credits to use live voice",
               unavailableCode: "insufficient_credits",
             }),
         recommended: index === 0,