@opengeni/api-router 4.1.0 → 4.1.2

package/dist/{chunk-24C5LPNE.js → chunk-2SSU5KWV.js}

@@ -294,6 +294,8 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
   browser_open: { sessionRequired: true, allOf: ["sessions:control"] },
   browser_tabs: { sessionRequired: true, allOf: ["sessions:control"] },
   browser_observe: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_read: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_screenshot: { sessionRequired: true, allOf: ["sessions:read"] },
   browser_act: { sessionRequired: true, allOf: ["sessions:control"] },
   browser_clipboard: { sessionRequired: true, allOf: ["sessions:read"] },
   browser_debug: { sessionRequired: true, allOf: ["sessions:read"] },
@@ -4600,6 +4602,9 @@ var Name = class {
     return new SQL([this]);
   }
 };
+function isDriverValueEncoder(value) {
+  return typeof value === "object" && value !== null && "mapToDriverValue" in value && typeof value.mapToDriverValue === "function";
+}
 var noopDecoder = {
   mapFromDriverValue: (value) => value
 };
@@ -4732,6 +4737,33 @@ Subquery.prototype.getSQL = function() {
   return new SQL([this]);
 };
 
+// ../../node_modules/.bun/drizzle-orm@0.45.2+1d2c014f134ec9f4/node_modules/drizzle-orm/sql/expressions/conditions.js
+function bindIfParam(value, column) {
+  if (isDriverValueEncoder(column) && !isSQLWrapper(value) && !is(value, Param) && !is(value, Placeholder) && !is(value, Column) && !is(value, Table) && !is(value, View)) {
+    return new Param(value, column);
+  }
+  return value;
+}
+var eq = (left, right) => {
+  return sql`${left} = ${bindIfParam(right, left)}`;
+};
+function and(...unfilteredConditions) {
+  const conditions = unfilteredConditions.filter(
+    (c) => c !== void 0
+  );
+  if (conditions.length === 0) {
+    return void 0;
+  }
+  if (conditions.length === 1) {
+    return new SQL(conditions);
+  }
+  return new SQL([
+    new StringChunk("("),
+    sql.join(conditions, new StringChunk(" and ")),
+    new StringChunk(")")
+  ]);
+}
+
 // src/auth/managed-auth.ts
 import { Pool } from "pg";
 
@@ -7598,7 +7630,14 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
       inputSchema: KnowledgeSavePreparationRequest.shape
     },
     (input) => run(
-      (context) => prepareKnowledgeSave(deps.db, context, input, () => deps.getDocumentServices().embedder)
+      (context) => prepareKnowledgeSave(
+        deps.db,
+        context,
+        input,
+        () => deps.getDocumentServices().embedder,
+        void 0,
+        deps.settings
+      )
     )
   );
   server.registerTool(
@@ -7613,7 +7652,13 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
       }).extend({ view: z8.enum(["published", "needs_review"]).default("published") }).shape
     },
     (input) => run(
-      (context) => searchKnowledgeEntries(deps.db, context, input, () => deps.getDocumentServices().embedder)
+      (context) => searchKnowledgeEntries(
+        deps.db,
+        context,
+        input,
+        () => deps.getDocumentServices().embedder,
+        deps.settings
+      )
     )
   );
   server.registerTool(
@@ -7901,26 +7946,26 @@ async function listWorkspaceGitHubRepositoryBranches(deps, input, services = wor
   ])) {
     throw new GitHubRepositoryBranchAuthorityError("changed");
   }
-  const page = await services.listProviderBranches(deps, {
+  const page2 = await services.listProviderBranches(deps, {
     installationId: input.installationId,
     repositoryId: input.repositoryId,
     page: input.query.cursor,
     limit: input.query.limit
   });
-  if (!page) {
+  if (!page2) {
     throw new GitHubAppApiError(
       "The configured GitHub provider cannot list exact repository branches"
     );
   }
-  if (page.installationId !== input.installationId || page.repositoryId !== input.repositoryId || page.branches.length > input.query.limit || page.nextPage !== null && page.nextPage !== input.query.cursor + 1 || page.branches.length < input.query.limit && page.nextPage !== null) {
+  if (page2.installationId !== input.installationId || page2.repositoryId !== input.repositoryId || page2.branches.length > input.query.limit || page2.nextPage !== null && page2.nextPage !== input.query.cursor + 1 || page2.branches.length < input.query.limit && page2.nextPage !== null) {
     throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
   }
   const response = GitHubRepositoryBranchesResponseSchema.safeParse({
-    branches: page.branches.map((name) => ({
+    branches: page2.branches.map((name) => ({
       name,
-      isDefault: name === page.defaultBranch
+      isDefault: name === page2.defaultBranch
     })),
-    nextCursor: page.nextPage
+    nextCursor: page2.nextPage
   });
   if (!response.success) {
     throw new GitHubAppApiError("GitHub returned an invalid repository branches page");
@@ -8009,6 +8054,11 @@ import {
 } from "@opengeni/db";
 import { retryWhileMissing as retryWhileMissing4 } from "@opengeni/storage";
 import { HTTPException as HTTPException12 } from "hono/http-exception";
+import {
+  isConnectedMachineAbsolutePath,
+  relativeConnectedMachinePath,
+  resolveConnectedMachinePath
+} from "@opengeni/runtime/sandbox";
 
 // src/sandbox/channel-a.ts
 import {
@@ -8016,6 +8066,7 @@ import {
   hasGitCredentialRepositorySelection,
   hasGitHubRepositorySelection,
   sandboxLifecycleTransitionWaitMs,
+  sandboxWarmRateMicrosPerSecond,
   stableSandboxEnvironmentForRun
 } from "@opengeni/config";
 import { githubAppBotIdentity } from "@opengeni/github";
@@ -8034,6 +8085,7 @@ import {
   SandboxImageConflictError,
   SandboxProviderReadLockUnavailableError,
   SandboxRigConflictError,
+  SandboxPaidComputeAdmissionError,
   withSandboxProviderReadLock
 } from "@opengeni/db";
 import { appendAndPublishEvents } from "@opengeni/events";
@@ -8853,6 +8905,10 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
       holderId,
       subjectId: session.id,
       backend: session.sandboxBackend,
+      warmBilling: {
+        mode: settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond(settings, session.sandboxBackend)
+      },
       os: session.sandboxOs,
       image: sandboxRuntime.image,
       rigVersionId: session.rigVersionId,
@@ -9153,6 +9209,8 @@ async function withChannelAOperation(services, ctx, readOnly, fn) {
 }
 function mapChannelAError(error, waitSignal) {
   if (error instanceof HTTPException6) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError)
+    return new HTTPException6(402, { message: error.message, cause: error });
   if (isChannelARequestCancellation(error, waitSignal))
     return new HTTPException6(499, {
       message: "request cancelled",
@@ -9335,6 +9393,7 @@ import {
   retainedGeneratedImageReferenceFromFile,
   retainedGeneratedVideoReferenceFromFile,
   retainedScreenshotReferenceFromFile,
+  retainedSessionScreenshotKindFromObjectKey,
   VideoArtifactPlaybackSource,
   resolveRetainedOutputRange
 } from "@opengeni/contracts";
@@ -9631,7 +9690,13 @@ function buildDocumentsMcpServer(db, accountId, workspaceId, documentServices, o
         {
           type: "text",
           text: JSON.stringify(
-            await searchKnowledgeEntries2(db, context, input, () => documentServices.embedder)
+            await searchKnowledgeEntries2(
+              db,
+              context,
+              input,
+              () => documentServices.embedder,
+              options.settings
+            )
           )
         }
       ]
@@ -9917,7 +9982,8 @@ async function prepareWorkspaceToolGatewayForGrantInternal(routeDeps, grant, all
           grant.workspaceId,
           routeDeps.getDocumentServices(),
           {
-            knowledge: await knowledgeContextForGateway(routeDeps, grant)
+            knowledge: await knowledgeContextForGateway(routeDeps, grant),
+            settings: gatewaySettings
           }
         )
       )
@@ -11718,12 +11784,15 @@ function retainedGeneratedImageMetadata(artifact) {
 }
 function retainedScreenshotMetadata(artifact) {
   if (artifact.status === "ready" && artifact.sessionId && artifact.retentionExpiresAt.getTime() > Date.now()) {
+    const kind = retainedSessionScreenshotKindFromObjectKey(artifact.file.objectKey);
+    if (!kind) return retainedArtifactUnavailable(artifact.artifactId, "invalid_content");
     const reference = retainedScreenshotReferenceFromFile({
       ...artifact.file,
       sessionId: artifact.sessionId,
       width: artifact.width,
       height: artifact.height,
-      expiresAt: artifact.retentionExpiresAt.toISOString()
+      expiresAt: artifact.retentionExpiresAt.toISOString(),
+      kind
     });
     if (reference) return reference;
   }
@@ -11798,13 +11867,12 @@ async function publishSandboxFileArtifactInScope(deps, input) {
       message: "object storage cannot verify immutable artifact files"
     });
   }
-  const path = sandboxArtifactRelativePath(input.path);
   const maxArtifactBytes = Math.min(SANDBOX_FILE_ARTIFACT_MAX_BYTES, storage.maxSinglePutSizeBytes);
   if (maxArtifactBytes < 1) {
     throw new HTTPException12(503, { message: "object storage cannot accept artifact files" });
   }
   const readLimit = Math.min(25 * 1024 * 1024, maxArtifactBytes + FILE_READ_SENTINEL_BYTES);
-  const read = await withChannelARead(
+  const { path, sandboxPath, read } = await withChannelARead(
     {
       db: deps.db,
       settings: deps.settings,
@@ -11819,7 +11887,7 @@ async function publishSandboxFileArtifactInScope(deps, input) {
       ...input.signal ? { waitSignal: input.signal } : {},
       operation: "artifact.publish"
     },
-    ({ service }) => service.fsRead({ path, encoding: "base64", maxBytes: readLimit })
+    ({ service }) => readSandboxArtifactFile(service, input.path, readLimit)
   );
   if (read.truncated || read.sizeBytes > maxArtifactBytes) {
     throw new HTTPException12(413, {
@@ -11929,42 +11997,46 @@ async function publishSandboxFileArtifactInScope(deps, input) {
   });
   return SandboxFileArtifactReceipt.parse({
     type: "sandbox_file",
-    sandboxPath: `/workspace/${path}`,
+    sandboxPath,
     filename,
     artifact
   });
 }
-function sandboxArtifactRelativePath(value) {
+async function readSandboxArtifactFile(service, value, maxBytes) {
+  const root2 = service.capabilities().FileSystem.root;
+  const path = sandboxArtifactRelativePath(value, root2);
+  const sandboxPath = resolveConnectedMachinePath(root2, path);
+  const read = await service.fsRead({ path, encoding: "base64", maxBytes });
+  return { path, sandboxPath, read };
+}
+function sandboxArtifactRelativePath(value, workspaceRoot = "/workspace") {
   let path = value.trim();
   if (path.startsWith("sandbox:")) {
     path = path.slice("sandbox:".length);
   }
-  if (path === "/workspace" || path === "/workspace/") {
+  if (!path || /[\\/]$/.test(path)) {
     throw new HTTPException12(400, { message: "sandbox artifact path must name a file" });
   }
-  if (path.startsWith("/workspace/")) {
-    path = path.slice("/workspace/".length);
-  } else if (path.startsWith("/")) {
+  let absolute;
+  let relative;
+  try {
+    if (!isConnectedMachineAbsolutePath(workspaceRoot)) throw new Error("Missing workspace root");
+    absolute = resolveConnectedMachinePath(workspaceRoot, path);
+    relative = relativeConnectedMachinePath(workspaceRoot, absolute);
+  } catch {
     throw new HTTPException12(400, {
-      message: "sandbox artifact path must be inside /workspace"
+      message: "sandbox artifact path is invalid for this workspace"
     });
   }
-  if (!path) {
-    throw new HTTPException12(400, { message: "sandbox artifact path must name a file" });
-  }
-  if (path.includes("\0")) {
-    throw new HTTPException12(400, { message: "sandbox artifact path is invalid" });
-  }
-  const normalized = posix.normalize(path);
-  if (normalized === "." || normalized === ".." || normalized.startsWith("../") || normalized.endsWith("/")) {
+  if (!relative) {
     throw new HTTPException12(400, {
-      message: "sandbox artifact path must canonically name a file inside /workspace"
+      message: "sandbox artifact path must name a file inside the active workspace root"
     });
   }
-  if (`/workspace/${normalized}`.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
+  if (absolute.length > SANDBOX_ARTIFACT_ABSOLUTE_PATH_MAX_CHARS) {
     throw new HTTPException12(400, { message: "sandbox artifact path is too long" });
   }
-  return normalized;
+  return relative;
 }
 function sandboxArtifactSafeFilename(filename) {
   return sanitizeFilename(filename).slice(0, SANDBOX_ARTIFACT_SAFE_FILENAME_MAX_CHARS);
@@ -15624,16 +15696,16 @@ function capEventPayload(event, perFieldChars) {
 function prettyJsonBytes(value) {
   return Buffer.byteLength(JSON.stringify(value, null, 2), "utf8");
 }
-function setMeasuredBytes(page) {
-  let measured = page.bytes;
+function setMeasuredBytes(page2) {
+  let measured = page2.bytes;
   for (let attempt = 0; attempt < 8; attempt += 1) {
-    page.bytes = measured;
-    const next = prettyJsonBytes(page);
+    page2.bytes = measured;
+    const next = prettyJsonBytes(page2);
     if (next === measured) return next;
     measured = next;
   }
-  page.bytes = measured;
-  return prettyJsonBytes(page);
+  page2.bytes = measured;
+  return prettyJsonBytes(page2);
 }
 function boundSessionEventMcpPage(input) {
   const maxBytes = Math.max(8 * 1024, input.maxBytes ?? SESSION_EVENT_MCP_MAX_BYTES);
@@ -15655,7 +15727,7 @@ function boundSessionEventMcpPage(input) {
     if (modelRowsDropped) reasons.push("model_bytes");
     const nextAfter = input.direction === "after" ? last ?? input.after : null;
     const nextBefore = input.direction === "before" ? first ?? input.before : null;
-    const page2 = {
+    const page3 = {
       mode: input.mode,
       payloadMode: input.payloadMode,
       direction: input.direction,
@@ -15675,20 +15747,20 @@ function boundSessionEventMcpPage(input) {
       bytes: 0,
       maxBytes
     };
-    setMeasuredBytes(page2);
-    return page2;
+    setMeasuredBytes(page3);
+    return page3;
   };
-  let page = build();
-  while (page.bytes > maxBytes && events.length > 0) {
+  let page2 = build();
+  while (page2.bytes > maxBytes && events.length > 0) {
     if (input.direction === "before") events.shift();
     else events.pop();
     modelRowsDropped = true;
-    page = build();
+    page2 = build();
   }
-  if (page.bytes > maxBytes) {
+  if (page2.bytes > maxBytes) {
     throw new RangeError(`Session-event MCP metadata exceeds its ${maxBytes}-byte envelope`);
   }
-  return page;
+  return page2;
 }
 function modelStringProjection(value, maxBytes) {
   const originalBytes = Buffer.byteLength(value, "utf8");
@@ -16145,9 +16217,9 @@ function boundRigDetailMcp(rig, versionsPage, changesPage, maxBytes = RIG_DETAIL
 }
 
 // src/mcp/child-read-evidence.ts
-function completeChildReadSequences(page) {
-  if (!page.sourceExact || !["conversation", "results"].includes(page.view)) return [];
-  return page.events.filter((event) => {
+function completeChildReadSequences(page2) {
+  if (!page2.sourceExact || !["conversation", "results"].includes(page2.view)) return [];
+  return page2.events.filter((event) => {
     if (event.sourceOmitted) return false;
     if (event.fragment === void 0) return true;
     if (!event.fragment || typeof event.fragment !== "object") return false;
@@ -17042,7 +17114,7 @@ function boundScheduledTaskMcpPage(input) {
     const rowsDroppedForBytes = droppedTasks.length > 0;
     const hasMore = input.sourceHasMore || rowsDroppedForBytes;
     const nextOffset = hasMore && input.tasks.length > 0 ? input.offset + input.tasks.length : null;
-    const page2 = {
+    const page3 = {
       tasks: summaries,
       page: {
         limit: input.limit,
@@ -17070,20 +17142,20 @@ function boundScheduledTaskMcpPage(input) {
       }
     };
     settleMeasuredBytes(
-      page2,
-      () => page2.projection.bytes,
+      page3,
+      () => page3.projection.bytes,
       (bytes) => {
-        page2.projection.bytes = bytes;
+        page3.projection.bytes = bytes;
       }
     );
-    return page2;
+    return page3;
   };
-  let page = build();
-  while (page.projection.bytes > maxBytes && summaries.length > 0) {
+  let page2 = build();
+  while (page2.projection.bytes > maxBytes && summaries.length > 0) {
     summaries = summaries.slice(0, -1);
-    page = build();
+    page2 = build();
   }
-  return page;
+  return page2;
 }
 
 // src/sandbox/viewer.ts
@@ -17094,6 +17166,7 @@ import {
   hasGitHubRepositorySelection as hasGitHubRepositorySelection2,
   resolveStreamTokenSecret,
   sandboxLifecycleTransitionWaitMs as sandboxLifecycleTransitionWaitMs2,
+  sandboxWarmRateMicrosPerSecond as sandboxWarmRateMicrosPerSecond2,
   stableSandboxEnvironmentForRun as stableSandboxEnvironmentForRun2
 } from "@opengeni/config";
 import { githubAppBotIdentity as githubAppBotIdentity2 } from "@opengeni/github";
@@ -17103,7 +17176,7 @@ import {
   getSandbox as getSandbox2,
   getScheduledScopedRigVersionMetadata as getScheduledScopedRigVersionMetadata2,
   getSandboxSessionEnvelope as getSandboxSessionEnvelope2,
-  heartbeatLeaseHolder,
+  heartbeatLeaseHolderStatus,
   loadWorkspaceEnvironmentForRun as loadWorkspaceEnvironmentForRun2,
   markSandboxProviderReady,
   markWarmLeaseInstanceLost as markWarmLeaseInstanceLost2,
@@ -17113,6 +17186,7 @@ import {
   releaseLeaseHolder as releaseLeaseHolder2,
   SandboxLeaseSupersededError as SandboxLeaseSupersededError2,
   SandboxViewerAdmissionBlockedError,
+  SandboxPaidComputeAdmissionError as SandboxPaidComputeAdmissionError2,
   getSessionAuthorityEpoch,
   namedSubjectHasLiveWorkspaceAuthority
 } from "@opengeni/db";
@@ -17242,6 +17316,10 @@ async function attachViewer(services, input) {
       ...attachSubjectId ? { viewerSubjectId: attachSubjectId } : {},
       ...attachAuthorityEpoch !== null ? { viewerAuthorityEpoch: attachAuthorityEpoch } : {},
       backend: session.sandboxBackend,
+      warmBilling: {
+        mode: settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond2(settings, session.sandboxBackend)
+      },
       os: session.sandboxOs,
       image: sandboxRuntime.image,
       rigVersionId: session.rigVersionId,
@@ -17251,6 +17329,9 @@ async function attachViewer(services, input) {
       ...input.waitSignal ? { waitSignal: input.waitSignal } : {}
     });
   } catch (error) {
+    if (error instanceof SandboxPaidComputeAdmissionError2) {
+      throw new HTTPException19(402, { message: error.message, cause: error });
+    }
     if (error instanceof SandboxViewerAdmissionBlockedError) {
       throw new HTTPException19(error.reason === "balance" ? 402 : 429, {
         message: error.reason === "balance" ? "insufficient OpenGeni credits for an idle sandbox viewer" : "workspace sandbox warm allowance exhausted",
@@ -17437,16 +17518,17 @@ async function ensureSessionGroupReady(services, input) {
   throw lastError ?? new Error("sandbox readiness could not be established");
 }
 async function heartbeatViewer(services, input) {
-  const alive = await heartbeatLeaseHolder(services.db, {
+  const status = await heartbeatLeaseHolderStatus(services.db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     sandboxGroupId: input.sandboxGroupId,
     kind: "viewer",
     holderId: input.viewerId,
     leaseTtlMs: services.settings.sandboxLeaseTtlMs,
-    expectedEpoch: input.expectedEpoch
+    expectedEpoch: input.expectedEpoch,
+    billingMode: services.settings.sandboxWarmBillingMode
   });
-  if (!alive) return false;
+  if (!status.leaseExtended) return status.holderAlive && status.fence === "funding";
   const lease = await readLease2(services.db, input.workspaceId, input.sandboxGroupId);
   if (lease?.liveness === "warm" && lease.leaseEpoch === input.expectedEpoch && lease.instanceId) {
     await renewSandboxProviderExpiration({
@@ -18326,7 +18408,7 @@ var OpenGeniSlackBotClient = class {
       let reactedMessage = null;
       const checkpointCreatedAtMs = restored?.state.createdAtMs ?? Date.now();
       const firstPage = restored?.state.pageCount ?? 0;
-      for (let page = firstPage; page < MAX_REACTION_CONTEXT_PAGES; page += 1) {
+      for (let page2 = firstPage; page2 < MAX_REACTION_CONTEXT_PAGES; page2 += 1) {
         const payload = await this.call(headers, "conversations.replies", {
           channel: input.channelId,
           // Slack accepts either the parent timestamp or a message timestamp from
@@ -18350,7 +18432,7 @@ var OpenGeniSlackBotClient = class {
           throw new SlackBotProviderError("reaction_pagination_invalid");
         }
         seenCursors.add(nextCursor);
-        const pageCount = page + 1;
+        const pageCount = page2 + 1;
         if (pageCount >= MAX_REACTION_CONTEXT_PAGES) {
           throw new SlackBotProviderError("reaction_pagination_exhausted");
         }
@@ -18576,14 +18658,14 @@ var OpenGeniSlackBotClient = class {
       if (offset > content.length) {
         throw new SlackBotProviderError("invalid_file_offset");
       }
-      const page = content.slice(offset, offset + SLACK_FILE_CONTENT_PAGE_CHARS);
-      const nextOffset = offset + page.length < content.length ? offset + page.length : null;
+      const page2 = content.slice(offset, offset + SLACK_FILE_CONTENT_PAGE_CHARS);
+      const nextOffset = offset + page2.length < content.length ? offset + page2.length : null;
       return {
         channel: info,
         file,
         contentType,
         offset,
-        content: page,
+        content: page2,
         nextOffset,
         truncated: nextOffset !== null
       };
@@ -18985,7 +19067,7 @@ var OpenGeniSlackBotClient = class {
     let cursor = null;
     let matchedTimestamp = null;
     let exhausted = false;
-    for (let page = 0; page < MAX_SLACK_POST_RECONCILIATION_PAGES; page += 1) {
+    for (let page2 = 0; page2 < MAX_SLACK_POST_RECONCILIATION_PAGES; page2 += 1) {
       const payload = await this.call(headers, method, {
         channel: input.channelId,
         limit: String(input.threadTimestamp ? MAX_THREAD_PAGE : MAX_HISTORY_PAGE),
@@ -20092,13 +20174,13 @@ function nextSlackFilesListPage(payload, requested, returnedFileCount) {
   }
   const count = paging?.count;
   const total = paging?.total;
-  const page = paging?.page;
+  const page2 = paging?.page;
   const pages = paging?.pages;
-  if (!positiveSafeInt(count) || !nonNegativeSafeInt(total) || !positiveSafeInt(page) || !nonNegativeSafeInt(pages) || count !== requested.count || page !== requested.page || returnedFileCount > count || pages !== (total === 0 ? 0 : Math.ceil(total / count)) || page > Math.max(1, pages)) {
+  if (!positiveSafeInt(count) || !nonNegativeSafeInt(total) || !positiveSafeInt(page2) || !nonNegativeSafeInt(pages) || count !== requested.count || page2 !== requested.page || returnedFileCount > count || pages !== (total === 0 ? 0 : Math.ceil(total / count)) || page2 > Math.max(1, pages)) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
-  if (page >= pages) return null;
-  const nextPage = page + 1;
+  if (page2 >= pages) return null;
+  const nextPage = page2 + 1;
   if (!positiveSafeInt(nextPage)) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
@@ -20459,14 +20541,14 @@ var FikenClient = class {
   resolveCredential;
   expectedConnectionVersion;
   async listCompanies(input = {}) {
-    const { payload, page } = await this.request("companies.list", "GET", "/companies", {
+    const { payload, page: page2 } = await this.request("companies.list", "GET", "/companies", {
       query: pageQuery(input)
     });
-    return { companies: projectArray(payload), page };
+    return { companies: projectArray(payload), page: page2 };
   }
   async listContacts(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "contacts.list",
       "GET",
       `/companies/${slug}/contacts`,
@@ -20482,7 +20564,7 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, contacts: projectArray(payload), page };
+    return { companySlug: slug, contacts: projectArray(payload), page: page2 };
   }
   async createContact(input) {
     const slug = this.companySlugFor(input.companySlug);
@@ -20508,7 +20590,7 @@ var FikenClient = class {
   }
   async listProducts(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "products.list",
       "GET",
       `/companies/${slug}/products`,
@@ -20520,11 +20602,11 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, products: projectArray(payload), page };
+    return { companySlug: slug, products: projectArray(payload), page: page2 };
   }
   async listInvoices(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "invoices.list",
       "GET",
       `/companies/${slug}/invoices`,
@@ -20539,7 +20621,7 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, invoices: projectArray(payload), page };
+    return { companySlug: slug, invoices: projectArray(payload), page: page2 };
   }
   async getInvoice(input) {
     const slug = this.companySlugFor(input.companySlug);
@@ -20623,7 +20705,7 @@ var FikenClient = class {
   }
   async listBankAccounts(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "bank_accounts.list",
       "GET",
       `/companies/${slug}/bankAccounts`,
@@ -20634,11 +20716,11 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, bankAccounts: projectArray(payload), page };
+    return { companySlug: slug, bankAccounts: projectArray(payload), page: page2 };
   }
   async listPurchases(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request(
+    const { payload, page: page2 } = await this.request(
       "purchases.list",
       "GET",
       `/companies/${slug}/purchases`,
@@ -20651,11 +20733,11 @@ var FikenClient = class {
         }
       }
     );
-    return { companySlug: slug, purchases: projectArray(payload), page };
+    return { companySlug: slug, purchases: projectArray(payload), page: page2 };
   }
   async listSales(input) {
     const slug = this.companySlugFor(input.companySlug);
-    const { payload, page } = await this.request("sales.list", "GET", `/companies/${slug}/sales`, {
+    const { payload, page: page2 } = await this.request("sales.list", "GET", `/companies/${slug}/sales`, {
       query: {
         ...pageQuery(input),
         ...input.dateGe ? { dateGe: input.dateGe } : {},
@@ -20663,7 +20745,7 @@ var FikenClient = class {
         ...input.settled !== void 0 ? { settled: String(input.settled) } : {}
       }
     });
-    return { companySlug: slug, sales: projectArray(payload), page };
+    return { companySlug: slug, sales: projectArray(payload), page: page2 };
   }
   /**
    * The company scope for a call: an explicit slug wins, then the connection's
@@ -20865,11 +20947,11 @@ function boundedInt2(value, max, fallback) {
   return Math.min(value, max);
 }
 function pageFromHeaders(headers) {
-  const page = headerInt(headers, "fiken-api-page");
+  const page2 = headerInt(headers, "fiken-api-page");
   const pageSize = headerInt(headers, "fiken-api-page-size");
-  if (page === null || pageSize === null) return null;
+  if (page2 === null || pageSize === null) return null;
   return {
-    page,
+    page: page2,
     pageSize,
     pageCount: headerInt(headers, "fiken-api-page-count"),
     resultCount: headerInt(headers, "fiken-api-result-count")
@@ -21828,24 +21910,24 @@ async function getAtlassianLiveItem(deps, input) {
     );
     url.searchParams.set("body-format", "storage");
     try {
-      const page = objectRecord(
+      const page2 = objectRecord(
         await atlassianApiRequest(deps, { ...input, url, label: "Confluence live page" })
       );
       const source = sources.find(
-        (candidate) => candidate.resourceId === optionalString(page.spaceId)
+        (candidate) => candidate.resourceId === optionalString(page2.spaceId)
       );
       if (!source) continue;
       const comments = await readConfluenceLiveComments(deps, input, cloudId);
-      const webUi = optionalString(objectRecord(page._links).webui);
+      const webUi = optionalString(objectRecord(page2._links).webui);
       return {
         kind: "confluence_page",
-        id: requiredString2(page.id, "page.id"),
-        title: requiredString2(page.title, "page.title"),
+        id: requiredString2(page2.id, "page.id"),
+        title: requiredString2(page2.title, "page.title"),
         source: { id: source.id, name: source.name, siteName: source.siteName },
-        status: optionalString(page.status),
-        createdAt: optionalString(page.createdAt),
-        updatedAt: optionalString(objectRecord(page.version).createdAt),
-        content: optionalString(objectRecord(objectRecord(page.body).storage).value) ?? "",
+        status: optionalString(page2.status),
+        createdAt: optionalString(page2.createdAt),
+        updatedAt: optionalString(objectRecord(page2.version).createdAt),
+        content: optionalString(objectRecord(objectRecord(page2.body).storage).value) ?? "",
         comments,
         url: webUi ? new URL(webUi.startsWith("/wiki/") ? webUi : `/wiki${webUi}`, source.siteUrl).toString() : source.siteUrl
       };
@@ -22359,7 +22441,7 @@ async function materializeSchedules(deps, input) {
 async function browseJiraProjects(deps, input, site) {
   const items = [];
   let startAt = 0;
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const url = new URL(
       `https://api.atlassian.com/ex/jira/${encodeURIComponent(site.cloudId)}/rest/api/3/project/search`
     );
@@ -22402,7 +22484,7 @@ async function browseConfluenceSpaces(deps, input, site) {
   let url = new URL(
     `https://api.atlassian.com/ex/confluence/${encodeURIComponent(site.cloudId)}/wiki/api/v2/spaces?limit=100`
   );
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const payload = objectRecord(
       await atlassianApiRequest(deps, { ...input, url, label: "Confluence spaces" })
     );
@@ -22802,7 +22884,7 @@ function cqlString(value) {
 async function readJiraLiveComments(deps, input, cloudId) {
   const comments = [];
   let startAt = 0;
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const url = new URL(
       `https://api.atlassian.com/ex/jira/${encodeURIComponent(cloudId)}/rest/api/3/issue/${encodeURIComponent(input.id)}/comment`
     );
@@ -22830,7 +22912,7 @@ async function readJiraLiveComments(deps, input, cloudId) {
 async function readConfluenceLiveComments(deps, input, cloudId) {
   const comments = [];
   let cursor = null;
-  for (let page = 0; page < 20; page += 1) {
+  for (let page2 = 0; page2 < 20; page2 += 1) {
     const url = new URL(
       `https://api.atlassian.com/ex/confluence/${encodeURIComponent(cloudId)}/wiki/api/v2/pages/${encodeURIComponent(input.id)}/footer-comments`
     );
@@ -27285,9 +27367,9 @@ function registerFikenTools(server, deps, grant, sessionId, json) {
         ...pageInputs
       }
     },
-    async ({ connectionId, page, pageSize }) => json(
+    async ({ connectionId, page: page2, pageSize }) => json(
       await (await clientFor(connectionId)).listCompanies({
-        ...page !== void 0 ? { page } : {},
+        ...page2 !== void 0 ? { page: page2 } : {},
         ...pageSize !== void 0 ? { pageSize } : {}
       })
     )
@@ -29223,7 +29305,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           if (decodedCursor && decodedCursor.updatedAfter !== (normalizedUpdatedAfter ?? null)) {
             throw new Error("sessions_list cursor does not match updatedAfter");
           }
-          const page = await listSessionDiscoverySummaries(deps.db, grant.workspaceId, {
+          const page2 = await listSessionDiscoverySummaries(deps.db, grant.workspaceId, {
             limit: boundedSessionDiscoveryLimit(limit),
             ...decodedCursor ? { cursor: decodedCursor } : {},
             includeLastMessage: includeLastMessage === true,
@@ -29243,7 +29325,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
             subjectId: grant.subjectId,
             ...authorizationScope ? { authorizationScope } : {}
           });
-          const result = detail === "full" ? capSessionDiscoveryPage(page, includeLastMessage === true) : capSessionDiscoveryCompactPage(page, {
+          const result = detail === "full" ? capSessionDiscoveryPage(page2, includeLastMessage === true) : capSessionDiscoveryCompactPage(page2, {
             includeLastMessage: includeLastMessage === true,
             includeRelatedWork: relatedWorkRequested
           });
@@ -29409,8 +29491,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         }
         if (view !== "debug" && !auditRequested) {
           const { readSessionEventView } = await import("./session-event-view-MU3HMNV3.js");
-          const { listSessionEventSlices } = await import("@opengeni/db/session-event-slices");
-          const page2 = await readSessionEventView(
+          const { listSessionEventSlices: listSessionEventSlices2 } = await import("@opengeni/db/session-event-slices");
+          const page3 = await readSessionEventView(
             {
               sessionId,
               view,
@@ -29423,7 +29505,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
               direction: requestedDirection,
               limit
             },
-            (options) => listSessionEventSlices(
+            (options) => listSessionEventSlices2(
               deps.db,
               grant.workspaceId,
               sessionId,
@@ -29431,8 +29513,8 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
               (legacyOptions) => listSessionEventPage(deps.db, grant.workspaceId, sessionId, legacyOptions)
             )
           );
-          await acknowledgeReads([{ sessionId, sequences: completeChildReadSequences(page2) }]);
-          return json(page2);
+          await acknowledgeReads([{ sessionId, sequences: completeChildReadSequences(page3) }]);
+          return json(page3);
         }
         if (cursor !== void 0 || callId !== void 0 || includeArguments !== void 0 || includeOutput !== void 0) {
           throw new Error("cursor/callId/includeArguments/includeOutput require a non-debug view");
@@ -29477,7 +29559,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           }
           return json(result);
         }
-        const page = boundSessionEventMcpPage({
+        const page2 = boundSessionEventMcpPage({
           events: dbPage.events,
           mode,
           payloadMode,
@@ -29487,12 +29569,12 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
           after: after ?? 0,
           before: before ?? null
         });
-        if (payloadMode === "full" && dbPage.fullPayloadsExact && !page.truncation?.reasons.includes("model_payload")) {
+        if (payloadMode === "full" && dbPage.fullPayloadsExact && !page2.truncation?.reasons.includes("model_payload")) {
           await acknowledgeReads([
-            { sessionId, sequences: page.events.map((event) => event.sequence) }
+            { sessionId, sequences: page2.events.map((event) => event.sequence) }
           ]);
         }
-        return json(page);
+        return json(page2);
       }
     );
     server.registerTool(
@@ -29548,7 +29630,7 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
               }
             },
             readTargetEvents: async (target) => {
-              const page = await listSessionEventPage(deps.db, workspaceId, target.sessionId, {
+              const page2 = await listSessionEventPage(deps.db, workspaceId, target.sessionId, {
                 after: target.afterSequence,
                 direction: "after",
                 limit: SESSION_WAIT_EVENTS_PER_TARGET,
@@ -29556,10 +29638,10 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
                 includeTypes: targetEventTypes,
                 maxBytes: SESSION_EVENT_MCP_MAX_BYTES * 4
               });
-              if (!page.fullPayloadsExact) {
-                for (const event of page.events) incompleteWaitEvents.add(event.id);
+              if (!page2.fullPayloadsExact) {
+                for (const event of page2.events) incompleteWaitEvents.add(event.id);
               }
-              return { events: page.events, hasMore: page.hasMore };
+              return { events: page2.events, hasMore: page2.hasMore };
             },
             readOwnPendingUpdateKinds: ownSessionId === null ? null : async () => (await listOutstandingSessionSystemUpdates(deps.db, workspaceId, ownSessionId)).map((update) => update.kind),
             subscribe: (targetSessionId, onEvents) => deps.bus.subscribe(workspaceId, targetSessionId, onEvents)
@@ -30443,9 +30525,12 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
   };
   const setupProjections = async (items) => {
     const availableServerIds = /* @__PURE__ */ new Set();
+    const availableFirstPartyTools = /* @__PURE__ */ new Set();
     const acceptedServerIds = /* @__PURE__ */ new Set();
     let accountSelectionKnown = false;
-    if (items.some((item) => item.enabled && item.connectionRef)) {
+    if (items.some(
+      (item) => item.enabled && (item.connectionRef || item.surfaceType === "first_party_fiken")
+    )) {
       const claims = exactAgentCommandContext(grant, sessionId);
       const attemptCatalog = await getAttemptToolCatalog2(deps.db, {
         accountId: grant.accountId,
@@ -30453,7 +30538,11 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
         attemptId: claims.callerAttemptId
       });
       if (attemptCatalog?.sessionId === sessionId && attemptCatalog.turnId === claims.callerTurnId && attemptCatalog.executionGeneration === claims.callerExecutionGeneration) {
-        for (const entry2 of attemptCatalog.entries) availableServerIds.add(entry2.identity.serverId);
+        for (const entry2 of attemptCatalog.entries) {
+          availableServerIds.add(entry2.identity.serverId);
+          if (entry2.identity.serverId === "opengeni")
+            availableFirstPartyTools.add(entry2.identity.toolName);
+        }
         const bindings = await getSessionTurnMcpAccountBindings(
           deps.db,
           grant.workspaceId,
@@ -30474,7 +30563,9 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
           item,
           availableServerIds,
           acceptedServerIds,
-          accountSelectionKnown
+          accountSelectionKnown,
+          availableFirstPartyTools,
+          new Set(grant.metadata?.firstPartyMcpTools ?? [])
         )
       )
     );
@@ -30593,7 +30684,38 @@ function registerCapabilityDiscoveryTools(server, deps, grant, sessionId, json)
     }
   );
 }
-async function capabilitySetupProjection(deps, workspaceId, item, availableServerIds, acceptedServerIds, accountSelectionKnown) {
+async function capabilitySetupProjection(deps, workspaceId, item, availableServerIds, acceptedServerIds, accountSelectionKnown, availableFirstPartyTools, selectedFirstPartyTools) {
+  if (item.surfaceType === "first_party_fiken") {
+    if (!item.enabled || item.metadata.connectionStatus !== "active") {
+      return {
+        status: "authorization_required",
+        action: "connect",
+        detail: item.metadata.connectionStatus === "needs_reauth" ? "The workspace Fiken connection needs reconnection." : "Connect Fiken through the protected setup form."
+      };
+    }
+    const selected = FIRST_PARTY_MCP_TOOL_NAMES2.filter(
+      (name) => name.startsWith("fiken_") && selectedFirstPartyTools.has(name)
+    );
+    if (selected.length === 0) {
+      return {
+        status: "authorization_required",
+        action: "enable",
+        detail: "Fiken is connected, but its tools are not selected for this conversation. Ask the user to add its tools through the setup card, then send a new message."
+      };
+    }
+    if (selected.some((name) => availableFirstPartyTools.has(name))) {
+      return {
+        status: "ready",
+        action: null,
+        detail: "Fiken is connected and has tools available in this turn."
+      };
+    }
+    return {
+      status: "unavailable",
+      action: null,
+      detail: "Fiken is connected, but its selected tools are unavailable in this execution. Check tool permissions and setup before retrying; reconnection is not required by this status."
+    };
+  }
   if (item.id === "api:github-app" || item.surfaceType === "first_party_github") {
     const missing = githubAppMissingSettings(deps.settings);
     if (missing.length > 0) {
@@ -30947,9 +31069,9 @@ function decodeSessionDiscoveryCursor(value) {
     throw new Error("sessions_list cursor is invalid");
   }
 }
-function capSessionDiscoveryCompactPage(page, options = {}, maxBytes = SESSION_DISCOVERY_PAGE_MAX_BYTES) {
+function capSessionDiscoveryCompactPage(page2, options = {}, maxBytes = SESSION_DISCOVERY_PAGE_MAX_BYTES) {
   let previewBytes = 0;
-  const projected = page.sessions.map((session) => {
+  const projected = page2.sessions.map((session) => {
     const row = {
       ...compactSessionMcpListRow(session, options.includeRelatedWork),
       ...options.includeLastMessage && session.queuedPromptCount > 0 ? { queuedPromptCount: session.queuedPromptCount } : {}
@@ -30986,24 +31108,24 @@ function capSessionDiscoveryCompactPage(page, options = {}, maxBytes = SESSION_D
   let kept = projected;
   const build = () => {
     const dropped = kept.length < projected.length;
-    const last = page.sessions[kept.length - 1];
+    const last = page2.sessions[kept.length - 1];
     const cursor = dropped && last ? {
-      orderBy: page.orderBy,
+      orderBy: page2.orderBy,
       sortRank: last.sortRank,
       sortRevision: last.sortRevision,
       sortAt: last.sortAt,
       id: last.id,
-      snapshotAt: page.snapshotAt,
-      snapshotRevision: page.snapshotRevision,
-      updatedAfter: page.updatedAfter,
-      filterHash: page.filterHash,
-      ...page.originSiteId ? { originSiteId: page.originSiteId } : {}
-    } : page.nextCursor;
+      snapshotAt: page2.snapshotAt,
+      snapshotRevision: page2.snapshotRevision,
+      updatedAfter: page2.updatedAfter,
+      filterHash: page2.filterHash,
+      ...page2.originSiteId ? { originSiteId: page2.originSiteId } : {}
+    } : page2.nextCursor;
     return {
       sessions: kept,
-      total: page.total,
+      total: page2.total,
       nextCursor: cursor ? encodeSessionDiscoveryCursor(cursor) : null,
-      ...page.orderBy === "updatedAt" ? { updatedThrough: page.updatedThrough } : {},
+      ...page2.orderBy === "updatedAt" ? { updatedThrough: page2.updatedThrough } : {},
       ...dropped ? {
         responseTruncated: true,
         truncationReason: `response exceeded ${maxBytes} bytes; continue with nextCursor`
@@ -31020,8 +31142,8 @@ function capSessionDiscoveryCompactPage(page, options = {}, maxBytes = SESSION_D
   }
   return result;
 }
-function capSessionDiscoveryPage(page, includeLastMessage) {
-  const projected = page.sessions.map((session) => {
+function capSessionDiscoveryPage(page2, includeLastMessage) {
+  const projected = page2.sessions.map((session) => {
     const title = capSessionDiscoveryText(session.title, 200, session.titleOriginalChars);
     const goal = session.goal ? capSessionDiscoveryText(
       session.goal.text,
@@ -31108,29 +31230,29 @@ function capSessionDiscoveryPage(page, includeLastMessage) {
     }).length : 0;
     const lastKept = kept.at(-1);
     const droppedForByteCap = kept.length < projected.length;
-    const sourceLast = lastKept ? page.sessions.find((session) => session.id === lastKept.id) : void 0;
+    const sourceLast = lastKept ? page2.sessions.find((session) => session.id === lastKept.id) : void 0;
     const nextCursor = droppedForByteCap ? sourceLast ? encodeSessionDiscoveryCursor({
-      orderBy: page.orderBy,
+      orderBy: page2.orderBy,
       sortRank: sourceLast.sortRank,
       sortRevision: sourceLast.sortRevision,
       sortAt: sourceLast.sortAt,
       id: sourceLast.id,
-      snapshotAt: page.snapshotAt,
-      snapshotRevision: page.snapshotRevision,
-      updatedAfter: page.updatedAfter,
-      filterHash: page.filterHash,
-      ...page.originSiteId ? { originSiteId: page.originSiteId } : {}
-    }) : null : page.nextCursor ? encodeSessionDiscoveryCursor(page.nextCursor) : null;
+      snapshotAt: page2.snapshotAt,
+      snapshotRevision: page2.snapshotRevision,
+      updatedAfter: page2.updatedAfter,
+      filterHash: page2.filterHash,
+      ...page2.originSiteId ? { originSiteId: page2.originSiteId } : {}
+    }) : null : page2.nextCursor ? encodeSessionDiscoveryCursor(page2.nextCursor) : null;
     const result2 = {
       sessions: kept,
-      total: page.total,
-      hasMore: page.hasMore || droppedForByteCap,
+      total: page2.total,
+      hasMore: page2.hasMore || droppedForByteCap,
       nextCursor,
-      orderBy: page.orderBy,
-      snapshotAt: page.snapshotAt,
-      snapshotRevision: page.snapshotRevision,
-      updatedAfter: page.updatedAfter,
-      updatedThrough: page.updatedThrough,
+      orderBy: page2.orderBy,
+      snapshotAt: page2.snapshotAt,
+      snapshotRevision: page2.snapshotRevision,
+      updatedAfter: page2.updatedAfter,
+      updatedThrough: page2.updatedThrough,
       ...includeLastMessage ? {
         latestMessagePreviewBudget: {
           bytes: previewBytes,
@@ -67405,7 +67527,8 @@ function registerDocumentRoutes(app, deps) {
             deps,
             await requireAccessGrantAuthorization8(c, deps, workspaceId, "documents:search"),
             "documents:search"
-          )
+          ),
+          settings: deps.settings
         }
       );
       await server.connect(transport);
@@ -67492,6 +67615,8 @@ import {
   prepareKnowledgeFile as prepareKnowledgeFile2,
   prepareKnowledgeSave as prepareKnowledgeSave2,
   searchKnowledgeEntries as searchKnowledgeEntries3,
+  KnowledgeVectorFundingError,
+  KnowledgeVectorQueryRejectedError,
   hasPermission as hasPermission13,
   knowledgeContextForAccess as knowledgeContextForAccess2,
   requireAccessGrantAuthorization as requireAccessGrantAuthorization9,
@@ -67531,6 +67656,18 @@ var WriteSettings = ReadSettings.extend({
 var Id = z22.uuid();
 function knowledgeHttpError(error) {
   if (error instanceof HTTPException42) throw error;
+  if (error instanceof KnowledgeVectorFundingError)
+    throw new ApiHttpError(402, {
+      code: "payment_required",
+      message: error.message,
+      details: { code: error.code, keywordAvailable: true }
+    });
+  if (error instanceof KnowledgeVectorQueryRejectedError)
+    throw new ApiHttpError(error.code === "quota" ? 429 : 422, {
+      code: error.code === "quota" ? "limit_exceeded" : "validation_failed",
+      message: error.message,
+      details: { code: error.code, keywordAvailable: true }
+    });
   if (error instanceof z22.ZodError)
     throw new HTTPException42(422, {
       message: error.issues[0]?.message ?? "Invalid Knowledge request"
@@ -67662,7 +67799,9 @@ function registerKnowledgeRoutes(app, deps) {
           deps.db,
           context,
           KnowledgeSavePreparationRequest2.parse(await c.req.json()),
-          () => deps.getDocumentServices().embedder
+          () => deps.getDocumentServices().embedder,
+          void 0,
+          deps.settings
         )
       );
     })
@@ -67677,7 +67816,8 @@ function registerKnowledgeRoutes(app, deps) {
           deps.db,
           context,
           KnowledgeEntryListRequest3.parse(await c.req.json()),
-          () => deps.getDocumentServices().embedder
+          () => deps.getDocumentServices().embedder,
+          deps.settings
         )
       )
     )
@@ -67724,7 +67864,8 @@ function registerKnowledgeRoutes(app, deps) {
             ...query,
             ...query.limit ? { limit: Number(query.limit) } : {}
           }),
-          () => deps.getDocumentServices().embedder
+          () => deps.getDocumentServices().embedder,
+          deps.settings
         )
       );
     })
@@ -70394,7 +70535,8 @@ import { randomUUID as randomUUID7 } from "crypto";
 import {
   environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes5,
   resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret3,
-  resolveStreamTokenSecret as resolveStreamTokenSecret2
+  resolveStreamTokenSecret as resolveStreamTokenSecret2,
+  sandboxWarmRateMicrosPerSecond as sandboxWarmRateMicrosPerSecond3
 } from "@opengeni/config";
 import {
   BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX,
@@ -70412,6 +70554,8 @@ import {
   BrowserDownloadSaveRequest,
   BrowserDownloadSaveResponse,
   BrowserDownloadListResponse,
+  BrowserDomReadRequest,
+  BrowserDomReadResponse,
   BrowserExternalAuthCommand,
   BrowserOpenTargetRequest,
   BrowserObservation,
@@ -70423,6 +70567,7 @@ import {
   BrowserSessionListResponse,
   BrowserSessionMutationResponse,
   BrowserTargetListResponse,
+  BrowserTargetState,
   CreateBrowserSessionRequest,
   ExternalAuthInteractiveRequest,
   ExternalAuthInteractiveResponse,
@@ -70454,6 +70599,7 @@ import {
   BrowserSessionNotFoundError,
   BrowserSessionOperationConflictError,
   BrowserSessionStateError as BrowserSessionStateError2,
+  SandboxPaidComputeAdmissionError as SandboxPaidComputeAdmissionError3,
   completeBrowserSessionEnd,
   completeExternalAuth,
   completeBrowserDownloadSave,
@@ -70467,6 +70613,7 @@ import {
   dispatchExternalAuth,
   dispatchProtectedAuthFill,
   failBrowserSessionOperation,
+  failPreparedBrowserSessionSuspend,
   failBrowserSessionResume,
   failBrowserSessionResumePreparation,
   failBrowserSessionSuspension,
@@ -72355,6 +72502,68 @@ function registerBrowserSessionRoutes(app, deps) {
       return context.json(result);
     }
   );
+  app.get(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/state",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read"
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const result = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.targetState(targetId)
+      );
+      return context.json(BrowserTargetState.parse(result));
+    }
+  );
+  app.post(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/dom-read",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read"
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const request = await parseJsonBody2(context, BrowserDomReadRequest);
+      const result = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.readDom(targetId, request)
+      );
+      return context.json(BrowserDomReadResponse.parse(result));
+    }
+  );
+  app.get(
+    "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/targets/:targetId/screenshot",
+    async (context) => {
+      const { workspaceId, grant, browserSessionId } = await browserRoutePreamble(
+        context,
+        "sessions:read"
+      );
+      const targetId = requireOpaqueParam(context, "targetId");
+      const captureOptions = parseBrowserScreenshotOptions(new URL(context.req.url).searchParams);
+      const frame = await withActiveBrowserController(
+        context,
+        grant,
+        workspaceId,
+        browserSessionId,
+        "session.read",
+        "browser.read",
+        async ({ sessionClient }) => await sessionClient.capture(targetId, captureOptions)
+      );
+      return browserScreenshotResponse(frame);
+    }
+  );
   app.post(
     "/v1/workspaces/:workspaceId/browser-sessions/:browserSessionId/actions",
     async (context) => {
@@ -73388,6 +73597,7 @@ function registerBrowserSessionRoutes(app, deps) {
       const request = await parseJsonBody2(context, BrowserSessionLifecycleRequest);
       const startedAtMs = performance.now();
       const origin = requestOrigin(context, deps.settings);
+      let preparedForDispatch = false;
       try {
         const before = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
@@ -73436,6 +73646,7 @@ function registerBrowserSessionRoutes(app, deps) {
           observeLifecycleResult(deps.observability, startedAtMs, parsed2);
           return context.json(parsed2, 200);
         }
+        preparedForDispatch = true;
         const record6 = await getBrowserSessionControlRecord(deps.db, {
           accountId: grant.accountId,
           workspaceId,
@@ -73594,6 +73805,15 @@ function registerBrowserSessionRoutes(app, deps) {
         observeLifecycleResult(deps.observability, startedAtMs, parsed);
         return context.json(parsed, 200);
       } catch (error) {
+        if (preparedForDispatch) {
+          await failPreparedBrowserSessionSuspend(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            browserSessionId,
+            operationId: request.operationId,
+            error: interactionFailure(error)
+          });
+        }
         throw browserRouteError(error);
       }
     }
@@ -74082,6 +74302,11 @@ function registerBrowserSessionRoutes(app, deps) {
         const resolved = await handle.routingSession.prime();
         if (expectedPlacement?.kind === "connected_machine") {
           if (resolved.kind !== "selfhosted" || resolved.sandboxId !== expectedPlacement.sandboxId) {
+            if (operation === "browser.create") {
+              throw new HTTPException51(422, {
+                message: "The requested Connected Machine is not this session's current placement. Move the session to that machine before creating an interaction resource."
+              });
+            }
             return await throwBrowserSourcePlacementChanged(
               grant,
               sourceSession.id,
@@ -74797,6 +75022,10 @@ async function ensureInteractionHolder(deps, grant, sourceSession, browserSessio
     holderId: interactionHolderId(browserSessionId),
     subjectId: sourceSession.id,
     backend: placement.lease.backend,
+    warmBilling: {
+      mode: deps.settings.sandboxWarmBillingMode,
+      rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond3(deps.settings, placement.lease.backend)
+    },
     os: placement.lease.os,
     image: sandboxRuntime.image,
     rigVersionId: sourceSession.rigVersionId,
@@ -75086,6 +75315,41 @@ function optionalBoundedInteger(value, minimum, maximum) {
   }
   return parsed;
 }
+function parseBrowserScreenshotOptions(query) {
+  for (const key of ["fullPage", "format", "quality"]) {
+    if (query.getAll(key).length > 1) {
+      throw new HTTPException51(400, { message: `duplicate browser screenshot ${key}` });
+    }
+  }
+  const fullPage = query.get("fullPage");
+  if (fullPage !== null && fullPage !== "true" && fullPage !== "false") {
+    throw new HTTPException51(400, { message: "invalid browser screenshot fullPage" });
+  }
+  const format = query.get("format");
+  if (format !== null && format !== "jpeg" && format !== "png") {
+    throw new HTTPException51(400, { message: "invalid browser screenshot format" });
+  }
+  const quality = query.get("quality");
+  const parsedQuality = quality === null ? null : optionalBoundedInteger(quality, 1, 100);
+  if (quality !== null && parsedQuality === null) {
+    throw new HTTPException51(400, { message: "invalid browser screenshot quality" });
+  }
+  return {
+    ...fullPage === null ? {} : { fullPage: fullPage === "true" },
+    ...format === null ? {} : { format },
+    ...parsedQuality === null ? {} : { quality: parsedQuality }
+  };
+}
+function browserScreenshotResponse(frame) {
+  return new Response(Uint8Array.from(frame.data).buffer, {
+    status: 200,
+    headers: {
+      "cache-control": "no-store",
+      "content-type": frame.mediaType,
+      "x-opengeni-browser-frame": frame.metadataHeader
+    }
+  });
+}
 function isUuid(value) {
   return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value);
 }
@@ -75480,6 +75744,8 @@ function browserRouteError(error) {
   const connectedMachineError = interactionControlApiError(error, "browser");
   if (connectedMachineError) return connectedMachineError;
   if (error instanceof HTTPException51) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError3)
+    return new HTTPException51(402, { message: error.message, cause: error });
   if (error instanceof BrowserSessionNotFoundError) {
     return new HTTPException51(404, { message: error.message, cause: error });
   }
@@ -75533,7 +75799,11 @@ function isAbort(error) {
 
 // src/routes/computer-sessions.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret4, resolveStreamTokenSecret as resolveStreamTokenSecret3 } from "@opengeni/config";
+import {
+  resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret4,
+  resolveStreamTokenSecret as resolveStreamTokenSecret3,
+  sandboxWarmRateMicrosPerSecond as sandboxWarmRateMicrosPerSecond4
+} from "@opengeni/config";
 import {
   BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX as BROWSER_CONTROL_WEBSOCKET_BEARER_PREFIX2,
   BROWSER_CONTROL_PORT as BROWSER_CONTROL_PORT2,
@@ -75560,6 +75830,7 @@ import {
   ComputerSessionNotFoundError,
   ComputerSessionOperationConflictError,
   ComputerSessionStateError,
+  SandboxPaidComputeAdmissionError as SandboxPaidComputeAdmissionError4,
   dispatchComputerSessionOperation,
   failComputerSessionOperation,
   findComputerSessionControlRecordByOperation,
@@ -76447,6 +76718,11 @@ function registerComputerSessionRoutes(app, deps) {
         }
         if (expectedPlacement?.kind === "connected_machine") {
           if (resolved.kind !== "selfhosted" || resolved.sandboxId !== expectedPlacement.sandboxId) {
+            if (operation === "computer.create") {
+              throw new HTTPException52(422, {
+                message: "The requested Connected Machine is not this session's current placement. Move the session to that machine before creating an interaction resource."
+              });
+            }
             return await throwComputerSourcePlacementChanged(
               grant,
               sourceSession.id,
@@ -76733,6 +77009,10 @@ function registerComputerSessionRoutes(app, deps) {
       holderId: interactionHolderId2(computerSessionId),
       subjectId: sourceSession.id,
       backend: placement.lease.backend,
+      warmBilling: {
+        mode: deps.settings.sandboxWarmBillingMode,
+        rateMicrosPerSecond: sandboxWarmRateMicrosPerSecond4(deps.settings, placement.lease.backend)
+      },
       os: placement.lease.os,
       image: sandboxRuntime.image,
       rigVersionId: sourceSession.rigVersionId,
@@ -77055,6 +77335,8 @@ function computerRouteError(error) {
   const connectedMachineError = interactionControlApiError(error, "computer");
   if (connectedMachineError) return connectedMachineError;
   if (error instanceof HTTPException52) return error;
+  if (error instanceof SandboxPaidComputeAdmissionError4)
+    return new HTTPException52(402, { message: error.message, cause: error });
   if (error instanceof ComputerSessionNotFoundError) {
     return new HTTPException52(404, { message: error.message, cause: error });
   }
@@ -77203,6 +77485,92 @@ async function integrationCommitGrant(authorization, permissions, request) {
   };
 }
 
+// src/routes/github-browser-pages.ts
+var pageStyle = `
+  :root{color-scheme:dark;--bg:oklch(.155 .012 260);--surface:oklch(.19 .014 260);--raised:oklch(.225 .015 260);--border:oklch(.3 .014 260);--border-strong:oklch(.42 .016 260);--fg:oklch(.955 .005 260);--muted:oklch(.73 .012 260);--blue:oklch(.54 .18 255);--blue-light:oklch(.72 .15 255)}
+  *{box-sizing:border-box}
+  html{min-height:100%;background:var(--bg)}
+  body{margin:0;min-height:100vh;min-height:100dvh;color:var(--fg);background:var(--bg);font-family:"Inter Variable",Inter,ui-sans-serif,system-ui,sans-serif;font-feature-settings:"cv11","ss01","ss03";-webkit-font-smoothing:antialiased}
+  .shell{width:min(100% - 48px,700px);margin:0 auto}
+  header{height:84px;display:flex;align-items:center;justify-content:space-between;gap:16px;border-bottom:1px solid var(--border)}
+  .brand{font-size:16px;font-weight:670;letter-spacing:-.045em;color:var(--fg);text-decoration:none}
+  .context{font-size:12px;color:var(--muted)}
+  main{padding:clamp(48px,10vh,100px) 0 96px}
+  h1{margin:0 0 14px;font-size:clamp(27px,4vw,36px);font-weight:640;letter-spacing:-.05em;line-height:1.17}
+  p{margin:0;color:var(--muted);font-size:14px;line-height:1.65;max-width:59ch}
+  .intro{margin-bottom:32px}
+  .options{display:grid;gap:10px;margin:0 0 24px;padding:0;border:0;max-height:min(390px,52vh);overflow:auto}
+  .option{display:flex;gap:14px;align-items:center;min-height:70px;padding:14px 16px;border:1px solid var(--border);border-radius:10px;background:var(--surface);cursor:pointer;transition:background .15s,border-color .15s}
+  .option:hover{background:var(--raised)}
+  .option:has(input:checked){border-color:var(--blue-light);background:var(--raised)}
+  .option:has(input:focus-visible){outline:2px solid var(--blue-light);outline-offset:3px}
+  .option input{margin:0;flex:none;width:17px;height:17px;accent-color:var(--blue-light)}
+  .option-text{min-width:0;display:grid;gap:3px}
+  .option strong{overflow-wrap:anywhere;font-size:14px;font-weight:600}
+  .option small{font-size:12px;color:var(--muted)}
+  .actions{display:flex;align-items:center;flex-wrap:wrap;gap:12px;margin-top:24px}
+  .button{display:inline-flex;min-height:42px;align-items:center;justify-content:center;padding:0 17px;border:1px solid var(--blue);border-radius:8px;background:var(--blue);color:#fff;font-family:inherit;font-size:13px;font-weight:600;text-decoration:none;cursor:pointer}
+  .button:hover{background:oklch(.6 .18 255)}
+  .button:disabled{cursor:wait;opacity:.7}
+  .secondary{border-color:var(--border);background:transparent;color:var(--fg)}
+  .secondary:hover{background:var(--raised)}
+  :is(button,a):focus-visible{outline:2px solid var(--blue-light);outline-offset:3px}
+  .note{margin-top:30px;padding-top:20px;border-top:1px solid var(--border);font-size:12px}
+  .env-header{display:flex;justify-content:space-between;align-items:center;gap:14px;margin-top:36px}
+  h2{margin:0;font-size:14px;font-weight:600}
+  pre{white-space:pre-wrap;overflow-wrap:anywhere;max-height:380px;overflow:auto;padding:18px;border:1px solid var(--border);border-radius:10px;background:var(--surface);font:12px/1.6 ui-monospace,SFMono-Regular,Menlo,monospace}
+  @media(max-width:480px){.shell{width:calc(100% - 32px)}header{height:70px}main{padding-top:56px}.actions{align-items:stretch;flex-direction:column}.actions form,.actions .button{width:100%}}
+  @media(prefers-reduced-motion:reduce){.option{transition:none}}
+`;
+function page(title, content) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml4(title)} \xB7 OpenGeni</title><style>${pageStyle}</style></head><body><div class="shell"><header><span class="brand">OpenGeni</span><span class="context">GitHub connection</span></header><main>${content}</main></div></body></html>`;
+}
+function githubInstallationChooserHtml(candidates, state, workspaceId, baseUrl) {
+  const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
+  const options = candidates.map(({ installation, authorityKind }, index) => {
+    const account = escapeHtml4(
+      installation.accountLogin ?? `installation ${installation.installationId}`
+    );
+    const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
+    return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required${candidates.length === 1 && index === 0 ? " checked" : ""}><span class="option-text"><strong>${account}</strong><small>${label}</small></span></label>`;
+  }).join("");
+  return page(
+    "Choose a GitHub account",
+    `<h1>Choose a GitHub account</h1><p class="intro">Connect an account where the OpenGeni GitHub App is already installed, or install it on another account.</p><form id="existing-account" method="get" action="${escapeHtml4(action)}"><input type="hidden" name="state" value="${escapeHtml4(state)}"><fieldset class="options" aria-label="Available GitHub accounts">${options}</fieldset></form><div class="actions"><button class="button" type="submit" form="existing-account">Connect selected account</button><form method="get" action="${escapeHtml4(action)}"><input type="hidden" name="state" value="${escapeHtml4(state)}"><input type="hidden" name="installation_id" value="new"><button class="button secondary" type="submit">Install on another account</button></form></div><p class="note">Only accounts GitHub has confirmed you own or manage appear here.</p>`
+  );
+}
+function githubSetupSuccessHtml(account, returnUrl2) {
+  return page(
+    "GitHub connected",
+    `<h1>GitHub connected</h1><p class="intro"><strong>${escapeHtml4(account)}</strong> is now available in this OpenGeni workspace. OpenGeni can access only the repositories allowed for this installation.</p><a class="button" href="${escapeHtml4(returnUrl2)}">Back to OpenGeni</a>`
+  );
+}
+function githubSetupPendingHtml() {
+  return page(
+    "GitHub approval pending",
+    `<h1>Waiting for an organization owner</h1><p>An owner needs to approve your GitHub App request before you can connect. OpenGeni has not created a workspace binding.</p>`
+  );
+}
+function githubSuccessHtml(envLines) {
+  const escaped = escapeHtml4(envLines.join("\n"));
+  return page(
+    "GitHub App created",
+    `<h1>GitHub App created</h1><p>Add these values to .env, then restart API and worker.</p><div class="env-header"><h2>Environment variables</h2><button class="button secondary" id="copy-env" type="button">Copy env</button></div><pre id="env-lines">${escaped}</pre><script>(()=>{const button=document.getElementById("copy-env");const env=document.getElementById("env-lines");async function copyText(text){if(navigator.clipboard&&window.isSecureContext){await navigator.clipboard.writeText(text);return;}const area=document.createElement("textarea");area.value=text;area.setAttribute("readonly","");area.style.position="fixed";area.style.inset="-9999px";document.body.append(area);area.select();document.execCommand("copy");area.remove();}button?.addEventListener("click",async()=>{try{await copyText(env?.textContent||"");button.textContent="Copied";setTimeout(()=>button.textContent="Copy env",1600);}catch{button.textContent="Copy failed";setTimeout(()=>button.textContent="Copy env",2200);}});})();</script>`
+  );
+}
+function escapeHtml4(value) {
+  return value.replace(
+    /[&<>"']/g,
+    (char) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    })[char] ?? char
+  );
+}
+
 // src/routes/github.ts
 var githubStateCookie = "opengeni_github_state";
 var githubBindingStateMaxAgeSeconds = 10 * 60;
@@ -78006,28 +78374,6 @@ function requirePublicGitHubRepositoryVerificationPermission(grant) {
 function isSecureRequest(c, deps) {
   return deps.settings.publicBaseUrl?.startsWith("https://") || c.req.header("x-forwarded-proto") === "https" || new URL(c.req.url).protocol === "https:";
 }
-function githubSuccessHtml(envLines) {
-  const envText = envLines.join("\n");
-  const escaped = escapeHtml4(envText);
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Created</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(760px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0 0 18px;color:#d4d4d8}.env-header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin:22px 0 8px}.env-header h2{margin:0;font-size:13px;line-height:1.2;text-transform:uppercase;letter-spacing:.08em;color:#a1a1aa}pre{white-space:pre-wrap;word-break:break-word;max-height:380px;overflow:auto;background:#09090b;border:1px solid #27272a;border-radius:8px;padding:16px;font-size:13px;line-height:1.5}button{display:inline-flex;align-items:center;justify-content:center;min-height:36px;border-radius:6px;border:1px solid #3f3f46;padding:0 12px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}button:disabled{cursor:not-allowed;opacity:.7}</style></head><body><main><h1>GitHub App created</h1><p>Add these values to .env, then restart API and worker.</p><div class="env-header"><h2>Environment variables</h2><button id="copy-env" type="button">Copy env</button></div><pre id="env-lines">${escaped}</pre><script>(()=>{const button=document.getElementById("copy-env");const env=document.getElementById("env-lines");async function copyText(text){if(navigator.clipboard&&window.isSecureContext){await navigator.clipboard.writeText(text);return;}const area=document.createElement("textarea");area.value=text;area.setAttribute("readonly","");area.style.position="fixed";area.style.inset="-9999px";document.body.append(area);area.select();document.execCommand("copy");area.remove();}button?.addEventListener("click",async()=>{try{await copyText(env?.textContent||"");button.textContent="Copied";setTimeout(()=>button.textContent="Copy env",1600);}catch{button.textContent="Copy failed";setTimeout(()=>button.textContent="Copy env",2200);}});})();</script></main></body></html>`;
-}
-function githubSetupSuccessHtml(account, returnUrl2) {
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Connected</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0 0 18px;color:#d4d4d8}.button{display:inline-flex;align-items:center;justify-content:center;min-height:36px;border-radius:6px;border:1px solid #3f3f46;padding:0 12px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;text-decoration:none}</style></head><body><main><h1>GitHub App connected</h1><p>${escapeHtml4(account)} is now available to this OpenGeni workspace through an explicit repository allowlist.</p><a class="button" href="${escapeHtml4(returnUrl2)}">Back to OpenGeni</a></main></body></html>`;
-}
-function githubInstallationChooserHtml(candidates, state, workspaceId, baseUrl) {
-  const action = `${baseUrl}/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/select`;
-  const options = candidates.map(({ installation, authorityKind }, index) => {
-    const account = escapeHtml4(
-      installation.accountLogin ?? `installation ${installation.installationId}`
-    );
-    const label = authorityKind === "personal_owner" ? "Personal account" : "Organization owner";
-    return `<label class="option"><input type="radio" name="installation_id" value="${installation.installationId}" required${candidates.length === 1 && index === 0 ? " checked" : ""}><span><strong>${account}</strong><small>${label}</small></span></label>`;
-  }).join("");
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Choose GitHub installation</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:12px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px}p{margin:0 0 18px;color:#d4d4d8}.options{display:grid;gap:8px;margin-bottom:18px}.option{display:flex;align-items:center;gap:12px;border:1px solid #3f3f46;border-radius:8px;padding:12px;cursor:pointer}.option span{display:grid;gap:2px}.option small{color:#a1a1aa}button{min-height:38px;border-radius:7px;border:1px solid #3f3f46;padding:0 14px;background:#f4f4f5;color:#09090b;font:600 14px system-ui,sans-serif;cursor:pointer}.secondary{margin-left:8px;background:transparent;color:#f4f4f5}</style></head><body><main><h1>Choose a GitHub account</h1><p>These accounts already have the OpenGeni GitHub App installed and GitHub proved you are the personal owner or an active organization owner.</p><form method="get" action="${escapeHtml4(action)}"><input type="hidden" name="state" value="${escapeHtml4(state)}"><div class="options">${options}</div><button type="submit">Connect selected</button><button class="secondary" type="submit" name="installation_id" value="new" formnovalidate>Install on another account</button></form></main></body></html>`;
-}
-function githubSetupPendingHtml() {
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>GitHub App Requested</title><style>body{font-family:system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#0b0b0d;color:#f4f4f5}main{width:min(640px,calc(100vw - 32px));border:1px solid #27272a;border-radius:8px;padding:28px;background:#111114}h1{margin:0 0 10px;font-size:24px;line-height:1.2}p{margin:0;color:#d4d4d8}</style></head><body><main><h1>GitHub App request sent</h1><p>A GitHub organization owner must approve the installation. OpenGeni has not created a workspace binding.</p></main></body></html>`;
-}
 function parsePositiveInteger(value) {
   if (!value || !/^\d+$/.test(value)) {
     return null;
@@ -78039,18 +78385,6 @@ function isFreshGitHubBindingState(payload) {
   const age = Math.floor(Date.now() / 1e3) - payload.iat;
   return age >= 0 && age < githubBindingStateMaxAgeSeconds;
 }
-function escapeHtml4(value) {
-  return value.replace(
-    /[&<>"']/g,
-    (char) => ({
-      "&": "&amp;",
-      "<": "&lt;",
-      ">": "&gt;",
-      '"': "&quot;",
-      "'": "&#39;"
-    })[char] ?? char
-  );
-}
 function openGeniReturnUrl(settings, c, workspaceId, returnPath = null) {
   const baseUrl = openGeniBaseUrl(settings, c) || new URL(c.req.url).origin;
   const safeReturnPath4 = githubSessionReturnPath(returnPath, workspaceId);
@@ -78636,7 +78970,7 @@ function registerPersonalGitHubRoutes(app, deps) {
       const query = ListPersonalGitHubRepositoriesQuery.parse(c.req.query());
       try {
         const selection = await loadRepositorySelectionState(deps, access.grant, connection);
-        const page = await listLivePersonalGitHubRepositories(deps, {
+        const page2 = await listLivePersonalGitHubRepositories(deps, {
           accountId: access.grant.accountId,
           workspaceId,
           subjectId: access.grant.subjectId,
@@ -78653,11 +78987,11 @@ function registerPersonalGitHubRoutes(app, deps) {
         );
         return c.json(
           ListPersonalGitHubRepositoriesResponse.parse({
-            repositories: page.repositories.map((repository) => ({
+            repositories: page2.repositories.map((repository) => ({
               ...repository,
               selectedAccess: selectedAccessById.get(repository.repositoryId) ?? null
             })),
-            nextCursor: page.nextPage,
+            nextCursor: page2.nextPage,
             selection
           })
         );
@@ -79991,11 +80325,11 @@ async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal,
       if (targetSequence !== void 0 && lastSent >= targetSequence) return;
       const previousLastSent = lastSent;
       const limit = targetSequence === void 0 ? SESSION_REPLAY_PAGE_SIZE : Math.min(SESSION_REPLAY_PAGE_SIZE, targetSequence - lastSent);
-      const page = await listSessionEvents(db, workspaceId, sessionId, {
+      const page2 = await listSessionEvents(db, workspaceId, sessionId, {
         after: lastSent,
         limit
       });
-      const eligible = targetSequence === void 0 ? page : page.filter((event) => event.sequence <= targetSequence);
+      const eligible = targetSequence === void 0 ? page2 : page2.filter((event) => event.sequence <= targetSequence);
       if (eligible.length === 0) {
         if (targetSequence === void 0) return;
         throw new Error(
@@ -80105,16 +80439,16 @@ async function replaySessionEvents(loadPage, send, after, pageSize = SESSION_REP
   let cursor = after;
   while (true) {
     const previousCursor = cursor;
-    const page = await loadPage(cursor, pageSize);
-    if (page.length === 0) {
+    const page2 = await loadPage(cursor, pageSize);
+    if (page2.length === 0) {
       return;
     }
-    for (const event of page.sort((a, b) => a.sequence - b.sequence)) {
+    for (const event of page2.sort((a, b) => a.sequence - b.sequence)) {
       if (event.sequence <= cursor) continue;
       await send(event);
       cursor = event.sequence;
     }
-    if (page.length < pageSize) {
+    if (page2.length < pageSize) {
       return;
     }
     if (cursor === previousCursor) {
@@ -80506,14 +80840,14 @@ async function replayWorkspaceControlEvents(loadPage, send, after, pageSize) {
   let cursor = after;
   while (true) {
     const previousCursor = cursor;
-    const page = await loadPage(cursor, pageSize);
-    if (page.length === 0) return;
-    for (const event of page.sort((a, b) => a.sequence - b.sequence)) {
+    const page2 = await loadPage(cursor, pageSize);
+    if (page2.length === 0) return;
+    for (const event of page2.sort((a, b) => a.sequence - b.sequence)) {
       if (event.sequence <= cursor) continue;
       await send(event);
       cursor = event.sequence;
     }
-    if (page.length < pageSize) return;
+    if (page2.length < pageSize) return;
     if (cursor === previousCursor) {
       throw new Error(
         `Workspace control replay made no progress after sequence ${cursor}; refusing to repeat a full stale page`
@@ -84605,10 +84939,10 @@ function registerSkillContentRoutes(app, deps) {
         ...query.data.sessionId ? { sessionId: query.data.sessionId } : {}
       }
     );
-    const page = rows2.slice(0, query.data.limit);
-    const last = page.at(-1);
+    const page2 = rows2.slice(0, query.data.limit);
+    const last = page2.at(-1);
     return c.json({
-      skills: page.map(({ files: _files, ...summary }) => summary),
+      skills: page2.map(({ files: _files, ...summary }) => summary),
       nextCursor: rows2.length > query.data.limit && last ? Buffer.from(JSON.stringify({ stableKey: last.stableKey, id: last.id })).toString(
         "base64url"
       ) : null
@@ -85665,6 +85999,8 @@ function registerScheduledTaskRoutes(app, deps) {
 // src/routes/sessions.ts
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
 import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
+import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
+import * as sessionPreviewSchema from "@opengeni/db/schema";
 import { SessionMessageSearchRequest } from "@opengeni/contracts";
 import { scheduledSessionIds } from "@opengeni/db";
 import { withSiteSessionOrigin as withSiteSessionOrigin2 } from "@opengeni/core";
@@ -87260,9 +87596,9 @@ function registerSessionRoutes(app, deps) {
     }
     const pageView = c.req.query("view") === "page";
     const query = sessionListQuery(c.req.query(), pageView);
-    let page;
+    let page2;
     try {
-      page = await listSessionsForSubject(db, workspaceId, {
+      page2 = await listSessionsForSubject(db, workspaceId, {
         subjectId: grant.subjectId,
         limit: boundedLimit(query.limit),
         materializeSnapshot: pageView,
@@ -87299,17 +87635,17 @@ function registerSessionRoutes(app, deps) {
       }
       throw error;
     }
-    c.header("x-opengeni-pinned-truncated", page.pinnedTruncated === true ? "true" : "false");
+    c.header("x-opengeni-pinned-truncated", page2.pinnedTruncated === true ? "true" : "false");
     const policy = await loadEffectivePolicyContext(deps, workspaceId, grant.subjectId);
     const commandActivity = await backgroundCommandActivityForSessions(db, {
       accountId: grant.accountId,
       workspaceId,
-      sessionIds: [...page.pinned, ...page.sessions].map((session) => session.id)
+      sessionIds: [...page2.pinned, ...page2.sessions].map((session) => session.id)
     });
     const scheduleTargets = hasPermission19(grant.permissions, "scheduled_tasks:run") && hasPermission19(grant.permissions, "sessions:control") ? await scheduledSessionIds(
       db,
       workspaceId,
-      [...page.pinned, ...page.sessions].map((session) => session.id)
+      [...page2.pinned, ...page2.sessions].map((session) => session.id)
     ) : /* @__PURE__ */ new Set();
     const decorate = (session) => {
       const activity = commandActivity.get(session.id);
@@ -87325,14 +87661,14 @@ function registerSessionRoutes(app, deps) {
     };
     if (pageView) {
       return c.json({
-        ...page,
+        ...page2,
         ...query.hasPageFilters ? { filtersApplied: true } : {},
         ...query.originSiteId ? { originSiteId: query.originSiteId } : {},
-        pinned: page.pinned.map(decorate),
-        sessions: page.sessions.map(decorate)
+        pinned: page2.pinned.map(decorate),
+        sessions: page2.sessions.map(decorate)
       });
     }
-    return c.json([...page.pinned, ...page.sessions].map(decorate));
+    return c.json([...page2.pinned, ...page2.sessions].map(decorate));
   });
   app.get("/v1/workspaces/:workspaceId/agent-topology", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -87365,7 +87701,7 @@ function registerSessionRoutes(app, deps) {
     }
     try {
       const orderBy = query.query || query.subject ? "relevance" : "updatedAt";
-      const page = await listSessionDiscoverySummaries2(db, workspaceId, {
+      const page2 = await listSessionDiscoverySummaries2(db, workspaceId, {
         limit: query.limit,
         orderBy,
         subjectId: grant.subjectId,
@@ -87384,11 +87720,11 @@ function registerSessionRoutes(app, deps) {
       const ancestorPaths = query.query || query.subject ? await listSessionDiscoveryAncestorPaths(
         db,
         workspaceId,
-        page.sessions.map((session) => session.id),
+        page2.sessions.map((session) => session.id),
         authorizationScope ?? void 0,
         grant.subjectId
       ) : /* @__PURE__ */ new Map();
-      const sessions = page.sessions.map((session) => {
+      const sessions = page2.sessions.map((session) => {
         const blocker = session.effectiveControl.primaryBlocker;
         return {
           id: session.id,
@@ -87426,11 +87762,11 @@ function registerSessionRoutes(app, deps) {
       });
       const response = {
         sessions,
-        total: page.total,
-        hasMore: page.hasMore,
+        total: page2.total,
+        hasMore: page2.hasMore,
         humanAdvisoriesEnabled: settings.workDiscoveryEnabled && settings.workDiscoveryHumanAdvisoriesEnabled,
-        nextCursor: page.nextCursor ? encodeAgentTopologyCursor({
-          cursor: page.nextCursor,
+        nextCursor: page2.nextCursor ? encodeAgentTopologyCursor({
+          cursor: page2.nextCursor,
           parentSessionId: query.parentSessionId === void 0 ? "all" : query.parentSessionId,
           rootSessionId: query.rootSessionId ?? null,
           query: query.query ?? null,
@@ -89211,35 +89547,94 @@ function registerSessionRoutes(app, deps) {
     const compactProjection = compact ? coalesceSessionEventDeltasWithCoverage2(events) : null;
     const projected = compactProjection?.events ?? events;
     const forensicExact = !compact && mode === "forensic" && payloadMode === "full" && dbPage.fullPayloadsExact;
-    const page = boundSessionEventHttpPage(projected, {
+    const page2 = boundSessionEventHttpPage(projected, {
       direction,
       eventProjection: payloadMode === "full" ? "exact" : "bounded",
       ...compactProjection ? { coveredThroughBySequence: compactProjection.coveredThroughBySequence } : {}
     });
-    const hasMore = dbPage.hasMore || page.truncated;
-    c.header("X-OpenGeni-Page-Bytes", String(page.bytes));
-    c.header("X-OpenGeni-Page-Max-Bytes", String(Math.max(1024 * 1024, page.bytes)));
+    const hasMore = dbPage.hasMore || page2.truncated;
+    c.header("X-OpenGeni-Page-Bytes", String(page2.bytes));
+    c.header("X-OpenGeni-Page-Max-Bytes", String(Math.max(1024 * 1024, page2.bytes)));
     c.header("X-OpenGeni-Page-Truncated", String(hasMore));
     c.header("X-OpenGeni-Has-More", String(hasMore));
     c.header("X-OpenGeni-Event-Mode", mode);
     c.header("X-OpenGeni-Event-Direction", direction);
     c.header("X-OpenGeni-Payload-Mode", payloadMode);
     c.header("X-OpenGeni-Forensic-Exact", String(forensicExact));
-    const coveredFirst = page.events[0]?.sequence;
-    const coveredLastEvent = page.events.at(-1);
+    const coveredFirst = page2.events[0]?.sequence;
+    const coveredLastEvent = page2.events.at(-1);
     const coveredLast = coveredLastEvent === void 0 ? void 0 : compactProjection?.coveredThroughBySequence.get(coveredLastEvent.sequence) ?? coveredLastEvent.sequence;
     if (coveredFirst !== void 0) c.header("X-OpenGeni-Covered-First", String(coveredFirst));
     if (coveredLast !== void 0) c.header("X-OpenGeni-Covered-Last", String(coveredLast));
-    const truncatedBy = page.truncated ? "http_bytes" : dbPage.truncatedBy;
+    const truncatedBy = page2.truncated ? "http_bytes" : dbPage.truncatedBy;
     if (truncatedBy) c.header("X-OpenGeni-Truncated-By", truncatedBy);
-    if (page.nextSequence !== null) {
+    if (page2.nextSequence !== null) {
       c.header(
         direction === "before" ? "X-OpenGeni-Next-Before" : "X-OpenGeni-Next-After",
-        String(page.nextSequence)
+        String(page2.nextSequence)
       );
     }
-    return c.json(page.events);
+    return c.json(page2.events);
   });
+  app.get(
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/events/:eventId/message-preview",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      await requireAccessGrant32(c, deps, workspaceId, "sessions:read");
+      const sessionId = c.req.param("sessionId");
+      await assertSessionExists(db, workspaceId, sessionId);
+      const eventId = c.req.param("eventId");
+      const rawSequence = c.req.query("sequence");
+      const sequence = Number(rawSequence);
+      if (!z27.string().uuid().safeParse(eventId).success || rawSequence === void 0 || !/^\d+$/.test(rawSequence) || !Number.isSafeInteger(sequence) || sequence < 1 || sequence > 2147483647)
+        throw new HTTPException72(400, { message: "Invalid message preview reference" });
+      const notFound = () => new HTTPException72(404, { message: "message not found" });
+      const maxUnits = 12e3;
+      const eventTable = sessionPreviewSchema.sessionEvents;
+      const candidates = await withWorkspaceRls(
+        db,
+        workspaceId,
+        (tx) => tx.select({ kind: sql`jsonb_typeof(${eventTable.payload}->'text')` }).from(eventTable).where(
+          and(
+            eq(eventTable.workspaceId, workspaceId),
+            eq(eventTable.sessionId, sessionId),
+            eq(eventTable.id, eventId),
+            eq(eventTable.sequence, sequence),
+            sql`${eventTable.type} in ('user.message', 'agent.message.completed')`
+          )
+        ).limit(1)
+      );
+      if (candidates[0]?.kind !== "string") throw notFound();
+      const read = (offset2) => listSessionEventSlices(db, workspaceId, sessionId, {
+        sourceSequence: sequence,
+        sourceOffset: offset2,
+        after: sequence - 1,
+        before: sequence + 1,
+        includeTypes: ["user.message", "agent.message.completed"],
+        view: "conversation"
+      });
+      const first = await read(0);
+      const event = first.events[0];
+      const slice = first.slices?.[sequence];
+      if (!event || event.id !== eventId || event.sequence !== sequence || !slice || slice.omitted)
+        throw notFound();
+      if (slice.total > maxUnits) return c.json({ status: "unavailable" });
+      let text = slice.text;
+      let offset = slice.unit === "utf16" ? slice.text.length : Array.from(slice.text).length;
+      if (text.length > maxUnits) return c.json({ status: "unavailable" });
+      while (offset < slice.total) {
+        if (offset === 0) throw notFound();
+        const next = await read(offset);
+        const part = next.slices?.[sequence];
+        if (next.events[0]?.id !== eventId || !part || part.omitted || part.unit !== slice.unit || part.total !== slice.total || part.offset !== offset)
+          throw notFound();
+        text += part.text;
+        offset += slice.unit === "utf16" ? part.text.length : Array.from(part.text).length;
+        if (text.length > maxUnits) return c.json({ status: "unavailable" });
+      }
+      return c.json({ status: "available", text });
+    }
+  );
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/events/stream", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant32(c, deps, workspaceId, "sessions:read");
@@ -90807,6 +91202,8 @@ function sessionAuthorizationOperationForHttp(method, pathname, sessionId) {
     return verb === "POST" ? "session.context.write" : null;
   }
   if (suffix === "/events/stream" && verb === "GET") return "session.stream.read";
+  if (/^\/events\/[^/]+\/message-preview$/.test(suffix) && verb === "GET")
+    return "session.events.read";
   if (suffix === "/events") {
     if (verb === "GET") return "session.events.read";
     if (verb === "POST") return "session.append";
@@ -92641,14 +93038,14 @@ function registerWorkspaceRoutes(app, deps) {
     const limit = boundedLimit(c.req.query("limit"));
     const fetched = await listWorkspaceControlEvents2(deps.db, workspaceId, after, limit + 1);
     const countHasMore = fetched.length > limit;
-    const page = boundWorkspaceControlHttpPage(fetched.slice(0, limit));
-    const truncated = countHasMore || page.truncated;
-    c.header("X-OpenGeni-Page-Bytes", String(page.bytes));
+    const page2 = boundWorkspaceControlHttpPage(fetched.slice(0, limit));
+    const truncated = countHasMore || page2.truncated;
+    c.header("X-OpenGeni-Page-Bytes", String(page2.bytes));
     c.header("X-OpenGeni-Page-Truncated", String(truncated));
-    if (page.nextSequence !== null) {
-      c.header("X-OpenGeni-Next-After", String(page.nextSequence));
+    if (page2.nextSequence !== null) {
+      c.header("X-OpenGeni-Next-After", String(page2.nextSequence));
     }
-    return c.json(page.events);
+    return c.json(page2.events);
   });
   app.get("/v1/workspaces/:workspaceId/control-events/stream", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -93800,10 +94197,10 @@ function preferenceLifecycle(row, generatedAt) {
   if (row.status === "superseded") return "superseded";
   return "historical";
 }
-function preferenceEntries(page, generatedAt) {
-  const visibleRevisionIds = new Set(page.rows.map((row) => row.revisionId));
-  const visiblePreferenceIds = new Set(page.rows.map((row) => row.preferenceId));
-  return page.rows.map((row) => {
+function preferenceEntries(page2, generatedAt) {
+  const visibleRevisionIds = new Set(page2.rows.map((row) => row.revisionId));
+  const visiblePreferenceIds = new Set(page2.rows.map((row) => row.preferenceId));
+  return page2.rows.map((row) => {
     const scope = row.scope === "organization" ? "organization" : row.scope === "user" ? "personal" : "workspace";
     const lifecycle2 = preferenceLifecycle(row, generatedAt);
     const relationships = [];
@@ -95367,6 +95764,7 @@ import {
   requireAccessGrant as requireAccessGrant41,
   WorkspaceInsightsFilterValidationError
 } from "@opengeni/core";
+import { currentSessionRlsActorIdentityKey } from "@opengeni/db";
 import { workspaceInsightsMetricObserver } from "@opengeni/observability";
 import { HTTPException as HTTPException85 } from "hono/http-exception";
 function normalizeWorkspaceInsightsQueryFilter(value, field) {
@@ -95379,9 +95777,36 @@ function normalizeWorkspaceInsightsQueryFilter(value, field) {
     throw error;
   }
 }
+function createInFlightCoalescer() {
+  const inFlight = /* @__PURE__ */ new Map();
+  return {
+    run(key, work) {
+      const pending = inFlight.get(key);
+      if (pending) return pending;
+      const started2 = work().finally(() => {
+        if (inFlight.get(key) === started2) inFlight.delete(key);
+      });
+      inFlight.set(key, started2);
+      return started2;
+    },
+    get size() {
+      return inFlight.size;
+    }
+  };
+}
+function workspaceInsightsCoalesceKey(input) {
+  return JSON.stringify([
+    input.workspaceId,
+    input.range,
+    input.provider,
+    input.model,
+    input.rlsActor
+  ]);
+}
 function registerInsightsRoutes(app, deps) {
   const observeRequest = workspaceInsightsMetricObserver(deps.observability);
   const observePhase = workspaceInsightsPhaseMetricObserver(deps.observability);
+  const coalesce = createInFlightCoalescer();
   app.get("/v1/workspaces/:workspaceId/insights", async (c) => {
     const startedAtMs = performance.now();
     const rangeRaw = c.req.query("range") ?? "week";
@@ -95405,16 +95830,25 @@ function registerInsightsRoutes(app, deps) {
       }
       provider = normalizeWorkspaceInsightsQueryFilter(providerRaw, "provider");
       model = normalizeWorkspaceInsightsQueryFilter(modelRaw, "model");
-      const response = await getWorkspaceInsights(
-        deps.db,
-        deps.settings,
-        {
+      const response = await coalesce.run(
+        workspaceInsightsCoalesceKey({
           workspaceId,
           range: rangeParsed.data,
           provider,
-          model
-        },
-        observePhase
+          model,
+          rlsActor: currentSessionRlsActorIdentityKey()
+        }),
+        () => getWorkspaceInsights(
+          deps.db,
+          deps.settings,
+          {
+            workspaceId,
+            range: rangeParsed.data,
+            provider,
+            model
+          },
+          observePhase
+        )
       );
       c.header("cache-control", "private, no-store");
       const result = c.json(WorkspaceInsightsResponse.parse(response));
@@ -98379,7 +98813,8 @@ function registerOrganizationMembershipRoutes(app, deps) {
           await createManagedOrganization(deps.db, {
             subjectId,
             subjectLabel: session.user.email || session.user.name,
-            ...payload
+            ...payload,
+            trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
           })
         ),
         201
@@ -99155,7 +99590,7 @@ function registerOrganizationSessionRoutes(app, deps) {
     while (index < workspaces.length && sessions.length < query.limit && reads < ORGANIZATION_SESSION_LIST_MAX_WORKSPACE_READS) {
       const workspace = workspaces[index];
       reads += 1;
-      const page = await listWorkspaceSessionPage(c, deps, {
+      const page2 = await listWorkspaceSessionPage(c, deps, {
         workspace,
         readAuthority,
         innerCursor,
@@ -99163,21 +99598,21 @@ function registerOrganizationSessionRoutes(app, deps) {
         limit: query.limit - sessions.length,
         query
       });
-      if (page === null) {
+      if (page2 === null) {
         index += 1;
         innerCursor = null;
         pinnedOffset = 0;
         continue;
       }
-      sessions.push(...page.sessions);
-      if (page.nextPinnedOffset !== null) {
+      sessions.push(...page2.sessions);
+      if (page2.nextPinnedOffset !== null) {
         innerCursor = null;
-        pinnedOffset = page.nextPinnedOffset;
+        pinnedOffset = page2.nextPinnedOffset;
         break;
       }
       pinnedOffset = 0;
-      if (page.nextCursor) {
-        innerCursor = page.nextCursor;
+      if (page2.nextCursor) {
+        innerCursor = page2.nextCursor;
       } else {
         index += 1;
         innerCursor = null;
@@ -99232,24 +99667,24 @@ async function listWorkspaceSessionPage(c, deps, input) {
       personalWorkspaceOwnerException: authorization.canonicalManagedHumanSession
     });
     const withStatus = (rows3) => input.query.status ? rows3.filter((session) => session.status === input.query.status) : rows3;
-    let page = await list(input.limit);
+    let page2 = await list(input.limit);
     let rows2;
     let nextPinnedOffset = null;
     if (cursor) {
-      rows2 = page.sessions;
+      rows2 = page2.sessions;
     } else {
-      const pinned = page.pinned.slice(input.pinnedOffset);
+      const pinned = page2.pinned.slice(input.pinnedOffset);
       if (pinned.length >= input.limit) {
         rows2 = pinned.slice(0, input.limit);
         nextPinnedOffset = input.pinnedOffset + input.limit;
         return { sessions: withStatus(rows2), nextCursor: null, nextPinnedOffset };
       }
-      if (pinned.length > 0 && page.sessions.length > input.limit - pinned.length) {
-        page = await list(input.limit - pinned.length);
+      if (pinned.length > 0 && page2.sessions.length > input.limit - pinned.length) {
+        page2 = await list(input.limit - pinned.length);
       }
-      rows2 = [...pinned, ...page.sessions];
+      rows2 = [...pinned, ...page2.sessions];
     }
-    return { sessions: withStatus(rows2), nextCursor: page.nextCursor, nextPinnedOffset };
+    return { sessions: withStatus(rows2), nextCursor: page2.nextCursor, nextPinnedOffset };
   } catch (error) {
     if (error instanceof SessionListAccessError2) {
       throw new HTTPException91(403, { message: error.message });
@@ -99591,7 +100026,8 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
             actorSubjectId: `user:${session.user.id}`,
             organizationName,
             operationId: parsed.data.operationId,
-            requestFingerprint
+            requestFingerprint,
+            trialCreditsEnabled: deps.settings.productAccessMode === "managed" && deps.settings.verifiedSignupTrialCreditsEnabled
           })
         )
       );
@@ -99843,7 +100279,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
       "workspace:read"
     );
     try {
-      const page = await listManagedHumanUserResourceAuthorities(
+      const page2 = await listManagedHumanUserResourceAuthorities(
         deps,
         access,
         workspaceId,
@@ -99852,7 +100288,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
       return context.json(
         ListUserResourceAuthoritiesResponse.parse({
           scope: "user",
-          ...page
+          ...page2
         })
       );
     } catch (error) {
@@ -101847,16 +102283,16 @@ async function publishSlackAppHome(deps, installation, refresh, renewLease) {
     let cursor;
     do {
       await renewLease();
-      const page = await listSessionsForSubject3(deps.db, installation.workspaceId, {
+      const page2 = await listSessionsForSubject3(deps.db, installation.workspaceId, {
         subjectId: grant.subjectId,
         limit: 500,
         ...cursor ? { cursor } : {},
         ...authorizationScope ? { authorizationScope } : {}
       });
-      if (!cursor) sessions.push(...page.pinned);
-      sessions.push(...page.sessions);
-      if (!page.nextCursor) break;
-      cursor = decodeSessionListCursor3(page.nextCursor) ?? void 0;
+      if (!cursor) sessions.push(...page2.pinned);
+      sessions.push(...page2.sessions);
+      if (!page2.nextCursor) break;
+      cursor = decodeSessionListCursor3(page2.nextCursor) ?? void 0;
       if (!cursor) throw new Error("Slack App Home session cursor was invalid");
     } while (cursor);
   } catch (error) {
@@ -104167,13 +104603,13 @@ async function resolveSlackDeliveryHome(deps, interaction) {
 }
 async function deliverSlackSessionEvents(deps, interaction, claimHolderId) {
   if (!interaction.sessionId) return;
-  const page = await listSessionEventPage3(deps.db, interaction.workspaceId, interaction.sessionId, {
+  const page2 = await listSessionEventPage3(deps.db, interaction.workspaceId, interaction.sessionId, {
     after: interaction.lastDeliveredSessionEventSequence,
     limit: 100,
     includeTypes: [...SLACK_DELIVERY_EVENT_TYPES],
     maxBytes: 256 * 1024
   });
-  if (page.events.length === 0) {
+  if (page2.events.length === 0) {
     await releaseSlackInteractionDelivery(deps.db, {
       ...interaction,
       claimHolderId
@@ -104212,10 +104648,10 @@ async function deliverSlackSessionEvents(deps, interaction, claimHolderId) {
   };
   let lastSequence = interaction.lastDeliveredSessionEventSequence;
   let terminal2 = null;
-  const orderedEvents = page.events.filter(
+  const orderedEvents = page2.events.filter(
     (event) => (event.turnAssociation === null || event.turnAssociation === "current") && event.duplicateOfEventId === null
   ).sort((left, right) => left.sequence - right.sequence);
-  lastSequence = page.events.reduce(
+  lastSequence = page2.events.reduce(
     (latest, event) => Math.max(latest, event.sequence),
     lastSequence
   );
@@ -107113,4 +107549,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-24C5LPNE.js.map
+//# sourceMappingURL=chunk-2SSU5KWV.js.map