@opengeni/api-router 2.13.0-canary.2 → 3.0.0-canary.1

package/dist/{chunk-K2NU4KRK.js → chunk-AJ62T5QN.js}

@@ -3557,7 +3557,7 @@ import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
 import { getCookie as getCookie2 } from "hono/cookie";
-import { HTTPException as HTTPException95 } from "hono/http-exception";
+import { HTTPException as HTTPException97 } from "hono/http-exception";
 
 // src/http/api-error.ts
 import { WorkspaceControlBusyError } from "@opengeni/db";
@@ -3592,17 +3592,17 @@ function workspaceControlBusyHttpError(error) {
 import {
   CodexCompactionV2ProviderLockedError,
   ManagedAuthActorLeaseOutcomeUnknownError,
-  hasPermission as hasPermission24,
+  hasPermission as hasPermission25,
   requireAccessGrant as requireAccessGrant47,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization36,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization37,
   requirePermission as requirePermission9,
   releaseManagedAuthRequestActorLease,
   resolveCatalogSettings,
   resolveWorkspaceCatalogSettings as resolveWorkspaceCatalogSettings10,
   validateManagedAuthRequestActorLease,
-  requireSessionAuthorization as requireSessionAuthorization15,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError16,
-  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError14
+  requireSessionAuthorization as requireSessionAuthorization16,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError17,
+  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError15
 } from "@opengeni/core";
 
 // src/auth/managed-auth.ts
@@ -6221,7 +6221,7 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
       return { content: [{ type: "text", text: JSON.stringify(result) }] };
     } catch (error) {
       const state = nestedPostgresSqlState2(error);
-      const message = surface === "instruction" ? state === "40001" ? "This instruction changed. Read its current content and baseline, then retry the same intended edit against that exact state." : state === "23505" ? "This instruction operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The instruction change is unavailable in this task's scope or Agent learning policy. Off disables authoring, not the task. Do not ask for approval to continue." : state === "22023" || state === "23514" ? "Invalid instruction change. Read the current instruction, use append for a new rule, edit with one exact oldText match to update or remove text, and replace only when the user explicitly wants the complete instruction replaced. The resulting instruction must stay within 600 characters." : "Workspace instructions are temporarily unavailable. Retry the same operation ID only if the prior change may have succeeded." : state === "40001" ? "This entry changed. Read its current revision and retry your correction with the current version." : state === "23505" ? "This operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The entry, reference, or write is unavailable in this task's scope and Agent learning policy. Off disables saving, not your task. Do not ask for an approval to continue." : state === "22023" || state === "23514" ? "Invalid Knowledge entry or relationship. Check the referenced IDs and revision before retrying." : "Knowledge is temporarily unavailable. Your task can continue; retry the same operation ID if saving may have succeeded.";
+      const message = surface === "instruction" ? state === "40001" ? "This instruction changed. Read its current content and baseline, then retry the same intended edit against that exact state." : state === "23505" ? "This instruction operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The instruction change is unavailable in this task's scope or Agent learning policy. Off disables authoring, not the task. Do not ask for approval to continue." : state === "22023" || state === "23514" ? "Invalid instruction change. Read the current instruction, use append for a new rule, or edit with one localized exact oldText match to update or remove text. Agents cannot replace the complete instruction. The resulting instruction must stay within 600 characters." : "Workspace instructions are temporarily unavailable. Retry the same operation ID only if the prior change may have succeeded." : state === "40001" ? "This entry changed. Read its current revision and retry your correction with the current version." : state === "23505" ? "This operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The entry, reference, or write is unavailable in this task's scope and Agent learning policy. Off disables saving, not your task. Do not ask for an approval to continue." : state === "22023" || state === "23514" ? "Invalid Knowledge entry or relationship. Check the referenced IDs and revision before retrying." : "Knowledge is temporarily unavailable. Your task can continue; retry the same operation ID if saving may have succeeded.";
       return {
         isError: true,
         content: [
@@ -6380,7 +6380,7 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
   server.registerTool(
     "instruction_policy_save",
     {
-      description: "Change a concise standing workspace instruction through this task's Agent learning policy. Read the current policy first and submit its exact baseline. Use editMode=append by default for a new rule; it preserves the current content and adds one blank-line separator. Use edit with oldText that occurs exactly once and newText to update or remove existing text. Use replace only when the user explicitly asks to replace the complete instruction; never reconstruct or summarize unrelated rules. Each supplied text and the resulting instruction are limited to 600 characters. Facts and incidents belong in knowledge_save and reusable procedures in skill_save. Review first saves an inactive revision and returns pending; continue the task without an approval question.",
+      description: "Change a concise standing workspace instruction through this task's Agent learning policy. Read the current policy first and submit its exact baseline. Use editMode=append by default for a new rule; it preserves the current content and adds one blank-line separator. Use edit with a localized oldText that occurs exactly once and newText to update or remove only that passage. Agents cannot replace the complete instruction; direct the user to the manual workspace-instruction editor for a whole-policy rewrite. Each supplied text and the resulting instruction are limited to 600 characters. Facts and incidents belong in knowledge_save and reusable procedures in skill_save. Review first saves an inactive revision and returns pending; continue the task without an approval question.",
       inputSchema: AgentInstructionSaveRequest.shape
     },
     (input) => run((context) => saveAgentInstruction(deps.db, context, input), "instruction")
@@ -6664,6 +6664,7 @@ import {
   prepareGeneratedWorkspaceFile,
   getSessionAuthorityProjection,
   requireWorkspace as requireWorkspace2,
+  recordSandboxFilePublication,
   withSessionRlsActorContext as withSessionRlsActorContext5
 } from "@opengeni/db";
 import { retryWhileMissing as retryWhileMissing3 } from "@opengeni/storage";
@@ -10343,6 +10344,12 @@ async function publishSandboxFileArtifactInScope(deps, input) {
   if (!artifact) {
     throw new HTTPException12(502, { message: "published sandbox artifact is not ready" });
   }
+  await recordSandboxFilePublication(deps.db, {
+    accountId: input.grant.accountId,
+    workspaceId: input.grant.workspaceId,
+    fileId: file.id,
+    sourceSessionId: input.session.id
+  });
   return SandboxFileArtifactReceipt.parse({
     type: "sandbox_file",
     sandboxPath: `/workspace/${path}`,
@@ -17864,7 +17871,7 @@ function parseSlackReactionContextCheckpoint(value, expectedBinding, key, nowMs
     (message) => seenMessageTimestamps.indexOf(message.timestamp)
   );
   if (seenMessageTimestamps.length > 0 && messages.length === 0 || messages.length > 0 && threadTimestamp === null || messages.length > 0 && messages[0].timestamp !== seenMessageTimestamps[0] || seenTimestampIndexes.some(
-    (index, position) => index < 0 || position > 0 && index <= seenTimestampIndexes[position - 1]
+    (index, position2) => index < 0 || position2 > 0 && index <= seenTimestampIndexes[position2 - 1]
   )) {
     throw new SlackBotProviderError("reaction_checkpoint_invalid");
   }
@@ -62833,12 +62840,12 @@ import {
   filterOpenApiDocumentForDefinition,
   googleDiscoveryToOpenApi,
   integrationDefinitionById as integrationDefinitionById2,
-  parseOpenApiDocument
+  parseOpenApiDocument,
+  MAX_CURATED_INTEGRATION_SPEC_BYTES
 } from "@opengeni/capabilities";
 import {
   ApiIntegrationPreview
 } from "@opengeni/contracts";
-var MAX_CURATED_DEFINITION_SOURCE_BYTES = 64 * 1024 * 1024;
 async function resolveApiIntegrationPreview(input) {
   if (input.source.kind === "definition") {
     return await resolveDefinition(input);
@@ -62876,20 +62883,26 @@ async function resolveDefinition(input) {
   const bytes = await fetchIntegrationSourceDocument(
     input.transport,
     definition.source.url,
-    MAX_CURATED_DEFINITION_SOURCE_BYTES
+    MAX_CURATED_INTEGRATION_SPEC_BYTES
   );
   let document;
   if (definition.source.kind === "google_discovery") {
     document = googleDiscoveryToOpenApi(JSON.parse(new TextDecoder().decode(bytes)));
   } else {
-    document = filterOpenApiDocumentForDefinition(parseOpenApiDocument(bytes), definition);
+    document = filterOpenApiDocumentForDefinition(
+      parseOpenApiDocument(bytes, {
+        maxBytes: MAX_CURATED_INTEGRATION_SPEC_BYTES
+      }),
+      definition
+    );
   }
   const identity = integrationInstallationIdentity("openapi", definition.id, definition.source.url);
   const revision = compileOpenApiRevision(document, {
     definitionId: definition.id,
     sourceUrl: definition.source.url,
     baseUrl: definition.baseUrl,
-    provider: definition.provider.id
+    provider: definition.provider.id,
+    ...definition.source.kind === "openapi" && definition.source.schemaMode ? { schemaMode: definition.source.schemaMode } : {}
   });
   const baseUrl = firstOpenApiServerUrl(revision);
   const providerDomain = definition.provider.domain;
@@ -62990,6 +63003,9 @@ async function resolveGraphql(input, endpoint, name) {
   });
 }
 function resolvedPreview(input) {
+  if (Buffer.byteLength(JSON.stringify(input.revision, null, 2), "utf8") > 4 * 1024 * 1024) {
+    throw new Error("Compiled integration exceeds the supported 4 MiB storage limit");
+  }
   const deprecated = input.revision.tools.filter((tool) => tool.deprecated).length;
   const warnings = [
     ...deprecated > 0 ? [`${deprecated} deprecated operation${deprecated === 1 ? "" : "s"} will not be enabled.`] : [],
@@ -63487,6 +63503,14 @@ function registerConnectRoutes(app, deps) {
         ownership: ["workspace"],
         setup: ["oauth"]
       }),
+      ConnectProvider.parse({
+        id: "gmail",
+        label: "Gmail",
+        family: "google",
+        readiness: !external || !canWrite2 || !personal ? "unsupported" : mcpConfigured ? "available" : "needs_configuration",
+        ownership: personal ? ["personal"] : [],
+        setup: ["oauth"]
+      }),
       ConnectProvider.parse({
         id: "slack-personal",
         label: "My Slack account",
@@ -63690,7 +63714,7 @@ function registerConnectRoutes(app, deps) {
             ConnectAccount.parse({
               id: connection.id,
               version: connection.version,
-              providerId: connection.metadata.mcpUrl === OPENGENI_PERSONAL_SLACK_MCP_URL2 ? "slack-personal" : "mcp-oauth",
+              providerId: connection.metadata.mcpUrl === OPENGENI_PERSONAL_SLACK_MCP_URL2 ? "slack-personal" : connection.metadata.mcpUrl === OFFICIAL_GMAIL_MCP_URL ? "gmail" : "mcp-oauth",
               label: connection.providerDomain,
               ownership: connection.subjectId === null ? "workspace" : "personal",
               status: connection.status === "revoked" ? "disabled" : connection.status === "active" ? "connected" : "auth_needed"
@@ -64046,10 +64070,10 @@ function registerConnectRoutes(app, deps) {
         })
       );
     }
-    if (["mcp-oauth", "slack-personal"].includes(before.providerId)) {
+    if (["mcp-oauth", "slack-personal", "gmail"].includes(before.providerId)) {
       if (action.type !== "credentials")
         throw new HTTPException38(422, { message: "MCP OAuth requires a server URL" });
-      const values = before.providerId === "slack-personal" ? { mcpUrl: OPENGENI_PERSONAL_SLACK_MCP_URL2 } : z18.object({ mcpUrl: z18.string().url().max(4096) }).strict().parse(action.values);
+      const values = before.providerId === "slack-personal" ? { mcpUrl: OPENGENI_PERSONAL_SLACK_MCP_URL2 } : before.providerId === "gmail" ? { mcpUrl: OFFICIAL_GMAIL_MCP_URL } : z18.object({ mcpUrl: z18.string().url().max(4096) }).strict().parse(action.values);
       return c.json(
         await executeConnectOperation({
           db: deps.db,
@@ -64485,6 +64509,7 @@ function registerConnectRoutes(app, deps) {
         if (input.installationTarget && [
           "mcp-oauth",
           "slack-personal",
+          "gmail",
           "mcp-bearer",
           "mcp-headers",
           "fiken-token",
@@ -64498,17 +64523,26 @@ function registerConnectRoutes(app, deps) {
           throw new HTTPException38(422, {
             message: "MCP credential setup does not install an API integration instance"
           });
-        if (["mcp-oauth", "slack-personal", "mcp-bearer", "mcp-headers", "fiken-token"].includes(
-          input.providerId
-        )) {
+        if ([
+          "mcp-oauth",
+          "slack-personal",
+          "gmail",
+          "mcp-bearer",
+          "mcp-headers",
+          "fiken-token"
+        ].includes(input.providerId)) {
           if (input.providerId === "slack-personal" && input.ownership !== "personal")
             throw new HTTPException38(422, {
               message: "Hosted Slack MCP requires personal ownership"
             });
+          if (input.providerId === "gmail" && input.ownership !== "personal")
+            throw new HTTPException38(422, {
+              message: "Gmail requires personal ownership; each user connects their own account"
+            });
           if (input.providerId === "fiken-token" && input.ownership !== "workspace")
             throw new HTTPException38(422, { message: "Fiken is workspace-owned" });
           requireEnvironmentEncryption11(deps.settings);
-          if (["mcp-oauth", "slack-personal"].includes(input.providerId))
+          if (["mcp-oauth", "slack-personal", "gmail"].includes(input.providerId))
             requireIntegrationsStateSecret(deps.settings);
           const existing = input.reconnectAccountId ? await getConnectionMetadata10(
             tx,
@@ -64516,7 +64550,7 @@ function registerConnectRoutes(app, deps) {
             input.reconnectAccountId,
             scope.subjectId
           ) : null;
-          if (input.reconnectAccountId && (!existing || (input.providerId === "fiken-token" ? !isFikenConnection2(existing) : ["mcp-oauth", "slack-personal"].includes(input.providerId) ? existing.kind !== "oauth2" || !existing.metadata.oauthDiscovery || input.providerId === "slack-personal" && existing.metadata.mcpUrl !== OPENGENI_PERSONAL_SLACK_MCP_URL2 : existing.kind !== "api_key" || existing.metadata.connectAdapter !== input.providerId) || (existing.subjectId === null ? "workspace" : "personal") !== input.ownership))
+          if (input.reconnectAccountId && (!existing || (input.providerId === "fiken-token" ? !isFikenConnection2(existing) : ["mcp-oauth", "slack-personal", "gmail"].includes(input.providerId) ? existing.kind !== "oauth2" || !existing.metadata.oauthDiscovery || input.providerId === "slack-personal" && existing.metadata.mcpUrl !== OPENGENI_PERSONAL_SLACK_MCP_URL2 || input.providerId === "gmail" && existing.metadata.mcpUrl !== OFFICIAL_GMAIL_MCP_URL : existing.kind !== "api_key" || existing.metadata.connectAdapter !== input.providerId) || (existing.subjectId === null ? "workspace" : "personal") !== input.ownership))
             throw new HTTPException38(404, { message: "MCP account not found for this ownership" });
           if (input.ownership === "personal" && !isPersonalConnectionOwnerPrincipal(authorization))
             throw new HTTPException38(403, { message: "personal ownership unavailable" });
@@ -64547,7 +64581,7 @@ function registerConnectRoutes(app, deps) {
               } : {},
               nextAction: {
                 type: "credentials",
-                fields: input.providerId === "slack-personal" ? [] : input.providerId === "fiken-token" ? [
+                fields: ["slack-personal", "gmail"].includes(input.providerId) ? [] : input.providerId === "fiken-token" ? [
                   {
                     name: "apiToken",
                     label: "Fiken API token",
@@ -93981,6 +94015,287 @@ function registerWorkspaceArtifactRoutes(app, deps) {
   });
 }
 
+// src/routes/artifact-catalog.ts
+import { resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret5 } from "@opengeni/config";
+import {
+  ArtifactCatalogItem,
+  ArtifactCatalogKind as ArtifactCatalogKind2,
+  ArtifactCatalogListQuery,
+  ArtifactCatalogListResponse,
+  retainedArtifactReferenceFromFile as retainedArtifactReferenceFromFile3,
+  retainedGeneratedImageReferenceFromFile as retainedGeneratedImageReferenceFromFile2
+} from "@opengeni/contracts";
+import {
+  editableArtifactId as editableArtifactId3,
+  editableArtifactScope as editableArtifactScope2,
+  fileOwnerContextForAccess as fileOwnerContextForAccess5,
+  grantHasAgentAttemptAuthority as grantHasAgentAttemptAuthority4,
+  hasPermission as hasPermission21,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization32,
+  requireLiveAgentAttemptAuthorization as requireLiveAgentAttemptAuthorization5,
+  requireSessionAuthorization as requireSessionAuthorization14,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError13,
+  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError11
+} from "@opengeni/core";
+import {
+  getFilesForSubject as getFilesForSubject3,
+  getGeneratedImageArtifact as getGeneratedImageArtifact2,
+  getSessionAuthorityProjection as getSessionAuthorityProjection3,
+  listArtifactCatalogCandidates,
+  withSessionRlsActorContext as withSessionRlsActorContext7
+} from "@opengeni/db";
+import { HTTPException as HTTPException84 } from "hono/http-exception";
+
+// src/artifact-catalog-cursor.ts
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, createHash as createHash27, randomBytes as randomBytes11 } from "crypto";
+import { ArtifactCatalogKind } from "@opengeni/contracts";
+import { HTTPException as HTTPException83 } from "hono/http-exception";
+import { z as z33 } from "zod";
+var Cursor = z33.object({
+  version: z33.literal(1),
+  snapshotAt: z33.string().datetime(),
+  expiresAt: z33.number().int().positive(),
+  after: z33.object({
+    key: z33.string().max(4096),
+    kind: ArtifactCatalogKind,
+    id: z33.string().min(1).max(128)
+  }).strict()
+}).strict();
+function artifactCatalogCursorCodec(secret, binding) {
+  const key = createHash27("sha256").update("opengeni:artifact-catalog:v1\0").update(secret).digest();
+  const aad = createHash27("sha256").update(binding).digest();
+  return {
+    encode(value) {
+      const iv = randomBytes11(12);
+      const cipher = createCipheriv3("aes-256-gcm", key, iv);
+      cipher.setAAD(aad);
+      const bytes = Buffer.concat([
+        cipher.update(JSON.stringify(Cursor.parse(value)), "utf8"),
+        cipher.final()
+      ]);
+      return Buffer.concat([iv, cipher.getAuthTag(), bytes]).toString("base64url");
+    },
+    decode(value) {
+      try {
+        if (value.length > 8192 || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error();
+        const bytes = Buffer.from(value, "base64url");
+        if (bytes.length < 29 || bytes.toString("base64url") !== value) throw new Error();
+        const decipher = createDecipheriv3("aes-256-gcm", key, bytes.subarray(0, 12));
+        decipher.setAAD(aad);
+        decipher.setAuthTag(bytes.subarray(12, 28));
+        const parsed = Cursor.parse(
+          JSON.parse(
+            Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString("utf8")
+          )
+        );
+        if (parsed.expiresAt <= Date.now() || Date.parse(parsed.snapshotAt) > Date.now() + 6e4)
+          throw new Error();
+        return parsed;
+      } catch {
+        throw new HTTPException83(422, { message: "Invalid or expired artifact catalog cursor" });
+      }
+    }
+  };
+}
+
+// src/routes/artifact-catalog.ts
+var editableKinds = /* @__PURE__ */ new Set(["document", "spreadsheet", "presentation"]);
+var CANDIDATE_BATCH = 200;
+var MAX_BATCHES = 10;
+var iso = (value) => new Date(value).toISOString();
+var position = (row) => ({
+  key: row.sort_key,
+  kind: row.kind,
+  id: row.id
+});
+function registerArtifactCatalogRoutes(app, deps) {
+  app.get("/v1/workspaces/:workspaceId/artifact-catalog", async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization32(context, deps, workspaceId);
+    const grant = authorization.grant;
+    const parsed = ArtifactCatalogListQuery.safeParse(context.req.query());
+    if (!parsed.success)
+      throw new HTTPException84(422, { message: "Invalid artifact catalog query" });
+    const query = parsed.data;
+    const artifactsAllowed = hasPermission21(grant.permissions, "artifacts:read");
+    const filesAllowed = hasPermission21(grant.permissions, "files:read");
+    if (!artifactsAllowed && !filesAllowed)
+      throw new HTTPException84(403, { message: "Artifact catalog read access required" });
+    let kinds = ArtifactCatalogKind2.options.filter(
+      (kind) => (kind === "image" || kind === "file" ? filesAllowed : artifactsAllowed) && (!query.kind || kind === query.kind)
+    );
+    if (!deps.editableArtifacts) {
+      if (query.kind && editableKinds.has(query.kind) && artifactsAllowed)
+        throw new HTTPException84(503, { message: "Editable artifacts are unavailable" });
+      kinds = kinds.filter((kind) => !editableKinds.has(kind));
+    }
+    const includesFiles = kinds.includes("file") || kinds.includes("image");
+    const actor = includesFiles ? await fileOwnerContextForAccess5(deps, authorization, "files:read") : { subjectId: grant.subjectId, privateFileOwnerSubjectId: null };
+    if (grantHasAgentAttemptAuthority4(grant) && actor.initiatingHumanSubjectId === void 0) {
+      const callerSessionId = grant.metadata?.["sessionId"];
+      try {
+        if (typeof callerSessionId !== "string")
+          throw new SessionAuthorizationDeniedError13("caller_stale");
+        const attempt = await requireLiveAgentAttemptAuthorization5(deps.db, grant, callerSessionId);
+        actor.initiatingHumanSubjectId = attempt.initiatingHumanSubjectId;
+      } catch (error) {
+        if (error instanceof SessionAuthorizationDeniedError13)
+          throw new HTTPException84(404, { message: "Session not found", cause: error });
+        throw error;
+      }
+    }
+    const sourceDecisions = /* @__PURE__ */ new Map();
+    const canReadSession = async (sessionId) => {
+      if (!hasPermission21(grant.permissions, "sessions:read")) return false;
+      if (sourceDecisions.has(sessionId)) return sourceDecisions.get(sessionId);
+      try {
+        await requireSessionAuthorization14(deps, grant, {
+          sessionId,
+          operation: "session.read",
+          surface: "http"
+        });
+        if (!await getSessionAuthorityProjection3(deps.db, workspaceId, sessionId)) {
+          sourceDecisions.set(sessionId, false);
+          return false;
+        }
+        sourceDecisions.set(sessionId, true);
+        return true;
+      } catch (error) {
+        if (error instanceof SessionAuthorizationDeniedError13) {
+          sourceDecisions.set(sessionId, false);
+          return false;
+        }
+        if (error instanceof SessionAuthorizationUnavailableError11)
+          throw new HTTPException84(503, { message: "Session authorization is unavailable" });
+        throw error;
+      }
+    };
+    context.header("cache-control", "private, no-store");
+    return withSessionRlsActorContext7(actor, async () => {
+      if (query.sourceSessionId && !await canReadSession(query.sourceSessionId))
+        throw new HTTPException84(404, { message: "Session not found" });
+      const secret = resolveFirstPartyDelegationSecret5(deps.settings);
+      if (!secret)
+        throw new HTTPException84(503, { message: "Artifact catalog cursor signing is unavailable" });
+      const filters = { ...query, cursor: void 0 };
+      const codec = artifactCatalogCursorCodec(
+        secret,
+        JSON.stringify({
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          principalKind: grant.principalKind,
+          metadata: grant.metadata,
+          permissions: [...grant.permissions].sort(),
+          initiatingHumanSubjectId: actor.initiatingHumanSubjectId ?? null,
+          owner: actor.privateFileOwnerSubjectId ?? null,
+          kinds,
+          filters
+        })
+      );
+      const prior = query.cursor ? codec.decode(query.cursor) : void 0;
+      const snapshotAt = prior?.snapshotAt ?? (/* @__PURE__ */ new Date()).toISOString();
+      const expiresAt = prior?.expiresAt ?? Date.now() + 60 * 6e4;
+      let after = prior?.after;
+      const items = [];
+      let lastReturned;
+      let nextCursor = null;
+      const fileSubject = includesFiles ? await fileAuthoritySubjectIdForGrant(deps, grant) : null;
+      for (let batch = 0; batch < MAX_BATCHES; batch++) {
+        const candidates = await listArtifactCatalogCandidates(
+          deps.db,
+          { accountId: grant.accountId, workspaceId },
+          {
+            query,
+            kinds,
+            snapshotAt,
+            ...after ? { after } : {},
+            limit: CANDIDATE_BATCH
+          }
+        );
+        for (const candidate of candidates) {
+          after = position(candidate);
+          const item = await projectCandidate(deps, grant, candidate, fileSubject);
+          if (!item || item.status !== query.status || query.q && !item.title.toLowerCase().includes(query.q.toLowerCase()))
+            continue;
+          if (items.length === query.limit) {
+            nextCursor = codec.encode({ version: 1, snapshotAt, expiresAt, after: lastReturned });
+            return context.json(ArtifactCatalogListResponse.parse({ items, nextCursor }));
+          }
+          if (candidate.source_session_id && await canReadSession(candidate.source_session_id))
+            item.sourceSessionId = candidate.source_session_id;
+          items.push(ArtifactCatalogItem.parse(item));
+          lastReturned = after;
+        }
+        if (candidates.length < CANDIDATE_BATCH) break;
+        if (batch === MAX_BATCHES - 1 && after)
+          nextCursor = codec.encode({ version: 1, snapshotAt, expiresAt, after });
+      }
+      return context.json(ArtifactCatalogListResponse.parse({ items, nextCursor }));
+    });
+  });
+}
+async function projectCandidate(deps, grant, row, fileSubject) {
+  const item = {
+    id: row.id,
+    kind: row.kind,
+    title: row.title,
+    status: row.status,
+    createdAt: iso(row.created_at),
+    updatedAt: iso(row.updated_at)
+  };
+  if (row.version_id) item.versionId = row.version_id;
+  if (editableKinds.has(row.kind)) {
+    const scope = editableArtifactScope2({
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId
+    });
+    try {
+      const artifact = await deps.editableArtifacts.readArtifact({
+        scope,
+        actor: editableArtifactActorForGrant(grant, "0000000000000001"),
+        artifactId: editableArtifactId3(row.id)
+      });
+      if (artifact.scope.accountId !== scope.accountId || artifact.scope.workspaceId !== scope.workspaceId || artifact.id !== row.id || artifact.modality !== row.kind)
+        throw new Error("Artifact application returned mismatched catalog metadata");
+      return {
+        ...item,
+        title: artifact.title,
+        status: artifact.lifecycle,
+        createdAt: artifact.createdAt,
+        updatedAt: artifact.updatedAt
+      };
+    } catch (error) {
+      if (isInvisibleListCandidate(error)) return null;
+      throw editableArtifactHttpError(error);
+    }
+  }
+  if (row.kind === "file" || row.kind === "image") {
+    const [file] = await getFilesForSubject3(deps.db, {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      subjectId: fileSubject,
+      fileIds: [row.id]
+    });
+    if (!file || file.status !== "ready") return null;
+    const generated = row.origin === "generated_image" ? await getGeneratedImageArtifact2(deps.db, grant.workspaceId, row.id) : null;
+    const reference = row.origin === "generated_image" ? generated?.status === "ready" ? retainedGeneratedImageReferenceFromFile2({
+      ...file,
+      width: generated.width,
+      height: generated.height
+    }) : null : retainedArtifactReferenceFromFile3(file, "file");
+    if (!reference) return null;
+    return {
+      ...item,
+      file: reference,
+      filename: file.filename,
+      contentType: reference.contentType,
+      sizeBytes: file.sizeBytes
+    };
+  }
+  return item;
+}
+
 // src/routes/insights.ts
 import { InsightsRange, WorkspaceInsightsResponse } from "@opengeni/contracts";
 import {
@@ -93990,13 +94305,13 @@ import {
   WorkspaceInsightsFilterValidationError
 } from "@opengeni/core";
 import { workspaceInsightsMetricObserver } from "@opengeni/observability";
-import { HTTPException as HTTPException83 } from "hono/http-exception";
+import { HTTPException as HTTPException85 } from "hono/http-exception";
 function normalizeWorkspaceInsightsQueryFilter(value, field) {
   try {
     return normalizeWorkspaceInsightsFilter(value, field);
   } catch (error) {
     if (error instanceof WorkspaceInsightsFilterValidationError) {
-      throw new HTTPException83(400, { message: error.message });
+      throw new HTTPException85(400, { message: error.message });
     }
     throw error;
   }
@@ -94016,7 +94331,7 @@ function registerInsightsRoutes(app, deps) {
       await requireAccessGrant42(c, deps, workspaceId, "workspace:admin");
       const rangeParsed = InsightsRange.safeParse(rangeRaw);
       if (!rangeParsed.success) {
-        throw new HTTPException83(400, {
+        throw new HTTPException85(400, {
           message: "range must be one of today|week|month|ytd"
         });
       }
@@ -94053,7 +94368,7 @@ import { requireAccessGrant as requireAccessGrant44, TranscriptionServiceError a
 import { getWorkspace as getWorkspace5 } from "@opengeni/db";
 
 // src/routes/transcription-recordings.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import {
   CreateTranscriptionRecordingRequest,
   FinalizeTranscriptionRecordingRequest,
@@ -94898,7 +95213,7 @@ function valueAsUuid(value) {
   if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
     return value;
   }
-  const hex2 = createHash27("sha256").update(value).digest("hex").slice(0, 32);
+  const hex2 = createHash28("sha256").update(value).digest("hex").slice(0, 32);
   return `${hex2.slice(0, 8)}-${hex2.slice(8, 12)}-4${hex2.slice(13, 16)}-a${hex2.slice(17, 20)}-${hex2.slice(20, 32)}`;
 }
 function nonnegativeInteger(value) {
@@ -94962,7 +95277,7 @@ async function readBoundedBody(request, maxBytes) {
   return body4;
 }
 function sha256Hex3(bytes) {
-  return createHash27("sha256").update(bytes).digest("hex");
+  return createHash28("sha256").update(bytes).digest("hex");
 }
 
 // src/routes/transcriptions.ts
@@ -95116,7 +95431,7 @@ import {
 } from "@opengeni/contracts";
 import {
   getVideoGenerationOperationSummary,
-  withSessionRlsActorContext as withSessionRlsActorContext7,
+  withSessionRlsActorContext as withSessionRlsActorContext8,
   getWorkspaceVercelAiGatewayConnectionMetadata as getWorkspaceVercelAiGatewayConnectionMetadata2,
   getWorkspaceVideoGenerationPolicy,
   updateWorkspaceVideoGenerationPolicy,
@@ -95125,14 +95440,14 @@ import {
 } from "@opengeni/db";
 import {
   requireAccessGrant as requireAccessGrant45,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization32,
-  fileOwnerContextForAccess as fileOwnerContextForAccess5,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization33,
+  fileOwnerContextForAccess as fileOwnerContextForAccess6,
   requireWorkspaceSettingsGrant as requireWorkspaceSettingsGrant4,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
   videoGenerationCapabilitiesForPolicy
 } from "@opengeni/core";
-import { HTTPException as HTTPException84 } from "hono/http-exception";
+import { HTTPException as HTTPException86 } from "hono/http-exception";
 function registerVideoGenerationRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/video-generation", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -95179,14 +95494,14 @@ function registerVideoGenerationRoutes(app, deps) {
       (option) => option.source === payload.fundingSource
     );
     if (payload.enabledModelIds.length > 0 && !selectedFunding?.available) {
-      throw new HTTPException84(422, {
+      throw new HTTPException86(422, {
         message: selectedFunding?.unavailableReason ?? "Video generation funding is unavailable"
       });
     }
     if (payload.enabledModelIds.some(
       (modelId) => !videoGenerationModelSupportsFundingSource(modelId, payload.fundingSource)
     )) {
-      throw new HTTPException84(422, {
+      throw new HTTPException86(422, {
         message: "The selected video model is unavailable for this funding source"
       });
     }
@@ -95200,24 +95515,24 @@ function registerVideoGenerationRoutes(app, deps) {
       return c.json(VideoGenerationPolicy.parse(policy));
     } catch (error) {
       if (error instanceof VideoGenerationConflictError) {
-        throw new HTTPException84(409, { message: error.message });
+        throw new HTTPException86(409, { message: error.message });
       }
       if (error instanceof Error && error.message.startsWith("Unknown video generation model:")) {
-        throw new HTTPException84(422, { message: error.message });
+        throw new HTTPException86(422, { message: error.message });
       }
       throw error;
     }
   });
   app.get("/v1/workspaces/:workspaceId/video-generation/operations/:operationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization32(c, deps, workspaceId, "workspace:read");
-    const actor = await fileOwnerContextForAccess5(deps, access, "workspace:read");
-    const summary = await withSessionRlsActorContext7(
+    const access = await requireAccessGrantAuthorization33(c, deps, workspaceId, "workspace:read");
+    const actor = await fileOwnerContextForAccess6(deps, access, "workspace:read");
+    const summary = await withSessionRlsActorContext8(
       actor,
       () => getVideoGenerationOperationSummary(deps.db, workspaceId, c.req.param("operationId"))
     );
     if (!summary)
-      throw new HTTPException84(404, {
+      throw new HTTPException86(404, {
         message: "video generation operation not found"
       });
     return c.json(VideoGenerationOperationSummary.parse(summary));
@@ -95274,9 +95589,9 @@ import {
   CanonicalHumanIdentityMutationInFlightError,
   getCanonicalHumanIdentityProjection as getCanonicalHumanIdentityProjection2
 } from "@opengeni/db/canonical-human-identities";
-import { HTTPException as HTTPException85 } from "hono/http-exception";
-import { z as z33 } from "zod";
-var BindingId = z33.string().uuid();
+import { HTTPException as HTTPException87 } from "hono/http-exception";
+import { z as z34 } from "zod";
+var BindingId = z34.string().uuid();
 async function requestIdentity(context, deps) {
   return await requireCanonicalHumanRequestIdentity(context, {
     db: deps.db,
@@ -95289,13 +95604,13 @@ async function requestIdentity(context, deps) {
 async function parseBody5(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) {
-    throw new HTTPException85(422, { message: "Invalid canonical human identity request" });
+    throw new HTTPException87(422, { message: "Invalid canonical human identity request" });
   }
   return parsed.data;
 }
 function bindingId(context) {
   const parsed = BindingId.safeParse(context.req.param("bindingId"));
-  if (!parsed.success) throw new HTTPException85(422, { message: "Invalid login binding id" });
+  if (!parsed.success) throw new HTTPException87(422, { message: "Invalid login binding id" });
   return parsed.data;
 }
 function identityError(context, error) {
@@ -95326,7 +95641,7 @@ async function mutate(context, deps, input) {
   const identity = await requestIdentity(context, deps);
   const actorFence = getManagedAuthRequestActorLeaseStamp(context.req.raw);
   if (deps.settings.managedAuthSessionSetMode !== "legacy" && !actorFence) {
-    throw new HTTPException85(409, { message: "Managed actor mutation fence is unavailable" });
+    throw new HTTPException87(409, { message: "Managed actor mutation fence is unavailable" });
   }
   try {
     const response = CanonicalHumanIdentityMutationResponse.parse(
@@ -95474,15 +95789,15 @@ import {
   updateOrganizationPrivateSessionSettings,
   updateOrganizationRetentionPolicy
 } from "@opengeni/db";
-import { HTTPException as HTTPException86 } from "hono/http-exception";
-import { z as z34 } from "zod";
-var OrganizationId2 = z34.string().uuid();
-var WorkspaceId = z34.string().uuid();
-var MembershipId = z34.string().uuid();
-var InvitationId = z34.string().uuid();
+import { HTTPException as HTTPException88 } from "hono/http-exception";
+import { z as z35 } from "zod";
+var OrganizationId2 = z35.string().uuid();
+var WorkspaceId = z35.string().uuid();
+var MembershipId = z35.string().uuid();
+var InvitationId = z35.string().uuid();
 async function requireManagedHuman(context, deps) {
   if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth || !context.req.header("cookie") || context.req.header("authorization")) {
-    throw new HTTPException86(401, { message: "managed human session required" });
+    throw new HTTPException88(401, { message: "managed human session required" });
   }
   const session = await getManagedSession3(context, deps.managedAuth, {
     db: deps.db,
@@ -95490,7 +95805,7 @@ async function requireManagedHuman(context, deps) {
     sessionSetMode: deps.settings.managedAuthSessionSetMode
   });
   if (!session?.user) {
-    throw new HTTPException86(401, { message: "managed human session required" });
+    throw new HTTPException88(401, { message: "managed human session required" });
   }
   return { session, subjectId: `user:${session.user.id}` };
 }
@@ -95506,14 +95821,14 @@ async function requireOrganizationAdministrator(context, deps, organizationId2)
     );
     return { subjectId };
   }
-  throw new HTTPException86(401, {
+  throw new HTTPException88(401, {
     message: "organization administrator session required"
   });
 }
 async function parseBody6(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) {
-    throw new HTTPException86(422, {
+    throw new HTTPException88(422, {
       message: "invalid organization membership request"
     });
   }
@@ -95521,19 +95836,19 @@ async function parseBody6(context, schema) {
 }
 function parseId(schema, value, label) {
   const parsed = schema.safeParse(value);
-  if (!parsed.success) throw new HTTPException86(422, { message: `invalid ${label}` });
+  if (!parsed.success) throw new HTTPException88(422, { message: `invalid ${label}` });
   return parsed.data;
 }
 function rethrowMembershipError(error, resourceLimitMessage) {
   const sqlState = nestedPostgresSqlState9(error);
   if (sqlState === "54000" && resourceLimitMessage) {
-    throw new HTTPException86(409, {
+    throw new HTTPException88(409, {
       message: resourceLimitMessage
     });
   }
   const status = organizationMembershipHttpStatus(sqlState);
   if (status !== null) {
-    throw new HTTPException86(status, {
+    throw new HTTPException88(status, {
       message: status === 403 ? "organization administration is not authorized" : status === 404 ? "organization resource not found" : status === 409 ? "organization membership state changed; refresh and retry" : "invalid organization membership operation"
     });
   }
@@ -95573,7 +95888,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (error instanceof HTTPException86) throw error;
+      if (error instanceof HTTPException88) throw error;
       rethrowMembershipError(error);
     }
   });
@@ -95630,7 +95945,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
       );
     } catch (error) {
       if (nestedPostgresSqlState9(error) === "42501") {
-        throw new HTTPException86(403, {
+        throw new HTTPException88(403, {
           message: "organization membership is not active"
         });
       }
@@ -95641,7 +95956,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
     const { session, subjectId } = await requireManagedHuman(context, deps);
     const query = ListOrganizationInvitationsPageQuery.safeParse(context.req.query());
     if (!query.success) {
-      throw new HTTPException86(422, {
+      throw new HTTPException88(422, {
         message: "invalid organization invitation page"
       });
     }
@@ -95919,7 +96234,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
       );
     } catch (error) {
       if (nestedPostgresSqlState9(error) === "55000") {
-        throw new HTTPException86(409, {
+        throw new HTTPException88(409, {
           message: "private-session readiness is not activated for this organization"
         });
       }
@@ -95937,7 +96252,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
     try {
       assertOrganizationUserSetupDeliveryConfigured(deps.settings, deps.managedEmailTransport);
     } catch {
-      throw new HTTPException86(503, {
+      throw new HTTPException88(503, {
         message: "invited-user account setup delivery is not configured on this deployment"
       });
     }
@@ -95973,7 +96288,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         201
       );
     } catch (error) {
-      if (error instanceof HTTPException86) throw error;
+      if (error instanceof HTTPException88) throw error;
       rethrowMembershipError(error);
     }
   });
@@ -95986,7 +96301,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
     );
     const query = ListOrganizationInvitationsPageQuery.safeParse(context.req.query());
     if (!query.success) {
-      throw new HTTPException86(422, {
+      throw new HTTPException88(422, {
         message: "invalid organization invitation page"
       });
     }
@@ -96023,7 +96338,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
       try {
         assertOrganizationUserSetupDeliveryConfigured(deps.settings, deps.managedEmailTransport);
       } catch {
-        throw new HTTPException86(503, {
+        throw new HTTPException88(503, {
           message: "invited-user account setup delivery is not configured on this deployment"
         });
       }
@@ -96070,7 +96385,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         membership: OrganizationMember.parse(result.membership)
       });
     } catch (error) {
-      if (error instanceof HTTPException86) throw error;
+      if (error instanceof HTTPException88) throw error;
       rethrowMembershipError(error);
     }
   });
@@ -96252,12 +96567,12 @@ import {
 } from "@opengeni/contracts";
 import {
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority3,
-  hasPermission as hasPermission21,
+  hasPermission as hasPermission22,
   requireAccessContext as requireAccessContext4,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization33,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization34,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope3,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError13,
-  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError11
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError14,
+  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError12
 } from "@opengeni/core";
 import {
   decodeSessionListCursor as decodeSessionListCursor2,
@@ -96267,14 +96582,14 @@ import {
   SessionListCursorError as SessionListCursorError2,
   SessionListCursorExpiredError as SessionListCursorExpiredError2
 } from "@opengeni/db";
-import { HTTPException as HTTPException87 } from "hono/http-exception";
-import { z as z35 } from "zod";
+import { HTTPException as HTTPException89 } from "hono/http-exception";
+import { z as z36 } from "zod";
 var ORGANIZATION_SESSION_LIST_MAX_WORKSPACE_READS = 25;
-var OrganizationId3 = z35.string().uuid();
-var OrganizationSessionListCursorEnvelope = z35.object({
-  workspaceId: z35.string().uuid(),
-  cursor: z35.string().min(1).nullable(),
-  pinnedOffset: z35.number().int().nonnegative().max(1e4).optional()
+var OrganizationId3 = z36.string().uuid();
+var OrganizationSessionListCursorEnvelope = z36.object({
+  workspaceId: z36.string().uuid(),
+  cursor: z36.string().min(1).nullable(),
+  pinnedOffset: z36.number().int().nonnegative().max(1e4).optional()
 }).strict();
 function encodeOrganizationSessionListCursor(cursor) {
   return Buffer.from(JSON.stringify(cursor)).toString("base64url");
@@ -96296,10 +96611,10 @@ function decodeOrganizationSessionListCursor(value) {
 function requireOrganizationSessionReadAuthority(context, organizationId2) {
   const authority = accountScopedApiKeyWorkspaceAuthority3(context);
   if (authority) {
-    if (authority.accountId === organizationId2 && hasPermission21(authority.permissions, "sessions:read")) {
+    if (authority.accountId === organizationId2 && hasPermission22(authority.permissions, "sessions:read")) {
       return "organization_api_key";
     }
-    throw new HTTPException87(403, { message: "organization session read authority required" });
+    throw new HTTPException89(403, { message: "organization session read authority required" });
   }
   const accountGrant = context.accountGrants.find(
     (candidate) => candidate.accountId === organizationId2
@@ -96307,16 +96622,16 @@ function requireOrganizationSessionReadAuthority(context, organizationId2) {
   if (accountGrant?.permissions.includes("account:admin")) {
     return "account_admin";
   }
-  throw new HTTPException87(403, { message: "organization session read authority required" });
+  throw new HTTPException89(403, { message: "organization session read authority required" });
 }
 function sessionAuthorizationHttpError2(error) {
-  if (error instanceof SessionAuthorizationDeniedError13) {
-    return new HTTPException87(404, { message: "session not found" });
+  if (error instanceof SessionAuthorizationDeniedError14) {
+    return new HTTPException89(404, { message: "session not found" });
   }
-  if (error instanceof SessionAuthorizationUnavailableError11) {
-    return new HTTPException87(503, { message: "session authorization is unavailable" });
+  if (error instanceof SessionAuthorizationUnavailableError12) {
+    return new HTTPException89(503, { message: "session authorization is unavailable" });
   }
-  if (error instanceof HTTPException87) return error;
+  if (error instanceof HTTPException89) return error;
   throw error;
 }
 function compareWorkspaceIds(left, right) {
@@ -96326,7 +96641,7 @@ function registerOrganizationSessionRoutes(app, deps) {
   app.get("/v1/organizations/:organizationId/sessions", async (c) => {
     const organizationIdResult = OrganizationId3.safeParse(c.req.param("organizationId"));
     if (!organizationIdResult.success) {
-      throw new HTTPException87(422, { message: "invalid organization id" });
+      throw new HTTPException89(422, { message: "invalid organization id" });
     }
     const organizationId2 = organizationIdResult.data;
     const context = await requireAccessContext4(c, deps);
@@ -96334,14 +96649,14 @@ function registerOrganizationSessionRoutes(app, deps) {
     const queryResult = ListOrganizationSessionsQuery.safeParse(c.req.query());
     if (!queryResult.success) {
       const issue = queryResult.error.issues[0];
-      throw new HTTPException87(400, {
+      throw new HTTPException89(400, {
         message: issue ? `${issue.path.length > 0 ? `${issue.path.join(".")}: ` : ""}${issue.message}` : "invalid organization session list query"
       });
     }
     const query = queryResult.data;
     const cursor = query.cursor ? decodeOrganizationSessionListCursor(query.cursor) : null;
     if (query.cursor && !cursor) {
-      throw new HTTPException87(400, { message: "cursor is invalid" });
+      throw new HTTPException89(400, { message: "cursor is invalid" });
     }
     const workspaces = (await listSharedWorkspacesForAccount2(deps.db, organizationId2)).sort(
       compareWorkspaceIds
@@ -96405,14 +96720,14 @@ function registerOrganizationSessionRoutes(app, deps) {
 async function listWorkspaceSessionPage(c, deps, input) {
   let authorization;
   try {
-    authorization = await requireAccessGrantAuthorization33(
+    authorization = await requireAccessGrantAuthorization34(
       c,
       deps,
       input.workspace.id,
       "sessions:read"
     );
   } catch (error) {
-    if (input.readAuthority === "account_admin" && error instanceof HTTPException87 && error.status === 403) {
+    if (input.readAuthority === "account_admin" && error instanceof HTTPException89 && error.status === 403) {
       return null;
     }
     throw error;
@@ -96426,7 +96741,7 @@ async function listWorkspaceSessionPage(c, deps, input) {
   }
   const cursor = input.innerCursor ? decodeSessionListCursor2(input.innerCursor) : null;
   if (input.innerCursor && !cursor) {
-    throw new HTTPException87(400, { message: "cursor is invalid" });
+    throw new HTTPException89(400, { message: "cursor is invalid" });
   }
   try {
     const list = async (limit) => await listSessionsForSubject2(deps.db, input.workspace.id, {
@@ -96459,13 +96774,13 @@ async function listWorkspaceSessionPage(c, deps, input) {
     return { sessions: withStatus(rows), nextCursor: page.nextCursor, nextPinnedOffset };
   } catch (error) {
     if (error instanceof SessionListAccessError2) {
-      throw new HTTPException87(403, { message: error.message });
+      throw new HTTPException89(403, { message: error.message });
     }
     if (error instanceof SessionListCursorExpiredError2) {
-      throw new HTTPException87(410, { message: error.message });
+      throw new HTTPException89(410, { message: error.message });
     }
     if (error instanceof SessionListCursorError2) {
-      throw new HTTPException87(400, { message: error.message });
+      throw new HTTPException89(400, { message: error.message });
     }
     throw error;
   }
@@ -96500,10 +96815,10 @@ import {
   OrganizationRecoveryUnavailableError,
   startOrganizationRecoveryOperation
 } from "@opengeni/db";
-import { HTTPException as HTTPException88 } from "hono/http-exception";
-import { z as z36 } from "zod";
-var OrganizationId4 = z36.string().uuid();
-var RecoveryOperationId = z36.string().uuid();
+import { HTTPException as HTTPException90 } from "hono/http-exception";
+import { z as z37 } from "zod";
+var OrganizationId4 = z37.string().uuid();
+var RecoveryOperationId = z37.string().uuid();
 var productionServices = {
   requireCanonicalHumanRequestIdentity: requireCanonicalHumanRequestIdentity2,
   getManagedAuthRequestActorAdmissionStamp,
@@ -96519,7 +96834,7 @@ var productionServices = {
 };
 async function requireRecoveryIdentity(context, deps, services) {
   if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth || !context.req.header("cookie") || context.req.header("authorization")) {
-    throw new HTTPException88(401, {
+    throw new HTTPException90(401, {
       message: "Managed human authentication required"
     });
   }
@@ -96535,7 +96850,7 @@ async function requireRecoveryIdentity(context, deps, services) {
 async function parseBody7(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success) {
-    throw new HTTPException88(422, {
+    throw new HTTPException90(422, {
       message: "Invalid organization recovery request"
     });
   }
@@ -96543,7 +96858,7 @@ async function parseBody7(context, schema) {
 }
 function parseId2(schema, value, label) {
   const parsed = schema.safeParse(value);
-  if (!parsed.success) throw new HTTPException88(422, { message: `Invalid ${label}` });
+  if (!parsed.success) throw new HTTPException90(422, { message: `Invalid ${label}` });
   return parsed.data;
 }
 function organizationId(context) {
@@ -96598,12 +96913,12 @@ function organizationRecoveryHttpError(error) {
 function requireActorFence(context, deps, services) {
   const actorFence = services.getManagedAuthRequestActorLeaseStamp(context.req.raw);
   if (deps.settings.managedAuthSessionSetMode !== "legacy" && !actorFence) {
-    throw new HTTPException88(409, {
+    throw new HTTPException90(409, {
       message: "Managed actor mutation fence is unavailable"
     });
   }
   if (!actorFence) {
-    throw new HTTPException88(409, {
+    throw new HTTPException90(409, {
       message: "Organization recovery requires provider-neutral browser login slots"
     });
   }
@@ -96758,7 +97073,7 @@ import {
   preflightOrganizationUserSetup,
   previewOrganizationUserSetup
 } from "@opengeni/db";
-import { HTTPException as HTTPException89 } from "hono/http-exception";
+import { HTTPException as HTTPException91 } from "hono/http-exception";
 var completedSetupReplayPasswordHash = `completed-replay:${"0".repeat(64)}`;
 function registerManagedOnboardingRoutes(app, deps, options = {}) {
   const accountSetupLimiter = options.accountSetupLimiter ?? new PublicSetupRateLimiter();
@@ -96781,7 +97096,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
       await context.req.json().catch(() => null)
     );
     if (!parsed.success) {
-      throw new HTTPException89(422, {
+      throw new HTTPException91(422, {
         message: "invalid organization setup request"
       });
     }
@@ -96805,17 +97120,17 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
     } catch (error) {
       const sqlState = nestedPostgresSqlState10(error);
       if (sqlState === "22023") {
-        throw new HTTPException89(422, {
+        throw new HTTPException91(422, {
           message: "invalid organization setup request"
         });
       }
       if (sqlState === "42501") {
-        throw new HTTPException89(403, {
+        throw new HTTPException91(403, {
           message: "verified managed user required"
         });
       }
       if (sqlState === "23505" || sqlState === "55000") {
-        throw new HTTPException89(409, {
+        throw new HTTPException91(409, {
           message: "organization setup is no longer available; refresh to continue"
         });
       }
@@ -96824,14 +97139,14 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
   });
   app.post("/v1/auth/organization-setup/preview", async (context) => {
     if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth) {
-      throw new HTTPException89(404, { message: "account setup is unavailable" });
+      throw new HTTPException91(404, { message: "account setup is unavailable" });
     }
     enforceAccountSetupRateLimit(context, accountSetupLimiter);
     const parsed = PreviewOrganizationUserSetupRequest.safeParse(
       await context.req.json().catch(() => null)
     );
     if (!parsed.success) {
-      throw new HTTPException89(422, { message: "invalid account setup preview request" });
+      throw new HTTPException91(422, { message: "invalid account setup preview request" });
     }
     return context.json(
       OrganizationUserSetupPreview.parse(
@@ -96844,14 +97159,14 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
   });
   app.post("/v1/auth/organization-setup", async (context) => {
     if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth) {
-      throw new HTTPException89(404, { message: "account setup is unavailable" });
+      throw new HTTPException91(404, { message: "account setup is unavailable" });
     }
     enforceAccountSetupRateLimit(context, accountSetupLimiter);
     const parsed = CompleteOrganizationUserSetupRequest.safeParse(
       await context.req.json().catch(() => null)
     );
     if (!parsed.success) {
-      throw new HTTPException89(422, {
+      throw new HTTPException91(422, {
         message: "invalid account setup request"
       });
     }
@@ -96859,7 +97174,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
     const tokenDigest = await organizationUserSetupTokenDigest(parsed.data.token);
     const preflight = await preflightOrganizationUserSetup(deps.db, tokenDigest);
     if (preflight === "unavailable") {
-      throw new HTTPException89(404, {
+      throw new HTTPException91(404, {
         message: "account setup link is invalid, expired, or already belongs to an account"
       });
     }
@@ -96885,17 +97200,17 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
     } catch (error) {
       const sqlState = nestedPostgresSqlState10(error);
       if (sqlState === "22023") {
-        throw new HTTPException89(422, {
+        throw new HTTPException91(422, {
           message: "invalid account setup request"
         });
       }
       if (sqlState === "23505") {
-        throw new HTTPException89(409, {
+        throw new HTTPException91(409, {
           message: "account setup request changed; reopen the original link and try again"
         });
       }
       if (sqlState === "P0002" || sqlState === "42501" || sqlState === "55000") {
-        throw new HTTPException89(404, {
+        throw new HTTPException91(404, {
           message: "account setup link is invalid, expired, or already belongs to an account"
         });
       }
@@ -96910,7 +97225,7 @@ function enforceAccountSetupRateLimit(context, limiter) {
   } catch {
   }
   if (!allowed2) {
-    throw new HTTPException89(429, { message: "too many account setup requests; slow down" });
+    throw new HTTPException91(429, { message: "too many account setup requests; slow down" });
   }
 }
 function accountSetupClientKey(context) {
@@ -96978,7 +97293,7 @@ function refillSetupRateLimitBucket(bucket, capacity, refillPerSecond, now) {
 }
 async function requireManagedHuman2(context, deps) {
   if (deps.settings.productAccessMode !== "managed" || !deps.managedAuth || !context.req.header("cookie") || context.req.header("authorization")) {
-    throw new HTTPException89(401, { message: "managed human session required" });
+    throw new HTTPException91(401, { message: "managed human session required" });
   }
   const session = await getManagedSession4(context, deps.managedAuth, {
     db: deps.db,
@@ -96986,7 +97301,7 @@ async function requireManagedHuman2(context, deps) {
     sessionSetMode: deps.settings.managedAuthSessionSetMode
   });
   if (!session?.user) {
-    throw new HTTPException89(401, { message: "managed human session required" });
+    throw new HTTPException91(401, { message: "managed human session required" });
   }
   return session;
 }
@@ -97013,7 +97328,7 @@ import {
   StartManagedAuthSocialTransactionRequest,
   StartManagedAuthSocialTransactionResponse
 } from "@opengeni/contracts/managed-auth-session-sets";
-import { hasPermission as hasPermission22, requireSessionAuthorization as requireSessionAuthorization14 } from "@opengeni/core";
+import { hasPermission as hasPermission23, requireSessionAuthorization as requireSessionAuthorization15 } from "@opengeni/core";
 import {
   authenticateAndAdoptManagedAuthSession,
   isolatedManagedAuthHeaders,
@@ -97053,13 +97368,13 @@ import {
 } from "@opengeni/db/managed-auth-session-sets";
 import { ensureManagedAccessForUser as ensureManagedAccessForUser2, getSession as getSession10 } from "@opengeni/db";
 import { deleteCookie as deleteCookie3, getCookie, setCookie as setCookie3 } from "hono/cookie";
-import { HTTPException as HTTPException90 } from "hono/http-exception";
-import { z as z37 } from "zod";
-var ManagedAuthSocialStartReceipt = z37.object({
-  version: z37.literal(1),
-  requestDigest: z37.string().regex(/^[0-9a-f]{64}$/u),
-  url: z37.string().url().max(4096),
-  stateCookie: z37.string().min(1).max(4096)
+import { HTTPException as HTTPException92 } from "hono/http-exception";
+import { z as z38 } from "zod";
+var ManagedAuthSocialStartReceipt = z38.object({
+  version: z38.literal(1),
+  requestDigest: z38.string().regex(/^[0-9a-f]{64}$/u),
+  url: z38.string().url().max(4096),
+  stateCookie: z38.string().min(1).max(4096)
 }).strict();
 function registerManagedAuthSessionSetRoutes(app, deps) {
   const noStore = async (context, next) => {
@@ -97080,7 +97395,7 @@ function registerManagedAuthSessionSetRoutes(app, deps) {
   app.use("/v1/auth/session-set/*", noStore);
   app.get("/v1/auth/get-session", async (context) => {
     if (deps.settings.managedAuthSessionSetMode === "legacy") {
-      if (!deps.managedAuth) throw new HTTPException90(404);
+      if (!deps.managedAuth) throw new HTTPException92(404);
       return await deps.managedAuth.handler(context.req.raw);
     }
     context.header("cache-control", "no-store");
@@ -97685,14 +98000,14 @@ async function resolveCanonicalDeepLink(deps, authority, path, expectedActorEpoc
     const grants = target.workspaceId ? access.workspaceGrants.filter((grant) => grant.workspaceId === target.workspaceId) : access.workspaceGrants;
     let authorized = false;
     for (const grant of grants) {
-      if (!hasPermission22(grant.permissions, target.sessionId ? "sessions:read" : target.permission)) {
+      if (!hasPermission23(grant.permissions, target.sessionId ? "sessions:read" : target.permission)) {
         continue;
       }
       if (target.sessionId) {
         const session = await getSession10(deps.db, grant.workspaceId, target.sessionId);
         if (!session) continue;
         try {
-          await requireSessionAuthorization14(deps, grant, {
+          await requireSessionAuthorization15(deps, grant, {
             sessionId: target.sessionId,
             operation: "session.read",
             surface: "http"
@@ -97919,7 +98234,7 @@ function appendCookies(context, cookies) {
   for (const cookie of cookies) context.header("set-cookie", cookie, { append: true });
 }
 function throwHttp(error) {
-  if (error instanceof HTTPException90) throw error;
+  if (error instanceof HTTPException92) throw error;
   if (error instanceof ManagedAuthSessionSetGenerationConflictError) {
     throw managedAuthApiError(409, "generation_conflict", { cause: error, retryable: true });
   }
@@ -97988,32 +98303,32 @@ import {
 import {
   issueManagedHumanUserResourceGrant,
   listManagedHumanUserResourceAuthorities,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization34,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization35,
   revokeManagedHumanUserResourceGrant,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError14,
-  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError12,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError15,
+  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError13,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError2
 } from "@opengeni/core";
 import { nestedPostgresSqlState as nestedPostgresSqlState11, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError2 } from "@opengeni/db";
-import { HTTPException as HTTPException91 } from "hono/http-exception";
-import { z as z38 } from "zod";
+import { HTTPException as HTTPException93 } from "hono/http-exception";
+import { z as z39 } from "zod";
 async function body2(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
-  if (!parsed.success) throw new HTTPException91(422, { message: "invalid user-resource request" });
+  if (!parsed.success) throw new HTTPException93(422, { message: "invalid user-resource request" });
   return parsed.data;
 }
 function lifecycleError(error) {
-  if (error instanceof SessionAuthorizationDeniedError14 || error instanceof SessionTenancyManagedHumanRequiredError2 || error instanceof SessionTenancyNotActivatedError2) {
-    throw new HTTPException91(403, { message: "user-resource authority denied" });
+  if (error instanceof SessionAuthorizationDeniedError15 || error instanceof SessionTenancyManagedHumanRequiredError2 || error instanceof SessionTenancyNotActivatedError2) {
+    throw new HTTPException93(403, { message: "user-resource authority denied" });
   }
-  if (error instanceof SessionAuthorizationUnavailableError12) {
-    throw new HTTPException91(503, { message: "session authorization unavailable" });
+  if (error instanceof SessionAuthorizationUnavailableError13) {
+    throw new HTTPException93(503, { message: "session authorization unavailable" });
   }
   if (nestedPostgresSqlState11(error) === "42501") {
-    throw new HTTPException91(403, { message: "user-resource authority denied" });
+    throw new HTTPException93(403, { message: "user-resource authority denied" });
   }
   if (nestedPostgresSqlState11(error) === "22023") {
-    throw new HTTPException91(422, { message: "invalid user-resource request" });
+    throw new HTTPException93(422, { message: "invalid user-resource request" });
   }
   throw error;
 }
@@ -98026,9 +98341,9 @@ function registerUserResourceAuthorityRoutes(app, deps) {
       cursor: context.req.query("cursor"),
       limit: context.req.query("limit")
     });
-    if (!query.success) throw new HTTPException91(422, { message: "explicit scope=user required" });
+    if (!query.success) throw new HTTPException93(422, { message: "explicit scope=user required" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization34(
+    const access = await requireAccessGrantAuthorization35(
       context,
       deps,
       workspaceId,
@@ -98053,10 +98368,10 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   });
   app.post(`${base}/:authorityId/grants`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const authorityId = z38.string().uuid().safeParse(context.req.param("authorityId"));
-    if (!authorityId.success) throw new HTTPException91(422, { message: "invalid authority id" });
+    const authorityId = z39.string().uuid().safeParse(context.req.param("authorityId"));
+    if (!authorityId.success) throw new HTTPException93(422, { message: "invalid authority id" });
     const request = await body2(context, IssueUserResourceGrantRequest);
-    const access = await requireAccessGrantAuthorization34(
+    const access = await requireAccessGrantAuthorization35(
       context,
       deps,
       workspaceId,
@@ -98082,11 +98397,11 @@ function registerUserResourceAuthorityRoutes(app, deps) {
   });
   app.delete(`${base}/grants/:grantId`, async (context) => {
     const query = RevokeUserResourceGrantQuery.safeParse({ scope: context.req.query("scope") });
-    if (!query.success) throw new HTTPException91(422, { message: "explicit scope=user required" });
-    const grantId = z38.string().uuid().safeParse(context.req.param("grantId"));
-    if (!grantId.success) throw new HTTPException91(422, { message: "invalid grant id" });
+    if (!query.success) throw new HTTPException93(422, { message: "explicit scope=user required" });
+    const grantId = z39.string().uuid().safeParse(context.req.param("grantId"));
+    if (!grantId.success) throw new HTTPException93(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization34(
+    const access = await requireAccessGrantAuthorization35(
       context,
       deps,
       workspaceId,
@@ -98116,22 +98431,22 @@ import {
 import {
   issueManagedHumanUserResourceGrant as issueManagedHumanUserResourceGrant2,
   listManagedHumanUserResourceAuthorities as listManagedHumanUserResourceAuthorities2,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization35,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization36,
   revokeManagedHumanUserResourceGrant as revokeManagedHumanUserResourceGrant2,
-  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError15,
-  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError13,
+  SessionAuthorizationDeniedError as SessionAuthorizationDeniedError16,
+  SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError14,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError3
 } from "@opengeni/core";
 import { nestedPostgresSqlState as nestedPostgresSqlState12, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
-import { HTTPException as HTTPException93 } from "hono/http-exception";
-import { z as z39 } from "zod";
+import { HTTPException as HTTPException95 } from "hono/http-exception";
+import { z as z40 } from "zod";
 
 // src/connection-authority-owner.ts
 import {
   IssueConnectionUseGrantRequest,
   ListConnectionAuthoritiesResponse
 } from "@opengeni/contracts/connection-authority";
-import { HTTPException as HTTPException92 } from "hono/http-exception";
+import { HTTPException as HTTPException94 } from "hono/http-exception";
 function projectSelfConnectionAuthorities(page) {
   return ListConnectionAuthoritiesResponse.parse({
     scope: "user",
@@ -98154,21 +98469,21 @@ function connectionUseGrantLifecycleInput(input) {
 // src/routes/connection-authorities.ts
 async function body3(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
-  if (!parsed.success) throw new HTTPException93(422, { message: "invalid connection authority" });
+  if (!parsed.success) throw new HTTPException95(422, { message: "invalid connection authority" });
   return parsed.data;
 }
 function lifecycleError2(error) {
-  if (error instanceof SessionAuthorizationDeniedError15 || error instanceof SessionTenancyManagedHumanRequiredError3 || error instanceof SessionTenancyNotActivatedError3) {
-    throw new HTTPException93(403, { message: "connection authority denied" });
+  if (error instanceof SessionAuthorizationDeniedError16 || error instanceof SessionTenancyManagedHumanRequiredError3 || error instanceof SessionTenancyNotActivatedError3) {
+    throw new HTTPException95(403, { message: "connection authority denied" });
   }
-  if (error instanceof SessionAuthorizationUnavailableError13) {
-    throw new HTTPException93(503, { message: "session authorization unavailable" });
+  if (error instanceof SessionAuthorizationUnavailableError14) {
+    throw new HTTPException95(503, { message: "session authorization unavailable" });
   }
   if (nestedPostgresSqlState12(error) === "42501") {
-    throw new HTTPException93(403, { message: "connection authority denied" });
+    throw new HTTPException95(403, { message: "connection authority denied" });
   }
   if (nestedPostgresSqlState12(error) === "22023") {
-    throw new HTTPException93(422, { message: "invalid connection authority" });
+    throw new HTTPException95(422, { message: "invalid connection authority" });
   }
   throw error;
 }
@@ -98180,9 +98495,9 @@ function registerConnectionAuthorityRoutes(app, deps) {
       cursor: context.req.query("cursor"),
       limit: context.req.query("limit")
     });
-    if (!query.success) throw new HTTPException93(422, { message: "explicit scope=user required" });
+    if (!query.success) throw new HTTPException95(422, { message: "explicit scope=user required" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization35(
+    const access = await requireAccessGrantAuthorization36(
       context,
       deps,
       workspaceId,
@@ -98204,10 +98519,10 @@ function registerConnectionAuthorityRoutes(app, deps) {
   });
   app.post(`${base}/:authorityId/grants`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const authorityId = z39.string().uuid().safeParse(context.req.param("authorityId"));
-    if (!authorityId.success) throw new HTTPException93(422, { message: "invalid authority id" });
+    const authorityId = z40.string().uuid().safeParse(context.req.param("authorityId"));
+    if (!authorityId.success) throw new HTTPException95(422, { message: "invalid authority id" });
     const request = await body3(context, IssueConnectionUseGrantRequest2);
-    const access = await requireAccessGrantAuthorization35(
+    const access = await requireAccessGrantAuthorization36(
       context,
       deps,
       workspaceId,
@@ -98234,11 +98549,11 @@ function registerConnectionAuthorityRoutes(app, deps) {
   });
   app.delete(`${base}/grants/:grantId`, async (context) => {
     const query = RevokeConnectionUseGrantQuery.safeParse({ scope: context.req.query("scope") });
-    if (!query.success) throw new HTTPException93(422, { message: "explicit scope=user required" });
-    const grantId = z39.string().uuid().safeParse(context.req.param("grantId"));
-    if (!grantId.success) throw new HTTPException93(422, { message: "invalid grant id" });
+    if (!query.success) throw new HTTPException95(422, { message: "explicit scope=user required" });
+    const grantId = z40.string().uuid().safeParse(context.req.param("grantId"));
+    if (!grantId.success) throw new HTTPException95(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization35(
+    const access = await requireAccessGrantAuthorization36(
       context,
       deps,
       workspaceId,
@@ -98825,7 +99140,7 @@ async function exactAvailable(providers, providerId, context) {
 }
 
 // src/integrations/slack-interactions.ts
-import { createHash as createHash29, createHmac as createHmac10, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash30, createHmac as createHmac10, timingSafeEqual as timingSafeEqual3 } from "crypto";
 import {
   approvalIdentifier,
   ApproveSlackUserLinkAccessRequest,
@@ -98928,14 +99243,14 @@ import {
   acceptSessionUserMessage as acceptSessionUserMessage2,
   controlHumanSessionWorkstream as controlHumanSessionWorkstream2,
   createSessionForRequest as createSessionForRequest2,
-  hasPermission as hasPermission23,
+  hasPermission as hasPermission24,
   requireAccessContext as requireAccessContext5,
   requireAccessGrant as requireAccessGrant46,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope4,
   resolveWorkspaceCatalogSettings as resolveWorkspaceCatalogSettings9
 } from "@opengeni/core";
 import { publishDurableSessionEvents as publishDurableSessionEvents4 } from "@opengeni/events";
-import { HTTPException as HTTPException94 } from "hono/http-exception";
+import { HTTPException as HTTPException96 } from "hono/http-exception";
 
 // src/integrations/slack-routing.ts
 function isSlackDirectMessageConversation(entry2) {
@@ -99303,7 +99618,7 @@ function record4(value) {
 }
 
 // src/slack-reaction-files.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 import { completeFileUpload as completeFileUpload5, prepareGeneratedWorkspaceFile as prepareGeneratedWorkspaceFile2 } from "@opengeni/db";
 import { retryWhileMissing as retryWhileMissing7 } from "@opengeni/storage";
 var IMPORT_IDENTITY_VERSION = "slack-reaction-image-v1";
@@ -99320,7 +99635,7 @@ async function importSlackReactionImage(dependencies, source, image, ordinal) {
   if (image.bytes.byteLength < 1 || image.bytes.byteLength > 4 * 1024 * 1024) {
     throw new Error("Slack reaction image size is invalid");
   }
-  const sha2564 = createHash28("sha256").update(image.bytes).digest("hex");
+  const sha2564 = createHash29("sha256").update(image.bytes).digest("hex");
   const identity = slackReactionImageIdentity(source, image.fileId);
   const fileId = deterministicUuid(`${identity}:file`);
   const uploadId = deterministicUuid(`${identity}:upload`);
@@ -99414,7 +99729,7 @@ function assertStoredSlackImage(head, image, sha2564) {
   }
 }
 function deterministicUuid(seed) {
-  const bytes = createHash28("sha256").update(seed, "utf8").digest().subarray(0, 16);
+  const bytes = createHash29("sha256").update(seed, "utf8").digest().subarray(0, 16);
   bytes[6] = (bytes[6] ?? 0) & 15 | 80;
   bytes[8] = (bytes[8] ?? 0) & 63 | 128;
   const hex2 = bytes.toString("hex");
@@ -99573,7 +99888,7 @@ function slackReactionInboxEntry(payload, bot, settings) {
   if (!settings.enabled || !event || event.type !== "reaction_added" || item?.type !== "message" || !teamId || !eventId || !userId || userId === bot.botUserId || !reaction || reaction !== settings.emoji || !channelId || !workspaceSlackReactionChannelAllowed(settings, channelId) || !timestamp) {
     return null;
   }
-  const stableReactionIdentity = createHash29("sha256").update([teamId, userId, channelId, timestamp, reaction].join("\n")).digest("hex");
+  const stableReactionIdentity = createHash30("sha256").update([teamId, userId, channelId, timestamp, reaction].join("\n")).digest("hex");
   return {
     providerEventId: eventId,
     providerMessageId: `reaction:${stableReactionIdentity}`,
@@ -99609,14 +99924,14 @@ function registerSlackInteractionRoutes(app, deps) {
     const payload = parseJsonObject(signed.rawBody);
     if (payload.type === "url_verification") {
       const challenge = boundedString(payload.challenge, 512);
-      if (!challenge) throw new HTTPException94(400, { message: "invalid Slack challenge" });
+      if (!challenge) throw new HTTPException96(400, { message: "invalid Slack challenge" });
       return c.json({ challenge });
     }
     const teamId = boundedString(payload.team_id, 64);
-    if (!teamId) throw new HTTPException94(400, { message: "invalid Slack event" });
+    if (!teamId) throw new HTTPException96(400, { message: "invalid Slack event" });
     const installation = await resolveSlackInstallationRoute(deps.db, teamId);
     if (!installation)
-      throw new HTTPException94(403, {
+      throw new HTTPException96(403, {
         message: "Slack installation unavailable"
       });
     const event = record5(payload.event);
@@ -99659,12 +99974,12 @@ function registerSlackInteractionRoutes(app, deps) {
     const signed = await readSignedSlackRequest(c, deps);
     const form = new URLSearchParams(signed.rawBody);
     if (form.get("command") !== deps.settings.slackCommand) {
-      throw new HTTPException94(400, { message: "invalid Slack command" });
+      throw new HTTPException96(400, { message: "invalid Slack command" });
     }
     const entry2 = normalizedFormInteraction(form, "slash_command");
     const installation = await resolveSlackInstallationRoute(deps.db, entry2.slackTeamId);
     if (!installation)
-      throw new HTTPException94(403, {
+      throw new HTTPException96(403, {
         message: "Slack installation unavailable"
       });
     if (isSlackInfoCommand(entry2.text)) {
@@ -99701,13 +100016,13 @@ function registerSlackInteractionRoutes(app, deps) {
       const entry2 = normalizedBlockActionInteraction(payload);
       const installation2 = await resolveSlackInstallationRoute(deps.db, entry2.slackTeamId);
       if (!installation2) {
-        throw new HTTPException94(403, { message: "Slack installation unavailable" });
+        throw new HTTPException96(403, { message: "Slack installation unavailable" });
       }
       await enqueueNormalizedSlackInteraction(deps, installation2, entry2);
       return c.json({ ok: true });
     }
     if (payload.type !== "message_action") {
-      throw new HTTPException94(400, {
+      throw new HTTPException96(400, {
         message: "unsupported Slack interaction"
       });
     }
@@ -99723,13 +100038,13 @@ function registerSlackInteractionRoutes(app, deps) {
     const threadTs = boundedString(message?.thread_ts, 64);
     const text = boundedText(message?.text);
     if (!triggerId || !teamId || !userId || !channelId || !messageTs || !text) {
-      throw new HTTPException94(400, {
+      throw new HTTPException96(400, {
         message: "invalid Slack message shortcut"
       });
     }
     const installation = await resolveSlackInstallationRoute(deps.db, teamId);
     if (!installation)
-      throw new HTTPException94(403, {
+      throw new HTTPException96(403, {
         message: "Slack installation unavailable"
       });
     await enqueueNormalizedSlackInteraction(deps, installation, {
@@ -99763,7 +100078,7 @@ function registerSlackInteractionRoutes(app, deps) {
       const prepared = await prepareSlackUserLinkAccessRequest(deps.db, {
         accountId: installation.accountId,
         workspaceId,
-        tokenDigest: createHash29("sha256").update(payload.linkToken).digest("hex"),
+        tokenDigest: createHash30("sha256").update(payload.linkToken).digest("hex"),
         connectionId: link.connectionId,
         slackTeamId: link.slackTeamId,
         slackUserId: link.slackUserId,
@@ -99950,19 +100265,19 @@ function registerSlackInteractionRoutes(app, deps) {
     const linkToken = boundedString(body4?.linkToken, 2048);
     const signingSecret = deps.settings.slackSigningSecret;
     if (!linkToken || !signingSecret) {
-      throw new HTTPException94(400, {
+      throw new HTTPException96(400, {
         message: "invalid or expired Slack identity link"
       });
     }
     const link = verifySlackUserLinkToken(signingSecret, linkToken);
     if (!link || link.workspaceId !== workspaceId) {
-      throw new HTTPException94(400, {
+      throw new HTTPException96(400, {
         message: "invalid or expired Slack identity link"
       });
     }
     const installation = await resolveSlackLinkTargetInstallation(deps, link, workspaceId);
     if (!installation) {
-      throw new HTTPException94(404, {
+      throw new HTTPException96(404, {
         message: "Slack installation not found"
       });
     }
@@ -99970,7 +100285,7 @@ function registerSlackInteractionRoutes(app, deps) {
       const prepared = await prepareSlackUserLinkAccessRequest(deps.db, {
         accountId: grant.accountId,
         workspaceId,
-        tokenDigest: createHash29("sha256").update(linkToken).digest("hex"),
+        tokenDigest: createHash30("sha256").update(linkToken).digest("hex"),
         connectionId: link.connectionId,
         slackTeamId: link.slackTeamId,
         slackUserId: link.slackUserId,
@@ -100003,7 +100318,7 @@ function registerSlackInteractionRoutes(app, deps) {
       const workspaceId = c.req.param("workspaceId");
       await requireAccessGrant46(c, deps, workspaceId, "connections:write");
       const connectionId = boundedString(c.req.query("connectionId"), 64);
-      if (!connectionId) throw new HTTPException94(400, { message: "connectionId is required" });
+      if (!connectionId) throw new HTTPException96(400, { message: "connectionId is required" });
       return c.json({
         deleted: await deleteSlackBotUserLink(
           deps.db,
@@ -100018,7 +100333,7 @@ function registerSlackInteractionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant46(c, deps, workspaceId, "workspace:admin");
     const connectionId = boundedString(c.req.query("connectionId"), 64);
-    if (!connectionId) throw new HTTPException94(400, { message: "connectionId is required" });
+    if (!connectionId) throw new HTTPException96(400, { message: "connectionId is required" });
     const routes = await listSlackChannelRoutes(
       deps.db,
       { accountId: grant.accountId, workspaceId },
@@ -100055,7 +100370,7 @@ function registerSlackInteractionRoutes(app, deps) {
       (candidate) => candidate.connectionId === payload.connectionId
     );
     if (!binding) {
-      throw new HTTPException94(404, { message: "Slack installation not found" });
+      throw new HTTPException96(404, { message: "Slack installation not found" });
     }
     const callerPersonalWorkspaceId = await namedSubjectPersonalWorkspaceId2(deps.db, {
       accountId: grant.accountId,
@@ -100068,13 +100383,13 @@ function registerSlackInteractionRoutes(app, deps) {
         targetAccountId: grant.accountId,
         targetWorkspaceId: route.targetWorkspaceId
       });
-      if (!authorized || !hasPermission23(authorized.permissions, "sessions:create")) {
-        throw new HTTPException94(403, {
+      if (!authorized || !hasPermission24(authorized.permissions, "sessions:create")) {
+        throw new HTTPException96(403, {
           message: `you cannot start work in the workspace chosen for ${route.slackChannelId}`
         });
       }
       if (callerPersonalWorkspaceId !== null && route.targetWorkspaceId === callerPersonalWorkspaceId) {
-        throw new HTTPException94(422, {
+        throw new HTTPException96(422, {
           message: `a channel cannot be routed to a personal workspace: work started in ${route.slackChannelId} would be invisible to everyone else in it`
         });
       }
@@ -100104,7 +100419,7 @@ function registerSlackInteractionRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant46(c, deps, workspaceId, "workspace:admin");
     const connectionId = boundedString(c.req.query("connectionId"), 64);
-    if (!connectionId) throw new HTTPException94(400, { message: "connectionId is required" });
+    if (!connectionId) throw new HTTPException96(400, { message: "connectionId is required" });
     const cursor = boundedString(c.req.query("cursor"), 1024);
     const client = await createOpenGeniSlackBotInteractionClient(deps, {
       accountId: grant.accountId,
@@ -100151,7 +100466,7 @@ async function publishSlackAppHome(deps, installation, refresh, renewLease) {
   const grant = link ? await getWorkspaceGrant4(deps.db, link.subjectId, installation.workspaceId, {
     principalKind: "human_session"
   }) : null;
-  if (!grant || grant.accountId !== installation.accountId || !hasPermission23(grant.permissions, "sessions:read")) {
+  if (!grant || grant.accountId !== installation.accountId || !hasPermission24(grant.permissions, "sessions:read")) {
     const client2 = await createOpenGeniSlackBotInteractionClient(deps, {
       accountId: installation.accountId,
       workspaceId: installation.workspaceId,
@@ -100229,7 +100544,7 @@ async function publishSlackAppHome(deps, installation, refresh, renewLease) {
   const currentGrant = currentLink ? await getWorkspaceGrant4(deps.db, currentLink.subjectId, installation.workspaceId, {
     principalKind: "human_session"
   }) : null;
-  if (!currentLink || currentLink.subjectId !== grant.subjectId || !currentGrant || currentGrant.accountId !== installation.accountId || !hasPermission23(currentGrant.permissions, "sessions:read")) {
+  if (!currentLink || currentLink.subjectId !== grant.subjectId || !currentGrant || currentGrant.accountId !== installation.accountId || !hasPermission24(currentGrant.permissions, "sessions:read")) {
     await publishSlackAppHomeAccessView(
       client,
       refresh,
@@ -100694,7 +101009,7 @@ async function handleSlackRouteChoice(deps, home, entry2, actionId, optionId) {
     targetAccountId: chosen.candidateAccountId,
     targetWorkspaceId: chosen.candidateWorkspaceId
   }) : null;
-  if (!grant || !hasPermission23(grant.permissions, "sessions:create")) {
+  if (!grant || !hasPermission24(grant.permissions, "sessions:create")) {
     await client.postMessage({
       operationId: deterministicUuid2(`slack-route-denied:${prompt.id}:${chosen.id}`),
       userId: entry2.slackUserId,
@@ -100892,7 +101207,7 @@ async function processSlackInboxEntry(deps, entry2) {
     });
     return;
   }
-  if (!hasPermission23(grant.permissions, "sessions:create")) {
+  if (!hasPermission24(grant.permissions, "sessions:create")) {
     throw new SlackInteractionPermanentError("sessions_create_denied");
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
@@ -100955,7 +101270,7 @@ async function processSlackInboxEntry(deps, entry2) {
       }
     );
   } catch (error) {
-    if (error instanceof HTTPException94) {
+    if (error instanceof HTTPException96) {
       await client.postMessage({
         operationId: deterministicUuid2(`slack-admission-failed:${interaction.id}`),
         ...routePolicy.directMessageShortcut ? { userId: entry2.slackUserId } : {
@@ -101222,7 +101537,7 @@ async function processSlackReactionInboxEntry(deps, entry2) {
     if (!resolved) {
       throw new SlackInteractionPermanentError("identity_access_revoked");
     }
-    if (!hasPermission23(resolved.permissions, "sessions:create") || !hasPermission23(resolved.permissions, "sessions:control")) {
+    if (!hasPermission24(resolved.permissions, "sessions:create") || !hasPermission24(resolved.permissions, "sessions:control")) {
       throw new SlackInteractionPermanentError("reaction_session_permissions_denied");
     }
     return resolved;
@@ -101392,7 +101707,7 @@ async function processSlackReactionInboxEntry(deps, entry2) {
     );
     await acceptSlackReactionTask(deps, grant, session.id, preparedEntry, preparedTask.resources);
   } catch (error) {
-    if (error instanceof HTTPException94) {
+    if (error instanceof HTTPException96) {
       await client.postMessage({
         operationId: deterministicUuid2(`slack-reaction-admission-failed:${interaction.id}`),
         channelId: entry2.slackChannelId,
@@ -101692,7 +102007,7 @@ async function continueSlackSession(deps, grant, interaction, entry2, resources
   }
   await reopenSlackInteractionDelivery(deps.db, interaction);
   if (entry2.text.trim().toLowerCase() === "stop") {
-    if (!hasPermission23(grant.permissions, "sessions:control")) {
+    if (!hasPermission24(grant.permissions, "sessions:control")) {
       throw new SlackInteractionPermanentError("sessions_control_denied");
     }
     await controlHumanSessionWorkstream2(
@@ -101753,7 +102068,7 @@ async function continueSlackSession(deps, grant, interaction, entry2, resources
       }
     }
   }
-  if (!hasPermission23(grant.permissions, "sessions:control")) {
+  if (!hasPermission24(grant.permissions, "sessions:control")) {
     throw new SlackInteractionPermanentError("sessions_control_denied");
   }
   await acceptSessionUserMessage2(
@@ -101841,7 +102156,7 @@ async function processSlackBlockAction(deps, entry2) {
     targetAccountId: target.accountId,
     targetWorkspaceId: target.workspaceId
   });
-  if (!grant || !hasPermission23(grant.permissions, "sessions:control")) {
+  if (!grant || !hasPermission24(grant.permissions, "sessions:control")) {
     throw new SlackInteractionPermanentError("sessions_control_denied");
   }
   const client = await createOpenGeniSlackBotInteractionClient(deps, {
@@ -102032,7 +102347,7 @@ async function executeSlackAction(deps, grant, interaction, handle) {
   }
   const session = await getSession11(deps.db, grant.workspaceId, handle.sessionId);
   if (!session) throw new SlackInteractionPermanentError("slack_action_session_missing");
-  const recurring = hasPermission23(grant.permissions, "sessions:read") && hasPermission23(grant.permissions, "scheduled_tasks:manage") ? makeRecurringText(deps, grant.workspaceId, handle.sessionId) : null;
+  const recurring = hasPermission24(grant.permissions, "sessions:read") && hasPermission24(grant.permissions, "scheduled_tasks:manage") ? makeRecurringText(deps, grant.workspaceId, handle.sessionId) : null;
   return {
     result: "status",
     text: `${mention}OpenGeni task status: *${session.status.replaceAll("_", " ")}*.${recurring ? `
@@ -102789,12 +103104,12 @@ async function enqueueNormalizedSlackInteraction(deps, route, entry2) {
 async function readSignedSlackRequest(c, deps) {
   const signingSecret = deps.settings.slackSigningSecret;
   if (!signingSecret)
-    throw new HTTPException94(503, {
+    throw new HTTPException96(503, {
       message: "Slack interactions are disabled"
     });
   const rawBytes = new Uint8Array(await c.req.raw.arrayBuffer());
   if (rawBytes.byteLength === 0 || rawBytes.byteLength > SLACK_INTERACTION_MAX_BODY_BYTES) {
-    throw new HTTPException94(rawBytes.byteLength > SLACK_INTERACTION_MAX_BODY_BYTES ? 413 : 400, {
+    throw new HTTPException96(rawBytes.byteLength > SLACK_INTERACTION_MAX_BODY_BYTES ? 413 : 400, {
       message: "invalid Slack request body"
     });
   }
@@ -102807,7 +103122,7 @@ async function readSignedSlackRequest(c, deps) {
     },
     signingSecret
   )) {
-    throw new HTTPException94(401, { message: "invalid Slack signature" });
+    throw new HTTPException96(401, { message: "invalid Slack signature" });
   }
   return { rawBody };
 }
@@ -102818,7 +103133,7 @@ function normalizedFormInteraction(form, triggerKind) {
   const triggerId = boundedString(form.get("trigger_id"), 256);
   const text = boundedText(form.get("text"));
   if (!teamId || !userId || !channelId || !triggerId || !text) {
-    throw new HTTPException94(400, { message: "invalid Slack command payload" });
+    throw new HTTPException96(400, { message: "invalid Slack command payload" });
   }
   return {
     providerEventId: `command:${triggerId}`,
@@ -102861,9 +103176,9 @@ function normalizedBlockActionInteraction(payload) {
   const actionId = boundedString(action?.action_id, 128);
   const handleId = boundedString(action?.value, 64);
   if (!teamId || !userId || !channelId || !messageTs || !actionTs || !actionId || !SLACK_BLOCK_ACTION_IDS.has(actionId) || !handleId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(handleId) || !Array.isArray(payload.actions) || payload.actions.length !== 1) {
-    throw new HTTPException94(400, { message: "invalid Slack block action" });
+    throw new HTTPException96(400, { message: "invalid Slack block action" });
   }
-  const identity = createHash29("sha256").update([teamId, userId, channelId, messageTs, actionTs, actionId, handleId].join("\n")).digest("hex");
+  const identity = createHash30("sha256").update([teamId, userId, channelId, messageTs, actionTs, actionId, handleId].join("\n")).digest("hex");
   return {
     providerEventId: `block:${identity}`,
     providerMessageId: `block:${identity}`,
@@ -102928,7 +103243,7 @@ async function slackInfoCommandResponse(deps, installation, entry2) {
   const grant = link ? await getWorkspaceGrant4(deps.db, link.subjectId, installation.workspaceId, {
     principalKind: "human_session"
   }) : null;
-  if (!grant || grant.accountId !== installation.accountId || !hasPermission23(grant.permissions, "sessions:read")) {
+  if (!grant || grant.accountId !== installation.accountId || !hasPermission24(grant.permissions, "sessions:read")) {
     return ephemeralSlackResponse(
       link ? `Your Slack identity is linked, but it does not currently have access to this OpenGeni workspace. Request access: ${linkUrl(deps, identity)}. No session was created.` : `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, identity)}. No session was created.`
     );
@@ -102936,9 +103251,9 @@ async function slackInfoCommandResponse(deps, installation, entry2) {
   const workspace = await getWorkspace6(deps.db, installation.workspaceId);
   const command = deps.settings.slackCommand;
   const botMention = slackBotMention(installation.botUserId);
-  const canControl = hasPermission23(grant.permissions, "sessions:control");
-  const canCreate = hasPermission23(grant.permissions, "sessions:create");
-  const schedules = hasPermission23(grant.permissions, "scheduled_tasks:manage") ? slackSchedulesUrl(deps, installation.workspaceId) : null;
+  const canControl = hasPermission24(grant.permissions, "sessions:control");
+  const canCreate = hasPermission24(grant.permissions, "sessions:create");
+  const schedules = hasPermission24(grant.permissions, "scheduled_tasks:manage") ? slackSchedulesUrl(deps, installation.workspaceId) : null;
   const workspaceUrl = slackWorkspaceUrl(deps, installation.workspaceId);
   const workspaceName = (workspace?.name ?? "").trim().slice(0, 120);
   const destination = workspaceName ? `the *${escapeSlackMrkdwn(workspaceName)}* workspace` : "your OpenGeni workspace";
@@ -103051,29 +103366,29 @@ function linkUrl(deps, entry2, mintedAtMs) {
 }
 async function requireManagedSlackLinkHuman(c, deps) {
   if (c.req.header("authorization")) {
-    throw new HTTPException94(401, { message: "managed browser sign-in required" });
+    throw new HTTPException96(401, { message: "managed browser sign-in required" });
   }
   const context = await requireAccessContext5(c, deps);
   if (context.mode !== "managed" || !context.subjectId.startsWith("user:")) {
-    throw new HTTPException94(403, { message: "managed browser sign-in required" });
+    throw new HTTPException96(403, { message: "managed browser sign-in required" });
   }
   return context;
 }
 function freshSlackLinkRequired() {
-  return new HTTPException94(400, {
+  return new HTTPException96(400, {
     message: "This Slack link is invalid or expired. Request a fresh link from Slack."
   });
 }
 function slackLinkAccessHttpError(error) {
-  if (error instanceof HTTPException94) return error;
+  if (error instanceof HTTPException96) return error;
   if (!(error instanceof SlackUserLinkAccessPersistenceError)) throw error;
   if (error.code === "version_conflict" || error.code === "idempotency_conflict") {
-    return new HTTPException94(409, {
+    return new HTTPException96(409, {
       message: "The Slack access request changed. Refresh and try again."
     });
   }
   if (error.code === "state_conflict") {
-    return new HTTPException94(409, {
+    return new HTTPException96(409, {
       message: "This Slack link is no longer pending. Request a fresh link from Slack."
     });
   }
@@ -103128,7 +103443,7 @@ function usesPrivateBotDm(interaction, entry2) {
   return isDirectMessageShortcut(entry2) || interaction.visibility === "private" && entry2.triggerKind !== "dm";
 }
 function deterministicUuid2(value) {
-  const bytes = createHash29("sha256").update(value).digest().subarray(0, 16);
+  const bytes = createHash30("sha256").update(value).digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
   const hex2 = bytes.toString("hex");
@@ -103141,7 +103456,7 @@ function parseJsonObject(value) {
     if (result) return result;
   } catch {
   }
-  throw new HTTPException94(400, { message: "invalid Slack JSON payload" });
+  throw new HTTPException96(400, { message: "invalid Slack JSON payload" });
 }
 function record5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -103171,7 +103486,7 @@ function safeErrorCode(error) {
   if (error instanceof SlackBotProviderError) return error.code.slice(0, 128);
   if (error instanceof SlackInteractionPermanentError) return error.code.slice(0, 128);
   if (error instanceof SlackInteractionRetryableError) return error.code.slice(0, 128);
-  if (error instanceof HTTPException94) return `http_${error.status}`;
+  if (error instanceof HTTPException96) return `http_${error.status}`;
   const raw = error instanceof Error ? error.name : "slack_interaction_error";
   return raw.toLowerCase().replace(/[^a-z0-9_-]/g, "_").slice(0, 128) || "error";
 }
@@ -103199,7 +103514,7 @@ var SlackInteractionRetryableError = class extends Error {
   }
 };
 function permanentSlackInteractionError(error) {
-  return error instanceof SlackInteractionPermanentError || error instanceof HTTPException94;
+  return error instanceof SlackInteractionPermanentError || error instanceof HTTPException96;
 }
 var PERMANENT_SLACK_DELIVERY_CODES = /* @__PURE__ */ new Set([
   "account_inactive",
@@ -103299,7 +103614,7 @@ function createAppComposition(deps) {
       authoritySubjectId
     }) => {
       if (!objectStorage) {
-        throw new HTTPException95(503, {
+        throw new HTTPException97(503, {
           message: "object storage is not configured"
         });
       }
@@ -103557,7 +103872,7 @@ function createAppComposition(deps) {
       } catch (error) {
         if (error instanceof ManagedAuthActorChangeError2) {
           c.header("x-opengeni-actor-state", "changed");
-          throw new HTTPException95(409, { message: error.code, cause: error });
+          throw new HTTPException97(409, { message: error.code, cause: error });
         }
         if (error instanceof ManagedAuthActorLeaseOutcomeUnknownError) {
           throw new ApiHttpError(503, {
@@ -103602,7 +103917,7 @@ function createAppComposition(deps) {
           deps.settings.publicBaseUrl
         );
         if (!attempt || !authority || attempt.authorityHash !== managedAuthSha2562(authority)) {
-          throw new HTTPException95(409, { message: "provider_route_blocked" });
+          throw new HTTPException97(409, { message: "provider_route_blocked" });
         }
         const isolated = await isolatedManagedAuthOAuthCallbackRequest(managedAuth, c.req.raw);
         preserveCookieNames = [isolated.stateCookieName];
@@ -103816,7 +104131,7 @@ function createAppComposition(deps) {
       boundedRequest = await boundedMcpRequest(c.req.raw);
     } catch (error) {
       if (error instanceof McpPayloadTooLargeError) {
-        throw new HTTPException95(413, {
+        throw new HTTPException97(413, {
           message: "MCP request body exceeds the safety limit"
         });
       }
@@ -103826,7 +104141,7 @@ function createAppComposition(deps) {
     try {
       oauthAccess = await resolveMcpOAuthRouteAccess(routeDeps, c.req.raw, workspaceId);
     } catch (error) {
-      if (error instanceof HTTPException95 && error.status === 401) {
+      if (error instanceof HTTPException97 && error.status === 401) {
         c.header(
           "www-authenticate",
           mcpOAuthAuthenticateHeader(routeDeps, new URL(c.req.url).pathname)
@@ -103861,7 +104176,7 @@ function createAppComposition(deps) {
     try {
       authorization = await requireMcpAccessGrantAuthorization(c, routeDeps, workspaceId);
     } catch (error) {
-      if (deps.settings.mcpOauthEnabled && error instanceof HTTPException95 && error.status === 401) {
+      if (deps.settings.mcpOauthEnabled && error instanceof HTTPException97 && error.status === 401) {
         c.header(
           "www-authenticate",
           mcpOAuthAuthenticateHeader(routeDeps, new URL(c.req.url).pathname)
@@ -103874,17 +104189,17 @@ function createAppComposition(deps) {
       const boundSessionId = grant.metadata?.sessionId;
       if (typeof boundSessionId === "string") {
         try {
-          await requireSessionAuthorization15(routeDeps, grant, {
+          await requireSessionAuthorization16(routeDeps, grant, {
             sessionId: boundSessionId,
             operation: "session.first_party_mcp.call",
             surface: "first_party_mcp"
           });
         } catch (error) {
-          if (error instanceof SessionAuthorizationDeniedError16) {
-            throw new HTTPException95(404, { message: "session not found" });
+          if (error instanceof SessionAuthorizationDeniedError17) {
+            throw new HTTPException97(404, { message: "session not found" });
           }
-          if (error instanceof SessionAuthorizationUnavailableError14) {
-            throw new HTTPException95(503, {
+          if (error instanceof SessionAuthorizationUnavailableError15) {
+            throw new HTTPException97(503, {
               message: "session authorization is unavailable"
             });
           }
@@ -103930,7 +104245,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/tools/catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization36(
+    const authorization = await requireAccessGrantAuthorization37(
       c,
       routeDeps,
       workspaceId,
@@ -103946,7 +104261,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/tools/calls", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization36(
+    const authorization = await requireAccessGrantAuthorization37(
       c,
       routeDeps,
       workspaceId,
@@ -103955,7 +104270,7 @@ function createAppComposition(deps) {
     const grant = authorization.grant;
     const parsed = ToolGatewayCallRequest2.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException95(400, { message: "Invalid tool gateway call" });
+      throw new HTTPException97(400, { message: "Invalid tool gateway call" });
     }
     const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
     try {
@@ -103975,7 +104290,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/tools/approvals", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization36(
+    const authorization = await requireAccessGrantAuthorization37(
       c,
       routeDeps,
       workspaceId,
@@ -103983,7 +104298,7 @@ function createAppComposition(deps) {
     );
     const parsed = ToolGatewayApprovalRequest2.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException95(400, { message: "Invalid tool gateway approval" });
+      throw new HTTPException97(400, { message: "Invalid tool gateway approval" });
     }
     const prepared = await prepareWorkspaceToolGateway(routeDeps, authorization);
     try {
@@ -104004,7 +104319,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/tools/declarations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization36(
+    const authorization = await requireAccessGrantAuthorization37(
       c,
       routeDeps,
       workspaceId,
@@ -104040,7 +104355,7 @@ function createAppComposition(deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant47(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
-      throw new HTTPException95(403, { message: "Codemode access denied" });
+      throw new HTTPException97(403, { message: "Codemode access denied" });
     }
     try {
       return c.json((await requireActiveCodemodeCatalog(routeDeps, grant)).catalog);
@@ -104052,11 +104367,11 @@ function createAppComposition(deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant47(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
-      throw new HTTPException95(403, { message: "Codemode access denied" });
+      throw new HTTPException97(403, { message: "Codemode access denied" });
     }
     const parsed = CodemodeCallRequest2.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
-      throw new HTTPException95(400, { message: "Invalid Codemode call" });
+      throw new HTTPException97(400, { message: "Invalid Codemode call" });
     }
     try {
       const submission = await submitAndDispatchCodemodeCall(routeDeps, grant, parsed.data);
@@ -104072,17 +104387,17 @@ function createAppComposition(deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant47(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
-      throw new HTTPException95(403, { message: "Codemode access denied" });
+      throw new HTTPException97(403, { message: "Codemode access denied" });
     }
     try {
       const operation = await readCodemodeOperation(routeDeps, grant, c.req.param("operationId"));
       if (!operation)
-        throw new HTTPException95(404, {
+        throw new HTTPException97(404, {
           message: "Codemode operation not found"
         });
       return c.json(operation);
     } catch (error) {
-      if (error instanceof HTTPException95) throw error;
+      if (error instanceof HTTPException97) throw error;
       throw codemodeHttpError(error);
     }
   });
@@ -104108,6 +104423,7 @@ function createAppComposition(deps) {
   registerWorkspaceStateRoutes(app, routeDeps);
   registerMemorySlackPublicationRoutes(app, routeDeps);
   registerWorkspaceArtifactRoutes(app, routeDeps);
+  registerArtifactCatalogRoutes(app, routeDeps);
   registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
   registerPersonalGitHubRoutes(app, routeDeps);
@@ -104196,7 +104512,7 @@ function managedAuthOAuthCallbackProvider(pathname) {
 }
 function mutationOutcomeUnknown(error, method) {
   if (method === "GET" || method === "HEAD" || method === "OPTIONS") return false;
-  const cause = error instanceof HTTPException95 ? error.cause : error;
+  const cause = error instanceof HTTPException97 ? error.cause : error;
   return cause instanceof BrowserControlTransportError5 || cause instanceof BrowserControlProtocolError3;
 }
 function appendVary(current, value) {
@@ -104225,15 +104541,15 @@ function workspaceRequestRequiresCodexAccountPrevalidation(request) {
 async function validateCodexAccountTarget(request) {
   const body4 = await request.clone().json().catch(() => null);
   if (typeof body4?.target !== "string" || body4.target.length === 0) {
-    throw new HTTPException95(400, {
+    throw new HTTPException97(400, {
       message: 'target is required ("auto" or an account id)'
     });
   }
 }
 async function requireMcpAccessGrantAuthorization(c, deps, workspaceId) {
-  const authorization = await requireAccessGrantAuthorization36(c, deps, workspaceId);
+  const authorization = await requireAccessGrantAuthorization37(c, deps, workspaceId);
   const grant = authorization.grant;
-  if (hasPermission24(grant.permissions, "workspace:read")) {
+  if (hasPermission25(grant.permissions, "workspace:read")) {
     return authorization;
   }
   if (isCodemodeGrant(grant)) {
@@ -104274,16 +104590,16 @@ function clientAuthConfig(settings) {
 }
 function codemodeHttpError(error) {
   if (error instanceof SiteSessionPathError) {
-    return new HTTPException95(404, { message: error.message, cause: error });
+    return new HTTPException97(404, { message: error.message, cause: error });
   }
-  if (error instanceof SessionAuthorizationDeniedError16) {
-    return new HTTPException95(404, {
+  if (error instanceof SessionAuthorizationDeniedError17) {
+    return new HTTPException97(404, {
       message: "session not found",
       cause: error
     });
   }
-  if (error instanceof SessionAuthorizationUnavailableError14) {
-    return new HTTPException95(503, {
+  if (error instanceof SessionAuthorizationUnavailableError15) {
+    return new HTTPException97(503, {
       message: "session authorization is unavailable",
       cause: error
     });
@@ -104316,21 +104632,21 @@ function codemodeHttpError(error) {
     });
   }
   if (error instanceof CodemodeOperationNotExecutableError) {
-    return new HTTPException95(409, { message: error.message, cause: error });
+    return new HTTPException97(409, { message: error.message, cause: error });
   }
   if (error instanceof CodemodeOperationConflictError) {
-    return new HTTPException95(409, { message: error.message, cause: error });
+    return new HTTPException97(409, { message: error.message, cause: error });
   }
   if (error instanceof CodemodeToolNotInCatalogError) {
-    return new HTTPException95(404, { message: error.message, cause: error });
+    return new HTTPException97(404, { message: error.message, cause: error });
   }
   if (error instanceof CodemodeToolApprovalRequiredError) {
-    return new HTTPException95(409, { message: error.message, cause: error });
+    return new HTTPException97(409, { message: error.message, cause: error });
   }
   if (error instanceof CodemodePayloadTooLargeError) {
-    return new HTTPException95(413, { message: error.message, cause: error });
+    return new HTTPException97(413, { message: error.message, cause: error });
   }
-  return error instanceof HTTPException95 ? error : new HTTPException95(500, {
+  return error instanceof HTTPException97 ? error : new HTTPException97(500, {
     message: "Codemode request failed",
     cause: error
   });
@@ -104359,7 +104675,7 @@ function structuredServicesHint(backend) {
 }
 function codexCompactionV2ProviderLockedError(error) {
   if (error instanceof CodexCompactionV2ProviderLockedError) return error;
-  if (error instanceof HTTPException95 && error.cause instanceof CodexCompactionV2ProviderLockedError) {
+  if (error instanceof HTTPException97 && error.cause instanceof CodexCompactionV2ProviderLockedError) {
     return error.cause;
   }
   return null;
@@ -104373,7 +104689,7 @@ function httpStatusForError(error) {
   if (workspaceControlBusyHttpError(error)) {
     return 503;
   }
-  if (error instanceof HTTPException95) {
+  if (error instanceof HTTPException97) {
     return error.status;
   }
   if (error instanceof McpPayloadTooLargeError) {
@@ -104405,7 +104721,7 @@ function publicErrorMessage(error, status) {
   if (status >= 500) {
     return "OpenGeni could not complete the request.";
   }
-  if (error instanceof HTTPException95) {
+  if (error instanceof HTTPException97) {
     return boundedPublicMessage(error.message) ?? "Request failed.";
   }
   if (error instanceof McpPayloadTooLargeError) {
@@ -105379,4 +105695,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-K2NU4KRK.js.map
+//# sourceMappingURL=chunk-AJ62T5QN.js.map