@opengeni/api-router 5.4.1 → 5.5.0-canary.37090756480001

package/dist/{chunk-2QCRFD6U.js → chunk-ZQ7PIFGF.js}

@@ -3894,7 +3894,15 @@ import {
   CLIENT_ERROR_REPORT_MAX_BYTES,
   CLIENT_ERROR_REVISION_PATTERN,
   CLIENT_ERROR_ROUTE_PATTERN,
-  CLIENT_ERRORS_PATH
+  CLIENT_ERRORS_PATH,
+  CLIENT_PAGES,
+  CLIENT_REQUEST_ACTIONS,
+  CLIENT_REQUEST_FAILURE_REASONS,
+  CLIENT_SIGNALS,
+  CLIENT_STREAM_EVENTS,
+  CLIENT_STREAMS,
+  CLIENT_WEB_VITAL_MAX_VALUE,
+  CLIENT_WEB_VITAL_METRICS
 } from "@opengeni/contracts/client-error-report";
 import { bodyLimit } from "hono/body-limit";
 import { z as z9 } from "zod";
@@ -3968,6 +3976,31 @@ var ClientErrorReport = z9.object({
   route: z9.string().regex(CLIENT_ERROR_ROUTE_PATTERN),
   revision: z9.string().regex(CLIENT_ERROR_REVISION_PATTERN)
 }).strict();
+var route = z9.string().regex(CLIENT_ERROR_ROUTE_PATTERN);
+var revision = z9.string().regex(CLIENT_ERROR_REVISION_PATTERN);
+var ClientSignalReport = z9.discriminatedUnion("signal", [
+  z9.object({
+    signal: z9.literal("request_failure"),
+    action: z9.enum(CLIENT_REQUEST_ACTIONS),
+    reason: z9.enum(CLIENT_REQUEST_FAILURE_REASONS),
+    route,
+    revision
+  }).strict(),
+  z9.object({
+    signal: z9.literal("stream"),
+    stream: z9.enum(CLIENT_STREAMS),
+    event: z9.enum(CLIENT_STREAM_EVENTS),
+    route,
+    revision
+  }).strict(),
+  z9.object({
+    signal: z9.literal("web_vital"),
+    metric: z9.enum(CLIENT_WEB_VITAL_METRICS),
+    page: z9.enum(CLIENT_PAGES),
+    value: z9.number().finite().nonnegative(),
+    revision
+  }).strict().refine((report) => report.value <= CLIENT_WEB_VITAL_MAX_VALUE[report.metric])
+]);
 var CLIENT_ERRORS_METRIC = {
   name: "opengeni_client_errors_total",
   help: "Web client errors reported by browsers, by closed kind. Admission is bounded per API process, so this is a lower bound."
@@ -3976,10 +4009,56 @@ var CLIENT_ERROR_REJECTIONS_METRIC = {
   name: "opengeni_client_error_reports_rejected_total",
   help: 'Web client error reports the API refused, by closed reason and kind ("unknown" when the body was not read or not valid).'
 };
+var CLIENT_REQUEST_FAILURES_METRIC = {
+  name: "opengeni_client_request_failures_total",
+  help: "Key web client requests that failed before any HTTP response, by closed action and reason (network, timeout, offline). Admission is bounded per API process, so this is a lower bound."
+};
+var CLIENT_STREAM_EVENTS_METRIC = {
+  name: "opengeni_client_stream_events_total",
+  help: "Web client live-stream health events, by stream (session, workspace) and closed event (reconnect, reconnect_exhausted, long_disconnect). Admission is bounded per API process, so this is a lower bound."
+};
+var CLIENT_WEB_VITAL_METRIC = {
+  name: "opengeni_client_web_vital",
+  help: "Web vitals reported by browsers, by metric and closed page label. lcp, inp and ttfb are seconds; cls is the unitless layout-shift score."
+};
+var CLIENT_WEB_VITAL_BUCKETS = [
+  0.01,
+  0.025,
+  0.05,
+  0.1,
+  0.2,
+  0.25,
+  0.5,
+  0.8,
+  1,
+  1.8,
+  2.5,
+  4,
+  6,
+  10,
+  20,
+  60
+];
+function createClientSignalAdmission(options = {}) {
+  return createKeyedAdmission(options);
+}
+function createClientWebVitalAdmission(options = {}) {
+  return createKeyedAdmission({ capacity: 1200, refillPerSecond: 20, ...options });
+}
+function signalAdmissionKey(report) {
+  switch (report.signal) {
+    case "request_failure":
+      return `request_failure:${report.action}`;
+    case "stream":
+      return `stream:${report.stream}:${report.event}`;
+    case "web_vital":
+      return `web_vital:${report.metric}`;
+  }
+}
 function createClientErrorAdmission(options = {}) {
   return createKeyedAdmission(options);
 }
-function parseClientErrorReport(body3) {
+function parseClientBeaconReport(body3) {
   if (body3 === null || new TextEncoder().encode(body3).byteLength > CLIENT_ERROR_REPORT_MAX_BYTES) {
     return null;
   }
@@ -3989,8 +4068,13 @@ function parseClientErrorReport(body3) {
   } catch {
     return null;
   }
-  const parsed = ClientErrorReport.safeParse(value);
-  return parsed.success ? parsed.data : null;
+  const error = ClientErrorReport.safeParse(value);
+  if (error.success) return error.data;
+  const signal = ClientSignalReport.safeParse(value);
+  return signal.success ? signal.data : null;
+}
+function isClientSignalReport(report) {
+  return "signal" in report;
 }
 function isClientErrorReportRequest(method, pathname) {
   return method === "POST" && pathname === CLIENT_ERRORS_PATH;
@@ -3998,6 +4082,8 @@ function isClientErrorReportRequest(method, pathname) {
 function registerClientErrorRoutes(app, deps) {
   const { observability, settings } = deps;
   const admission = deps.admission ?? createClientErrorAdmission();
+  const signalAdmission = deps.signalAdmission ?? createClientSignalAdmission();
+  const webVitalAdmission = deps.webVitalAdmission ?? createClientWebVitalAdmission();
   for (const kind of CLIENT_ERROR_KINDS) {
     observability.incrementCounter({ ...CLIENT_ERRORS_METRIC, labels: { kind }, amount: 0 });
     observability.incrementCounter({
@@ -4006,6 +4092,31 @@ function registerClientErrorRoutes(app, deps) {
       amount: 0
     });
   }
+  for (const action of CLIENT_REQUEST_ACTIONS) {
+    for (const reason of CLIENT_REQUEST_FAILURE_REASONS) {
+      observability.incrementCounter({
+        ...CLIENT_REQUEST_FAILURES_METRIC,
+        labels: { action, reason },
+        amount: 0
+      });
+    }
+  }
+  for (const stream of CLIENT_STREAMS) {
+    for (const event of CLIENT_STREAM_EVENTS) {
+      observability.incrementCounter({
+        ...CLIENT_STREAM_EVENTS_METRIC,
+        labels: { stream, event },
+        amount: 0
+      });
+    }
+  }
+  for (const signal of CLIENT_SIGNALS) {
+    observability.incrementCounter({
+      ...CLIENT_ERROR_REJECTIONS_METRIC,
+      labels: { reason: "rate_limited", kind: signal },
+      amount: 0
+    });
+  }
   for (const reason of CLIENT_ERROR_REJECTION_REASONS) {
     if (reason === "rate_limited") continue;
     observability.incrementCounter({
@@ -4033,8 +4144,16 @@ function registerClientErrorRoutes(app, deps) {
       if (origin !== void 0 && !isAllowedBrowserOrigin(origin, settings)) {
         return reject(c, "origin", 403);
       }
-      const report = parseClientErrorReport(await c.req.text().catch(() => null));
+      const report = parseClientBeaconReport(await c.req.text().catch(() => null));
       if (!report) return reject(c, "invalid", 400);
+      if (isClientSignalReport(report)) {
+        const bucket = report.signal === "web_vital" ? webVitalAdmission : signalAdmission;
+        if (!bucket.admit(signalAdmissionKey(report))) {
+          return reject(c, "rate_limited", 429, report.signal);
+        }
+        recordClientSignal(observability, report);
+        return c.body(null, 204);
+      }
       if (!admission.admit(report.kind)) return reject(c, "rate_limited", 429, report.kind);
       observability.incrementCounter({ ...CLIENT_ERRORS_METRIC, labels: { kind: report.kind } });
       observability.warn("Web client error reported", {
@@ -4047,6 +4166,46 @@ function registerClientErrorRoutes(app, deps) {
     }
   );
 }
+function recordClientSignal(observability, report) {
+  switch (report.signal) {
+    case "request_failure":
+      observability.incrementCounter({
+        ...CLIENT_REQUEST_FAILURES_METRIC,
+        labels: { action: report.action, reason: report.reason }
+      });
+      observability.warn("Web client request failed before a response", {
+        surface: "web",
+        op: report.action,
+        reason: report.reason,
+        clientRoute: report.route,
+        clientRevision: report.revision
+      });
+      return;
+    case "stream":
+      observability.incrementCounter({
+        ...CLIENT_STREAM_EVENTS_METRIC,
+        labels: { stream: report.stream, event: report.event }
+      });
+      if (report.event !== "reconnect") {
+        observability.warn("Web client live stream degraded", {
+          surface: "web",
+          op: report.stream,
+          reason: report.event,
+          clientRoute: report.route,
+          clientRevision: report.revision
+        });
+      }
+      return;
+    case "web_vital":
+      observability.observeHistogram({
+        ...CLIENT_WEB_VITAL_METRIC,
+        labels: { metric: report.metric, page: report.page },
+        value: report.value,
+        buckets: CLIENT_WEB_VITAL_BUCKETS
+      });
+      return;
+  }
+}
 
 // src/routes/analytics-consent.ts
 import {
@@ -4263,6 +4422,11 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
   browser_act: { sessionRequired: true, allOf: ["sessions:control"] },
   browser_clipboard: { sessionRequired: true, allOf: ["sessions:read"] },
   browser_debug: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_downloads: { sessionRequired: true, allOf: ["sessions:read"] },
+  browser_download_save: {
+    sessionRequired: true,
+    allOf: ["sessions:control", "files:upload"]
+  },
   browser_auth: { sessionRequired: true, allOf: ["sessions:control"] },
   interaction_request_human: {
     sessionRequired: true,
@@ -4726,9 +4890,10 @@ import {
 } from "@opengeni/core";
 function projectClientModel(model) {
   const anonymousProvider = model.credentialSource.kind === "deployment" && model.credentialSource.mechanism === "none";
+  const directProvider = model.providerId.startsWith("workspace-openai-") || model.providerId.startsWith("workspace-azure-openai-");
   const organizationProvider = model.credentialSource.kind === "organization_connection";
-  const source = organizationProvider || model.providerId === "workspace-anthropic" || model.providerId === "workspace-claude-subscription" || model.providerId === OPENROUTER_PROVIDER_ID || model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID ? void 0 : model.credentialSource.kind === "connected_subscription" ? model.credentialSource.provider === "xai" ? "supergrok" : "codex" : model.credentialSource.kind === "workspace_connection" ? "workspace_gateway" : anonymousProvider ? void 0 : "opengeni";
-  const publicProvider = anonymousProvider || organizationProvider || model.providerId === "workspace-anthropic" || model.providerId === "workspace-claude-subscription" ? { provider: model.providerId, providerLabel: model.providerLabel } : model.providerId === OPENROUTER_PROVIDER_ID ? { provider: "openrouter", providerLabel: "OpenRouter" } : model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID ? { provider: "workspace-openrouter", providerLabel: "Your OpenRouter" } : source === "codex" ? { provider: "codex", providerLabel: "Codex" } : source === "supergrok" ? { provider: "supergrok", providerLabel: "SuperGrok" } : source === "workspace_gateway" ? { provider: "workspace-gateway", providerLabel: "Your Gateway" } : { provider: "opengeni", providerLabel: "OpenGeni" };
+  const source = directProvider || organizationProvider || model.providerId === "workspace-anthropic" || model.providerId === "workspace-claude-subscription" || model.providerId === OPENROUTER_PROVIDER_ID || model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID ? void 0 : model.credentialSource.kind === "connected_subscription" ? model.credentialSource.provider === "xai" ? "supergrok" : "codex" : model.credentialSource.kind === "workspace_connection" ? "workspace_gateway" : anonymousProvider ? void 0 : "opengeni";
+  const publicProvider = directProvider || anonymousProvider || organizationProvider || model.providerId === "workspace-anthropic" || model.providerId === "workspace-claude-subscription" ? { provider: model.providerId, providerLabel: model.providerLabel } : model.providerId === OPENROUTER_PROVIDER_ID ? { provider: "openrouter", providerLabel: "OpenRouter" } : model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID ? { provider: "workspace-openrouter", providerLabel: "Your OpenRouter" } : source === "codex" ? { provider: "codex", providerLabel: "Codex" } : source === "supergrok" ? { provider: "supergrok", providerLabel: "SuperGrok" } : source === "workspace_gateway" ? { provider: "workspace-gateway", providerLabel: "Your Gateway" } : { provider: "opengeni", providerLabel: "OpenGeni" };
   return ClientModel.parse({
     id: model.id,
     label: model.label,
@@ -5704,7 +5869,8 @@ import {
   agentConfigDeploymentPolicy as agentConfigDeploymentPolicy3,
   configuredAllowedReasoningEfforts,
   resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy2,
-  resolveVoiceInputProviderRegistry as resolveVoiceInputProviderRegistry2
+  resolveVoiceInputProviderRegistry as resolveVoiceInputProviderRegistry2,
+  UnsupportedLatencyModeError as UnsupportedLatencyModeError2
 } from "@opengeni/config";
 import {
   AGENT_CAPABILITY_IDS,
@@ -5784,7 +5950,11 @@ import { getCookie as getCookie3 } from "hono/cookie";
 import { HTTPException as HTTPException107 } from "hono/http-exception";
 
 // src/http/api-error.ts
-import { AgentConfigError, AllowanceExhaustedRefusal } from "@opengeni/contracts";
+import {
+  AgentConfigError,
+  AllowanceExhaustedRefusal,
+  ModelUnavailableError
+} from "@opengeni/contracts";
 import { WorkspaceControlBusyError } from "@opengeni/db";
 import { HTTPException as HTTPException14 } from "hono/http-exception";
 var ApiHttpError = class extends HTTPException14 {
@@ -5840,6 +6010,17 @@ function agentConfigHttpError(error) {
     }
   });
 }
+function modelUnavailableHttpError(error) {
+  const cause = error instanceof ModelUnavailableError ? error : error instanceof HTTPException14 && error.cause instanceof ModelUnavailableError ? error.cause : null;
+  if (!cause) return null;
+  return new ApiHttpError(422, {
+    code: "validation_failed",
+    message: cause.message,
+    retryable: false,
+    outcomeUnknown: false,
+    details: { code: cause.code, modelId: cause.modelId }
+  });
+}
 
 // src/http/request-body.ts
 import { ZodError } from "zod";
@@ -6056,19 +6237,19 @@ function ipv6Groups(address) {
 // src/http/unmatched-route.ts
 import { matchedRoutes } from "hono/route";
 var PROBED_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
-function isTerminalRoute(route) {
-  if (route.method.toUpperCase() !== "ALL") return true;
-  return typeof route.handler === "function" && route.handler.length < 2;
+function isTerminalRoute(route2) {
+  if (route2.method.toUpperCase() !== "ALL") return true;
+  return typeof route2.handler === "function" && route2.handler.length < 2;
 }
 function routesFor(app, method, path) {
   const result = app.router.match(method, path);
-  return result[0].map(([[, route]]) => route);
+  return result[0].map(([[, route2]]) => route2);
 }
 function unmatchedRoute(app, c) {
   const method = c.req.method.toUpperCase();
   if (method === "OPTIONS") return null;
   try {
-    if (matchedRoutes(c).some((route) => isTerminalRoute(route))) {
+    if (matchedRoutes(c).some((route2) => isTerminalRoute(route2))) {
       return null;
     }
     const effectiveMethod = method === "HEAD" ? "GET" : method;
@@ -6114,9 +6295,9 @@ async function isContractRefusal(response) {
 import { matchedRoutes as matchedRoutes2 } from "hono/route";
 function registeredHandlerRoutePath(context) {
   try {
-    for (const route of matchedRoutes2(context)) {
-      if (typeof route.handler !== "function" || route.handler.length >= 2) continue;
-      const label = boundedRegisteredRouteLabel(route.path);
+    for (const route2 of matchedRoutes2(context)) {
+      if (typeof route2.handler !== "function" || route2.handler.length >= 2) continue;
+      const label = boundedRegisteredRouteLabel(route2.path);
       if (label) return label;
     }
   } catch {
@@ -10684,6 +10865,7 @@ function ticketBodyTooLarge() {
 // src/mcp/knowledge-entries.ts
 import {
   AgentInstructionSaveRequest,
+  WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS,
   WorkspaceInstructionPolicyTarget,
   KnowledgeEntryListRequest,
   KnowledgeSavePreparationRequest,
@@ -10750,7 +10932,7 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
         };
       }
       const state = nestedPostgresSqlState3(error);
-      const message = surface === "instruction" ? state === "40001" ? "This instruction changed. Read its current content and baseline, then retry the same intended edit against that exact state." : state === "23505" ? "This instruction operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The instruction change is unavailable in this task's scope or Agent learning policy. Off disables authoring, not the task. Do not ask for approval to continue." : state === "22023" || state === "23514" ? "Invalid instruction change. Read the current instruction, use append for a new rule, or edit with one localized exact oldText match to update or remove text. Agents cannot replace the complete instruction. The resulting instruction must stay within 600 characters." : "Workspace instructions are temporarily unavailable. Retry the same operation ID only if the prior change may have succeeded." : state === "40001" ? "This entry changed. Read its current revision and retry your correction with the current version." : state === "23505" ? "This operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The entry, reference, or write is unavailable in this task's scope and Agent learning policy. Off disables saving, not your task. Do not ask for an approval to continue." : state === "22023" || state === "23514" ? "Invalid Knowledge entry or relationship. Check the referenced IDs and revision before retrying." : "Knowledge is temporarily unavailable. Your task can continue; retry the same operation ID if saving may have succeeded.";
+      const message = surface === "instruction" ? state === "40001" ? "This instruction changed. Read its current content and baseline, then retry the same intended edit against that exact state." : state === "23505" ? "This instruction operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The instruction change is unavailable in this task's scope or Agent learning policy. Off disables authoring, not the task. Do not ask for approval to continue." : state === "22023" || state === "23514" ? `Invalid instruction change. Read the current instruction, use append for a new rule, or edit with one localized exact oldText match to update or remove text. Agents cannot replace the complete instruction. Each supplied text and the resulting instruction must stay within ${WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters, the same limit as the human editor.` : "Workspace instructions are temporarily unavailable. Retry the same operation ID only if the prior change may have succeeded." : state === "40001" ? "This entry changed. Read its current revision and retry your correction with the current version." : state === "23505" ? "This operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The entry, reference, or write is unavailable in this task's scope and Agent learning policy. Off disables saving, not your task. Do not ask for an approval to continue." : state === "22023" || state === "23514" ? "Invalid Knowledge entry or relationship. Check the referenced IDs and revision before retrying." : "Knowledge is temporarily unavailable. Your task can continue; retry the same operation ID if saving may have succeeded.";
       return {
         isError: true,
         content: [
@@ -10935,7 +11117,7 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
   server.registerTool(
     "instruction_policy_save",
     {
-      description: "Change a concise standing workspace instruction through this task's Agent learning policy. Use for short always-on behavior such as 'Keep replies concise; expand when asked', within the intended workspace scope; active instructions enter applicable prompts without Knowledge retrieval. Read the current policy first and submit its exact baseline. Use editMode=append by default for a new rule; it preserves the current content and adds one blank-line separator. Use edit with a localized oldText that occurs exactly once and newText to update or remove only that passage. Agents cannot replace the complete instruction; direct the user to the manual workspace-instruction editor for a whole-policy rewrite. Each supplied text and the resulting instruction are limited to 600 characters. Facts and incidents belong in knowledge_save and reusable procedures or context-specific preferences in skill_save. Preserve personal scope rather than creating a workspace-wide rule. Review first saves an inactive revision and returns pending; continue the task without an approval question. Report the actual receipt; Knowledge is not a workaround for Off, pending review, unavailable scope or size limits.",
+      description: `Change a concise standing workspace instruction through this task's Agent learning policy. Use for short always-on behavior such as 'Keep replies concise; expand when asked', within the intended workspace scope; active instructions enter applicable prompts without Knowledge retrieval. Read the current policy first and submit its exact baseline. Use editMode=append by default for a new rule; it preserves the current content and adds one blank-line separator. Use edit with a localized oldText that occurs exactly once and newText to update or remove only that passage. Agents cannot replace the complete instruction; direct the user to the manual workspace-instruction editor for a whole-policy rewrite. Each supplied text and the resulting instruction are limited to ${WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters, the same limit as the human editor. Facts and incidents belong in knowledge_save and reusable procedures or context-specific preferences in skill_save. Preserve personal scope rather than creating a workspace-wide rule. Review first saves an inactive revision and returns pending; continue the task without an approval question. Report the actual receipt; Knowledge is not a workaround for Off, pending review, unavailable scope or size limits.`,
       inputSchema: AgentInstructionSaveRequest.shape
     },
     (input) => run((context) => saveAgentInstruction(deps.db, context, input), "instruction")
@@ -33915,7 +34097,9 @@ function registerWorkspaceOrchestrationTools(server, deps, grant, can, callerSes
         "Model for the worker. Omit to inherit the exact calling turn's model, including its Codex subscription billing path."
       ),
       reasoningEffort: z43.string().optional().describe("Omit to inherit the exact calling turn's reasoning effort."),
-      latencyMode: z43.enum(["standard", "priority", "fast"]).optional().describe("Omit to inherit the exact calling turn's latency mode."),
+      latencyMode: z43.enum(["standard", "priority", "fast"]).optional().describe(
+        "Omit for standard latency, even when model and reasoning are inherited. Fast or priority must be selected explicitly and supported by the model."
+      ),
       sandboxBackend: z43.string().optional(),
       // Model-only structural coupling: workingDir cannot exist without a
       // targetSandboxId because both live inside one optional object. The
@@ -35249,11 +35433,11 @@ function normalizeSessionDiscoveryRevision(value, label) {
   if (!SESSION_DISCOVERY_REVISION.test(value)) {
     throw new Error(`sessions_list ${label} must be a decimal activity revision`);
   }
-  const revision = BigInt(value);
-  if (revision > SESSION_DISCOVERY_REVISION_MAX) {
+  const revision2 = BigInt(value);
+  if (revision2 > SESSION_DISCOVERY_REVISION_MAX) {
     throw new Error(`sessions_list ${label} exceeds the database activity revision range`);
   }
-  return revision.toString();
+  return revision2.toString();
 }
 function decodeSessionDiscoveryCursor(value) {
   try {
@@ -65662,6 +65846,7 @@ function registerOrganizationIntegrationPolicyRoutes(app, deps) {
 
 // src/routes/connections.ts
 import { createHash as createHash18, createHmac as createHmac6 } from "crypto";
+import { verifyDirectModelAccess } from "@opengeni/core";
 import {
   createConnectionIdempotently,
   upsertWorkspaceProviderApiKeyConnection as upsertWorkspaceProviderApiKeyConnection2,
@@ -65755,6 +65940,7 @@ import {
 import {
   API_INTEGRATION_OAUTH_CREDENTIAL_ROLE as API_INTEGRATION_OAUTH_CREDENTIAL_ROLE3,
   ApiIntegrationOAuthStartRequest,
+  DirectModelProviderMetadata,
   ConnectionResponse,
   CreateConnectionRequest,
   FikenInstallRequest as FikenInstallRequest2,
@@ -67213,6 +67399,28 @@ function registerConnectionRoutes(app, deps) {
     const grant = access.grant;
     const beforeCommit = externalContinuationCommitAuthorizer2(access);
     const payload = await parseRequestJson(c, CreateConnectionRequest);
+    if (payload.metadata?.directModelProvider !== void 0 || String(payload.metadata?.credentialRole ?? "").startsWith("direct_")) {
+      const config = DirectModelProviderMetadata.safeParse(payload.metadata?.directModelProvider);
+      const domain = config.success ? new URL(config.data.endpoint ?? "https://api.openai.com/v1").hostname : null;
+      if (!config.success || payload.subjectId !== null || payload.kind !== "api_key" || canonicalProviderDomain(payload.providerDomain) !== domain || payload.metadata?.credentialRole !== `direct_${config.data.provider}` || typeof payload.credential.apiKey !== "string" || !payload.credential.apiKey.trim() || !payload.operationId || payload.expiresAt) {
+        throw new HTTPException44(422, {
+          message: "Invalid OpenAI or Azure OpenAI connection: provide a key, model, and official provider endpoint"
+        });
+      }
+      payload.metadata = { ...payload.metadata, directModelProvider: config.data };
+      if (payload.verifyModelAccess) {
+        await verifyDirectModelAccess(
+          config.data,
+          payload.credential.apiKey,
+          deps.directModelFetch
+        );
+      }
+    } else if (payload.verifyModelAccess) {
+      throw new HTTPException44(422, {
+        message: "Model checks require an OpenAI or Azure OpenAI connection"
+      });
+    }
+    const directModelKey = payload.metadata?.directModelProvider !== void 0;
     const persist = async (db2) => {
       assertNotReservedSlackBotMetadata(payload.metadata);
       assertNotReservedFikenMetadata(payload.metadata);
@@ -67248,7 +67456,8 @@ function registerConnectionRoutes(app, deps) {
         kind: payload.kind,
         metadata: payload.metadata
       });
-      if (!workspaceProviderKind) assertBrokeredApiKeyCredential(payload.kind, payload.credential);
+      if (!workspaceProviderKind && !directModelKey)
+        assertBrokeredApiKeyCredential(payload.kind, payload.credential);
       const connection = workspaceProviderKind ? await (async () => {
         const provider = workspaceProviderApiKeyConnectionSpec(workspaceProviderKind);
         if (!payload.operationId) {
@@ -67336,7 +67545,7 @@ function registerConnectionRoutes(app, deps) {
       kind: payload.kind,
       metadata: payload.metadata
     });
-    return modelKey ? commit(db) : withOrganizationIntegrationAcquisition8(
+    return modelKey || directModelKey ? commit(db) : withOrganizationIntegrationAcquisition8(
       db,
       { accountId: grant.accountId, workspaceId },
       [null],
@@ -67857,6 +68066,11 @@ function registerConnectionRoutes(app, deps) {
             c.req.param("connectionId"),
             grant.subjectId
           );
+          if (initial?.metadata.directModelProvider !== void 0 || payload.metadata?.directModelProvider !== void 0 || String(payload.metadata?.credentialRole ?? "").startsWith("direct_")) {
+            throw new HTTPException44(422, {
+              message: "Disconnect and reconnect OpenAI or Azure OpenAI to replace its key or deployment"
+            });
+          }
           if (!initial || !workspaceProviderApiKeyConnectionKind(initial)) {
             await db2.execute(
               sql`select id from connections where workspace_id = ${workspaceId}::uuid and id = ${c.req.param("connectionId")}::uuid and (subject_id is null or subject_id = ${grant.subjectId}) for update`
@@ -69219,6 +69433,7 @@ import {
 } from "@opengeni/core";
 import { withOrganizationIntegrationPolicyFence as withOrganizationIntegrationPolicyFence5 } from "@opengeni/db/organization-integration-policy";
 import {
+  ApiIntegrationConnectionReferenceError,
   ApiIntegrationInstallationVersionConflictError,
   buildConnectionTokenResolver as buildConnectionTokenResolver6,
   getApiIntegrationUninstallPreview,
@@ -69304,14 +69519,14 @@ async function resolveDefinition(input) {
     );
   }
   const identity2 = integrationInstallationIdentity("openapi", definition.id, definition.source.url);
-  const revision = compileOpenApiRevision(document, {
+  const revision2 = compileOpenApiRevision(document, {
     definitionId: definition.id,
     sourceUrl: definition.source.url,
     baseUrl: definition.baseUrl,
     provider: definition.provider.id,
     ...definition.source.kind === "openapi" && definition.source.schemaMode ? { schemaMode: definition.source.schemaMode } : {}
   });
-  const baseUrl = firstOpenApiServerUrl(revision);
+  const baseUrl = firstOpenApiServerUrl(revision2);
   const providerDomain = definition.provider.domain;
   const auth = {
     kind: "oauth2",
@@ -69323,7 +69538,7 @@ async function resolveDefinition(input) {
     definitionId: definition.id,
     definitionProvenance: "curated",
     identity: identity2,
-    revision,
+    revision: revision2,
     provider: definition.provider.id,
     providerDomain,
     baseUrl,
@@ -69348,12 +69563,12 @@ async function resolveOpenApi(input, sourceUrl, baseUrl) {
     new URL(sourceUrl).hostname,
     sourceUrl
   );
-  const revision = compileOpenApiRevision(document, {
+  const revision2 = compileOpenApiRevision(document, {
     definitionId: identity2.sourceDerivedDefinitionId,
     sourceUrl,
     ...baseUrl ? { baseUrl } : {}
   });
-  const resolvedBaseUrl = firstOpenApiServerUrl(revision);
+  const resolvedBaseUrl = firstOpenApiServerUrl(revision2);
   const providerDomain = new URL(resolvedBaseUrl).hostname.toLowerCase();
   const discovered = discoverOpenApiAuth(document);
   const auth = authPreview(discovered, providerDomain, input.connection);
@@ -69362,13 +69577,13 @@ async function resolveOpenApi(input, sourceUrl, baseUrl) {
     definitionId: identity2.sourceDerivedDefinitionId,
     definitionProvenance: "workspace",
     identity: identity2,
-    revision,
+    revision: revision2,
     provider: null,
     providerDomain,
     baseUrl: resolvedBaseUrl,
     sourceUrl,
-    name: revision.title,
-    description: revision.description ?? null,
+    name: revision2.title,
+    description: revision2.description ?? null,
     auth,
     connection: input.connection,
     requiredScopes: auth.kind === "oauth2" ? auth.scopes : [],
@@ -69388,9 +69603,9 @@ function resolveInlineOpenApiDocument(input, source) {
     source.sourceKey,
     `document:${source.sourceKey}`
   );
-  let revision;
+  let revision2;
   try {
-    revision = compileOpenApiRevision(document, {
+    revision2 = compileOpenApiRevision(document, {
       definitionId: identity2.sourceDerivedDefinitionId,
       ...source.baseUrl ? { baseUrl: source.baseUrl } : {}
     });
@@ -69404,7 +69619,7 @@ function resolveInlineOpenApiDocument(input, source) {
     }
     throw error;
   }
-  const resolvedBaseUrl = firstOpenApiServerUrl(revision);
+  const resolvedBaseUrl = firstOpenApiServerUrl(revision2);
   const providerDomain = new URL(resolvedBaseUrl).hostname.toLowerCase();
   const discovered = discoverOpenApiAuth(document);
   const auth = authPreview(discovered, providerDomain, input.connection);
@@ -69418,13 +69633,13 @@ function resolveInlineOpenApiDocument(input, source) {
     definitionId: identity2.sourceDerivedDefinitionId,
     definitionProvenance: "workspace",
     identity: identity2,
-    revision,
+    revision: revision2,
     provider: null,
     providerDomain,
     baseUrl: resolvedBaseUrl,
     sourceUrl: null,
-    name: revision.title,
-    description: revision.description ?? null,
+    name: revision2.title,
+    description: revision2.description ?? null,
     auth,
     connection: input.connection,
     requiredScopes: auth.kind === "oauth2" ? auth.scopes : [],
@@ -69440,7 +69655,7 @@ async function resolveGraphql(input, endpoint, name) {
     authority: input.authority,
     ...input.credentialResolver ? { credentialResolver: input.credentialResolver } : {}
   });
-  const revision = compileGraphqlRevision(introspection, {
+  const revision2 = compileGraphqlRevision(introspection, {
     definitionId: identity2.sourceDerivedDefinitionId,
     endpoint,
     sourceUrl: endpoint,
@@ -69452,13 +69667,13 @@ async function resolveGraphql(input, endpoint, name) {
     definitionId: identity2.sourceDerivedDefinitionId,
     definitionProvenance: "workspace",
     identity: identity2,
-    revision,
+    revision: revision2,
     provider: null,
     providerDomain,
     baseUrl: endpoint,
     sourceUrl: endpoint,
-    name: revision.title,
-    description: revision.description ?? null,
+    name: revision2.title,
+    description: revision2.description ?? null,
     auth,
     connection: input.connection,
     requiredScopes: input.connection?.scopes ?? [],
@@ -69521,8 +69736,8 @@ function integrationInstallationIdentity(protocol, label, locator2) {
     serverId: `api_${protocol}_${slug.replaceAll("-", "_").slice(0, 48)}_${hash}`
   };
 }
-function firstOpenApiServerUrl(revision) {
-  const first = Object.values(revision.bindings)[0]?.serverUrl;
+function firstOpenApiServerUrl(revision2) {
+  const first = Object.values(revision2.bindings)[0]?.serverUrl;
   if (!first) throw new Error("OpenAPI revision has no executable server URL");
   return first;
 }
@@ -69780,6 +69995,11 @@ function registerApiIntegrationRoutes(app, deps, overrides = {}) {
         payload.expectedInstanceVersion === void 0 ? 201 : 200
       );
     } catch (error) {
+      if (error instanceof ApiIntegrationConnectionReferenceError) {
+        throw new HTTPException47(error.reason === "not_found" ? 404 : 422, {
+          message: error.reason === "not_found" ? "connection not found" : error.message
+        });
+      }
       if (error instanceof IntegrationFacetBindingVersionConflictError || error instanceof IntegrationFacetBindingVersionRequiredError || error instanceof IntegrationFacetBindingOwnershipConflictError) {
         throw new HTTPException47(409, {
           message: "The Integration instance changed or is shared by another owner. Refresh its details before updating it."
@@ -74503,14 +74723,17 @@ import {
   OrganizationUsageQuery,
   OrganizationUsageWorkspacePageQuery
 } from "@opengeni/contracts";
+import { OrganizationModelUsageQuery } from "@opengeni/contracts/organization-model-usage";
 import { configuredEntitlements } from "@opengeni/config";
 import {
   applyCreditLedgerEntry,
   getBillingBalance,
   getBillingCustomer,
+  getCreditLedgerEntry,
   hasCreditLedgerEntry,
   isStripeWebhookProcessed,
   listUsageEvents,
+  getOrganizationModelUsage,
   getOrganizationUsageSummary,
   getOrganizationUsageWorkspacePage,
   withSessionRlsActorContext as withSessionRlsActorContext8,
@@ -74580,6 +74803,21 @@ function registerBillingRoutes(app, deps) {
       async () => c.json(await getOrganizationUsageWorkspacePage(deps.db, { accountId, ...parsed.data }))
     );
   });
+  app.get("/v1/billing/usage-models", async (c) => {
+    const context = await requireAccessContext5(c, deps);
+    const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
+    const parsed = OrganizationModelUsageQuery.safeParse(c.req.query());
+    if (!parsed.success)
+      throw new HTTPException56(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid model usage query"
+      });
+    return await withBillingUsageActor(
+      deps,
+      context,
+      accountId,
+      async () => c.json(await getOrganizationModelUsage(deps.db, { accountId, ...parsed.data }))
+    );
+  });
   app.get("/v1/billing/entitlements", async (c) => {
     const context = await requireAccessContext5(c, deps);
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
@@ -74615,6 +74853,7 @@ function registerBillingRoutes(app, deps) {
         amountMicros,
         creditsProductId: deps.settings.stripeCreditsProductId,
         publicBaseUrl: deps.settings.publicBaseUrl,
+        webBaseUrl: deps.settings.webBaseUrl,
         successUrl: body3.successUrl,
         cancelUrl: body3.cancelUrl,
         idempotencyKey
@@ -74649,6 +74888,7 @@ function registerBillingRoutes(app, deps) {
       stripeBillingPortalSessionCreateParams({
         customerId,
         publicBaseUrl: deps.settings.publicBaseUrl,
+        webBaseUrl: deps.settings.webBaseUrl,
         returnUrl: parsed.data.returnUrl
       })
     );
@@ -74708,18 +74948,21 @@ function registerBillingRoutes(app, deps) {
 function stripeCheckoutSessionCreateParams(input) {
   const successUrl = checkoutReturnUrl(
     input.publicBaseUrl,
+    input.webBaseUrl,
     input.successUrl,
     "/billing?checkout=success",
     "successUrl"
   );
   const cancelUrl = checkoutReturnUrl(
     input.publicBaseUrl,
+    input.webBaseUrl,
     input.cancelUrl,
     "/billing?checkout=cancelled",
     "cancelUrl"
   );
   return {
     mode: "payment",
+    allow_promotion_codes: true,
     customer: input.customerId,
     customer_update: {
       address: "auto",
@@ -74751,14 +74994,16 @@ function stripeCheckoutSessionCreateParams(input) {
       opengeni_account_id: input.accountId,
       opengeni_credit_amount_usd: (input.amountCents / 100).toFixed(2),
       opengeni_credit_micros: String(input.amountMicros),
-      opengeni_credit_idempotency_key: input.idempotencyKey
+      opengeni_credit_idempotency_key: input.idempotencyKey,
+      opengeni_credit_coupon_v1: "1"
     },
     payment_intent_data: {
       metadata: {
         opengeni_account_id: input.accountId,
         opengeni_credit_amount_usd: (input.amountCents / 100).toFixed(2),
         opengeni_credit_micros: String(input.amountMicros),
-        opengeni_credit_idempotency_key: input.idempotencyKey
+        opengeni_credit_idempotency_key: input.idempotencyKey,
+        opengeni_credit_coupon_v1: "1"
       }
     },
     invoice_creation: {
@@ -74768,7 +75013,8 @@ function stripeCheckoutSessionCreateParams(input) {
           opengeni_account_id: input.accountId,
           opengeni_credit_amount_usd: (input.amountCents / 100).toFixed(2),
           opengeni_credit_micros: String(input.amountMicros),
-          opengeni_credit_idempotency_key: input.idempotencyKey
+          opengeni_credit_idempotency_key: input.idempotencyKey,
+          opengeni_credit_coupon_v1: "1"
         }
       }
     }
@@ -74777,23 +75023,32 @@ function stripeCheckoutSessionCreateParams(input) {
 function stripeBillingPortalSessionCreateParams(input) {
   return {
     customer: input.customerId,
-    return_url: checkoutReturnUrl(input.publicBaseUrl, input.returnUrl, "/billing", "returnUrl")
+    return_url: checkoutReturnUrl(
+      input.publicBaseUrl,
+      input.webBaseUrl,
+      input.returnUrl,
+      "/billing",
+      "returnUrl"
+    )
   };
 }
-function checkoutReturnUrl(publicBaseUrl, candidate, fallbackPath, field) {
+function checkoutReturnUrl(publicBaseUrl, webBaseUrl, candidate, fallbackPath, field) {
   if (!publicBaseUrl) {
     throw new HTTPException56(500, {
       message: "OPENGENI_PUBLIC_BASE_URL is required for Stripe redirects"
     });
   }
-  const base = new URL(publicBaseUrl);
+  const base = new URL(webBaseUrl ?? publicBaseUrl);
   const fallback = new URL(fallbackPath, base).toString();
   if (!candidate) {
     return fallback;
   }
   const parsed = new URL(candidate);
-  if (parsed.origin !== base.origin) {
-    throw new HTTPException56(400, { message: `${field} must use the OpenGeni public origin` });
+  const allowedOrigins2 = /* @__PURE__ */ new Set([new URL(publicBaseUrl).origin, base.origin]);
+  if (!allowedOrigins2.has(parsed.origin)) {
+    throw new HTTPException56(400, {
+      message: `${field} must use the OpenGeni public${allowedOrigins2.size > 1 ? " or web" : ""} origin`
+    });
   }
   return parsed.toString();
 }
@@ -74845,13 +75100,17 @@ function stripeCheckoutCreditDecision(session) {
   if (session.mode !== "payment") {
     return { action: "ignore", reason: "not_payment_mode" };
   }
-  if (session.payment_status !== "paid") {
+  if (session.payment_status !== "paid" && !isFreeCouponCheckout(session)) {
     return { action: "ignore", reason: "payment_not_paid" };
   }
-  return {
-    action: "grant",
-    credit: creditMetadata(session.metadata, `Stripe checkout session ${session.id}`)
-  };
+  const credit = creditMetadata(session.metadata, `Stripe checkout session ${session.id}`);
+  if (session.metadata?.opengeni_credit_coupon_v1 === "1" && (session.currency !== "usd" || session.amount_subtotal !== credit.amountMicros / 1e4 || typeof session.amount_total !== "number" || !Number.isSafeInteger(session.amount_total) || session.amount_total < 0)) {
+    throw new Error(`Stripe checkout session ${session.id} has invalid credit package totals`);
+  }
+  return { action: "grant", credit };
+}
+function isFreeCouponCheckout(session) {
+  return (session.payment_status === "paid" || session.payment_status === "no_payment_required") && session.status === "complete" && session.amount_total === 0 && typeof session.amount_subtotal === "number" && session.amount_subtotal > 0 && (session.total_details?.amount_discount ?? 0) >= session.amount_subtotal;
 }
 async function handleCheckoutSessionPayment(deps, event) {
   const session = event.data.object;
@@ -74866,6 +75125,7 @@ async function handleCheckoutSessionPayment(deps, event) {
     return;
   }
   const credit = decision.credit;
+  const freeCouponCheckout = isFreeCouponCheckout(session);
   if (!await getManagedAccount2(deps.db, credit.accountId)) {
     console.info(
       "[api] stripe webhook ignored a checkout session for an account not in this deployment",
@@ -74887,19 +75147,23 @@ async function handleCheckoutSessionPayment(deps, event) {
   }
   await applyCreditLedgerEntry(deps.db, {
     accountId: credit.accountId,
-    type: "credit_topup",
+    type: freeCouponCheckout ? "grant" : "credit_topup",
     amountMicros: credit.amountMicros,
-    sourceType: "stripe_checkout_session",
+    sourceType: freeCouponCheckout ? "stripe_checkout_coupon" : "stripe_checkout_session",
     sourceId: session.id,
     idempotencyKey: credit.idempotencyKey,
     metadata: {
       stripeEventId: event.id,
       stripePaymentIntentId: typeof session.payment_intent === "string" ? session.payment_intent : session.payment_intent?.id ?? null,
       stripePackageId: credit.packageId,
-      stripeCreditAmountUsd: credit.amountUsd
+      stripeCreditAmountUsd: credit.amountUsd,
+      ...session.metadata?.opengeni_credit_coupon_v1 === "1" ? {
+        stripeAmountTotalCents: session.amount_total,
+        stripeDiscountCents: session.total_details?.amount_discount ?? 0
+      } : {}
     }
   });
-  recordCreditMicrosMetric(deps, "topup", credit.amountMicros);
+  recordCreditMicrosMetric(deps, freeCouponCheckout ? "grant" : "topup", credit.amountMicros);
 }
 async function mirrorPaymentIntentCustomer(deps, event) {
   const intent = event.data.object;
@@ -74936,19 +75200,21 @@ async function applyRefundDebit(deps, stripe, refund) {
   if (await hasCreditLedgerEntry(deps.db, accountId, idempotencyKey)) {
     return;
   }
+  const debitMicros = await creditAdjustmentMicros(deps, metadata, refund.amount);
   await applyCreditLedgerEntry(deps.db, {
     accountId,
     type: "credit_refund",
-    amountMicros: -centsToMicros(refund.amount),
+    amountMicros: -debitMicros,
     sourceType: "stripe_refund",
     sourceId: refund.id,
     idempotencyKey,
     metadata: {
       stripeRefundId: refund.id,
-      stripePaymentIntentId: paymentIntentId(refund.payment_intent)
+      stripePaymentIntentId: paymentIntentId(refund.payment_intent),
+      stripeRefundAmountCents: refund.amount
     }
   });
-  recordCreditMicrosMetric(deps, "refund", centsToMicros(refund.amount));
+  recordCreditMicrosMetric(deps, "refund", debitMicros);
 }
 async function holdDisputedCredits(deps, stripe, event) {
   const dispute = event.data.object;
@@ -74957,10 +75223,11 @@ async function holdDisputedCredits(deps, stripe, event) {
   if (!accountId) {
     return;
   }
+  const debitMicros = await creditAdjustmentMicros(deps, metadata, dispute.amount);
   await applyCreditLedgerEntry(deps.db, {
     accountId,
     type: "credit_dispute_hold",
-    amountMicros: -centsToMicros(dispute.amount),
+    amountMicros: -debitMicros,
     sourceType: "stripe_dispute",
     sourceId: dispute.id,
     idempotencyKey: `stripe:dispute_hold:${dispute.id}`,
@@ -74981,16 +75248,30 @@ async function releaseDisputedCredits(deps, stripe, event) {
   if (!await hasCreditLedgerEntry(deps.db, accountId, holdIdempotencyKey)) {
     return;
   }
+  const debitMicros = await creditAdjustmentMicros(deps, metadata, dispute.amount);
   await applyCreditLedgerEntry(deps.db, {
     accountId,
     type: "credit_dispute_release",
-    amountMicros: centsToMicros(dispute.amount),
+    amountMicros: debitMicros,
     sourceType: "stripe_dispute",
     sourceId: dispute.id,
     idempotencyKey: `stripe:dispute_release:${dispute.id}`,
     metadata: { stripeDisputeId: dispute.id, stripeEventType: event.type }
   });
 }
+async function creditAdjustmentMicros(deps, metadata, amountCents) {
+  if (metadata?.opengeni_credit_coupon_v1 !== "1") return centsToMicros(amountCents);
+  const credit = creditMetadata(metadata, "Stripe adjustment");
+  const entry2 = await getCreditLedgerEntry(deps.db, credit.accountId, credit.idempotencyKey);
+  const paidCents = entry2?.metadata.stripeAmountTotalCents;
+  if (entry2?.sourceType !== "stripe_checkout_session" || entry2.amountMicros !== credit.amountMicros || typeof paidCents !== "number" || !Number.isSafeInteger(paidCents) || paidCents <= 0 || !Number.isSafeInteger(amountCents) || amountCents <= 0) {
+    throw new Error("Stripe credit adjustment is missing a settled checkout");
+  }
+  const proportionalMicros = (BigInt(entry2.amountMicros) * BigInt(amountCents) + BigInt(Math.floor(paidCents / 2))) / BigInt(paidCents);
+  return Number(
+    proportionalMicros > BigInt(entry2.amountMicros) ? entry2.amountMicros : proportionalMicros
+  );
+}
 async function mirrorCustomer(deps, event, customer) {
   const accountId = customer.metadata?.opengeni_account_id;
   if (!accountId || customer.deleted) {
@@ -75015,14 +75296,14 @@ function recordCreditMicrosMetric(deps, kind, amountMicros) {
   });
 }
 async function metadataForRefund(stripe, refund) {
-  if (Object.keys(refund.metadata ?? {}).length > 0) {
+  if (refund.metadata?.opengeni_credit_idempotency_key) {
     return refund.metadata;
   }
   const paymentIntent = paymentIntentId(refund.payment_intent);
-  return paymentIntent ? (await stripe.paymentIntents.retrieve(paymentIntent)).metadata : null;
+  return paymentIntent ? (await stripe.paymentIntents.retrieve(paymentIntent)).metadata : refund.metadata;
 }
 async function metadataForDispute(stripe, dispute) {
-  if (Object.keys(dispute.metadata ?? {}).length > 0) {
+  if (dispute.metadata?.opengeni_credit_idempotency_key) {
     return dispute.metadata;
   }
   const paymentIntent = paymentIntentId(
@@ -75033,7 +75314,7 @@ async function metadataForDispute(stripe, dispute) {
   }
   const chargeId = typeof dispute.charge === "string" ? dispute.charge : dispute.charge?.id;
   if (!chargeId) {
-    return null;
+    return dispute.metadata;
   }
   const charge = await stripe.charges.retrieve(chargeId);
   const chargePaymentIntent = paymentIntentId(charge.payment_intent);
@@ -76430,6 +76711,7 @@ function registerBrowserSessionRoutes(app, deps) {
     await authorizeSourceSession2(deps, grant, request.sessionId, "session.control");
     const origin = requestOrigin(context, deps.settings);
     const authority = browserAuthorityRoot(deps);
+    let prepared = null;
     try {
       assertEphemeralBrowserCreateEnabled(
         request,
@@ -76446,7 +76728,7 @@ function registerBrowserSessionRoutes(app, deps) {
         );
       }
       if (existing) assertCreateReplay(request, existing.session);
-      let prepared = existing ? await prepareBrowserSessionCreate(
+      prepared = existing ? await prepareBrowserSessionCreate(
         deps.db,
         browserCreateInput(grant, workspaceId, request, existing.session.placement)
       ) : null;
@@ -76661,6 +76943,16 @@ function registerBrowserSessionRoutes(app, deps) {
         parsed.operation.state === "completed" && !parsed.operation.replayed ? 201 : 200
       );
     } catch (error) {
+      if (prepared) {
+        await failBrowserSessionOperation(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          operationId: request.operationId,
+          browserSessionId: prepared.session.id,
+          onlyIfPreparedCreate: true,
+          error: interactionFailure(error)
+        }).catch(() => void 0);
+      }
       throw browserRouteError(error);
     }
   });
@@ -79662,6 +79954,7 @@ async function ensureInteractionHolder(deps, grant, sourceSession, browserSessio
     },
     os: placement.lease.os,
     image: sandboxRuntime.image,
+    imagePolicy: "new_creates_only",
     rigVersionId: sourceSession.rigVersionId,
     leaseTtlMs: deps.settings.sandboxLeaseTtlMs,
     expectedEpoch: placement.lease.leaseEpoch,
@@ -80059,10 +80352,10 @@ async function resolveBrowserNetworkRouteLaunch(input) {
     browserSessionId: input.browserSessionId,
     operationId: input.operationId
   });
-  const route = record6.networkRouteAuthority;
-  if (!route) return null;
-  const kind = route.configuration.kind;
-  const providerRoute = kind === "managed" ? managedNetworkRouteForPlacement(route.configuration, route.consistency, input.placement) : void 0;
+  const route2 = record6.networkRouteAuthority;
+  if (!route2) return null;
+  const kind = route2.configuration.kind;
+  const providerRoute = kind === "managed" ? managedNetworkRouteForPlacement(route2.configuration, route2.consistency, input.placement) : void 0;
   if (kind !== "managed" && input.placement.kind === "external_provider") {
     throw new BrowserSessionStateError2(
       "External browser providers require a provider-managed NetworkRoute"
@@ -80073,7 +80366,7 @@ async function resolveBrowserNetworkRouteLaunch(input) {
   let proxyUrl;
   const dispatched = record6.operation?.state === "dispatched";
   if (kind === "proxy") {
-    const reference = route.configuration.credential;
+    const reference = route2.configuration.credential;
     if (reference) {
       try {
         const credential = await loadExactInteractionCredential(
@@ -80085,27 +80378,27 @@ async function resolveBrowserNetworkRouteLaunch(input) {
         credentialVersion = credential.version;
         proxyCredential = proxyCredentialFromBundle(credential.credential);
       } catch (error) {
-        if (route.authorityDigest && dispatched) {
-          return secretlessNetworkRouteReplay(route, kind, providerRoute);
+        if (route2.authorityDigest && dispatched) {
+          return secretlessNetworkRouteReplay(route2, kind, providerRoute);
         }
         throw error;
       }
-      if (dispatched && route.credentialVersion !== credentialVersion) {
-        return secretlessNetworkRouteReplay(route, kind, providerRoute);
+      if (dispatched && route2.credentialVersion !== credentialVersion) {
+        return secretlessNetworkRouteReplay(route2, kind, providerRoute);
       }
     }
-    proxyUrl = browserProxyUrl(route.configuration, proxyCredential);
+    proxyUrl = browserProxyUrl(route2.configuration, proxyCredential);
   }
   if (dispatched) {
-    if (!route.authorityDigest) {
+    if (!route2.authorityDigest) {
       throw new BrowserSessionStateError2("BrowserSession route authority is not bound");
     }
     return {
-      routeId: route.routeId,
-      routeVersion: route.routeVersion,
-      authorityDigest: route.authorityDigest,
+      routeId: route2.routeId,
+      routeVersion: route2.routeVersion,
+      authorityDigest: route2.authorityDigest,
       kind,
-      consistency: route.consistency,
+      consistency: route2.consistency,
       ...proxyUrl === void 0 ? {} : { proxyUrl },
       ...providerRoute === void 0 ? {} : { providerRoute }
     };
@@ -80115,11 +80408,11 @@ async function resolveBrowserNetworkRouteLaunch(input) {
     accountId: input.grant.accountId,
     workspaceId: input.workspaceId,
     browserSessionId: input.browserSessionId,
-    routeId: route.routeId,
-    routeVersion: route.routeVersion,
+    routeId: route2.routeId,
+    routeVersion: route2.routeVersion,
     credentialVersion,
-    configuration: route.configuration,
-    consistency: route.consistency,
+    configuration: route2.configuration,
+    consistency: route2.consistency,
     proxyCredential
   });
   const bound = await bindBrowserSessionNetworkRouteAuthority(input.deps.db, {
@@ -80127,7 +80420,7 @@ async function resolveBrowserNetworkRouteLaunch(input) {
     workspaceId: input.workspaceId,
     browserSessionId: input.browserSessionId,
     operationId: input.operationId,
-    routeVersion: route.routeVersion,
+    routeVersion: route2.routeVersion,
     credentialVersion,
     authorityDigest
   });
@@ -80135,23 +80428,23 @@ async function resolveBrowserNetworkRouteLaunch(input) {
     throw new BrowserSessionOperationConflictError("BrowserSession route launch authority changed");
   }
   return {
-    routeId: route.routeId,
-    routeVersion: route.routeVersion,
+    routeId: route2.routeId,
+    routeVersion: route2.routeVersion,
     authorityDigest,
     kind,
-    consistency: route.consistency,
+    consistency: route2.consistency,
     ...proxyUrl === void 0 ? {} : { proxyUrl },
     ...providerRoute === void 0 ? {} : { providerRoute }
   };
 }
 async function resolveActiveBrowserNetworkRouteLaunch(input) {
-  const route = input.record.networkRouteAuthority;
-  if (!route) return null;
-  if (!route.authorityDigest) {
+  const route2 = input.record.networkRouteAuthority;
+  if (!route2) return null;
+  if (!route2.authorityDigest) {
     throw new BrowserSessionStateError2("BrowserSession route authority is not bound");
   }
-  const kind = route.configuration.kind;
-  const providerRoute = kind === "managed" ? managedNetworkRouteForPlacement(route.configuration, route.consistency, input.placement) : void 0;
+  const kind = route2.configuration.kind;
+  const providerRoute = kind === "managed" ? managedNetworkRouteForPlacement(route2.configuration, route2.consistency, input.placement) : void 0;
   if (kind !== "managed" && input.placement.kind === "external_provider") {
     throw new BrowserSessionStateError2(
       "External browser providers require a provider-managed NetworkRoute"
@@ -80159,7 +80452,7 @@ async function resolveActiveBrowserNetworkRouteLaunch(input) {
   }
   let proxyUrl;
   if (kind === "proxy") {
-    const reference = route.configuration.credential;
+    const reference = route2.configuration.credential;
     let proxyCredential = null;
     if (reference) {
       const credential = await loadExactInteractionCredential(
@@ -80168,35 +80461,35 @@ async function resolveActiveBrowserNetworkRouteLaunch(input) {
         input.record.session.workspaceId,
         reference
       );
-      if (credential.version !== route.credentialVersion) {
+      if (credential.version !== route2.credentialVersion) {
         throw new BrowserSessionStateError2(
           "BrowserSession proxy credential changed; resume the browser to reconnect safely"
         );
       }
       proxyCredential = proxyCredentialFromBundle(credential.credential);
     }
-    proxyUrl = browserProxyUrl(route.configuration, proxyCredential);
+    proxyUrl = browserProxyUrl(route2.configuration, proxyCredential);
   }
   return {
-    routeId: route.routeId,
-    routeVersion: route.routeVersion,
-    authorityDigest: route.authorityDigest,
+    routeId: route2.routeId,
+    routeVersion: route2.routeVersion,
+    authorityDigest: route2.authorityDigest,
     kind,
-    consistency: route.consistency,
+    consistency: route2.consistency,
     ...proxyUrl === void 0 ? {} : { proxyUrl },
     ...providerRoute === void 0 ? {} : { providerRoute }
   };
 }
-function secretlessNetworkRouteReplay(route, kind, providerRoute) {
-  if (!route.authorityDigest) {
+function secretlessNetworkRouteReplay(route2, kind, providerRoute) {
+  if (!route2.authorityDigest) {
     throw new BrowserSessionStateError2("BrowserSession route authority is not bound");
   }
   return {
-    routeId: route.routeId,
-    routeVersion: route.routeVersion,
-    authorityDigest: route.authorityDigest,
+    routeId: route2.routeId,
+    routeVersion: route2.routeVersion,
+    authorityDigest: route2.authorityDigest,
     kind,
-    consistency: route.consistency,
+    consistency: route2.consistency,
     ...providerRoute === void 0 ? {} : { providerRoute }
   };
 }
@@ -80633,6 +80926,7 @@ function registerComputerSessionRoutes(app, deps) {
     await authorizeSourceSession3(deps, grant, request.sessionId, "session.control");
     const origin = requestOrigin2(context, deps.settings);
     const authority = controllerAuthorityRoot(deps);
+    let prepared = null;
     try {
       const existing = await findComputerSessionControlRecordByOperation(deps.db, {
         accountId: grant.accountId,
@@ -80645,7 +80939,7 @@ function registerComputerSessionRoutes(app, deps) {
         );
       }
       if (existing) assertCreateReplay2(request, existing.session);
-      let prepared = existing ? await prepareComputerSessionCreate(
+      prepared = existing ? await prepareComputerSessionCreate(
         deps.db,
         computerCreateInput(grant, workspaceId, request, existing.session.placement)
       ) : null;
@@ -80791,6 +81085,16 @@ function registerComputerSessionRoutes(app, deps) {
         parsed.operation.state === "completed" && !parsed.operation.replayed ? 201 : 200
       );
     } catch (error) {
+      if (prepared) {
+        await failComputerSessionOperation(deps.db, {
+          accountId: grant.accountId,
+          workspaceId,
+          operationId: request.operationId,
+          computerSessionId: prepared.session.id,
+          onlyIfPreparedCreate: true,
+          error: interactionFailure2(error)
+        }).catch(() => void 0);
+      }
       throw computerRouteError(error);
     }
   });
@@ -81669,6 +81973,7 @@ function registerComputerSessionRoutes(app, deps) {
       },
       os: placement.lease.os,
       image: sandboxRuntime.image,
+      imagePolicy: "new_creates_only",
       rigVersionId: sourceSession.rigVersionId,
       leaseTtlMs: deps.settings.sandboxLeaseTtlMs,
       expectedEpoch: placement.lease.leaseEpoch,
@@ -84707,7 +85012,7 @@ import {
 } from "@opengeni/contracts";
 import {
   getWorkspaceInteractionRevisionState,
-  listSessionEvents,
+  listSessionEventPage as listSessionEventPage2,
   listWorkspaceControlEvents
 } from "@opengeni/db";
 import {
@@ -84719,6 +85024,7 @@ import {
 } from "@opengeni/events";
 import { MANAGED_AUTH_ACTOR_EPOCH_HEADER } from "@opengeni/core/managed-auth-session-sets";
 var SESSION_REPLAY_PAGE_SIZE = 100;
+var SESSION_REPLAY_PAGE_MAX_BYTES = 8 * 1024 * 1024;
 var WORKSPACE_CONTROL_REPLAY_PAGE_SIZE = 100;
 var SSE_QUEUED_FRAME_MAX_COUNT = 1;
 var SSE_WRITE_STALL_TIMEOUT_MS = 3e4;
@@ -84894,9 +85200,10 @@ function createLatestWinsDelivery(send, onError) {
 }
 async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal, options = {}) {
   if (isHttp1BrowserBatch(options)) {
-    const events = await listSessionEvents(db, workspaceId, sessionId, {
+    const { events } = await listSessionEventPage2(db, workspaceId, sessionId, {
       after,
-      limit: SESSION_REPLAY_PAGE_SIZE
+      limit: SESSION_REPLAY_PAGE_SIZE,
+      maxBytes: options.finiteResponseMaxBytes ?? HTTP1_BROWSER_SSE_BATCH_MAX_BYTES
     });
     await options.reauthorize?.();
     const compactProjection = coalesceSessionEventDeltasWithCoverage(events);
@@ -84969,10 +85276,12 @@ async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal,
       if (targetSequence !== void 0 && lastSent >= targetSequence) return;
       const previousLastSent = lastSent;
       const limit = targetSequence === void 0 ? SESSION_REPLAY_PAGE_SIZE : Math.min(SESSION_REPLAY_PAGE_SIZE, targetSequence - lastSent);
-      const page2 = await listSessionEvents(db, workspaceId, sessionId, {
+      const replayPage = await listSessionEventPage2(db, workspaceId, sessionId, {
         after: lastSent,
-        limit
+        limit,
+        maxBytes: SESSION_REPLAY_PAGE_MAX_BYTES
       });
+      const page2 = replayPage.events;
       const eligible = targetSequence === void 0 ? page2 : page2.filter((event) => event.sequence <= targetSequence);
       if (eligible.length === 0) {
         if (targetSequence === void 0) return;
@@ -84990,6 +85299,7 @@ async function sseSessionStream(db, bus, workspaceId, sessionId, after, signal,
         throw new Error(`Session event replay made no progress after sequence ${lastSent}`);
       }
       if (targetSequence !== void 0 && lastSent >= targetSequence) return;
+      if (targetSequence === void 0 && !replayPage.hasMore) return;
     }
   };
   let durableDeliveryTail = Promise.resolve();
@@ -86212,6 +86522,7 @@ import {
   defaultPrReviewProviderBaseUrl,
   workspaceCustomModelReference as workspaceCustomModelReference2,
   lockActiveCustomModelForAdmission as lockActiveCustomModelForAdmission2,
+  modelUnavailableHttpException as modelUnavailableHttpException2,
   prReviewWebhookAuthKind,
   normalizePrReviewProviderBaseUrl,
   requireAccessGrant as requireAccessGrant26,
@@ -86470,7 +86781,7 @@ import { HTTPException as HTTPException68 } from "hono/http-exception";
 
 // src/routes/automations.ts
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes7 } from "@opengeni/config";
-import { requireAgentConfigAdmission as requireAgentConfigAdmission2 } from "@opengeni/core";
+import { modelUnavailableHttpException, requireAgentConfigAdmission as requireAgentConfigAdmission2 } from "@opengeni/core";
 import {
   AUTOMATION_WEBHOOK_MAX_BYTES,
   AUTOMATION_MAX_MATCHED_TRIGGERS,
@@ -87076,9 +87387,7 @@ function workspaceCustomModelCommitGuard(input) {
       reference
     });
     if (!active) {
-      throw new HTTPException67(422, {
-        message: `model is not available: ${input.modelId}`
-      });
+      throw modelUnavailableHttpException(input.modelId);
     }
   };
 }
@@ -87174,12 +87483,12 @@ function registerPrReviewGitHubRoutes(app, deps) {
     if (installationId === null || repositoryId === null) {
       return c.json(ignoredWebhook("unsupported_event"), 202);
     }
-    const route = await resolveManagedGitHubPrReviewRoute(deps.db, {
+    const route2 = await resolveManagedGitHubPrReviewRoute(deps.db, {
       installationId: String(installationId),
       providerRepositoryId: String(repositoryId)
     });
-    if (!route) return c.json(ignoredWebhook("repository_not_connected"), 202);
-    const source = await getAutomationSourceSecret2(deps.db, route);
+    if (!route2) return c.json(ignoredWebhook("repository_not_connected"), 202);
+    const source = await getAutomationSourceSecret2(deps.db, route2);
     if (!source || source.status !== "active") {
       return c.json(ignoredWebhook("source_disabled"), 202);
     }
@@ -88212,9 +88521,7 @@ function prReviewCustomModelCommitGuard(input) {
       reference
     });
     if (!active) {
-      throw new HTTPException69(422, {
-        message: `model is not available: ${input.modelId}`
-      });
+      throw modelUnavailableHttpException2(input.modelId);
     }
   };
 }
@@ -89653,8 +89960,8 @@ function registerSkillContentRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant29(c, deps, workspaceId, "workspace:read");
     const skillId = skillIdentifier(c.req.param("skillId"));
-    const revision = c.req.query("revisionId");
-    const revisionId2 = revision === void 0 ? void 0 : skillIdentifier(revision);
+    const revision2 = c.req.query("revisionId");
+    const revisionId2 = revision2 === void 0 ? void 0 : skillIdentifier(revision2);
     const skill = await readSkill(
       deps.db,
       { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
@@ -90906,6 +91213,7 @@ function registerScheduledTaskRoutes(app, deps) {
 
 // src/routes/sessions.ts
 import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
+import { UnsupportedLatencyModeError } from "@opengeni/config";
 import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
 import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
 import * as sessionPreviewSchema from "@opengeni/db/schema";
@@ -91027,7 +91335,7 @@ import {
   getSessionQueueSnapshot as getSessionQueueSnapshot2,
   getStreamAcknowledgment,
   insertPtySession,
-  listSessionEventPage as listSessionEventPage2,
+  listSessionEventPage as listSessionEventPage3,
   listSessionHumanInputRequests,
   listSessionGoalRevisionPage,
   listSessionGoalRevisions,
@@ -91036,6 +91344,7 @@ import {
   listSessionDiscoverySummaries as listSessionDiscoverySummaries2,
   listSessionDiscoveryAncestorPaths,
   listSessionsForSubject,
+  listSessionEntriesForSubject,
   getLatestStartedSessionTurn,
   listSessionTurns,
   projectEffectiveControlForRelatedAccess as projectEffectiveControlForRelatedAccess2,
@@ -91905,8 +92214,7 @@ import {
   workflowIdForSession as workflowIdForSession3,
   sessionWithEffectiveToolPolicy as sessionWithEffectiveToolPolicy2,
   workspaceSessionEffectiveToolsContext as workspaceSessionEffectiveToolsContext2,
-  workspaceSessionToolPolicyDefaultServerIds as workspaceSessionToolPolicyDefaultServerIds2,
-  workspaceSessionToolPolicyServerIds as workspaceSessionToolPolicyServerIds2,
+  workspaceSessionToolPolicyContext,
   relayConfigFromSettings as relayConfigFromSettings5,
   validateVariableSetAttachment
 } from "@opengeni/core";
@@ -92517,33 +92825,44 @@ function registerSessionRoutes(app, deps) {
     }
     const pageView = c.req.query("view") === "page";
     const query = sessionListQuery(c.req.query(), pageView);
+    const projection = c.req.query("projection");
+    if (projection !== void 0 && projection !== "summary")
+      throw new HTTPException80(400, { message: 'projection must be "summary"' });
+    if (projection && !pageView)
+      throw new HTTPException80(400, { message: 'summary projection requires view="page"' });
+    const summary = projection === "summary";
     let page2;
     try {
-      page2 = await listSessionsForSubject(db, workspaceId, {
-        subjectId: grant.subjectId,
-        limit: boundedLimit(query.limit),
-        materializeSnapshot: pageView,
-        ...query.cursor ? { cursor: query.cursor } : {},
-        ...query.search ? { search: query.search } : {},
-        ...query.pinsOnly ? { pinsOnly: true } : {},
-        ...query.archivedOnly ? { archivedOnly: true } : {},
-        ...query.sortBy ? { sortBy: query.sortBy } : {},
-        ...query.archiveStatus ? { archiveStatus: query.archiveStatus } : {},
-        ...query.parentSessionId !== void 0 ? { parentSessionId: query.parentSessionId } : {},
-        ...query.channelId !== void 0 ? { channelId: query.channelId } : {},
-        ...query.originSiteId ? { originSiteId: query.originSiteId } : {},
-        ...query.createdBy ? { createdBy: query.createdBy } : {},
-        ...query.updatedFrom ? { updatedFrom: query.updatedFrom } : {},
-        ...query.updatedBefore ? { updatedBefore: query.updatedBefore } : {},
-        ...query.createdFrom ? { createdFrom: query.createdFrom } : {},
-        ...query.createdBefore ? { createdBefore: query.createdBefore } : {},
-        ...query.scopeSubjectId ? { scopeSubjectId: query.scopeSubjectId } : {},
-        ...authorizationScope ? { authorizationScope } : {},
-        // A managed human's own personal workspace has no membership row, so
-        // the list's removal fence must fall back to the organization-membership
-        // pointer, only with verified native or external owning-user provenance.
-        personalWorkspaceOwnerException: hasVerifiedOwningUserAuthorization(authorization)
-      });
+      page2 = await (summary ? listSessionEntriesForSubject : listSessionsForSubject)(
+        db,
+        workspaceId,
+        {
+          subjectId: grant.subjectId,
+          limit: boundedLimit(query.limit),
+          materializeSnapshot: pageView,
+          ...query.cursor ? { cursor: query.cursor } : {},
+          ...query.search ? { search: query.search } : {},
+          ...query.pinsOnly ? { pinsOnly: true } : {},
+          ...query.includePinned === false ? { includePinned: false } : {},
+          ...query.archivedOnly ? { archivedOnly: true } : {},
+          ...query.sortBy ? { sortBy: query.sortBy } : {},
+          ...query.archiveStatus ? { archiveStatus: query.archiveStatus } : {},
+          ...query.parentSessionId !== void 0 ? { parentSessionId: query.parentSessionId } : {},
+          ...query.channelId !== void 0 ? { channelId: query.channelId } : {},
+          ...query.originSiteId ? { originSiteId: query.originSiteId } : {},
+          ...query.createdBy ? { createdBy: query.createdBy } : {},
+          ...query.updatedFrom ? { updatedFrom: query.updatedFrom } : {},
+          ...query.updatedBefore ? { updatedBefore: query.updatedBefore } : {},
+          ...query.createdFrom ? { createdFrom: query.createdFrom } : {},
+          ...query.createdBefore ? { createdBefore: query.createdBefore } : {},
+          ...query.scopeSubjectId ? { scopeSubjectId: query.scopeSubjectId } : {},
+          ...authorizationScope ? { authorizationScope } : {},
+          // A managed human's own personal workspace has no membership row, so
+          // the list's removal fence must fall back to the organization-membership
+          // pointer, only with verified native or external owning-user provenance.
+          personalWorkspaceOwnerException: hasVerifiedOwningUserAuthorization(authorization)
+        }
+      );
     } catch (error) {
       if (error instanceof SessionListAccessError) {
         throw new HTTPException80(403, { message: error.message });
@@ -92557,10 +92876,6 @@ function registerSessionRoutes(app, deps) {
       throw error;
     }
     c.header("x-opengeni-pinned-truncated", page2.pinnedTruncated === true ? "true" : "false");
-    const policy = await loadEffectivePolicyContext(deps, workspaceId, grant.subjectId, [
-      ...page2.pinned,
-      ...page2.sessions
-    ]);
     const commandActivity = await backgroundCommandActivityForSessions(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -92571,14 +92886,33 @@ function registerSessionRoutes(app, deps) {
       workspaceId,
       [...page2.pinned, ...page2.sessions].map((session) => session.id)
     ) : /* @__PURE__ */ new Set();
+    if ("projection" in page2) {
+      const decorateEntry = (session) => ({
+        ...session,
+        hasSchedules: scheduleTargets.has(session.id),
+        ...commandActivity.has(session.id) ? { backgroundCommandActivity: commandActivity.get(session.id) } : {}
+      });
+      return c.json({
+        ...page2,
+        ...query.hasPageFilters ? { filtersApplied: true } : {},
+        ...query.originSiteId ? { originSiteId: query.originSiteId } : {},
+        pinned: page2.pinned.map(decorateEntry),
+        sessions: page2.sessions.map(decorateEntry)
+      });
+    }
+    const policy = await loadEffectivePolicyContext(deps, workspaceId, grant.subjectId, [
+      ...page2.pinned,
+      ...page2.sessions
+    ]);
     const decorate = (session) => {
       const activity = commandActivity.get(session.id);
+      const decorated = {
+        ...session,
+        hasSchedules: scheduleTargets.has(session.id),
+        ...activity ? { backgroundCommandActivity: activity } : {}
+      };
       return sessionWithEffectiveToolPolicy2(
-        {
-          ...session,
-          hasSchedules: scheduleTargets.has(session.id),
-          ...activity ? { backgroundCommandActivity: activity } : {}
-        },
+        decorated,
         policy.workspaceServerIds,
         policy.workspaceDefaultServerIds,
         policy.effectiveToolsContext
@@ -94081,20 +94415,20 @@ function registerSessionRoutes(app, deps) {
       const sessionId = c.req.param("sessionId");
       await assertSessionExists(db, workspaceId, sessionId);
       const payload = await parseRequestJson(c, ApplySessionGoalRevisionRequest);
-      const revision = await getSessionGoalRevision(
+      const revision2 = await getSessionGoalRevision(
         db,
         workspaceId,
         sessionId,
         c.req.param("revisionId")
       );
-      if (!revision || revision.disposition !== "proposed") {
+      if (!revision2 || revision2.disposition !== "proposed") {
         throw new HTTPException80(404, {
           message: "goal rewrite proposal not found"
         });
       }
-      if (!goalProposalMatchesExpectedRevision(revision, payload.expectedObjectiveRevision)) {
+      if (!goalProposalMatchesExpectedRevision(revision2, payload.expectedObjectiveRevision)) {
         throw new HTTPException80(409, {
-          message: `goal proposal was based on objective revision ${revision.baseObjectiveRevision}; requested fence ${payload.expectedObjectiveRevision} cannot apply it`
+          message: `goal proposal was based on objective revision ${revision2.baseObjectiveRevision}; requested fence ${payload.expectedObjectiveRevision} cannot apply it`
         });
       }
       try {
@@ -94102,15 +94436,15 @@ function registerSessionRoutes(app, deps) {
           accountId: grant.accountId,
           workspaceId,
           sessionId,
-          text: revision.text,
-          successCriteria: revision.successCriteria,
-          rootConstraints: revision.rootConstraints,
-          mutationPolicy: revision.mutationPolicy,
+          text: revision2.text,
+          successCriteria: revision2.successCriteria,
+          rootConstraints: revision2.rootConstraints,
+          mutationPolicy: revision2.mutationPolicy,
           expectedObjectiveRevision: payload.expectedObjectiveRevision,
-          expectedGoalId: revision.goalId,
-          changeKind: revision.changeKind,
-          changeRationale: payload.rationale ?? `Applied goal proposal ${revision.id}`,
-          sourceProposalId: revision.id,
+          expectedGoalId: revision2.goalId,
+          changeKind: revision2.changeKind,
+          changeRationale: payload.rationale ?? `Applied goal proposal ${revision2.id}`,
+          sourceProposalId: revision2.id,
           createdBy: "api",
           actor: "api"
         });
@@ -94171,13 +94505,13 @@ function registerSessionRoutes(app, deps) {
       const sessionId = c.req.param("sessionId");
       await assertSessionExists(db, workspaceId, sessionId);
       const payload = await parseRequestJson(c, RollbackSessionGoalRevisionRequest);
-      const revision = await getSessionGoalRevision(
+      const revision2 = await getSessionGoalRevision(
         db,
         workspaceId,
         sessionId,
         c.req.param("revisionId")
       );
-      if (!revision || revision.disposition !== "applied") {
+      if (!revision2 || revision2.disposition !== "applied") {
         throw new HTTPException80(404, { message: "applied goal revision not found" });
       }
       try {
@@ -94185,15 +94519,15 @@ function registerSessionRoutes(app, deps) {
           accountId: grant.accountId,
           workspaceId,
           sessionId,
-          text: revision.text,
-          successCriteria: revision.successCriteria,
-          rootConstraints: revision.rootConstraints,
-          mutationPolicy: revision.mutationPolicy,
+          text: revision2.text,
+          successCriteria: revision2.successCriteria,
+          rootConstraints: revision2.rootConstraints,
+          mutationPolicy: revision2.mutationPolicy,
           expectedObjectiveRevision: payload.expectedObjectiveRevision,
-          expectedGoalId: revision.goalId,
+          expectedGoalId: revision2.goalId,
           changeKind: "replacement",
           changeRationale: payload.rationale,
-          rollbackOfRevisionId: revision.id,
+          rollbackOfRevisionId: revision2.id,
           createdBy: "api",
           actor: "api"
         });
@@ -94476,7 +94810,7 @@ function registerSessionRoutes(app, deps) {
       mode === "monitoring" ? 40 : 500
     );
     const dbPayloadMode = resultMode === "compact" ? "full" : payloadMode;
-    const dbPage = await listSessionEventPage2(db, workspaceId, sessionId, {
+    const dbPage = await listSessionEventPage3(db, workspaceId, sessionId, {
       after,
       ...before !== void 0 ? { before } : {},
       limit,
@@ -95828,13 +96162,13 @@ function registerSessionRoutes(app, deps) {
     const revisionParam = c.req.query("revision");
     let row;
     if (revisionParam !== void 0 && revisionParam !== "") {
-      const revision = Number(revisionParam);
-      if (!Number.isInteger(revision) || revision < 0) {
+      const revision2 = Number(revisionParam);
+      if (!Number.isInteger(revision2) || revision2 < 0) {
         throw new HTTPException80(400, {
           message: "revision must be a non-negative integer"
         });
       }
-      row = await workspaceCaptureAtRevision(db, workspaceId, sessionId, revision);
+      row = await workspaceCaptureAtRevision(db, workspaceId, sessionId, revision2);
     } else {
       row = await latestWorkspaceCapture(db, workspaceId, sessionId);
     }
@@ -96077,8 +96411,8 @@ function registerSessionRoutes(app, deps) {
     return c.body(null, 204);
   });
 }
-function goalProposalMatchesExpectedRevision(revision, expectedObjectiveRevision) {
-  return revision.baseObjectiveRevision === expectedObjectiveRevision;
+function goalProposalMatchesExpectedRevision(revision2, expectedObjectiveRevision) {
+  return revision2.baseObjectiveRevision === expectedObjectiveRevision;
 }
 function eventListLimit(raw, max = 2e3, fallback = 500) {
   const limit = Number(raw ?? fallback);
@@ -96367,6 +96701,13 @@ function sessionListQuery(query, allowCursor = true) {
     });
   }
   const pinsOnly = query.pinsOnly === "true";
+  if (query.includePinned !== void 0 && !["true", "false"].includes(query.includePinned)) {
+    throw new HTTPException80(400, { message: 'includePinned must be "true" or "false"' });
+  }
+  const includePinned = query.includePinned !== "false";
+  if (pinsOnly && !includePinned) {
+    throw new HTTPException80(400, { message: "pinsOnly requires includePinned" });
+  }
   if (query.archivedOnly !== void 0 && query.archivedOnly !== "true") {
     throw new HTTPException80(400, { message: 'archivedOnly must be the literal "true"' });
   }
@@ -96461,6 +96802,7 @@ function sessionListQuery(query, allowCursor = true) {
     cursor,
     search: search || void 0,
     pinsOnly,
+    includePinned,
     archivedOnly,
     sortBy: sortBy.data,
     archiveStatus: archiveStatus.data,
@@ -96724,6 +97066,21 @@ function optionalEventSequence(raw) {
   return Math.floor(sequence);
 }
 function sessionCreateErrorResponse(c, error) {
+  if (error instanceof UnsupportedLatencyModeError) {
+    return c.json(
+      {
+        code: "SESSION_CREATE_REJECTED",
+        message: error.message,
+        details: {
+          code: error.code,
+          modelId: error.modelId,
+          latencyMode: error.latencyMode,
+          allowedLatencyModes: [...error.allowedLatencyModes]
+        }
+      },
+      422
+    );
+  }
   if (error instanceof SessionCreateConnectionSelectionUnavailableError2) {
     return c.json({ code: error.code, message: error.message, retryable: false }, 409);
   }
@@ -96856,12 +97213,11 @@ function commandConflictResponse(c, error) {
   throw error;
 }
 async function loadEffectivePolicyContext(deps, workspaceId, subjectId, sessions) {
-  const [workspaceServerIds, workspaceDefaultServerIds, effectiveToolsContext] = await Promise.all([
-    workspaceSessionToolPolicyServerIds2(deps.db, workspaceId, deps.settings, subjectId),
-    workspaceSessionToolPolicyDefaultServerIds2(deps.db, workspaceId, deps.settings, subjectId),
+  const [policy, effectiveToolsContext] = await Promise.all([
+    workspaceSessionToolPolicyContext(deps.db, workspaceId, deps.settings, subjectId),
     workspaceSessionEffectiveToolsContext2(deps, workspaceId, subjectId, sessions)
   ]);
-  return { workspaceServerIds, workspaceDefaultServerIds, effectiveToolsContext };
+  return { ...policy, effectiveToolsContext };
 }
 async function withEffectivePolicy(deps, workspaceId, subjectId, session) {
   const policy = await loadEffectivePolicyContext(deps, workspaceId, subjectId, [session]);
@@ -97330,9 +97686,12 @@ function socialHttpException(error) {
 }
 
 // src/routes/workspaces.ts
+import { withDirectModelProviders } from "@opengeni/config";
+import { listConnectionsMetadata as listConnectionsMetadata7 } from "@opengeni/db";
 import {
-  getWorkspaceProviderApiKeyConnectionMetadata as getWorkspaceProviderApiKeyConnectionMetadata3,
-  listWorkspaceProviderCustomModels as listWorkspaceProviderCustomModels2
+  workspaceProviderApiKeyConnectionMetadataFromConnections,
+  listWorkspaceProviderCustomModelsByKind,
+  getOrganizationModelProviderCatalogForWorkspace
 } from "@opengeni/db";
 import { CLAUDE_CONNECTION_KINDS } from "@opengeni/config";
 import { SessionControlConflictError as SessionControlConflictError2, WorkspacePauseTimerInputError } from "@opengeni/db";
@@ -97407,9 +97766,6 @@ import {
   workspaceControlRequestLockTimeoutMs as workspaceControlRequestLockTimeoutMs2,
   workspaceXaiSubscriptionActive,
   workspaceVercelAiGatewayConnectionActive,
-  workspaceOpenRouterConnectionActive,
-  organizationModelProviderConnectionActiveForWorkspace,
-  listOrganizationModelProviderCustomModelsForWorkspace,
   WorkspaceGatewayCustomModelHistoryLimitError,
   WorkspaceOpenRouterCustomModelHistoryLimitError,
   WorkspaceExternalIdentityConflictError,
@@ -97542,6 +97898,11 @@ async function deleteWorkspaceForRequest(deps, input) {
     if (state === "P0002") {
       throw new HTTPException83(404, { message: "workspace not found" });
     }
+    if (state === "23503") {
+      throw new HTTPException83(409, {
+        message: "workspace deletion is blocked by retained or linked records; keep the workspace, revoke access, and disable scheduled work instead"
+      });
+    }
     throw error;
   }
   if (deleted.status === "not_found") {
@@ -97882,6 +98243,13 @@ function registerWorkspaceRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant36(c, deps, workspaceId, "workspace:read");
     const catalogSettings = deps.resolveCatalogSettings();
+    const providerKinds = [
+      "vercel_gateway",
+      "openrouter",
+      ...CLAUDE_CONNECTION_KINDS.filter(
+        (kind) => kind !== "claude_subscription" || deps.settings.claudeSubscriptionEnabled
+      )
+    ];
     const [
       connectionModelRestrictions,
       resolvedCatalog,
@@ -97889,14 +98257,9 @@ function registerWorkspaceRoutes(app, deps) {
       codexSubscriptionActive,
       codexModelAvailability,
       xaiSubscriptionActive,
-      workspaceGatewayConnectionActive,
-      workspaceGatewayCustomModels,
-      openRouterConnectionActive,
-      workspaceOpenRouterCustomModels,
-      organizationGatewayConnectionActive,
-      organizationOpenRouterConnectionActive,
-      organizationGatewayCustomModels,
-      organizationOpenRouterCustomModels,
+      workspaceConnections,
+      workspaceCustomModels,
+      organizationProviders,
       workspace
     ] = await Promise.all([
       getWorkspaceConnectionModelRestrictions(deps.db, workspaceId, grant.subjectId),
@@ -97907,88 +98270,55 @@ function registerWorkspaceRoutes(app, deps) {
         ({ settings }) => loadWorkspaceCodexModelAvailability(deps.db, settings, workspaceId)
       ),
       workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
-      workspaceVercelAiGatewayConnectionActive(deps.db, workspaceId),
-      listWorkspaceGatewayCustomModels(deps.db, {
-        accountId: grant.accountId,
-        workspaceId
-      }),
-      workspaceOpenRouterConnectionActive(deps.db, workspaceId),
-      listWorkspaceOpenRouterCustomModels(deps.db, {
-        accountId: grant.accountId,
-        workspaceId
-      }),
-      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
+      listConnectionsMetadata7(deps.db, workspaceId, null),
+      listWorkspaceProviderCustomModelsByKind(deps.db, {
         accountId: grant.accountId,
         workspaceId,
-        providerKind: "vercel_gateway"
+        providerKinds
       }),
-      organizationModelProviderConnectionActiveForWorkspace(deps.db, {
+      getOrganizationModelProviderCatalogForWorkspace(deps.db, {
         accountId: grant.accountId,
         workspaceId,
-        providerKind: "openrouter"
-      }),
-      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
-        accountId: grant.accountId,
-        workspaceId,
-        providerKind: "vercel_gateway"
-      }),
-      listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
-        accountId: grant.accountId,
-        workspaceId,
-        providerKind: "openrouter"
+        providerKinds
       }),
       getWorkspace4(deps.db, workspaceId)
     ]);
     const claudeConnections = {};
     const workspaceClaudeConnections = {};
-    await Promise.all(
-      CLAUDE_CONNECTION_KINDS.map(async (kind) => {
-        if (kind === "claude_subscription" && !deps.settings.claudeSubscriptionEnabled) return;
-        const [active, models] = await Promise.all([
-          organizationModelProviderConnectionActiveForWorkspace(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            providerKind: kind
-          }),
-          listOrganizationModelProviderCustomModelsForWorkspace(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            providerKind: kind
-          })
-        ]);
-        claudeConnections[kind] = { active, models };
-        const [metadata, workspaceModels] = await Promise.all([
-          getWorkspaceProviderApiKeyConnectionMetadata3(deps.db, workspaceId, kind),
-          listWorkspaceProviderCustomModels2(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            providerKind: kind
-          })
-        ]);
-        workspaceClaudeConnections[kind] = { active: metadata !== null, models: workspaceModels };
-      })
+    const workspaceConnectionActive = (kind) => workspaceProviderApiKeyConnectionMetadataFromConnections(workspaceConnections, kind) !== null;
+    for (const kind of CLAUDE_CONNECTION_KINDS) {
+      if (kind === "claude_subscription" && !deps.settings.claudeSubscriptionEnabled) continue;
+      claudeConnections[kind] = organizationProviders[kind];
+      workspaceClaudeConnections[kind] = {
+        active: workspaceConnectionActive(kind),
+        models: workspaceCustomModels[kind]
+      };
+    }
+    const workspaceCatalogSettings = withDirectModelProviders(
+      resolvedCatalog.settings,
+      workspaceConnections
     );
     const selections = resolveWorkspaceModelSelection2({
       claudeConnections,
       workspaceClaudeConnections,
       connectionModelRestrictions,
-      settings: resolvedCatalog.settings,
+      settings: workspaceCatalogSettings,
       policy,
       observations: codexModelAvailability,
       codexSubscriptionActive,
       xaiSubscriptionActive,
-      workspaceGatewayConnectionActive,
-      workspaceGatewayCustomModels,
-      workspaceOpenRouterConnectionActive: openRouterConnectionActive,
-      workspaceOpenRouterCustomModels,
-      organizationGatewayConnectionActive,
-      organizationOpenRouterConnectionActive,
-      organizationGatewayCustomModels,
-      organizationOpenRouterCustomModels
+      workspaceGatewayConnectionActive: workspaceConnectionActive("vercel_gateway"),
+      workspaceGatewayCustomModels: workspaceCustomModels.vercel_gateway,
+      workspaceOpenRouterConnectionActive: workspaceConnectionActive("openrouter"),
+      workspaceOpenRouterCustomModels: workspaceCustomModels.openrouter,
+      organizationGatewayConnectionActive: organizationProviders.vercel_gateway.active,
+      organizationOpenRouterConnectionActive: organizationProviders.openrouter.active,
+      organizationGatewayCustomModels: organizationProviders.vercel_gateway.models,
+      organizationOpenRouterCustomModels: organizationProviders.openrouter.models
     });
     const workspaceSettings = workspace?.settings ?? {};
     const defaultSelection = await resolveDefaultSessionModelForSelections(deps.db, {
-      settings: resolvedCatalog.settings,
+      settings: workspaceCatalogSettings,
       accountId: grant.accountId,
       workspaceSettings,
       selections
@@ -97999,7 +98329,7 @@ function registerWorkspaceRoutes(app, deps) {
         projectWorkspaceModelCatalog(selections, {
           defaultSelection,
           creditsSelection: creditsDefaultSessionModel({
-            settings: resolvedCatalog.settings,
+            settings: workspaceCatalogSettings,
             selections,
             workspaceSettings
           })
@@ -98982,7 +99312,7 @@ import {
   WorkspaceInstructionPolicyOnboardingProposalStaleResponse,
   WorkspaceInstructionPolicyOperationReuseResponse,
   WorkspaceInstructionPolicyRevision,
-  WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS
+  WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS as WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS2
 } from "@opengeni/contracts";
 import { requireAccessGrant as requireAccessGrant37 } from "@opengeni/core";
 import {
@@ -99039,7 +99369,7 @@ function policyErrorResponse(context, error) {
       WorkspaceInstructionPolicyOnboardingProposalContentErrorResponse.parse({
         code: error.code,
         message: error.message,
-        maxChars: WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS
+        maxChars: WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS2
       }),
       422
     );
@@ -99788,67 +100118,67 @@ function canonicalJson(value) {
 }
 function companyProfileEntries(profile) {
   const activeRevisionId = profile.current?.revisionId ?? null;
-  const byId = new Map(profile.revisions.map((revision) => [revision.id, revision]));
+  const byId = new Map(profile.revisions.map((revision2) => [revision2.id, revision2]));
   if (profile.activeRevision) byId.set(profile.activeRevision.id, profile.activeRevision);
   return {
-    entries: [...byId.values()].map((revision) => {
-      const active = revision.id === activeRevisionId;
+    entries: [...byId.values()].map((revision2) => {
+      const active = revision2.id === activeRevisionId;
       return {
         id: "company-profile",
-        revisionId: revision.id,
+        revisionId: revision2.id,
         path: "company/profile",
         scope: "organization",
         classification: "company_profile",
         title: "Company profile",
         description: "Company identity, mission, products, customers, goals, and constraints.",
         // Company-profile hashes cover this exact canonical field order.
-        content: JSON.stringify(revision.profile),
-        contentHash: revision.contentHash,
-        revision: revision.revision,
+        content: JSON.stringify(revision2.profile),
+        contentHash: revision2.contentHash,
+        revision: revision2.revision,
         active,
-        lifecycle: active ? "active" : revision.intent === "proposal" ? "proposal" : "historical",
+        lifecycle: active ? "active" : revision2.intent === "proposal" ? "proposal" : "historical",
         provenance: {
-          source: revision.provenance.source,
-          sourceId: revision.provenance.sourceId,
-          trust: revision.intent === "proposal" ? "untrusted_proposal" : "organization_managed"
+          source: revision2.provenance.source,
+          sourceId: revision2.provenance.sourceId,
+          trust: revision2.intent === "proposal" ? "untrusted_proposal" : "organization_managed"
         },
-        relationships: revision.supersedesRevisionId && byId.has(revision.supersedesRevisionId) ? [{ type: "supersedes", targetId: revision.supersedesRevisionId }] : [],
-        createdAt: revision.createdAt
+        relationships: revision2.supersedesRevisionId && byId.has(revision2.supersedesRevisionId) ? [{ type: "supersedes", targetId: revision2.supersedesRevisionId }] : [],
+        createdAt: revision2.createdAt
       };
     }),
     truncated: profile.nextAfterRevision !== null
   };
 }
 function instructionPolicyEntries(policies, activeRevisions, activatedRevisionIds) {
-  const byId = new Map(policies.revisions.map((revision) => [revision.id, revision]));
-  for (const revision of activeRevisions) byId.set(revision.id, revision);
+  const byId = new Map(policies.revisions.map((revision2) => [revision2.id, revision2]));
+  for (const revision2 of activeRevisions) byId.set(revision2.id, revision2);
   const activeIds = new Set(policies.activeHeads.map((head) => head.revisionId));
   const activatedIds = new Set(activatedRevisionIds);
   return {
-    entries: [...byId.values()].map((revision) => {
-      const roleSegment = revision.roleKey ?? "all";
-      const active = activeIds.has(revision.id);
-      const lifecycle3 = active ? "active" : activatedIds.has(revision.id) ? "historical" : revision.provenance.source === "onboarding" || revision.provenance.source === "knowledge_proposal" ? "proposal" : "inactive";
+    entries: [...byId.values()].map((revision2) => {
+      const roleSegment = revision2.roleKey ?? "all";
+      const active = activeIds.has(revision2.id);
+      const lifecycle3 = active ? "active" : activatedIds.has(revision2.id) ? "historical" : revision2.provenance.source === "onboarding" || revision2.provenance.source === "knowledge_proposal" ? "proposal" : "inactive";
       return {
-        id: `instruction-policy:${revision.kind}:${revision.scope}:${roleSegment}`,
-        revisionId: revision.id,
-        path: `ways-of-working/rules/${revision.kind}/${revision.scope}/${roleSegment}`,
+        id: `instruction-policy:${revision2.kind}:${revision2.scope}:${roleSegment}`,
+        revisionId: revision2.id,
+        path: `ways-of-working/rules/${revision2.kind}/${revision2.scope}/${roleSegment}`,
         scope: "workspace",
         classification: "mandatory_rule",
-        title: revision.kind === "charter" ? "Workspace charter" : revision.scope === "role" ? `Role policy: ${roleSegment}` : "Workspace policy",
+        title: revision2.kind === "charter" ? "Workspace charter" : revision2.scope === "role" ? `Role policy: ${roleSegment}` : "Workspace policy",
         description: active ? "Mandatory context included for applicable agents." : null,
-        content: revision.content,
-        contentHash: revision.contentHash,
-        revision: revision.revision,
+        content: revision2.content,
+        contentHash: revision2.contentHash,
+        revision: revision2.revision,
         active,
         lifecycle: lifecycle3,
         provenance: {
-          source: revision.provenance.source,
-          sourceId: revision.provenance.sourceId,
-          trust: revision.provenance.source === "human" ? "workspace_managed" : revision.provenance.source === "legacy_import" ? "migrated" : "untrusted_proposal"
+          source: revision2.provenance.source,
+          sourceId: revision2.provenance.sourceId,
+          trust: revision2.provenance.source === "human" ? "workspace_managed" : revision2.provenance.source === "legacy_import" ? "migrated" : "untrusted_proposal"
         },
-        relationships: revision.supersedesRevisionId && byId.has(revision.supersedesRevisionId) ? [{ type: "supersedes", targetId: revision.supersedesRevisionId }] : [],
-        createdAt: revision.createdAt
+        relationships: revision2.supersedesRevisionId && byId.has(revision2.supersedesRevisionId) ? [{ type: "supersedes", targetId: revision2.supersedesRevisionId }] : [],
+        createdAt: revision2.createdAt
       };
     }),
     truncated: policies.nextAfterRevision !== null
@@ -100308,11 +100638,11 @@ async function readCompanyBrainPackage(deps, input) {
     ) : Promise.resolve(null)
   ]);
   if (!workspace) throw new HTTPException89(404, { message: "workspace not found" });
-  const listedRevisionIds = new Set(instructionPolicies.revisions.map((revision) => revision.id));
+  const listedRevisionIds = new Set(instructionPolicies.revisions.map((revision2) => revision2.id));
   const missingActiveIds = instructionPolicies.activeHeads.map((head) => head.revisionId).filter((revisionId2) => !listedRevisionIds.has(revisionId2));
   const activeInstructionPolicyRevisions = [
     ...instructionPolicies.revisions.filter(
-      (revision) => instructionPolicies.activeHeads.some((head) => head.revisionId === revision.id)
+      (revision2) => instructionPolicies.activeHeads.some((head) => head.revisionId === revision2.id)
     ),
     ...await Promise.all(
       missingActiveIds.map(
@@ -100326,7 +100656,7 @@ async function readCompanyBrainPackage(deps, input) {
       workspaceId: input.workspaceId,
       subjectId: input.subjectId,
       revisionIds: [...instructionPolicies.revisions, ...activeInstructionPolicyRevisions].map(
-        (revision) => revision.id
+        (revision2) => revision2.id
       )
     }
   );
@@ -101443,6 +101773,7 @@ import {
   measureInsightsPhase,
   workspaceInsightsPhaseMetricObserver,
   normalizeWorkspaceInsightsFilter,
+  normalizeWorkspaceInsightsSessionScope,
   requireAccessGrant as requireAccessGrant43,
   WorkspaceInsightsFilterValidationError
 } from "@opengeni/core";
@@ -101451,7 +101782,7 @@ import { workspaceInsightsMetricObserver } from "@opengeni/observability";
 import { HTTPException as HTTPException95 } from "hono/http-exception";
 function normalizeWorkspaceInsightsQueryFilter(value, field) {
   try {
-    return normalizeWorkspaceInsightsFilter(value, field);
+    return field === "rootSessionId" || field === "sessionId" ? normalizeWorkspaceInsightsSessionScope(value, field) : normalizeWorkspaceInsightsFilter(value, field);
   } catch (error) {
     if (error instanceof WorkspaceInsightsFilterValidationError) {
       throw new HTTPException95(400, { message: error.message });
@@ -101482,6 +101813,8 @@ function workspaceInsightsCoalesceKey(input) {
     input.range,
     input.provider,
     input.model,
+    input.rootSessionId ?? null,
+    input.sessionId ?? null,
     input.rlsActor
   ]);
 }
@@ -101494,6 +101827,8 @@ function registerInsightsRoutes(app, deps) {
     const rangeRaw = c.req.query("range") ?? "week";
     const providerRaw = c.req.query("provider");
     const modelRaw = c.req.query("model");
+    const rootSessionIdRaw = c.req.query("rootSessionId");
+    const sessionIdRaw = c.req.query("sessionId");
     let provider = null;
     let model = null;
     let outcome = "failed";
@@ -101512,12 +101847,19 @@ function registerInsightsRoutes(app, deps) {
       }
       provider = normalizeWorkspaceInsightsQueryFilter(providerRaw, "provider");
       model = normalizeWorkspaceInsightsQueryFilter(modelRaw, "model");
+      const rootSessionId = normalizeWorkspaceInsightsQueryFilter(
+        rootSessionIdRaw,
+        "rootSessionId"
+      );
+      const sessionId = normalizeWorkspaceInsightsQueryFilter(sessionIdRaw, "sessionId");
       const response = await coalesce.run(
         workspaceInsightsCoalesceKey({
           workspaceId,
           range: rangeParsed.data,
           provider,
           model,
+          rootSessionId,
+          sessionId,
           rlsActor: currentSessionRlsActorIdentityKey()
         }),
         () => getWorkspaceInsights(
@@ -101527,7 +101869,9 @@ function registerInsightsRoutes(app, deps) {
             workspaceId,
             range: rangeParsed.data,
             provider,
-            model
+            model,
+            rootSessionId,
+            sessionId
           },
           observePhase
         )
@@ -106809,7 +107153,7 @@ import {
   namedSubjectPersonalWorkspaceId as namedSubjectPersonalWorkspaceId2,
   resolveSlackTargetAuthority as resolveSlackTargetAuthority2,
   listSlackInteractionProgressDeliveryEvidence,
-  listSessionEventPage as listSessionEventPage3,
+  listSessionEventPage as listSessionEventPage4,
   listSessionHumanInputRequests as listSessionHumanInputRequests2,
   listPendingSlackInteractionMessageActionHandles,
   listPendingSlackUserLinkAccessRequests,
@@ -107734,17 +108078,17 @@ function slackReactionInboxEntry(payload, bot, settings) {
   };
 }
 async function resolveSlackLinkTargetInstallation(deps, link, workspaceId) {
-  const route = await resolveSlackInstallationRoute2(deps.db, link.slackTeamId);
-  if (!route || route.connectionId !== link.connectionId || route.accountId.length === 0) {
+  const route2 = await resolveSlackInstallationRoute2(deps.db, link.slackTeamId);
+  if (!route2 || route2.connectionId !== link.connectionId || route2.accountId.length === 0) {
     return null;
   }
   const workspace = await getWorkspace10(deps.db, workspaceId);
-  if (!workspace || workspace.accountId !== route.accountId) return null;
+  if (!workspace || workspace.accountId !== route2.accountId) return null;
   return {
-    accountId: route.accountId,
-    connectionId: route.connectionId,
+    accountId: route2.accountId,
+    connectionId: route2.connectionId,
     workspaceName: workspace.name,
-    identityHome: { accountId: route.accountId, workspaceId: route.workspaceId }
+    identityHome: { accountId: route2.accountId, workspaceId: route2.workspaceId }
   };
 }
 function registerSlackInteractionRoutes(app, deps) {
@@ -108169,22 +108513,22 @@ function registerSlackInteractionRoutes(app, deps) {
       { connectionId }
     );
     const names = /* @__PURE__ */ new Map();
-    for (const route of routes) {
-      if (names.has(route.targetWorkspaceId)) continue;
+    for (const route2 of routes) {
+      if (names.has(route2.targetWorkspaceId)) continue;
       names.set(
-        route.targetWorkspaceId,
-        (await getWorkspace10(deps.db, route.targetWorkspaceId))?.name ?? null
+        route2.targetWorkspaceId,
+        (await getWorkspace10(deps.db, route2.targetWorkspaceId))?.name ?? null
       );
     }
     return c.json(
       SlackChannelRouteListResponse.parse({
         routingEnabled: deps.settings.slackWorkspaceRoutingEnabled,
-        routes: routes.map((route) => ({
-          slackChannelId: route.slackChannelId,
-          targetWorkspaceId: route.targetWorkspaceId,
-          targetWorkspaceName: names.get(route.targetWorkspaceId) ?? null,
-          source: route.source,
-          updatedAt: route.updatedAt.toISOString()
+        routes: routes.map((route2) => ({
+          slackChannelId: route2.slackChannelId,
+          targetWorkspaceId: route2.targetWorkspaceId,
+          targetWorkspaceName: names.get(route2.targetWorkspaceId) ?? null,
+          source: route2.source,
+          updatedAt: route2.updatedAt.toISOString()
         }))
       })
     );
@@ -108205,38 +108549,38 @@ function registerSlackInteractionRoutes(app, deps) {
       accountId: grant.accountId,
       subjectId: grant.subjectId
     });
-    for (const route of payload.routes) {
-      if (route.targetWorkspaceId === null) continue;
+    for (const route2 of payload.routes) {
+      if (route2.targetWorkspaceId === null) continue;
       const authorized = await resolveSlackTargetAuthority2(deps.db, {
         subjectId: grant.subjectId,
         targetAccountId: grant.accountId,
-        targetWorkspaceId: route.targetWorkspaceId
+        targetWorkspaceId: route2.targetWorkspaceId
       });
       if (!authorized || !hasPermission29(authorized.permissions, "sessions:create")) {
         throw new HTTPException106(403, {
-          message: `you cannot start work in the workspace chosen for ${route.slackChannelId}`
+          message: `you cannot start work in the workspace chosen for ${route2.slackChannelId}`
         });
       }
-      if (callerPersonalWorkspaceId !== null && route.targetWorkspaceId === callerPersonalWorkspaceId) {
+      if (callerPersonalWorkspaceId !== null && route2.targetWorkspaceId === callerPersonalWorkspaceId) {
         throw new HTTPException106(422, {
-          message: `a channel cannot be routed to a personal workspace: work started in ${route.slackChannelId} would be invisible to everyone else in it`
+          message: `a channel cannot be routed to a personal workspace: work started in ${route2.slackChannelId} would be invisible to everyone else in it`
         });
       }
     }
-    for (const route of payload.routes) {
-      if (route.targetWorkspaceId === null) {
+    for (const route2 of payload.routes) {
+      if (route2.targetWorkspaceId === null) {
         await deleteSlackChannelRoute(deps.db, home, {
           connectionId: payload.connectionId,
-          slackChannelId: route.slackChannelId
+          slackChannelId: route2.slackChannelId
         });
         continue;
       }
       await upsertSlackChannelRoute(deps.db, home, {
         connectionId: payload.connectionId,
         slackTeamId: binding.slackTeamId,
-        slackChannelId: route.slackChannelId,
+        slackChannelId: route2.slackChannelId,
         targetAccountId: grant.accountId,
-        targetWorkspaceId: route.targetWorkspaceId,
+        targetWorkspaceId: route2.targetWorkspaceId,
         decidedBySubjectId: grant.subjectId,
         decidedBySlackUserId: "admin",
         source: "admin"
@@ -110200,8 +110544,8 @@ async function processSlackBlockAction(deps, entry2) {
   const actionId = separator > 0 ? entry2.text.slice(0, separator) : "";
   const handleId = separator > 0 ? entry2.text.slice(separator + 1) : "";
   const home = { accountId: entry2.accountId, workspaceId: entry2.workspaceId };
-  const route = await resolveSlackInstallationRoute2(deps.db, entry2.slackTeamId);
-  if (!route || route.accountId !== entry2.accountId || route.workspaceId !== entry2.workspaceId || route.connectionId !== entry2.connectionId) {
+  const route2 = await resolveSlackInstallationRoute2(deps.db, entry2.slackTeamId);
+  if (!route2 || route2.accountId !== entry2.accountId || route2.workspaceId !== entry2.workspaceId || route2.connectionId !== entry2.connectionId) {
     throw new SlackInteractionPermanentError("slack_action_installation_changed");
   }
   if (actionId === "opengeni.route.select" || actionId === "opengeni.route.cancel") {
@@ -111051,7 +111395,7 @@ async function resolveSlackDeliveryHome(deps, interaction) {
 }
 async function deliverSlackSessionEvents(deps, interaction, claimHolderId) {
   if (!interaction.sessionId) return;
-  const page2 = await listSessionEventPage3(deps.db, interaction.workspaceId, interaction.sessionId, {
+  const page2 = await listSessionEventPage4(deps.db, interaction.workspaceId, interaction.sessionId, {
     after: interaction.lastDeliveredSessionEventSequence,
     limit: 100,
     includeTypes: [...SLACK_DELIVERY_EVENT_TYPES],
@@ -111412,11 +111756,11 @@ async function deliverSlackModelText(deliver) {
     await deliver((text) => text);
   }
 }
-async function enqueueNormalizedSlackInteraction(deps, route, entry2) {
+async function enqueueNormalizedSlackInteraction(deps, route2, entry2) {
   await enqueueSlackInteractionInbox(deps.db, {
-    accountId: route.accountId,
-    workspaceId: route.workspaceId,
-    connectionId: route.connectionId,
+    accountId: route2.accountId,
+    workspaceId: route2.workspaceId,
+    connectionId: route2.connectionId,
     ...entry2
   });
 }
@@ -112153,14 +112497,14 @@ function createAppComposition(deps) {
   app.use("/v1/*", bearerApiContractHeaderCompatibility());
   app.use("*", async (c, next) => {
     const url = new URL(c.req.url);
-    const route = routeLabel(url.pathname, registeredHandlerRoutePath(c));
+    const route2 = routeLabel(url.pathname, registeredHandlerRoutePath(c));
     const correlationId2 = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
     const start = performance.now();
     const span = observability.startSpan(
-      `HTTP ${c.req.method} ${route}`,
+      `HTTP ${c.req.method} ${route2}`,
       {
         "http.request.method": c.req.method,
-        "opengeni.route": route
+        "opengeni.route": route2
       },
       { parent: null }
     );
@@ -112174,7 +112518,7 @@ function createAppComposition(deps) {
           const durationSeconds = (performance.now() - start) / 1e3;
           observability.recordHttpRequest({
             method: c.req.method,
-            route,
+            route: route2,
             status,
             durationSeconds
           });
@@ -112186,7 +112530,7 @@ function createAppComposition(deps) {
           });
           observability.info("HTTP request completed", {
             method: c.req.method,
-            route,
+            route: route2,
             status,
             durationMs: Math.round(durationSeconds * 1e3),
             traceId: span.traceId,
@@ -112199,14 +112543,14 @@ function createAppComposition(deps) {
           const durationSeconds = (performance.now() - start) / 1e3;
           observability.recordHttpRequest({
             method: c.req.method,
-            route,
+            route: route2,
             status,
             durationSeconds
           });
           observability.incrementCounter({
             name: "opengeni_http_errors_total",
             help: "Total OpenGeni HTTP request failures by bounded route, status, and stable code.",
-            labels: { route, status: String(status), code: errorCode }
+            labels: { route: route2, status: String(status), code: errorCode }
           });
           span.end({
             attributes: {
@@ -112217,7 +112561,7 @@ function createAppComposition(deps) {
           });
           observability.error("HTTP request failed", {
             method: c.req.method,
-            route,
+            route: route2,
             status,
             durationMs: Math.round(durationSeconds * 1e3),
             traceId: span.traceId,
@@ -112639,6 +112983,8 @@ function createAppComposition(deps) {
         auth: clientAuthConfig(deps.settings),
         documentationUrl: deps.settings.documentationUrl,
         analytics: clientAnalyticsConfig(deps.settings),
+        legal: clientLegalConfig(deps.settings),
+        ...deps.settings.supportEmail ? { supportEmail: deps.settings.supportEmail } : {},
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
         // available on every real backend; `none` has no box so they are all off.
         // Per-session availability is still negotiated on /stream-capabilities.
@@ -113029,7 +113375,18 @@ function createAppComposition(deps) {
     }
     const importErrorResponse = archivedSessionImportErrorResponse(c, rawError);
     if (importErrorResponse) return importErrorResponse;
-    const error = rawError instanceof OrganizationIntegrationDeniedError4 ? new HTTPException107(403, { message: rawError.message }) : allowanceExhaustedHttpError(rawError) ?? workspaceControlBusyHttpError(rawError) ?? agentConfigHttpError(rawError) ?? requestBodyValidationHttpError(rawError) ?? invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ?? rawError;
+    const error = rawError instanceof OrganizationIntegrationDeniedError4 ? new HTTPException107(403, { message: rawError.message }) : allowanceExhaustedHttpError(rawError) ?? workspaceControlBusyHttpError(rawError) ?? agentConfigHttpError(rawError) ?? modelUnavailableHttpError(rawError) ?? (rawError instanceof UnsupportedLatencyModeError2 ? new ApiHttpError(422, {
+      code: "validation_failed",
+      message: rawError.message,
+      retryable: false,
+      outcomeUnknown: false,
+      details: {
+        code: rawError.code,
+        modelId: rawError.modelId,
+        latencyMode: rawError.latencyMode,
+        allowedLatencyModes: [...rawError.allowedLatencyModes]
+      }
+    }) : null) ?? requestBodyValidationHttpError(rawError) ?? invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ?? rawError;
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
@@ -113080,7 +113437,7 @@ function workspaceActorContextExempt(method, pathname) {
   ))
     return true;
   if (/^\/v1\/workspaces\/[^/]+\/mcp(?:\/(?:docs|files))?$/.test(pathname)) return true;
-  if (method === "GET" && publicWorkspaceBrowserRoutePatterns.some((route) => route.test(pathname))) {
+  if (method === "GET" && publicWorkspaceBrowserRoutePatterns.some((route2) => route2.test(pathname))) {
     return true;
   }
   return method === "POST" && /^\/v1\/workspaces\/[^/]+\/github\/installations$/.test(pathname);
@@ -113331,6 +113688,12 @@ function clientAnalyticsConfig(settings) {
     }
   };
 }
+function clientLegalConfig(settings) {
+  return {
+    ...settings.legalPrivacyPolicyUrl ? { privacyPolicyUrl: settings.legalPrivacyPolicyUrl } : {},
+    ...settings.legalTermsOfServiceUrl ? { termsOfServiceUrl: settings.legalTermsOfServiceUrl } : {}
+  };
+}
 function structuredServicesHint(backend) {
   const hasBox = backend !== "none";
   return { fileSystem: hasBox, git: hasBox, terminalEvents: hasBox };
@@ -114462,4 +114825,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-2QCRFD6U.js.map
+//# sourceMappingURL=chunk-ZQ7PIFGF.js.map