@opengeni/api-router 4.1.0 → 4.1.2-canary.36079201993001

package/dist/{chunk-24C5LPNE.js → chunk-PTO4RZT5.js}

@@ -294,6 +294,8 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
   browser_open: { sessionRequired: true, allOf: ["sessions:control"] },
   browser_tabs: { sessionRequired: true, allOf: ["sessions:control"] },
   browser_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_read: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_screenshot: { sessionRequired: true, allOf: ["sessions:read"] },
   browser_act: { sessionRequired: true, allOf: ["sessions:control"] },
   browser_clipboard: { sessionRequired: true, allOf: ["sessions:read"] },
   browser_debug: { sessionRequired: true, allOf: ["sessions:read"] },
@@ -329,6 +331,10 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
     sessionRequired: true,
     allOf: ["workspace:read"]
   },
+  custom_mcp_setup_request: {
+    sessionRequired: true,
+    allOf: ["workspace:read"]
+  },
   github_connect_link: { allOf: ["github:use"] },
   github_repositories_list: { allOf: ["github:use"] },
   social_connections_list: { allOf: ["connections:read"] },
@@ -4600,6 +4606,9 @@ var Name = class {
     return new SQL([this]);
   }
 };
+function isDriverValueEncoder(value) {
+  return typeof value === "object" && value !== null && "mapToDriverValue" in value && typeof value.mapToDriverValue === "function";
+}
 var noopDecoder = {
   mapFromDriverValue: (value) => value
 };
@@ -4732,6 +4741,33 @@ Subquery.prototype.getSQL = function() {
   return new SQL([this]);
 };
 
+// ../../node_modules/.bun/drizzle-orm@0.45.2+1d2c014f134ec9f4/node_modules/drizzle-orm/sql/expressions/conditions.js
+function bindIfParam(value, column) {
+  if (isDriverValueEncoder(column) && !isSQLWrapper(value) && !is(value, Param) && !is(value, Placeholder) && !is(value, Column) && !is(value, Table) && !is(value, View)) {
+    return new Param(value, column);
+  }
+  return value;
+}
+var eq = (left, right) => {
+  return sql`${left} = ${bindIfParam(right, left)}`;
+};
+function and(...unfilteredConditions) {
+  const conditions = unfilteredConditions.filter(
+    (c) => c !== void 0
+  );
+  if (conditions.length === 0) {
+    return void 0;
+  }
+  if (conditions.length === 1) {
+    return new SQL(conditions);
+  }
+  return new SQL([
+    new StringChunk("("),
+    sql.join(conditions, new StringChunk(" and ")),
+    new StringChunk(")")
+  ]);
+}
+
 // src/auth/managed-auth.ts
 import { Pool } from "pg";
 
@@ -7598,7 +7634,14 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
       inputSchema: KnowledgeSavePreparationRequest.shape
     },
     (input) => run(
-      (context) => prepareKnowledgeSave(deps.db, context, input, () => deps.getDocumentServices().embedder)
+      (context) => prepareKnowledgeSave(
+        deps.db,
+        context,
+        input,
+        () => deps.getDocumentServices().embedder,
+        void 0,
+        deps.settings
+      )
     )
   );
   server.registerTool(
@@ -7613,7 +7656,13 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
       }).extend({ view: z8.enum(["published", "needs_review"]).default("published") }).shape
     },
     (input) => run(
-      (context) => searchKnowledgeEntries(deps.db, context, input, () => deps.getDocumentServices().embedder)
+      (context) => searchKnowledgeEntries(
+        deps.db,
+        context,
+        input,
+        () => deps.getDocumentServices().embedder,
+        deps.settings
+      )
     )
   );
   server.registerTool(
@@ -7901,26 +7950,26 @@ async function listWorkspaceGitHubRepositoryBranches(deps, input, services = wor
   ])) {
     throw new GitHubRepositoryBranchAuthorityError("changed");
   }
-  const page = await services.listProviderBranches(deps, {
+  const page2 = await services.listProviderBranches(deps, {
     installationId: input.installationId,
     repositoryId: input.repositoryId,
     page: input.query.cursor,
     limit: input.query.limit
   });
-  if (!page) {
+  if (!page2) {
     throw new GitHubAppApiError(
       "The configured GitHub provider cannot list exact repository branches"
     );
   }
-  if (page.installationId !== input.installationId || page.repositoryId !== input.repositoryId || page.branches.length > input.query.limit || page.nextPage !== null && page.nextPage !== input.query.cursor + 1 || page.branches.length < input.query.limit && page.nextPage !== null) {
+  if (page2.installationId !== input.installationId || page2.repositoryId !== input.repositoryId || page2.branches.length > input.query.limit || page2.nextPage !== null && page2.nextPage !== input.query.cursor + 1 || page2.branches.length < input.query.limit && page2.nextPage !== null) {
     throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
   }
   const response = GitHubRepositoryBranchesResponseSchema.safeParse({
-    branches: page.branches.map((name) => ({
+    branches: page2.branches.map((name) => ({
       name,
-      isDefault: name === page.defaultBranch
+      isDefault: name === page2.defaultBranch
     })),
-    nextCursor: page.nextPage
+    nextCursor: page2.nextPage
   });
   if (!response.success) {
     throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
@@ -8009,6 +8058,11 @@ import {
 } from "@opengeni/db";
 import { retryWhileMissing as retryWhileMissing4 } from "@opengeni/storage";
 import { HTTPException as HTTPException12 } from "hono/http-exception";
+import {
+  isConnectedMachineAbsolutePath,
+  relativeConnectedMachinePath,
+  resolveConnectedMachinePath
+} from "@opengeni/runtime/sandbox";
 
 // src/sandbox/channel-a.ts
 import {
@@ -8016,6 +8070,7 @@ import {
   hasGitCredentialRepositorySelection,
   hasGitHubRepositorySelection,
   sandboxLifecycleTransitionWaitMs,
+  sandboxWarmRateMicrosPerSecond,
   stableSandboxEnvironmentForRun
 } from "@opengeni/config";
 import { githubAppBotIdentity } from "@opengeni/github";
@@ -8034,6 +8089,7 @@ import {
   SandboxImageConflictError,
   SandboxProviderReadLockUnavailableError,
   SandboxRigConflictError,
+  SandboxPaidComputeAdmissionError,
   withSandboxProviderReadLock
 } from "@opengeni/db";
 import { appendAndPublishEvents } from "@opengeni/events";
@@ -8853,6 +8909,10 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
       holderId,
       subjectId: session.id,
       backend: session.sandboxBackend,
+      warmBilling: {
+        mode: settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond(settings, session.sandboxBackend)
+      },
       os: session.sandboxOs,
       image: sandboxRuntime.image,
       rigVersionId: session.rigVersionId,
@@ -9153,6 +9213,8 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
 }
 function mapChannelAError(error, waitSignal) {
   if (error instanceof HTTPException6) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError)
+    return new HTTPException6(402, { message: error.message, cause: error });
   if (isChannelARequestCancellation(error, waitSignal))
     return new HTTPException6(499, {
       message: "request cancelled",
@@ -9335,6 +9397,7 @@ import {
   retainedGeneratedImageReferenceFromFile,
   retainedGeneratedVideoReferenceFromFile,
   retainedScreenshotReferenceFromFile,
+  retainedSessionScreenshotKindFromObjectKey,
   VideoArtifactPlaybackSource,
   resolveRetainedOutputRange
 } from "@opengeni/contracts";
@@ -9631,7 +9694,13 @@ function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, o
         {
           type: "text",
           text: JSON.stringify(
-            await searchKnowledgeEntries2(db, context, input, () => documentServices.embedder)
+            await searchKnowledgeEntries2(
+              db,
+              context,
+              input,
+              () => documentServices.embedder,
+              options.settings
+            )
           )
         }
       ]
@@ -9917,7 +9986,8 @@ async function prepareWorkspaceToolGatewayForGrantInternal(routeDeps, grant, all
           grant.workspaceId,
           routeDeps.getDocumentServices(),
           {
-            knowledge: await knowledgeContextForGateway(routeDeps, grant)
+            knowledge: await knowledgeContextForGateway(routeDeps, grant),
+            settings: gatewaySettings
           }
         )
       )
@@ -11718,12 +11788,15 @@ function retainedGeneratedImageMetadata(artifact) {
 }
 function retainedScreenshotMetadata(artifact) {
   if (artifact.status === "ready" && artifact.sessionId && artifact.retentionExpiresAt.getTime() > Date.now()) {
+    const kind = retainedSessionScreenshotKindFromObjectKey(artifact.file.objectKey);
+    if (!kind) return retainedArtifactUnavailable(artifact.artifactId, "invalid_content");
     const reference = retainedScreenshotReferenceFromFile({
       ...artifact.file,
       sessionId: artifact.sessionId,
       width: artifact.width,
       height: artifact.height,
-      expiresAt: artifact.retentionExpiresAt.toISOString()
+      expiresAt: artifact.retentionExpiresAt.toISOString(),
+      kind
     });
     if (reference) return reference;
   }
@@ -11798,13 +11871,12 @@ async function publishSandboxFileArtifactInScope(deps, input) {
       message: "object storage cannot verify immutable artifact files"
     });
   }
-  const path = sandboxArtifactRelativePath(input.path);
   const maxArtifactBytes = Math.min(SANDBOX_FILE_ARTIFACT_MAX_BYTES, storage.maxSinglePutSizeBytes);
   if (maxArtifactBytes < 1) {
     throw new HTTPException12(503, { message: "object storage cannot accept artifact files" });
   }
   const readLimit = Math.min(25 * 1024 * 1024, maxArtifactBytes + FILE_READ_SENTINEL_BYTES);
-  const read = await withChannelARead(
+  const { path, sandboxPath, read } = await withChannelARead(
     {
       db: deps.db,
       settings: deps.settings,
@@ -11819,7 +11891,7 @@ async function publishSandboxFileArtifactInScope(deps, input) {
       ...input.signal ? { waitSignal: input.signal } : {},
       operation: "artifact.publish"
     },
-    ({ service }) => service.fsRead({ path, encoding: "base64", maxBytes: readLimit })
+    ({ service }) => readSandboxArtifactFile(service, input.path, readLimit)
   );
   if (read.truncated || read.sizeBytes > maxArtifactBytes) {
     throw new HTTPException12(413, {
@@ -11929,42 +12001,46 @@ async function publishSandboxFileArtifactInScope(deps, input) {
   });
   return SandboxFileArtifactReceipt.parse({
     type: "sandbox_file",
-    sandboxPath: `/workspace/${path}`,
+    sandboxPath,
     filename,
     artifact
   });
 }
-function sandboxArtifactRelativePath(value) {
+async function readSandboxArtifactFile(service, value, maxBytes) {
+  const root2 = service.capabilities().FileSystem.root;
+  const path = sandboxArtifactRelativePath(value, root2);
+  const sandboxPath = resolveConnectedMachinePath(root2, path);
+  const read = await service.fsRead({ path, encoding: "base64", maxBytes });
+  return { path, sandboxPath, read };
+}
+function sandboxArtifactRelativePath(value, workspaceRoot = "/workspace") {
   let path = value.trim();
   if (path.startsWith("sandbox:")) {
     path = path.slice("sandbox:".length);
   }
-  if (path === "/workspace" || path === "/workspace/") {
+  if (!path || /[\\/]$/.test(path)) {
     throw new HTTPException12(400, { message: "sandbox artifact path must name a file" });
   }
-  if (path.startsWith("/workspace/")) {
-    path = path.slice("/workspace/".length);
-  } else if (path.startsWith("/")) {
+  let absolute;
+  let relative;
+  try {
+    if (!isConnectedMachineAbsolutePath(workspaceRoot)) throw new Error("Missing workspace root");
+    absolute = resolveConnectedMachinePath(workspaceRoot, path);
+    relative = relativeConnectedMachinePath(workspaceRoot, absolute);
+  } catch {
     throw new HTTPException12(400, {
-      message: "sandbox artifact path must be inside /workspace"
+      message: "sandbox artifact path is invalid for this workspace"
     });
   }
-  if (!path) {
-    throw new HTTPException12(400, { message: "sandbox artifact path must name a file" });
-  }
-  if (path.includes("\0")) {
-    throw new HTTPException12(400, { message: "sandbox artifact path is invalid" });
-  }
-  const normalized = posix.normalize(path);
-  if (normalized === "." || normalized === ".." || normalized.startsWith("../") || normalized.endsWith("/")) {
+  if (!relative) {
     throw new HTTPException12(400, {
-      message: "sandbox artifact path must canonically name a file inside /workspace"
+      message: "sandbox artifact path must name a file inside the active workspace root"
     });
   }
-  if (`/workspace/${normalized}`.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
+  if (absolute.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
     throw new HTTPException12(400, { message: "sandbox artifact path is too long" });
   }
-  return normalized;
+  return relative;
 }
 function sandboxArtifactSafeFilename(filename) {
   return sanitizeFilename(filename).slice(0, SANDBOX_ARTIFACT_SAFE_FILENAME_MAX_CHARS);
@@ -15624,16 +15700,16 @@ function capEventPayload(event, perFieldChars) {
 function prettyJsonBytes(value) {
   return Buffer.byteLength(JSON.stringify(value, null, 2), "utf8");
 }
-function setMeasuredBytes(page) {
-  let measured = page.bytes;
+function setMeasuredBytes(page2) {
+  let measured = page2.bytes;
   for (let attempt = 0; attempt < 8; attempt += 1) {
-    page.bytes = measured;
-    const next = prettyJsonBytes(page);
+    page2.bytes = measured;
+    const next = prettyJsonBytes(page2);
     if (next === measured) return next;
     measured = next;
   }
-  page.bytes = measured;
-  return prettyJsonBytes(page);
+  page2.bytes = measured;
+  return prettyJsonBytes(page2);
 }
 function boundSessionEventMcpPage(input) {
   const maxBytes = Math.max(8 * 1024, input.maxBytes ?? SESSION_EVENT_MCP_MAX_BYTES);
@@ -15655,7 +15731,7 @@ function boundSessionEventMcpPage(input) {
     if (modelRowsDropped) reasons.push("model_bytes");
     const nextAfter = input.direction === "after" ? last ?? input.after : null;
     const nextBefore = input.direction === "before" ? first ?? input.before : null;
-    const page2 = {
+    const page3 = {
       mode: input.mode,
       payloadMode: input.payloadMode,
       direction: input.direction,
@@ -15675,20 +15751,20 @@ function boundSessionEventMcpPage(input) {
       bytes: 0,
       maxBytes
     };
-    setMeasuredBytes(page2);
-    return page2;
+    setMeasuredBytes(page3);
+    return page3;
   };
-  let page = build();
-  while (page.bytes > maxBytes && events.length > 0) {
+  let page2 = build();
+  while (page2.bytes > maxBytes && events.length > 0) {
     if (input.direction === "before") events.shift();
     else events.pop();
     modelRowsDropped = true;
-    page = build();
+    page2 = build();
   }
-  if (page.bytes > maxBytes) {
+  if (page2.bytes > maxBytes) {
     throw new RangeError(`Session-event MCP metadata exceeds its ${maxBytes}-byte envelope`);
   }
-  return page;
+  return page2;
 }
 function modelStringProjection(value, maxBytes) {
   const originalBytes = Buffer.byteLength(value, "utf8");
@@ -16145,9 +16221,9 @@ function boundRigDetailMcp(rig, versionsPage, changesPage, maxBytes = RIG_DETAIL
 }
 
 // src/mcp/child-read-evidence.ts
-function completeChildReadSequences(page) {
-  if (!page.sourceExact || !["conversation", "results"].includes(page.view)) return [];
-  return page.events.filter((event) => {
+function completeChildReadSequences(page2) {
+  if (!page2.sourceExact || !["conversation", "results"].includes(page2.view)) return [];
+  return page2.events.filter((event) => {
     if (event.sourceOmitted) return false;
     if (event.fragment === void 0) return true;
     if (!event.fragment || typeof event.fragment !== "object") return false;
@@ -17042,7 +17118,7 @@ function boundScheduledTaskMcpPage(input) {
     const rowsDroppedForBytes = droppedTasks.length > 0;
     const hasMore = input.sourceHasMore || rowsDroppedForBytes;
     const nextOffset = hasMore && input.tasks.length > 0 ? input.offset + input.tasks.length : null;
-    const page2 = {
+    const page3 = {
       tasks: summaries,
       page: {
         limit: input.limit,
@@ -17070,20 +17146,20 @@ function boundScheduledTaskMcpPage(input) {
       }
     };
     settleMeasuredBytes(
-      page2,
-      () => page2.projection.bytes,
+      page3,
+      () => page3.projection.bytes,
       (bytes) => {
-        page2.projection.bytes = bytes;
+        page3.projection.bytes = bytes;
       }
     );
-    return page2;
+    return page3;
   };
-  let page = build();
-  while (page.projection.bytes > maxBytes && summaries.length > 0) {
+  let page2 = build();
+  while (page2.projection.bytes > maxBytes && summaries.length > 0) {
     summaries = summaries.slice(0, -1);
-    page = build();
+    page2 = build();
   }
-  return page;
+  return page2;
 }
 
 // src/sandbox/viewer.ts
@@ -17094,6 +17170,7 @@ import {
   hasGitHubRepositorySelection as hasGitHubRepositorySelection2,
   resolveStreamTokenSecret,
   sandboxLifecycleTransitionWaitMs as sandboxLifecycleTransitionWaitMs2,
+  sandboxWarmRateMicrosPerSecond as sandboxWarmRateMicrosPerSecond2,
   stableSandboxEnvironmentForRun as stableSandboxEnvironmentForRun2
 } from "@opengeni/config";
 import { githubAppBotIdentity as githubAppBotIdentity2 } from "@opengeni/github";
@@ -17103,7 +17180,7 @@ import {
   getSandbox as getSandbox2,
   getScheduledScopedRigVersionMetadata as getScheduledScopedRigVersionMetadata2,
   getSandboxSessionEnvelope as getSandboxSessionEnvelope2,
-  heartbeatLeaseHolder,
+  heartbeatLeaseHolderStatus,
   loadWorkspaceEnvironmentForRun as loadWorkspaceEnvironmentForRun2,
   markSandboxProviderReady,
   markWarmLeaseInstanceLost as markWarmLeaseInstanceLost2,
@@ -17113,6 +17190,7 @@ import {
   releaseLeaseHolder as releaseLeaseHolder2,
   SandboxLeaseSupersededError as SandboxLeaseSupersededError2,
   SandboxViewerAdmissionBlockedError,
+  SandboxPaidComputeAdmissionError as SandboxPaidComputeAdmissionError2,
   getSessionAuthorityEpoch,
   namedSubjectHasLiveWorkspaceAuthority
 } from "@opengeni/db";
@@ -17242,6 +17320,10 @@ async function attachViewer(services, input) {
       ...attachSubjectId ? { viewerSubjectId: attachSubjectId } : {},
       ...attachAuthorityEpoch !== null ? { viewerAuthorityEpoch: attachAuthorityEpoch } : {},
       backend: session.sandboxBackend,
+      warmBilling: {
+        mode: settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond2(settings, session.sandboxBackend)
+      },
       os: session.sandboxOs,
       image: sandboxRuntime.image,
       rigVersionId: session.rigVersionId,
@@ -17251,6 +17333,9 @@ async function attachViewer(services, input) {
       ...input.waitSignal ? { waitSignal: input.waitSignal } : {}
     });
   } catch (error) {
+    if (error instanceof SandboxPaidComputeAdmissionError2) {
+      throw new HTTPException19(402, { message: error.message, cause: error });
+    }
     if (error instanceof SandboxViewerAdmissionBlockedError) {
       throw new HTTPException19(error.reason === "balance" ? 402 : 429, {
         message: error.reason === "balance" ? "insufficient OpenGeni credits for an idle sandbox viewer" : "workspace sandbox warm allowance exhausted",
@@ -17437,16 +17522,17 @@ async function ensureSessionGroupReady(services, input) {
   throw lastError ?? new Error("sandbox readiness could not be established");
 }
 async function heartbeatViewer(services, input) {
-  const alive = await heartbeatLeaseHolder(services.db, {
+  const status = await heartbeatLeaseHolderStatus(services.db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     sandboxGroupId: input.sandboxGroupId,
     kind: "viewer",
     holderId: input.viewerId,
     leaseTtlMs: services.settings.sandboxLeaseTtlMs,
-    expectedEpoch: input.expectedEpoch
+    expectedEpoch: input.expectedEpoch,
+    billingMode: services.settings.sandboxWarmBillingMode
   });
-  if (!alive) return false;
+  if (!status.leaseExtended) return status.holderAlive && status.fence === "funding";
   const lease = await readLease2(services.db, input.workspaceId, input.sandboxGroupId);
   if (lease?.liveness === "warm" && lease.leaseEpoch === input.expectedEpoch && lease.instanceId) {
     await renewSandboxProviderExpiration({
@@ -18326,7 +18412,7 @@ var OpenGeniSlackBotClient = class {
       let reactedMessage = null;
       const checkpointCreatedAtMs = restored?.state.createdAtMs ?? Date.now();
       const firstPage = restored?.state.pageCount ?? 0;
-      for (let page = firstPage; page < MAX_REACTION_CONTEXT_PAGES; page += 1) {
+      for (let page2 = firstPage; page2 < MAX_REACTION_CONTEXT_PAGES; page2 += 1) {
         const payload = await this.call(headers, "conversations.replies", {
           channel: input.channelId,
           // Slack accepts either the parent timestamp or a message timestamp from
@@ -18350,7 +18436,7 @@ var OpenGeniSlackBotClient = class {
           throw new SlackBotProviderError("reaction_pagination_invalid");
         }
         seenCursors.add(nextCursor);
-        const pageCount = page + 1;
+        const pageCount = page2 + 1;
         if (pageCount >= MAX_REACTION_CONTEXT_PAGES) {
           throw new SlackBotProviderError("reaction_pagination_exhausted");
         }
@@ -18576,14 +18662,14 @@ var OpenGeniSlackBotClient = class {
       if (offset > content.length) {
         throw new SlackBotProviderError("invalid_file_offset");
       }
-      const page = content.slice(offset, offset + SLACK_FILE_CONTENT_PAGE_CHARS);
-      const nextOffset = offset + page.length < content.length ? offset + page.length : null;
+      const page2 = content.slice(offset, offset + SLACK_FILE_CONTENT_PAGE_CHARS);
+      const nextOffset = offset + page2.length < content.length ? offset + page2.length : null;
       return {
         channel: info,
         file,
         contentType,
         offset,
-        content: page,
+        content: page2,
         nextOffset,
         truncated: nextOffset !== null
       };
@@ -18985,7 +19071,7 @@ var OpenGeniSlackBotClient = class {
     let cursor = null;
     let matchedTimestamp = null;
     let exhausted = false;
-    for (let page = 0; page < MAX_SLACK_POST_RECONCILIATION_PAGES; page += 1) {
+    for (let page2 = 0; page2 < MAX_SLACK_POST_RECONCILIATION_PAGES; page2 += 1) {
       const payload = await this.call(headers, method, {
         channel: input.channelId,
         limit: String(input.threadTimestamp ? MAX_THREAD_PAGE : MAX_HISTORY_PAGE),
@@ -20092,13 +20178,13 @@ function nextSlackFilesListPage(payload, requested, returnedFileCount) {
   }
   const count = paging?.count;
   const total = paging?.total;
-  const page = paging?.page;
+  const page2 = paging?.page;
   const pages = paging?.pages;
-  if (!positiveSafeInt(count) || !nonNegativeSafeInt(total) || !positiveSafeInt(page) || !nonNegativeSafeInt(pages) || count !== requested.count || page !== requested.page || returnedFileCount > count || pages !== (total === 0 ? 0 : Math.ceil(total / count)) || page > Math.max(1, pages)) {
+  if (!positiveSafeInt(count) || !nonNegativeSafeInt(total) || !positiveSafeInt(page2) || !nonNegativeSafeInt(pages) || count !== requested.count || page2 !== requested.page || returnedFileCount > count || pages !== (total === 0 ? 0 : Math.ceil(total / count)) || page2 > Math.max(1, pages)) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
-  if (page >= pages) return null;
-  const nextPage = page + 1;
+  if (page2 >= pages) return null;
+  const nextPage = page2 + 1;
   if (!positiveSafeInt(nextPage)) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
@@ -20459,14 +20545,14 @@ var FikenClient = class {
   resolveCredential;
   expectedConnectionVersion;
   async listCompanies(input = {}) {
-    const { payload, page } = await this.request("companies.list", "GET", "/companies", {
+    const { payload, page: page2 } = await this.request("companies.list", "GET", "/companies", {
       query: pageQuery(input)
     });
-    return { companies: projectArray(payload), page };
+    return { companies: projectArray(payload), page: page2 };
   }
   async listContacts(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "contacts.list",
       "GET",
       `/companies/${slug}/contacts`,
@@ -20482,7 +20568,7 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, contacts: projectArray(payload), page };
+    return { companySlug: slug, contacts: projectArray(payload), page: page2 };
   }
   async createContact(input) {
     const slug = this.companySlugFor(input.companySlug);
@@ -20508,7 +20594,7 @@ var FikenClient = class {
   }
   async listProducts(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "products.list",
       "GET",
       `/companies/${slug}/products`,
@@ -20520,11 +20606,11 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, products: projectArray(payload), page };
+    return { companySlug: slug, products: projectArray(payload), page: page2 };
   }
   async listInvoices(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "invoices.list",
       "GET",
       `/companies/${slug}/invoices`,
@@ -20539,7 +20625,7 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, invoices: projectArray(payload), page };
+    return { companySlug: slug, invoices: projectArray(payload), page: page2 };
   }
   async getInvoice(input) {
     const slug = this.companySlugFor(input.companySlug);
@@ -20623,7 +20709,7 @@ var FikenClient = class {
   }
   async listBankAccounts(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "bank_accounts.list",
       "GET",
       `/companies/${slug}/bankAccounts`,
@@ -20634,11 +20720,11 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, bankAccounts: projectArray(payload), page };
+    return { companySlug: slug, bankAccounts: projectArray(payload), page: page2 };
   }
   async listPurchases(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "purchases.list",
       "GET",
       `/companies/${slug}/purchases`,
@@ -20651,11 +20737,11 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, purchases: projectArray(payload), page };
+    return { companySlug: slug, purchases: projectArray(payload), page: page2 };
   }
   async listSales(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request("sales.list", "GET", `/companies/${slug}/sales`, {
+    const { payload, page: page2 } = await this.request("sales.list", "GET", `/companies/${slug}/sales`, {
       query: {
         ...pageQuery(input),
         ...input.dateGe ? { dateGe: input.dateGe } : {},
@@ -20663,7 +20749,7 @@ var FikenClient = class {
         ...input.settled !== void 0 ? { settled: String(input.settled) } : {}
       }
     });
-    return { companySlug: slug, sales: projectArray(payload), page };
+    return { companySlug: slug, sales: projectArray(payload), page: page2 };
   }
   /**
    * The company scope for a call: an explicit slug wins, then the connection's
@@ -20865,11 +20951,11 @@ function boundedInt2(value, max, fallback) {
   return Math.min(value, max);
 }
 function pageFromHeaders(headers) {
-  const page = headerInt(headers, "fiken-api-page");
+  const page2 = headerInt(headers, "fiken-api-page");
   const pageSize = headerInt(headers, "fiken-api-page-size");
-  if (page === null || pageSize === null) return null;
+  if (page2 === null || pageSize === null) return null;
   return {
-    page,
+    page: page2,
     pageSize,
     pageCount: headerInt(headers, "fiken-api-page-count"),
     resultCount: headerInt(headers, "fiken-api-result-count")
@@ -21828,24 +21914,24 @@ async function getAtlassianLiveItem(deps, input) {
     );
     url.searchParams.set("body-format", "storage");
     try {
-      const page = objectRecord(
+      const page2 = objectRecord(
         await atlassianApiRequest(deps, { ...input, url, label: "Confluence live page" })
       );
       const source = sources.find(
-        (candidate) => candidate.resourceId === optionalString(page.spaceId)
+        (candidate) => candidate.resourceId === optionalString(page2.spaceId)
       );
       if (!source) continue;
       const comments = await readConfluenceLiveComments(deps, input, cloudId);
-      const webUi = optionalString(objectRecord(page._links).webui);
+      const webUi = optionalString(objectRecord(page2._links).webui);
       return {
         kind: "confluence_page",
-        id: requiredString2(page.id, "page.id"),
-        title: requiredString2(page.title, "page.title"),
+        id: requiredString2(page2.id, "page.id"),
+        title: requiredString2(page2.title, "page.title"),
         source: { id: source.id, name: source.name, siteName: source.siteName },
-        status: optionalString(page.status),
-        createdAt: optionalString(page.createdAt),
-        updatedAt: optionalString(objectRecord(page.version).createdAt),
-        content: optionalString(objectRecord(objectRecord(page.body).storage).value) ?? "",
+        status: optionalString(page2.status),
+        createdAt: optionalString(page2.createdAt),
+        updatedAt: optionalString(objectRecord(page2.version).createdAt),
+        content: optionalString(objectRecord(objectRecord(page2.body).storage).value) ?? "",
         comments,
         url: webUi ? new URL(webUi.startsWith("/wiki/") ? webUi : `/wiki${webUi}`, source.siteUrl).toString() : source.siteUrl
       };
@@ -22359,7 +22445,7 @@ async function materializeSchedules(deps, input) {
 async function browseJiraProjects(deps, input, site) {
   const items = [];
   let startAt = 0;
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const url = new URL(
       `https://api.atlassian.com/ex/jira/${encodeURIComponent(site.cloudId)}/rest/api/3/project/search`
     );
@@ -22402,7 +22488,7 @@ async function browseConfluenceSpaces(deps, input, site) {
   let url = new URL(
     `https://api.atlassian.com/ex/confluence/${encodeURIComponent(site.cloudId)}/wiki/api/v2/spaces?limit=100`
   );
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const payload = objectRecord(
       await atlassianApiRequest(deps, { ...input, url, label: "Confluence spaces" })
     );
@@ -22802,7 +22888,7 @@ function cqlString(value) {
 async function readJiraLiveComments(deps, input, cloudId) {
   const comments = [];
   let startAt = 0;
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const url = new URL(
       `https://api.atlassian.com/ex/jira/${encodeURIComponent(cloudId)}/rest/api/3/issue/${encodeURIComponent(input.id)}/comment`
     );
@@ -22830,7 +22916,7 @@ async function readJiraLiveComments(deps, input, cloudId) {
 async function readConfluenceLiveComments(deps, input, cloudId) {
   const comments = [];
   let cursor = null;
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const url = new URL(
       `https://api.atlassian.com/ex/confluence/${encodeURIComponent(cloudId)}/wiki/api/v2/pages/${encodeURIComponent(input.id)}/footer-comments`
     );
@@ -27285,9 +27371,9 @@ function registerFikenTools(server, deps, grant, sessionId, json) {
         ...pageInputs
       }
     },
-    async ({ connectionId, page, pageSize }) => json(
+    async ({ connectionId, page: page2, pageSize }) => json(
       await (await clientFor(connectionId)).listCompanies({
-        ...page !== void 0 ? { page } : {},
+        ...page2 !== void 0 ? { page: page2 } : {},
         ...pageSize !== void 0 ? { pageSize } : {}
       })
     )
@@ -27669,7 +27755,7 @@ function registerGoalTools(server, deps, grant, sessionId, json) {
   server.registerTool(
     "goal_update",
     {
-      description: "Propose or apply a semantic goal revision under the session's mutation policy. Retain the standing goal unless explicit user direction or meaningful new evidence justifies the declared refinement, adaptation, or replacement. Every rewrite must use the exact expected objective revision and a concise rationale. Root constraints cannot be changed by an agent. A rewrite is not an execution-progress audit fact; use the optional goal_progress tool when such a fact should be recorded.",
+      description: "Maintain your operational goal as user direction or meaningful new evidence clarifies the intended outcome. Changes apply directly unless the user explicitly configured review_changes; refinement, adaptation, and replacement are audit classifications, not approval gates under the default policy. Use the exact expected objective revision and a concise rationale. Updating a goal grants no additional authority and cannot change root constraints. Use goal_progress for an execution-progress audit fact rather than a goal rewrite.",
       inputSchema: {
         text: goalText.optional(),
         successCriteria: successCriteriaSchema.nullable().optional(),
@@ -29223,7 +29309,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           if (decodedCursor && decodedCursor.updatedAfter !== (normalizedUpdatedAfter ?? null)) {
             throw new Error("sessions_list cursor does not match updatedAfter");
           }
-          const page = await listSessionDiscoverySummaries(deps.db, grant.workspaceId, {
+          const page2 = await listSessionDiscoverySummaries(deps.db, grant.workspaceId, {
             limit: boundedSessionDiscoveryLimit(limit),
             ...decodedCursor ? { cursor: decodedCursor } : {},
             includeLastMessage: includeLastMessage === true,
@@ -29243,7 +29329,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             subjectId: grant.subjectId,
             ...authorizationScope ? { authorizationScope } : {}
           });
-          const result = detail === "full" ? capSessionDiscoveryPage(page, includeLastMessage === true) : capSessionDiscoveryCompactPage(page, {
+          const result = detail === "full" ? capSessionDiscoveryPage(page2, includeLastMessage === true) : capSessionDiscoveryCompactPage(page2, {
             includeLastMessage: includeLastMessage === true,
             includeRelatedWork: relatedWorkRequested
           });
@@ -29409,8 +29495,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         }
         if (view !== "debug" && !auditRequested) {
           const { readSessionEventView } = await import("./session-event-view-MU3HMNV3.js");
-          const { listSessionEventSlices } = await import("@opengeni/db/session-event-slices");
-          const page2 = await readSessionEventView(
+          const { listSessionEventSlices: listSessionEventSlices2 } = await import("@opengeni/db/session-event-slices");
+          const page3 = await readSessionEventView(
             {
               sessionId,
               view,
@@ -29423,7 +29509,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
               direction: requestedDirection,
               limit
             },
-            (options) => listSessionEventSlices(
+            (options) => listSessionEventSlices2(
               deps.db,
               grant.workspaceId,
               sessionId,
@@ -29431,8 +29517,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
               (legacyOptions) => listSessionEventPage(deps.db, grant.workspaceId, sessionId, legacyOptions)
             )
           );
-          await acknowledgeReads([{ sessionId, sequences: completeChildReadSequences(page2) }]);
-          return json(page2);
+          await acknowledgeReads([{ sessionId, sequences: completeChildReadSequences(page3) }]);
+          return json(page3);
         }
         if (cursor !== void 0 || callId !== void 0 || includeArguments !== void 0 || includeOutput !== void 0) {
           throw new Error("cursor/callId/includeArguments/includeOutput require a non-debug view");
@@ -29477,7 +29563,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           }
           return json(result);
         }
-        const page = boundSessionEventMcpPage({
+        const page2 = boundSessionEventMcpPage({
           events: dbPage.events,
           mode,
           payloadMode,
@@ -29487,12 +29573,12 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           after: after ?? 0,
           before: before ?? null
         });
-        if (payloadMode === "full" && dbPage.fullPayloadsExact && !page.truncation?.reasons.includes("model_payload")) {
+        if (payloadMode === "full" && dbPage.fullPayloadsExact && !page2.truncation?.reasons.includes("model_payload")) {
           await acknowledgeReads([
-            { sessionId, sequences: page.events.map((event) => event.sequence) }
+            { sessionId, sequences: page2.events.map((event) => event.sequence) }
           ]);
         }
-        return json(page);
+        return json(page2);
       }
     );
     server.registerTool(
@@ -29548,7 +29634,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
               }
             },
             readTargetEvents: async (target) => {
-              const page = await listSessionEventPage(deps.db, workspaceId, target.sessionId, {
+              const page2 = await listSessionEventPage(deps.db, workspaceId, target.sessionId, {
                 after: target.afterSequence,
                 direction: "after",
                 limit: SESSION_WAIT_EVENTS_PER_TARGET,
@@ -29556,10 +29642,10 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
                 includeTypes: targetEventTypes,
                 maxBytes: SESSION_EVENT_MCP_MAX_BYTES * 4
               });
-              if (!page.fullPayloadsExact) {
-                for (const event of page.events) incompleteWaitEvents.add(event.id);
+              if (!page2.fullPayloadsExact) {
+                for (const event of page2.events) incompleteWaitEvents.add(event.id);
               }
-              return { events: page.events, hasMore: page.hasMore };
+              return { events: page2.events, hasMore: page2.hasMore };
             },
             readOwnPendingUpdateKinds: ownSessionId === null ? null : async () => (await listOutstandingSessionSystemUpdates(deps.db, workspaceId, ownSessionId)).map((update) => update.kind),
             subscribe: (targetSessionId, onEvents) => deps.bus.subscribe(workspaceId, targetSessionId, onEvents)
@@ -30443,9 +30529,12 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
   };
   const setupProjections = async (items) => {
     const availableServerIds = /* @__PURE__ */ new Set();
+    const availableFirstPartyTools = /* @__PURE__ */ new Set();
     const acceptedServerIds = /* @__PURE__ */ new Set();
     let accountSelectionKnown = false;
-    if (items.some((item) => item.enabled && item.connectionRef)) {
+    if (items.some(
+      (item) => item.enabled && (item.connectionRef || item.surfaceType === "first_party_fiken")
+    )) {
       const claims = exactAgentCommandContext(grant, sessionId);
       const attemptCatalog = await getAttemptToolCatalog2(deps.db, {
         accountId: grant.accountId,
@@ -30453,7 +30542,11 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
         attemptId: claims.callerAttemptId
       });
       if (attemptCatalog?.sessionId === sessionId && attemptCatalog.turnId === claims.callerTurnId && attemptCatalog.executionGeneration === claims.callerExecutionGeneration) {
-        for (const entry2 of attemptCatalog.entries) availableServerIds.add(entry2.identity.serverId);
+        for (const entry2 of attemptCatalog.entries) {
+          availableServerIds.add(entry2.identity.serverId);
+          if (entry2.identity.serverId === "opengeni")
+            availableFirstPartyTools.add(entry2.identity.toolName);
+        }
         const bindings = await getSessionTurnMcpAccountBindings(
           deps.db,
           grant.workspaceId,
@@ -30474,7 +30567,9 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
           item,
           availableServerIds,
           acceptedServerIds,
-          accountSelectionKnown
+          accountSelectionKnown,
+          availableFirstPartyTools,
+          new Set(grant.metadata?.firstPartyMcpTools ?? [])
         )
       )
     );
@@ -30592,8 +30687,93 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
       });
     }
   );
+  server.registerTool(
+    "custom_mcp_setup_request",
+    {
+      description: "Show a review card for a remote HTTPS MCP server that is not in the workspace catalog. Use only an endpoint supplied by the user or established by reliable documentation; do not invent a URL. Never include query parameters or secrets in this URL; the human can edit it in the protected setup form. The agent cannot add, enable, or contact the server. Search the catalog first and do not propose an already available integration.",
+      inputSchema: {
+        name: z43.string().trim().min(1).max(256),
+        endpointUrl: z43.string().url().max(2048).refine((url) => {
+          const parsed = new URL(url);
+          return parsed.protocol === "https:" && !parsed.username && !parsed.password && !parsed.hash && !parsed.search;
+        }),
+        rationale: z43.string().trim().min(1).max(2e3)
+      }
+    },
+    async ({ name, endpointUrl, rationale }) => {
+      await authorize();
+      const current = await catalog();
+      const existing = current.items.find(
+        (item) => item.kind === "mcp" && item.endpointUrl === endpointUrl && !item.stale
+      );
+      if (existing) {
+        return json({
+          status: "already_in_catalog",
+          capabilityId: existing.id,
+          message: "Use the catalog authorization flow for this server instead."
+        });
+      }
+      const claims = exactAgentCommandContext(grant, sessionId);
+      const payload = ToolAuthNeededPayload.parse({
+        serverId: "opengeni",
+        toolName: "custom_mcp_setup_request",
+        providerDomain: new URL(endpointUrl).hostname,
+        reason: "missing_connection",
+        setupRequest: { kind: "mcp", name, endpointUrl, rationale }
+      });
+      const appended = await appendAndPublishTurnEventsFenced(
+        deps.db,
+        deps.bus,
+        grant.workspaceId,
+        sessionId,
+        claims.callerTurnId,
+        claims.callerExecutionGeneration,
+        claims.callerAttemptId,
+        [{ type: "tool.auth_needed", payload }]
+      );
+      if (!appended.accepted) {
+        throw new Error("The calling turn was replaced before the setup request committed.");
+      }
+      return json({
+        status: "setup_requested",
+        eventId: appended.events[0]?.id ?? null,
+        message: "The human review card was posted. No server was added or contacted."
+      });
+    }
+  );
 }
-async function capabilitySetupProjection(deps, workspaceId, item, availableServerIds, acceptedServerIds, accountSelectionKnown) {
+async function capabilitySetupProjection(deps, workspaceId, item, availableServerIds, acceptedServerIds, accountSelectionKnown, availableFirstPartyTools, selectedFirstPartyTools) {
+  if (item.surfaceType === "first_party_fiken") {
+    if (!item.enabled || item.metadata.connectionStatus !== "active") {
+      return {
+        status: "authorization_required",
+        action: "connect",
+        detail: item.metadata.connectionStatus === "needs_reauth" ? "The workspace Fiken connection needs reconnection." : "Connect Fiken through the protected setup form."
+      };
+    }
+    const selected = FIRST_PARTY_MCP_TOOL_NAMES2.filter(
+      (name) => name.startsWith("fiken_") && selectedFirstPartyTools.has(name)
+    );
+    if (selected.length === 0) {
+      return {
+        status: "authorization_required",
+        action: "enable",
+        detail: "Fiken is connected, but its tools are not selected for this conversation. Ask the user to add its tools through the setup card, then send a new message."
+      };
+    }
+    if (selected.some((name) => availableFirstPartyTools.has(name))) {
+      return {
+        status: "ready",
+        action: null,
+        detail: "Fiken is connected and has tools available in this turn."
+      };
+    }
+    return {
+      status: "unavailable",
+      action: null,
+      detail: "Fiken is connected, but its selected tools are unavailable in this execution. Check tool permissions and setup before retrying; reconnection is not required by this status."
+    };
+  }
   if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
     const missing = githubAppMissingSettings(deps.settings);
     if (missing.length > 0) {
@@ -30947,9 +31127,9 @@ function decodeSessionDiscoveryCursor(value) {
     throw new Error("sessions_list cursor is invalid");
   }
 }
-function capSessionDiscoveryCompactPage(page, options = {}, maxBytes = SESSION_DISCOVERY_PAGE_MAX_BYTES) {
+function capSessionDiscoveryCompactPage(page2, options = {}, maxBytes = SESSION_DISCOVERY_PAGE_MAX_BYTES) {
   let previewBytes = 0;
-  const projected = page.sessions.map((session) => {
+  const projected = page2.sessions.map((session) => {
     const row = {
       ...compactSessionMcpListRow(session, options.includeRelatedWork),
       ...options.includeLastMessage && session.queuedPromptCount > 0 ? { queuedPromptCount: session.queuedPromptCount } : {}
@@ -30986,24 +31166,24 @@ function capSessionDiscoveryCompactPage(page, options = {}, maxBytes = SESSION_D
   let kept = projected;
   const build = () => {
     const dropped = kept.length < projected.length;
-    const last = page.sessions[kept.length - 1];
+    const last = page2.sessions[kept.length - 1];
     const cursor = dropped && last ? {
-      orderBy: page.orderBy,
+      orderBy: page2.orderBy,
       sortRank: last.sortRank,
       sortRevision: last.sortRevision,
       sortAt: last.sortAt,
       id: last.id,
-      snapshotAt: page.snapshotAt,
-      snapshotRevision: page.snapshotRevision,
-      updatedAfter: page.updatedAfter,
-      filterHash: page.filterHash,
-      ...page.originSiteId ? { originSiteId: page.originSiteId } : {}
-    } : page.nextCursor;
+      snapshotAt: page2.snapshotAt,
+      snapshotRevision: page2.snapshotRevision,
+      updatedAfter: page2.updatedAfter,
+      filterHash: page2.filterHash,
+      ...page2.originSiteId ? { originSiteId: page2.originSiteId } : {}
+    } : page2.nextCursor;
     return {
       sessions: kept,
-      total: page.total,
+      total: page2.total,
       nextCursor: cursor ? encodeSessionDiscoveryCursor(cursor) : null,
-      ...page.orderBy === "updatedAt" ? { updatedThrough: page.updatedThrough } : {},
+      ...page2.orderBy === "updatedAt" ? { updatedThrough: page2.updatedThrough } : {},
       ...dropped ? {
         responseTruncated: true,
         truncationReason: `response exceeded ${maxBytes} bytes; continue with nextCursor`
@@ -31020,8 +31200,8 @@ function capSessionDiscoveryCompactPage(page, options = {}, maxBytes = SESSION_D
   }
   return result;
 }
-function capSessionDiscoveryPage(page, includeLastMessage) {
-  const projected = page.sessions.map((session) => {
+function capSessionDiscoveryPage(page2, includeLastMessage) {
+  const projected = page2.sessions.map((session) => {
     const title = capSessionDiscoveryText(session.title, 200, session.titleOriginalChars);
     const goal = session.goal ? capSessionDiscoveryText(
       session.goal.text,
@@ -31108,29 +31288,29 @@ function capSessionDiscoveryPage(page, includeLastMessage) {
     }).length : 0;
     const lastKept = kept.at(-1);
     const droppedForByteCap = kept.length < projected.length;
-    const sourceLast = lastKept ? page.sessions.find((session) => session.id === lastKept.id) : void 0;
+    const sourceLast = lastKept ? page2.sessions.find((session) => session.id === lastKept.id) : void 0;
     const nextCursor = droppedForByteCap ? sourceLast ? encodeSessionDiscoveryCursor({
-      orderBy: page.orderBy,
+      orderBy: page2.orderBy,
       sortRank: sourceLast.sortRank,
       sortRevision: sourceLast.sortRevision,
       sortAt: sourceLast.sortAt,
       id: sourceLast.id,
-      snapshotAt: page.snapshotAt,
-      snapshotRevision: page.snapshotRevision,
-      updatedAfter: page.updatedAfter,
-      filterHash: page.filterHash,
-      ...page.originSiteId ? { originSiteId: page.originSiteId } : {}
-    }) : null : page.nextCursor ? encodeSessionDiscoveryCursor(page.nextCursor) : null;
+      snapshotAt: page2.snapshotAt,
+      snapshotRevision: page2.snapshotRevision,
+      updatedAfter: page2.updatedAfter,
+      filterHash: page2.filterHash,
+      ...page2.originSiteId ? { originSiteId: page2.originSiteId } : {}
+    }) : null : page2.nextCursor ? encodeSessionDiscoveryCursor(page2.nextCursor) : null;
     const result2 = {
       sessions: kept,
-      total: page.total,
-      hasMore: page.hasMore || droppedForByteCap,
+      total: page2.total,
+      hasMore: page2.hasMore || droppedForByteCap,
       nextCursor,
-      orderBy: page.orderBy,
-      snapshotAt: page.snapshotAt,
-      snapshotRevision: page.snapshotRevision,
-      updatedAfter: page.updatedAfter,
-      updatedThrough: page.updatedThrough,
+      orderBy: page2.orderBy,
+      snapshotAt: page2.snapshotAt,
+      snapshotRevision: page2.snapshotRevision,
+      updatedAfter: page2.updatedAfter,
+      updatedThrough: page2.updatedThrough,
       ...includeLastMessage ? {
         latestMessagePreviewBudget: {
           bytes: previewBytes,
@@ -67405,7 +67585,8 @@ function registerDocumentRoutes(app, deps) {
             deps,
             await requireAccessGrantAuthorization8(c, deps, workspaceId, "documents:search"),
             "documents:search"
-          )
+          ),
+          settings: deps.settings
         }
       );
       await server.connect(transport);
@@ -67492,6 +67673,8 @@ import {
   prepareKnowledgeFile as prepareKnowledgeFile2,
   prepareKnowledgeSave as prepareKnowledgeSave2,
   searchKnowledgeEntries as searchKnowledgeEntries3,
+  KnowledgeVectorFundingError,
+  KnowledgeVectorQueryRejectedError,
   hasPermission as hasPermission13,
   knowledgeContextForAccess as knowledgeContextForAccess2,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization9,
@@ -67531,6 +67714,18 @@ var WriteSettings = ReadSettings.extend({
 var Id = z22.uuid();
 function knowledgeHttpError(error) {
   if (error instanceof HTTPException42) throw error;
+  if (error instanceof KnowledgeVectorFundingError)
+    throw new ApiHttpError(402, {
+      code: "payment_required",
+      message: error.message,
+      details: { code: error.code, keywordAvailable: true }
+    });
+  if (error instanceof KnowledgeVectorQueryRejectedError)
+    throw new ApiHttpError(error.code === "quota" ? 429 : 422, {
+      code: error.code === "quota" ? "limit_exceeded" : "validation_failed",
+      message: error.message,
+      details: { code: error.code, keywordAvailable: true }
+    });
   if (error instanceof z22.ZodError)
     throw new HTTPException42(422, {
       message: error.issues[0]?.message ?? "Invalid Knowledge request"
@@ -67662,7 +67857,9 @@ function registerKnowledgeRoutes(app, deps) {
           deps.db,
           context,
           KnowledgeSavePreparationRequest2.parse(await c.req.json()),
-          () => deps.getDocumentServices().embedder
+          () => deps.getDocumentServices().embedder,
+          void 0,
+          deps.settings
         )
       );
     })
@@ -67677,7 +67874,8 @@ function registerKnowledgeRoutes(app, deps) {
           deps.db,
           context,
           KnowledgeEntryListRequest3.parse(await c.req.json()),
-          () => deps.getDocumentServices().embedder
+          () => deps.getDocumentServices().embedder,
+          deps.settings
         )
       )
     )
@@ -67724,7 +67922,8 @@ function registerKnowledgeRoutes(app, deps) {
             ...query,
             ...query.limit ? { limit: Number(query.limit) } : {}
           }),
-          () => deps.getDocumentServices().embedder
+          () => deps.getDocumentServices().embedder,
+          deps.settings
         )
       );
     })
@@ -70394,7 +70593,8 @@ import { randomUUID as randomUUID7 } from "crypto";
 import {
   environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes5,
   resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret3,
-  resolveStreamTokenSecret as resolveStreamTokenSecret2
+  resolveStreamTokenSecret as resolveStreamTokenSecret2,
+  sandboxWarmRateMicrosPerSecond as sandboxWarmRateMicrosPerSecond3
 } from "@opengeni/config";
 import {
   BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX,
@@ -70412,6 +70612,8 @@ import {
   BrowserDownloadSaveRequest,
   BrowserDownloadSaveResponse,
   BrowserDownloadListResponse,
+  BrowserDomReadRequest,
+  BrowserDomReadResponse,
   BrowserExternalAuthCommand,
   BrowserOpenTargetRequest,
   BrowserObservation,
@@ -70423,6 +70625,7 @@ import {
   BrowserSessionListResponse,
   BrowserSessionMutationResponse,
   BrowserTargetListResponse,
+  BrowserTargetState,
   CreateBrowserSessionRequest,
   ExternalAuthInteractiveRequest,
   ExternalAuthInteractiveResponse,
@@ -70454,6 +70657,7 @@ import {
   BrowserSessionNotFoundError,
   BrowserSessionOperationConflictError,
   BrowserSessionStateError as BrowserSessionStateError2,
+  SandboxPaidComputeAdmissionError as SandboxPaidComputeAdmissionError3,
   completeBrowserSessionEnd,
   completeExternalAuth,
   completeBrowserDownloadSave,
@@ -70467,6 +70671,8 @@ import {
   dispatchExternalAuth,
   dispatchProtectedAuthFill,
   failBrowserSessionOperation,
+  failPreparedBrowserSessionEnd,
+  failPreparedBrowserSessionSuspend,
   failBrowserSessionResume,
   failBrowserSessionResumePreparation,
   failBrowserSessionSuspension,
@@ -72355,6 +72561,68 @@ function registerBrowserSessionRoutes(app, deps) {
       return context.json(result);
     }
   );
+  app.get(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/state",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read"
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const result = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.targetState(targetId)
+      );
+      return context.json(BrowserTargetState.parse(result));
+    }
+  );
+  app.post(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/dom-read",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read"
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const request = await parseJsonBody2(context, BrowserDomReadRequest);
+      const result = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.readDom(targetId, request)
+      );
+      return context.json(BrowserDomReadResponse.parse(result));
+    }
+  );
+  app.get(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/screenshot",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read"
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const captureOptions = parseBrowserScreenshotOptions(new URL(context.req.url).searchParams);
+      const frame = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.capture(targetId, captureOptions)
+      );
+      return browserScreenshotResponse(frame);
+    }
+  );
   app.post(
     "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/actions",
     async (context) => {
@@ -73388,6 +73656,7 @@ function registerBrowserSessionRoutes(app, deps) {
       const request = await parseJsonBody2(context, BrowserSessionLifecycleRequest);
       const startedAtMs = performance.now();
       const origin = requestOrigin(context, deps.settings);
+      let preparedForDispatch = false;
       try {
         const before = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
@@ -73436,6 +73705,7 @@ function registerBrowserSessionRoutes(app, deps) {
           observeLifecycleResult(deps.observability, startedAtMs, parsed2);
           return context.json(parsed2, 200);
         }
+        preparedForDispatch = true;
         const record6 = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
           workspaceId,
@@ -73594,6 +73864,15 @@ function registerBrowserSessionRoutes(app, deps) {
         observeLifecycleResult(deps.observability, startedAtMs, parsed);
         return context.json(parsed, 200);
       } catch (error) {
+        if (preparedForDispatch) {
+          await failPreparedBrowserSessionSuspend(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            browserSessionId,
+            operationId: request.operationId,
+            error: interactionFailure(error)
+          });
+        }
         throw browserRouteError(error);
       }
     }
@@ -73844,6 +74123,7 @@ function registerBrowserSessionRoutes(app, deps) {
       const request = await parseJsonBody2(context, BrowserSessionLifecycleRequest);
       const startedAtMs = performance.now();
       const origin = requestOrigin(context, deps.settings);
+      let endPreparation = null;
       try {
         const before = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
@@ -73857,7 +74137,10 @@ function registerBrowserSessionRoutes(app, deps) {
           workspaceId,
           browserSessionId,
           operationId: request.operationId,
-          actorSubjectId: grant.subjectId
+          actorSubjectId: grant.subjectId,
+          expectedLifecycle: before.session.lifecycle,
+          expectedFailureCode: before.session.failureCode,
+          expectedControllerGeneration: before.session.controller?.controllerGeneration ?? null
         });
         if (isTerminalOperation(prepared.operation.state)) {
           if (prepared.operation.state === "completed") {
@@ -73873,6 +74156,13 @@ function registerBrowserSessionRoutes(app, deps) {
           observeLifecycleResult(deps.observability, startedAtMs, parsed2);
           return context.json(parsed2, 200);
         }
+        if (before.session.lifecycle !== "ending") {
+          endPreparation = {
+            restoreLifecycle: before.session.lifecycle,
+            restoreFailureCode: before.session.failureCode,
+            expectedControllerGeneration: before.session.controller?.controllerGeneration ?? null
+          };
+        }
         const record6 = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
           workspaceId,
@@ -73962,6 +74252,16 @@ function registerBrowserSessionRoutes(app, deps) {
         observeLifecycleResult(deps.observability, startedAtMs, parsed);
         return context.json(parsed, 200);
       } catch (error) {
+        if (endPreparation) {
+          await failPreparedBrowserSessionEnd(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            browserSessionId,
+            operationId: request.operationId,
+            ...endPreparation,
+            error: interactionFailure(error)
+          });
+        }
         throw browserRouteError(error);
       }
     }
@@ -74082,6 +74382,11 @@ function registerBrowserSessionRoutes(app, deps) {
         const resolved = await handle.routingSession.prime();
         if (expectedPlacement?.kind === "connected_machine") {
           if (resolved.kind !== "selfhosted" || resolved.sandboxId !== expectedPlacement.sandboxId) {
+            if (operation === "browser.create") {
+              throw new HTTPException51(422, {
+                message: "The requested Connected Machine is not this session's current placement. Move the session to that machine before creating an interaction resource."
+              });
+            }
             return await throwBrowserSourcePlacementChanged(
               grant,
               sourceSession.id,
@@ -74797,6 +75102,10 @@ async function ensureInteractionHolder(deps, grant, sourceSession, browserSessio
     holderId: interactionHolderId(browserSessionId),
     subjectId: sourceSession.id,
     backend: placement.lease.backend,
+    warmBilling: {
+      mode: deps.settings.sandboxWarmBillingMode,
+      rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond3(deps.settings, placement.lease.backend)
+    },
     os: placement.lease.os,
     image: sandboxRuntime.image,
     rigVersionId: sourceSession.rigVersionId,
@@ -74994,6 +75303,7 @@ async function settleBrowserSessionSuspensionCaptureFailure(deps, input, error)
   return await failBrowserSessionSuspension(deps.db, {
     ...input,
     ...outcomeUnknown ? { state: "outcome_unknown" } : {},
+    missingControllerSession: error.status === 404 && isMissingBrowserControllerSession(error),
     error: error.error
   });
 }
@@ -75086,6 +75396,41 @@ function optionalBoundedInteger(value, minimum, maximum) {
   }
   return parsed;
 }
+function parseBrowserScreenshotOptions(query) {
+  for (const key of ["fullPage", "format", "quality"]) {
+    if (query.getAll(key).length > 1) {
+      throw new HTTPException51(400, { message: `duplicate browser screenshot ${key}` });
+    }
+  }
+  const fullPage = query.get("fullPage");
+  if (fullPage !== null && fullPage !== "true" && fullPage !== "false") {
+    throw new HTTPException51(400, { message: "invalid browser screenshot fullPage" });
+  }
+  const format = query.get("format");
+  if (format !== null && format !== "jpeg" && format !== "png") {
+    throw new HTTPException51(400, { message: "invalid browser screenshot format" });
+  }
+  const quality = query.get("quality");
+  const parsedQuality = quality === null ? null : optionalBoundedInteger(quality, 1, 100);
+  if (quality !== null && parsedQuality === null) {
+    throw new HTTPException51(400, { message: "invalid browser screenshot quality" });
+  }
+  return {
+    ...fullPage === null ? {} : { fullPage: fullPage === "true" },
+    ...format === null ? {} : { format },
+    ...parsedQuality === null ? {} : { quality: parsedQuality }
+  };
+}
+function browserScreenshotResponse(frame) {
+  return new Response(Uint8Array.from(frame.data).buffer, {
+    status: 200,
+    headers: {
+      "cache-control": "no-store",
+      "content-type": frame.mediaType,
+      "x-opengeni-browser-frame": frame.metadataHeader
+    }
+  });
+}
 function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value);
 }
@@ -75480,6 +75825,8 @@ function browserRouteError(error) {
   const connectedMachineError = interactionControlApiError(error, "browser");
   if (connectedMachineError) return connectedMachineError;
   if (error instanceof HTTPException51) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError3)
+    return new HTTPException51(402, { message: error.message, cause: error });
   if (error instanceof BrowserSessionNotFoundError) {
     return new HTTPException51(404, { message: error.message, cause: error });
   }
@@ -75533,7 +75880,11 @@ function isAbort(error) {
 
 // src/routes/computer-sessions.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret4, resolveStreamTokenSecret as resolveStreamTokenSecret3 } from "@opengeni/config";
+import {
+  resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret4,
+  resolveStreamTokenSecret as resolveStreamTokenSecret3,
+  sandboxWarmRateMicrosPerSecond as sandboxWarmRateMicrosPerSecond4
+} from "@opengeni/config";
 import {
   BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX as BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX2,
   BROWSER_CONTROL_PORT as BROWSER_CONTROL_PORT2,
@@ -75560,6 +75911,7 @@ import {
   ComputerSessionNotFoundError,
   ComputerSessionOperationConflictError,
   ComputerSessionStateError,
+  SandboxPaidComputeAdmissionError as SandboxPaidComputeAdmissionError4,
   dispatchComputerSessionOperation,
   failComputerSessionOperation,
   findComputerSessionControlRecordByOperation,
@@ -76447,6 +76799,11 @@ function registerComputerSessionRoutes(app, deps) {
         }
         if (expectedPlacement?.kind === "connected_machine") {
           if (resolved.kind !== "selfhosted" || resolved.sandboxId !== expectedPlacement.sandboxId) {
+            if (operation === "computer.create") {
+              throw new HTTPException52(422, {
+                message: "The requested Connected Machine is not this session's current placement. Move the session to that machine before creating an interaction resource."
+              });
+            }
             return await throwComputerSourcePlacementChanged(
               grant,
               sourceSession.id,
@@ -76733,6 +77090,10 @@ function registerComputerSessionRoutes(app, deps) {
       holderId: interactionHolderId2(computerSessionId),
       subjectId: sourceSession.id,
       backend: placement.lease.backend,
+      warmBilling: {
+        mode: deps.settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond4(deps.settings, placement.lease.backend)
+      },
       os: placement.lease.os,
       image: sandboxRuntime.image,
       rigVersionId: sourceSession.rigVersionId,
@@ -77055,6 +77416,8 @@ function computerRouteError(error) {
   const connectedMachineError = interactionControlApiError(error, "computer");
   if (connectedMachineError) return connectedMachineError;
   if (error instanceof HTTPException52) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError4)
+    return new HTTPException52(402, { message: error.message, cause: error });
   if (error instanceof ComputerSessionNotFoundError) {
     return new HTTPException52(404, { message: error.message, cause: error });
   }
@@ -77203,6 +77566,92 @@ async function integrationCommitGrant(authorization, permissions, request) {
   };
 }
 
+// src/routes/github-browser-pages.ts
+var pageStyle = `
+  :root{color-scheme:dark;--bg:oklch(.155 .012 260);--surface:oklch(.19 .014 260);--raised:oklch(.225 .015 260);--border:oklch(.3 .014 260);--border-strong:oklch(.42 .016 260);--fg:oklch(.955 .005 260);--muted:oklch(.73 .012 260);--blue:oklch(.54 .18 255);--blue-light:oklch(.72 .15 255)}
+  *{box-sizing:border-box}
+  html{min-height:100%;background:var(--bg)}
+  body{margin:0;min-height:100vh;min-height:100dvh;color:var(--fg);background:var(--bg);font-family:"Inter Variable",Inter,ui-sans-serif,system-ui,sans-serif;font-feature-settings:"cv11","ss01","ss03";-webkit-font-smoothing:antialiased}
+  .shell{width:min(100% - 48px,700px);margin:0 auto}
+  header{height:84px;display:flex;align-items:center;justify-content:space-between;gap:16px;border-bottom:1px solid var(--border)}
+  .brand{font-size:16px;font-weight:670;letter-spacing:-.045em;color:var(--fg);text-decoration:none}
+  .context{font-size:12px;color:var(--muted)}
+  main{padding:clamp(48px,10vh,100px) 0 96px}
+  h1{margin:0 0 14px;font-size:clamp(27px,4vw,36px);font-weight:640;letter-spacing:-.05em;line-height:1.17}
+  p{margin:0;color:var(--muted);font-size:14px;line-height:1.65;max-width:59ch}
+  .intro{margin-bottom:32px}
+  .options{display:grid;gap:10px;margin:0 0 24px;padding:0;border:0;max-height:min(390px,52vh);overflow:auto}
+  .option{display:flex;gap:14px;align-items:center;min-height:70px;padding:14px 16px;border:1px solid var(--border);border-radius:10px;background:var(--surface);cursor:pointer;transition:background .15s,border-color .15s}
+  .option:hover{background:var(--raised)}
+  .option:has(input:checked){border-color:var(--blue-light);background:var(--raised)}
+  .option:has(input:focus-visible){outline:2px solid var(--blue-light);outline-offset:3px}
+  .option input{margin:0;flex:none;width:17px;height:17px;accent-color:var(--blue-light)}
+  .option-text{min-width:0;display:grid;gap:3px}
+  .option strong{overflow-wrap:anywhere;font-size:14px;font-weight:600}
+  .option small{font-size:12px;color:var(--muted)}
+  .actions{display:flex;align-items:center;flex-wrap:wrap;gap:12px;margin-top:24px}
+  .button{display:inline-flex;min-height:42px;align-items:center;justify-content:center;padding:0 17px;border:1px solid var(--blue);border-radius:8px;background:var(--blue);color:#fff;font-family:inherit;font-size:13px;font-weight:600;text-decoration:none;cursor:pointer}
+  .button:hover{background:oklch(.6 .18 255)}
+  .button:disabled{cursor:wait;opacity:.7}
+  .secondary{border-color:var(--border);background:transparent;color:var(--fg)}
+  .secondary:hover{background:var(--raised)}
+  :is(button,a):focus-visible{outline:2px solid var(--blue-light);outline-offset:3px}
+  .note{margin-top:30px;padding-top:20px;border-top:1px solid var(--border);font-size:12px}
+  .env-header{display:flex;justify-content:space-between;align-items:center;gap:14px;margin-top:36px}
+  h2{margin:0;font-size:14px;font-weight:600}
+  pre{white-space:pre-wrap;overflow-wrap:anywhere;max-height:380px;overflow:auto;padding:18px;border:1px solid var(--border);border-radius:10px;background:var(--surface);font:12px/1.6 ui-monospace,SFMono-Regular,Menlo,monospace}
+  @media(max-width:480px){.shell{width:calc(100% - 32px)}header{height:70px}main{padding-top:56px}.actions{align-items:stretch;flex-direction:column}.actions form,.actions .button{width:100%}}
+  @media(prefers-reduced-motion:reduce){.option{transition:none}}
+`;
+function page(title, content) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml4(title)} \xB7 OpenGeni</title><style>${pageStyle}</style></head><body><div class="shell"><header><span class="brand">OpenGeni</span><span class="context">GitHub connection</span></header><main>${content}</main></div></body></html>`;
+}
+function githubInstallationChooserHtml(candidates, state, workspaceId, baseUrl) {
+  const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
+  const options = candidates.map(({ installation, authorityKind }, index) => {
+    const account = escapeHtml4(
+      installation.accountLogin ?? `installation ${installation.installationId}`
+    );
+    const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
+    return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required${candidates.length === 1 && index === 0 ? " checked" : ""}><span class="option-text"><strong>${account}</strong><small>${label}</small></span></label>`;
+  }).join("");
+  return page(
+    "Choose a GitHub account",
+    `<h1>Choose a GitHub account</h1><p class="intro">Connect an account where the OpenGeni GitHub App is already installed, or install it on another account.</p><form id="existing-account" method="get" action="${escapeHtml4(action)}"><input type="hidden" name="state" value="${escapeHtml4(state)}"><fieldset class="options" aria-label="Available GitHub accounts">${options}</fieldset></form><div class="actions"><button class="button" type="submit" form="existing-account">Connect selected account</button><form method="get" action="${escapeHtml4(action)}"><input type="hidden" name="state" value="${escapeHtml4(state)}"><input type="hidden" name="installation_id" value="new"><button class="button secondary" type="submit">Install on another account</button></form></div><p class="note">Only accounts GitHub has confirmed you own or manage appear here.</p>`
+  );
+}
+function githubSetupSuccessHtml(account, returnUrl2) {
+  return page(
+    "GitHub connected",
+    `<h1>GitHub connected</h1><p class="intro"><strong>${escapeHtml4(account)}</strong> is now available in this OpenGeni workspace. OpenGeni can access only the repositories allowed for this installation.</p><a class="button" href="${escapeHtml4(returnUrl2)}">Back to OpenGeni</a>`
+  );
+}
+function githubSetupPendingHtml() {
+  return page(
+    "GitHub approval pending",
+    `<h1>Waiting for an organization owner</h1><p>An owner needs to approve your GitHub App request before you can connect. OpenGeni has not created a workspace binding.</p>`
+  );
+}
+function githubSuccessHtml(envLines) {
+  const escaped = escapeHtml4(envLines.join("\n"));
+  return page(
+    "GitHub App created",
+    `<h1>GitHub App created</h1><p>Add these values to .env, then restart API and worker.</p><div class="env-header"><h2>Environment variables</h2><button class="button secondary" id="copy-env" type="button">Copy env</button></div><pre id="env-lines">${escaped}</pre><script>(()=>{const button=document.getElementById("copy-env");const env=document.getElementById("env-lines");async function copyText(text){if(navigator.clipboard&&window.isSecureContext){await navigator.clipboard.writeText(text);return;}const area=document.createElement("textarea");area.value=text;area.setAttribute("readonly","");area.style.position="fixed";area.style.inset="-9999px";document.body.append(area);area.select();document.execCommand("copy");area.remove();}button?.addEventListener("click",async()=>{try{await copyText(env?.textContent||"");button.textContent="Copied";setTimeout(()=>button.textContent="Copy env",1600);}catch{button.textContent="Copy failed";setTimeout(()=>button.textContent="Copy env",2200);}});})();</script>`
+  );
+}
+function escapeHtml4(value) {
+  return value.replace(
+    /[&<>"']/g,
+    (char) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    })[char] ?? char
+  );
+}
+
 // src/routes/github.ts
 var githubStateCookie = "opengeni_github_state";
 var githubBindingStateMaxAgeSeconds = 10 * 60;
@@ -78006,28 +78455,6 @@ function requirePublicGitHubRepositoryVerificationPermission(grant) {
 function isSecureRequest(c, deps) {
   return deps.settings.publicBaseUrl?.startsWith("https://") || c.req.header("x-forwarded-proto") === "https" || new URL(c.req.url).protocol === "https:";
 }
-function githubSuccessHtml(envLines) {
-  const envText = envLines.join("\n");
-  const escaped = escapeHtml4(envText);
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Created</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(760px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0 0 18px;color:#d4d4d8}.env-header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin:22px 0 8px}.env-header h2{margin:0;font-size:13px;line-height:1.2;text-transform:uppercase;letter-spacing:.08em;color:#a1a1aa}pre{white-space:pre-wrap;word-break:break-word;max-height:380px;overflow:auto;background:#09090b;border:1px solid #27272a;border-radius:8px;padding:16px;font-size:13px;line-height:1.5}button{display:inline-flex;align-items:center;justify-content:center;min-height:36px;border-radius:6px;border:1px solid #3f3f46;padding:0 12px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}button:disabled{cursor:not-allowed;opacity:.7}</style></head><body><main><h1>GitHub App created</h1><p>Add these values to .env, then restart API and worker.</p><div class="env-header"><h2>Environment variables</h2><button id="copy-env" type="button">Copy env</button></div><pre id="env-lines">${escaped}</pre><script>(()=>{const button=document.getElementById("copy-env");const env=document.getElementById("env-lines");async function copyText(text){if(navigator.clipboard&&window.isSecureContext){await navigator.clipboard.writeText(text);return;}const area=document.createElement("textarea");area.value=text;area.setAttribute("readonly","");area.style.position="fixed";area.style.inset="-9999px";document.body.append(area);area.select();document.execCommand("copy");area.remove();}button?.addEventListener("click",async()=>{try{await copyText(env?.textContent||"");button.textContent="Copied";setTimeout(()=>button.textContent="Copy env",1600);}catch{button.textContent="Copy failed";setTimeout(()=>button.textContent="Copy env",2200);}});})();</script></main></body></html>`;
-}
-function githubSetupSuccessHtml(account, returnUrl2) {
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Connected</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0 0 18px;color:#d4d4d8}.button{display:inline-flex;align-items:center;justify-content:center;min-height:36px;border-radius:6px;border:1px solid #3f3f46;padding:0 12px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;text-decoration:none}</style></head><body><main><h1>GitHub App connected</h1><p>${escapeHtml4(account)} is now available to this OpenGeni workspace through an explicit repository allowlist.</p><a class="button" href="${escapeHtml4(returnUrl2)}">Back to OpenGeni</a></main></body></html>`;
-}
-function githubInstallationChooserHtml(candidates, state, workspaceId, baseUrl) {
-  const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
-  const options = candidates.map(({ installation, authorityKind }, index) => {
-    const account = escapeHtml4(
-      installation.accountLogin ?? `installation ${installation.installationId}`
-    );
-    const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
-    return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required${candidates.length === 1 && index === 0 ? " checked" : ""}><span><strong>${account}</strong><small>${label}</small></span></label>`;
-  }).join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>These accounts already have the OpenGeni GitHub App installed and GitHub proved you are the personal owner or an active organization owner.</p><form method="get" action="${escapeHtml4(action)}"><input type="hidden" name="state" value="${escapeHtml4(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
-}
-function githubSetupPendingHtml() {
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Requested</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0;color:#d4d4d8}</style></head><body><main><h1>GitHub App request sent</h1><p>A GitHub organization owner must approve the installation. OpenGeni has not created a workspace binding.</p></main></body></html>`;
-}
 function parsePositiveInteger(value) {
   if (!value || !/^\d+$/.test(value)) {
     return null;
@@ -78039,18 +78466,6 @@ function isFreshGitHubBindingState(payload) {
   const age = Math.floor(Date.now() / 1e3) - payload.iat;
   return age >= 0 && age < githubBindingStateMaxAgeSeconds;
 }
-function escapeHtml4(value) {
-  return value.replace(
-    /[&<>"']/g,
-    (char) => ({
-      "&": "&amp;",
-      "<": "&lt;",
-      ">": "&gt;",
-      '"': "&quot;",
-      "'": "&#39;"
-    })[char] ?? char
-  );
-}
 function openGeniReturnUrl(settings, c, workspaceId, returnPath = null) {
   const baseUrl = openGeniBaseUrl(settings, c) || new URL(c.req.url).origin;
   const safeReturnPath4 = githubSessionReturnPath(returnPath, workspaceId);
@@ -78636,7 +79051,7 @@ function registerPersonalGitHubRoutes(app, deps) {
       const query = ListPersonalGitHubRepositoriesQuery.parse(c.req.query());
       try {
         const selection = await loadRepositorySelectionState(deps, access.grant, connection);
-        const page = await listLivePersonalGitHubRepositories(deps, {
+        const page2 = await listLivePersonalGitHubRepositories(deps, {
           accountId: access.grant.accountId,
           workspaceId,
           subjectId: access.grant.subjectId,
@@ -78653,11 +79068,11 @@ function registerPersonalGitHubRoutes(app, deps) {
         );
         return c.json(
           ListPersonalGitHubRepositoriesResponse.parse({
-            repositories: page.repositories.map((repository) => ({
+            repositories: page2.repositories.map((repository) => ({
               ...repository,
               selectedAccess: selectedAccessById.get(repository.repositoryId) ?? null
             })),
-            nextCursor: page.nextPage,
+            nextCursor: page2.nextPage,
             selection
           })
         );
@@ -79991,11 +80406,11 @@ async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal,
       if (targetSequence !== void 0 && lastSent >= targetSequence) return;
       const previousLastSent = lastSent;
       const limit = targetSequence === void 0 ? SESSION_REPLAY_PAGE_SIZE : Math.min(SESSION_REPLAY_PAGE_SIZE, targetSequence - lastSent);
-      const page = await listSessionEvents(db, workspaceId, sessionId, {
+      const page2 = await listSessionEvents(db, workspaceId, sessionId, {
         after: lastSent,
         limit
       });
-      const eligible = targetSequence === void 0 ? page : page.filter((event) => event.sequence <= targetSequence);
+      const eligible = targetSequence === void 0 ? page2 : page2.filter((event) => event.sequence <= targetSequence);
       if (eligible.length === 0) {
         if (targetSequence === void 0) return;
         throw new Error(
@@ -80105,16 +80520,16 @@ async function replaySessionEvents(loadPage, send, after, pageSize = SESSION_REP
   let cursor = after;
   while (true) {
     const previousCursor = cursor;
-    const page = await loadPage(cursor, pageSize);
-    if (page.length === 0) {
+    const page2 = await loadPage(cursor, pageSize);
+    if (page2.length === 0) {
       return;
     }
-    for (const event of page.sort((a, b) => a.sequence - b.sequence)) {
+    for (const event of page2.sort((a, b) => a.sequence - b.sequence)) {
       if (event.sequence <= cursor) continue;
       await send(event);
       cursor = event.sequence;
     }
-    if (page.length < pageSize) {
+    if (page2.length < pageSize) {
       return;
     }
     if (cursor === previousCursor) {
@@ -80506,14 +80921,14 @@ async function replayWorkspaceControlEvents(loadPage, send, after, pageSize) {
   let cursor = after;
   while (true) {
     const previousCursor = cursor;
-    const page = await loadPage(cursor, pageSize);
-    if (page.length === 0) return;
-    for (const event of page.sort((a, b) => a.sequence - b.sequence)) {
+    const page2 = await loadPage(cursor, pageSize);
+    if (page2.length === 0) return;
+    for (const event of page2.sort((a, b) => a.sequence - b.sequence)) {
       if (event.sequence <= cursor) continue;
       await send(event);
       cursor = event.sequence;
     }
-    if (page.length < pageSize) return;
+    if (page2.length < pageSize) return;
     if (cursor === previousCursor) {
       throw new Error(
         `Workspace control replay made no progress after sequence ${cursor}; refusing to repeat a full stale page`
@@ -84605,10 +85020,10 @@ function registerSkillContentRoutes(app, deps) {
         ...query.data.sessionId ? { sessionId: query.data.sessionId } : {}
       }
     );
-    const page = rows2.slice(0, query.data.limit);
-    const last = page.at(-1);
+    const page2 = rows2.slice(0, query.data.limit);
+    const last = page2.at(-1);
     return c.json({
-      skills: page.map(({ files: _files, ...summary }) => summary),
+      skills: page2.map(({ files: _files, ...summary }) => summary),
       nextCursor: rows2.length > query.data.limit && last ? Buffer.from(JSON.stringify({ stableKey: last.stableKey, id: last.id })).toString(
         "base64url"
       ) : null
@@ -85665,6 +86080,8 @@ function registerScheduledTaskRoutes(app, deps) {
 // src/routes/sessions.ts
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
 import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
+import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
+import * as sessionPreviewSchema from "@opengeni/db/schema";
 import { SessionMessageSearchRequest } from "@opengeni/contracts";
 import { scheduledSessionIds } from "@opengeni/db";
 import { withSiteSessionOrigin as withSiteSessionOrigin2 } from "@opengeni/core";
@@ -87260,9 +87677,9 @@ function registerSessionRoutes(app, deps) {
     }
     const pageView = c.req.query("view") === "page";
     const query = sessionListQuery(c.req.query(), pageView);
-    let page;
+    let page2;
     try {
-      page = await listSessionsForSubject(db, workspaceId, {
+      page2 = await listSessionsForSubject(db, workspaceId, {
         subjectId: grant.subjectId,
         limit: boundedLimit(query.limit),
         materializeSnapshot: pageView,
@@ -87299,17 +87716,17 @@ function registerSessionRoutes(app, deps) {
       }
       throw error;
     }
-    c.header("x-opengeni-pinned-truncated", page.pinnedTruncated === true ? "true" : "false");
+    c.header("x-opengeni-pinned-truncated", page2.pinnedTruncated === true ? "true" : "false");
     const policy = await loadEffectivePolicyContext(deps, workspaceId, grant.subjectId);
     const commandActivity = await backgroundCommandActivityForSessions(db, {
       accountId: grant.accountId,
       workspaceId,
-      sessionIds: [...page.pinned, ...page.sessions].map((session) => session.id)
+      sessionIds: [...page2.pinned, ...page2.sessions].map((session) => session.id)
     });
     const scheduleTargets = hasPermission19(grant.permissions, "scheduled_tasks:run") && hasPermission19(grant.permissions, "sessions:control") ? await scheduledSessionIds(
       db,
       workspaceId,
-      [...page.pinned, ...page.sessions].map((session) => session.id)
+      [...page2.pinned, ...page2.sessions].map((session) => session.id)
     ) : /* @__PURE__ */ new Set();
     const decorate = (session) => {
       const activity = commandActivity.get(session.id);
@@ -87325,14 +87742,14 @@ function registerSessionRoutes(app, deps) {
     };
     if (pageView) {
       return c.json({
-        ...page,
+        ...page2,
         ...query.hasPageFilters ? { filtersApplied: true } : {},
         ...query.originSiteId ? { originSiteId: query.originSiteId } : {},
-        pinned: page.pinned.map(decorate),
-        sessions: page.sessions.map(decorate)
+        pinned: page2.pinned.map(decorate),
+        sessions: page2.sessions.map(decorate)
       });
     }
-    return c.json([...page.pinned, ...page.sessions].map(decorate));
+    return c.json([...page2.pinned, ...page2.sessions].map(decorate));
   });
   app.get("/v1/workspaces/:workspaceId/agent-topology", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -87365,7 +87782,7 @@ function registerSessionRoutes(app, deps) {
     }
     try {
       const orderBy = query.query || query.subject ? "relevance" : "updatedAt";
-      const page = await listSessionDiscoverySummaries2(db, workspaceId, {
+      const page2 = await listSessionDiscoverySummaries2(db, workspaceId, {
         limit: query.limit,
         orderBy,
         subjectId: grant.subjectId,
@@ -87384,11 +87801,11 @@ function registerSessionRoutes(app, deps) {
       const ancestorPaths = query.query || query.subject ? await listSessionDiscoveryAncestorPaths(
         db,
         workspaceId,
-        page.sessions.map((session) => session.id),
+        page2.sessions.map((session) => session.id),
         authorizationScope ?? void 0,
         grant.subjectId
       ) : /* @__PURE__ */ new Map();
-      const sessions = page.sessions.map((session) => {
+      const sessions = page2.sessions.map((session) => {
         const blocker = session.effectiveControl.primaryBlocker;
         return {
           id: session.id,
@@ -87426,11 +87843,11 @@ function registerSessionRoutes(app, deps) {
       });
       const response = {
         sessions,
-        total: page.total,
-        hasMore: page.hasMore,
+        total: page2.total,
+        hasMore: page2.hasMore,
         humanAdvisoriesEnabled: settings.workDiscoveryEnabled && settings.workDiscoveryHumanAdvisoriesEnabled,
-        nextCursor: page.nextCursor ? encodeAgentTopologyCursor({
-          cursor: page.nextCursor,
+        nextCursor: page2.nextCursor ? encodeAgentTopologyCursor({
+          cursor: page2.nextCursor,
           parentSessionId: query.parentSessionId === void 0 ? "all" : query.parentSessionId,
           rootSessionId: query.rootSessionId ?? null,
           query: query.query ?? null,
@@ -89211,35 +89628,94 @@ function registerSessionRoutes(app, deps) {
     const compactProjection = compact ? coalesceSessionEventDeltasWithCoverage2(events) : null;
     const projected = compactProjection?.events ?? events;
     const forensicExact = !compact && mode === "forensic" && payloadMode === "full" && dbPage.fullPayloadsExact;
-    const page = boundSessionEventHttpPage(projected, {
+    const page2 = boundSessionEventHttpPage(projected, {
       direction,
       eventProjection: payloadMode === "full" ? "exact" : "bounded",
       ...compactProjection ? { coveredThroughBySequence: compactProjection.coveredThroughBySequence } : {}
     });
-    const hasMore = dbPage.hasMore || page.truncated;
-    c.header("X-OpenGeni-Page-Bytes", String(page.bytes));
-    c.header("X-OpenGeni-Page-Max-Bytes", String(Math.max(1024 * 1024, page.bytes)));
+    const hasMore = dbPage.hasMore || page2.truncated;
+    c.header("X-OpenGeni-Page-Bytes", String(page2.bytes));
+    c.header("X-OpenGeni-Page-Max-Bytes", String(Math.max(1024 * 1024, page2.bytes)));
     c.header("X-OpenGeni-Page-Truncated", String(hasMore));
     c.header("X-OpenGeni-Has-More", String(hasMore));
     c.header("X-OpenGeni-Event-Mode", mode);
     c.header("X-OpenGeni-Event-Direction", direction);
     c.header("X-OpenGeni-Payload-Mode", payloadMode);
     c.header("X-OpenGeni-Forensic-Exact", String(forensicExact));
-    const coveredFirst = page.events[0]?.sequence;
-    const coveredLastEvent = page.events.at(-1);
+    const coveredFirst = page2.events[0]?.sequence;
+    const coveredLastEvent = page2.events.at(-1);
     const coveredLast = coveredLastEvent === void 0 ? void 0 : compactProjection?.coveredThroughBySequence.get(coveredLastEvent.sequence) ?? coveredLastEvent.sequence;
     if (coveredFirst !== void 0) c.header("X-OpenGeni-Covered-First", String(coveredFirst));
     if (coveredLast !== void 0) c.header("X-OpenGeni-Covered-Last", String(coveredLast));
-    const truncatedBy = page.truncated ? "http_bytes" : dbPage.truncatedBy;
+    const truncatedBy = page2.truncated ? "http_bytes" : dbPage.truncatedBy;
     if (truncatedBy) c.header("X-OpenGeni-Truncated-By", truncatedBy);
-    if (page.nextSequence !== null) {
+    if (page2.nextSequence !== null) {
       c.header(
         direction === "before" ? "X-OpenGeni-Next-Before" : "X-OpenGeni-Next-After",
-        String(page.nextSequence)
+        String(page2.nextSequence)
       );
     }
-    return c.json(page.events);
+    return c.json(page2.events);
   });
+  app.get(
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/events/:eventId/message-preview",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      await requireAccessGrant32(c, deps, workspaceId, "sessions:read");
+      const sessionId = c.req.param("sessionId");
+      await assertSessionExists(db, workspaceId, sessionId);
+      const eventId = c.req.param("eventId");
+      const rawSequence = c.req.query("sequence");
+      const sequence = Number(rawSequence);
+      if (!z27.string().uuid().safeParse(eventId).success || rawSequence === void 0 || !/^\d+$/.test(rawSequence) || !Number.isSafeInteger(sequence) || sequence < 1 || sequence > 2147483647)
+        throw new HTTPException72(400, { message: "Invalid message preview reference" });
+      const notFound = () => new HTTPException72(404, { message: "message not found" });
+      const maxUnits = 12e3;
+      const eventTable = sessionPreviewSchema.sessionEvents;
+      const candidates = await withWorkspaceRls(
+        db,
+        workspaceId,
+        (tx) => tx.select({ kind: sql`jsonb_typeof(${eventTable.payload}->'text')` }).from(eventTable).where(
+          and(
+            eq(eventTable.workspaceId, workspaceId),
+            eq(eventTable.sessionId, sessionId),
+            eq(eventTable.id, eventId),
+            eq(eventTable.sequence, sequence),
+            sql`${eventTable.type} in ('user.message', 'agent.message.completed')`
+          )
+        ).limit(1)
+      );
+      if (candidates[0]?.kind !== "string") throw notFound();
+      const read = (offset2) => listSessionEventSlices(db, workspaceId, sessionId, {
+        sourceSequence: sequence,
+        sourceOffset: offset2,
+        after: sequence - 1,
+        before: sequence + 1,
+        includeTypes: ["user.message", "agent.message.completed"],
+        view: "conversation"
+      });
+      const first = await read(0);
+      const event = first.events[0];
+      const slice = first.slices?.[sequence];
+      if (!event || event.id !== eventId || event.sequence !== sequence || !slice || slice.omitted)
+        throw notFound();
+      if (slice.total > maxUnits) return c.json({ status: "unavailable" });
+      let text = slice.text;
+      let offset = slice.unit === "utf16" ? slice.text.length : Array.from(slice.text).length;
+      if (text.length > maxUnits) return c.json({ status: "unavailable" });
+      while (offset < slice.total) {
+        if (offset === 0) throw notFound();
+        const next = await read(offset);
+        const part = next.slices?.[sequence];
+        if (next.events[0]?.id !== eventId || !part || part.omitted || part.unit !== slice.unit || part.total !== slice.total || part.offset !== offset)
+          throw notFound();
+        text += part.text;
+        offset += slice.unit === "utf16" ? part.text.length : Array.from(part.text).length;
+        if (text.length > maxUnits) return c.json({ status: "unavailable" });
+      }
+      return c.json({ status: "available", text });
+    }
+  );
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/events/stream", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant32(c, deps, workspaceId, "sessions:read");
@@ -90807,6 +91283,8 @@ function sessionAuthorizationOperationForHttp(method, pathname, sessionId) {
     return verb === "POST" ? "session.context.write" : null;
   }
   if (suffix === "/events/stream" && verb === "GET") return "session.stream.read";
+  if (/^\/events\/[^/]+\/message-preview$/.test(suffix) && verb === "GET")
+    return "session.events.read";
   if (suffix === "/events") {
     if (verb === "GET") return "session.events.read";
     if (verb === "POST") return "session.append";
@@ -92641,14 +93119,14 @@ function registerWorkspaceRoutes(app, deps) {
     const limit = boundedLimit(c.req.query("limit"));
     const fetched = await listWorkspaceControlEvents2(deps.db, workspaceId, after, limit + 1);
     const countHasMore = fetched.length > limit;
-    const page = boundWorkspaceControlHttpPage(fetched.slice(0, limit));
-    const truncated = countHasMore || page.truncated;
-    c.header("X-OpenGeni-Page-Bytes", String(page.bytes));
+    const page2 = boundWorkspaceControlHttpPage(fetched.slice(0, limit));
+    const truncated = countHasMore || page2.truncated;
+    c.header("X-OpenGeni-Page-Bytes", String(page2.bytes));
     c.header("X-OpenGeni-Page-Truncated", String(truncated));
-    if (page.nextSequence !== null) {
-      c.header("X-OpenGeni-Next-After", String(page.nextSequence));
+    if (page2.nextSequence !== null) {
+      c.header("X-OpenGeni-Next-After", String(page2.nextSequence));
     }
-    return c.json(page.events);
+    return c.json(page2.events);
   });
   app.get("/v1/workspaces/:workspaceId/control-events/stream", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -93800,10 +94278,10 @@ function preferenceLifecycle(row, generatedAt) {
   if (row.status === "superseded") return "superseded";
   return "historical";
 }
-function preferenceEntries(page, generatedAt) {
-  const visibleRevisionIds = new Set(page.rows.map((row) => row.revisionId));
-  const visiblePreferenceIds = new Set(page.rows.map((row) => row.preferenceId));
-  return page.rows.map((row) => {
+function preferenceEntries(page2, generatedAt) {
+  const visibleRevisionIds = new Set(page2.rows.map((row) => row.revisionId));
+  const visiblePreferenceIds = new Set(page2.rows.map((row) => row.preferenceId));
+  return page2.rows.map((row) => {
     const scope = row.scope === "organization" ? "organization" : row.scope === "user" ? "personal" : "workspace";
     const lifecycle2 = preferenceLifecycle(row, generatedAt);
     const relationships = [];
@@ -95367,6 +95845,7 @@ import {
   requireAccessGrant as requireAccessGrant41,
   WorkspaceInsightsFilterValidationError
 } from "@opengeni/core";
+import { currentSessionRlsActorIdentityKey } from "@opengeni/db";
 import { workspaceInsightsMetricObserver } from "@opengeni/observability";
 import { HTTPException as HTTPException85 } from "hono/http-exception";
 function normalizeWorkspaceInsightsQueryFilter(value, field) {
@@ -95379,9 +95858,36 @@ function normalizeWorkspaceInsightsQueryFilter(value, field) {
     throw error;
   }
 }
+function createInFlightCoalescer() {
+  const inFlight = /* @__PURE__ */ new Map();
+  return {
+    run(key, work) {
+      const pending = inFlight.get(key);
+      if (pending) return pending;
+      const started2 = work().finally(() => {
+        if (inFlight.get(key) === started2) inFlight.delete(key);
+      });
+      inFlight.set(key, started2);
+      return started2;
+    },
+    get size() {
+      return inFlight.size;
+    }
+  };
+}
+function workspaceInsightsCoalesceKey(input) {
+  return JSON.stringify([
+    input.workspaceId,
+    input.range,
+    input.provider,
+    input.model,
+    input.rlsActor
+  ]);
+}
 function registerInsightsRoutes(app, deps) {
   const observeRequest = workspaceInsightsMetricObserver(deps.observability);
   const observePhase = workspaceInsightsPhaseMetricObserver(deps.observability);
+  const coalesce = createInFlightCoalescer();
   app.get("/v1/workspaces/:workspaceId/insights", async (c) => {
     const startedAtMs = performance.now();
     const rangeRaw = c.req.query("range") ?? "week";
@@ -95405,16 +95911,25 @@ function registerInsightsRoutes(app, deps) {
       }
       provider = normalizeWorkspaceInsightsQueryFilter(providerRaw, "provider");
       model = normalizeWorkspaceInsightsQueryFilter(modelRaw, "model");
-      const response = await getWorkspaceInsights(
-        deps.db,
-        deps.settings,
-        {
+      const response = await coalesce.run(
+        workspaceInsightsCoalesceKey({
           workspaceId,
           range: rangeParsed.data,
           provider,
-          model
-        },
-        observePhase
+          model,
+          rlsActor: currentSessionRlsActorIdentityKey()
+        }),
+        () => getWorkspaceInsights(
+          deps.db,
+          deps.settings,
+          {
+            workspaceId,
+            range: rangeParsed.data,
+            provider,
+            model
+          },
+          observePhase
+        )
       );
       c.header("cache-control", "private, no-store");
       const result = c.json(WorkspaceInsightsResponse.parse(response));
@@ -98379,7 +98894,8 @@ function registerOrganizationMembershipRoutes(app, deps) {
           await createManagedOrganization(deps.db, {
             subjectId,
             subjectLabel: session.user.email || session.user.name,
-            ...payload
+            ...payload,
+            trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
           })
         ),
         201
@@ -99155,7 +99671,7 @@ function registerOrganizationSessionRoutes(app, deps) {
     while (index < workspaces.length && sessions.length < query.limit && reads < ORGANIZATION_SESSION_LIST_MAX_WORKSPACE_READS) {
       const workspace = workspaces[index];
       reads += 1;
-      const page = await listWorkspaceSessionPage(c, deps, {
+      const page2 = await listWorkspaceSessionPage(c, deps, {
         workspace,
         readAuthority,
         innerCursor,
@@ -99163,21 +99679,21 @@ function registerOrganizationSessionRoutes(app, deps) {
         limit: query.limit - sessions.length,
         query
       });
-      if (page === null) {
+      if (page2 === null) {
         index += 1;
         innerCursor = null;
         pinnedOffset = 0;
         continue;
       }
-      sessions.push(...page.sessions);
-      if (page.nextPinnedOffset !== null) {
+      sessions.push(...page2.sessions);
+      if (page2.nextPinnedOffset !== null) {
         innerCursor = null;
-        pinnedOffset = page.nextPinnedOffset;
+        pinnedOffset = page2.nextPinnedOffset;
         break;
       }
       pinnedOffset = 0;
-      if (page.nextCursor) {
-        innerCursor = page.nextCursor;
+      if (page2.nextCursor) {
+        innerCursor = page2.nextCursor;
       } else {
         index += 1;
         innerCursor = null;
@@ -99232,24 +99748,24 @@ async function listWorkspaceSessionPage(c, deps, input) {
       personalWorkspaceOwnerException: authorization.canonicalManagedHumanSession
     });
     const withStatus = (rows3) => input.query.status ? rows3.filter((session) => session.status === input.query.status) : rows3;
-    let page = await list(input.limit);
+    let page2 = await list(input.limit);
     let rows2;
     let nextPinnedOffset = null;
     if (cursor) {
-      rows2 = page.sessions;
+      rows2 = page2.sessions;
     } else {
-      const pinned = page.pinned.slice(input.pinnedOffset);
+      const pinned = page2.pinned.slice(input.pinnedOffset);
       if (pinned.length >= input.limit) {
         rows2 = pinned.slice(0, input.limit);
         nextPinnedOffset = input.pinnedOffset + input.limit;
         return { sessions: withStatus(rows2), nextCursor: null, nextPinnedOffset };
       }
-      if (pinned.length > 0 && page.sessions.length > input.limit - pinned.length) {
-        page = await list(input.limit - pinned.length);
+      if (pinned.length > 0 && page2.sessions.length > input.limit - pinned.length) {
+        page2 = await list(input.limit - pinned.length);
       }
-      rows2 = [...pinned, ...page.sessions];
+      rows2 = [...pinned, ...page2.sessions];
     }
-    return { sessions: withStatus(rows2), nextCursor: page.nextCursor, nextPinnedOffset };
+    return { sessions: withStatus(rows2), nextCursor: page2.nextCursor, nextPinnedOffset };
   } catch (error) {
     if (error instanceof SessionListAccessError2) {
       throw new HTTPException91(403, { message: error.message });
@@ -99591,7 +100107,8 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
             actorSubjectId: `user:${session.user.id}`,
             organizationName,
             operationId: parsed.data.operationId,
-            requestFingerprint
+            requestFingerprint,
+            trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
           })
         )
       );
@@ -99843,7 +100360,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
       "workspace:read"
     );
     try {
-      const page = await listManagedHumanUserResourceAuthorities(
+      const page2 = await listManagedHumanUserResourceAuthorities(
         deps,
         access,
         workspaceId,
@@ -99852,7 +100369,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
       return context.json(
         ListUserResourceAuthoritiesResponse.parse({
           scope: "user",
-          ...page
+          ...page2
         })
       );
     } catch (error) {
@@ -101847,16 +102364,16 @@ async function publishSlackAppHome(deps, installation, refresh, renewLease) {
     let cursor;
     do {
       await renewLease();
-      const page = await listSessionsForSubject3(deps.db, installation.workspaceId, {
+      const page2 = await listSessionsForSubject3(deps.db, installation.workspaceId, {
         subjectId: grant.subjectId,
         limit: 500,
         ...cursor ? { cursor } : {},
         ...authorizationScope ? { authorizationScope } : {}
       });
-      if (!cursor) sessions.push(...page.pinned);
-      sessions.push(...page.sessions);
-      if (!page.nextCursor) break;
-      cursor = decodeSessionListCursor3(page.nextCursor) ?? void 0;
+      if (!cursor) sessions.push(...page2.pinned);
+      sessions.push(...page2.sessions);
+      if (!page2.nextCursor) break;
+      cursor = decodeSessionListCursor3(page2.nextCursor) ?? void 0;
       if (!cursor) throw new Error("Slack App Home session cursor was invalid");
     } while (cursor);
   } catch (error) {
@@ -104167,13 +104684,13 @@ async function resolveSlackDeliveryHome(deps, interaction) {
 }
 async function deliverSlackSessionEvents(deps, interaction, claimHolderId) {
   if (!interaction.sessionId) return;
-  const page = await listSessionEventPage3(deps.db, interaction.workspaceId, interaction.sessionId, {
+  const page2 = await listSessionEventPage3(deps.db, interaction.workspaceId, interaction.sessionId, {
     after: interaction.lastDeliveredSessionEventSequence,
     limit: 100,
     includeTypes: [...SLACK_DELIVERY_EVENT_TYPES],
     maxBytes: 256 * 1024
   });
-  if (page.events.length === 0) {
+  if (page2.events.length === 0) {
     await releaseSlackInteractionDelivery(deps.db, {
       ...interaction,
       claimHolderId
@@ -104212,10 +104729,10 @@ async function deliverSlackSessionEvents(deps, interaction, claimHolderId) {
   };
   let lastSequence = interaction.lastDeliveredSessionEventSequence;
   let terminal2 = null;
-  const orderedEvents = page.events.filter(
+  const orderedEvents = page2.events.filter(
     (event) => (event.turnAssociation === null || event.turnAssociation === "current") && event.duplicateOfEventId === null
   ).sort((left, right) => left.sequence - right.sequence);
-  lastSequence = page.events.reduce(
+  lastSequence = page2.events.reduce(
     (latest, event) => Math.max(latest, event.sequence),
     lastSequence
   );
@@ -107113,4 +107630,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-24C5LPNE.js.map
+//# sourceMappingURL=chunk-PTO4RZT5.js.map