@opengeni/api-router 0.21.11 → 0.22.2

package/dist/{chunk-J4JS2F7L.js → chunk-HWXJW5C7.js}

@@ -13,14 +13,15 @@ import {
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
   resolveWorkspaceMemoryEnabled,
-  VOICE_INPUT_ACCEPTED_MIME_TYPES as VOICE_INPUT_ACCEPTED_MIME_TYPES2
+  VOICE_INPUT_ACCEPTED_MIME_TYPES as VOICE_INPUT_ACCEPTED_MIME_TYPES2,
+  TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS as TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS2
 } from "@opengeni/contracts";
 import {
   createDocumentServices,
   getDocument as getDocument2,
   indexDocumentNow
 } from "@opengeni/documents";
-import { dbSql, getWorkspace as getWorkspace5, rlsContextForWorkspace } from "@opengeni/db";
+import { dbSql, getWorkspace as getWorkspace6, rlsContextForWorkspace } from "@opengeni/db";
 import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport3 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
@@ -49,7 +50,7 @@ var ApiHttpError = class extends HTTPException {
 import {
   CodexCompactionV2ProviderLockedError,
   hasPermission as hasPermission15,
-  requireAccessGrant as requireAccessGrant24,
+  requireAccessGrant as requireAccessGrant25,
   requirePermission,
   requireSessionAuthorization as requireSessionAuthorization3,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError2,
@@ -347,7 +348,6 @@ import {
   getPreferenceRegistryFullContent,
   getVariableSet,
   getVariableSetByName,
-  areGitHubRepositoriesAllowedForWorkspace,
   listScheduledTaskRuns,
   listScheduledTasks,
   listSessionEventPage,
@@ -386,7 +386,6 @@ import {
 import { appendAndPublishEvents as appendAndPublishEvents2, publishDurableSessionEvents } from "@opengeni/events";
 import {
   createSignedState as createSignedState3,
-  createGitHubAppInstallationToken,
   GitHubAppConfigurationError,
   githubAppMissingSettings
 } from "@opengeni/github";
@@ -6253,7 +6252,6 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
   variable_set_set_variable: { allOf: ["variable-sets:manage"] },
   environment_set_variable: { allOf: ["variable-sets:manage"] },
   github_connect_link: { allOf: ["github:use"] },
-  github_token: { sessionRequired: true, allOf: ["github:use"] },
   github_repositories_list: { allOf: ["github:use"] },
   social_connections_list: { allOf: ["connections:read"] },
   social_posts_recent: { allOf: ["connections:read"] },
@@ -6411,9 +6409,6 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   registerVariableSetTools(server, deps, grant, can, json);
   if (can("github:use")) {
     registerGitHubConnectTool(server, deps, grant, options, json);
-    if (sessionId !== null) {
-      registerGitHubTokenTool(server, deps, grant, sessionId, json);
-    }
   }
   if (!toolspaceMode || can("github:use")) {
     server.registerTool(
@@ -7631,7 +7626,7 @@ function registerFleetTools(server, deps, grant, sessionId, json) {
   server.registerTool(
     "sandboxes_list",
     {
-      description: "List the sandboxes this session can run on: its own session sandbox plus enrolled selfhosted machines. `liveness` is conservative: online requires observed provider existence and verified workspace readiness. Provider, lease, route, archive, restore, workspace, lease epoch, and route epoch are also reported separately. Use an entry `id` as an attach/swap/run_on target.",
+      description: "List the sandboxes this session can run on: its own session sandbox plus enrolled selfhosted machines. `liveness` is conservative: online requires observed provider existence and verified workspace readiness. An idle session-home sandbox may report offline/cold/draining and still wake or restore on the next ordinary sandbox operation; never infer that shell/files are unavailable from list liveness alone\u2014only a typed operation/attach failure proves that. Provider, lease, route, archive, restore, workspace, lease epoch, and route epoch are also reported separately. Use an entry `id` as an attach/swap/run_on target.",
       inputSchema: {}
     },
     async () => json(await listFleet(services, await fleetContext()))
@@ -8508,50 +8503,6 @@ function registerGitHubConnectTool(server, deps, grant, options, json) {
     }
   );
 }
-function registerGitHubTokenTool(server, deps, grant, sessionId, json) {
-  server.registerTool(
-    "github_token",
-    {
-      description: "Mint a fresh short-lived GitHub token for this session's repositories. Write it to $OPENGENI_GIT_TOKEN_FILE (default $HOME/.opengeni/git-token) to refresh git auth before the current token expires.",
-      inputSchema: {}
-    },
-    async () => {
-      const session = await requireSession(deps.db, grant.workspaceId, sessionId);
-      const selected = (session.resources ?? []).flatMap((resource) => {
-        if (resource.kind !== "repository") {
-          return [];
-        }
-        const installationId2 = resource.githubInstallationId;
-        const repositoryId = resource.githubRepositoryId;
-        return typeof installationId2 === "number" && installationId2 > 0 && typeof repositoryId === "number" && repositoryId > 0 ? [{ installationId: installationId2, repositoryId }] : [];
-      });
-      if (selected.length === 0) {
-        throw new Error("this session has no GitHub App repository resources to mint a token for");
-      }
-      const installationId = selected[0].installationId;
-      if (selected.some((item) => item.installationId !== installationId)) {
-        throw new Error("GitHub App repository resources must belong to one installation");
-      }
-      const repositoryIds = selected.map((item) => item.repositoryId);
-      if (!await areGitHubRepositoriesAllowedForWorkspace(
-        deps.db,
-        grant.workspaceId,
-        installationId,
-        repositoryIds
-      )) {
-        throw new Error("this workspace no longer authorizes the session's GitHub repositories");
-      }
-      const token = await createGitHubAppInstallationToken(deps.settings, {
-        installationId,
-        repositoryIds
-      });
-      return json({
-        token,
-        tokenFile: "$OPENGENI_GIT_TOKEN_FILE (default $HOME/.opengeni/git-token)"
-      });
-    }
-  );
-}
 function requireVariableSetsUseForMcpAttachment(grant, variableSetId) {
   if (variableSetId !== void 0 && !hasPermission4(grant.permissions, "variable-sets:use")) {
     throw new Error("missing permission: variable-sets:use");
@@ -8937,6 +8888,8 @@ import {
   boundedParallelMap,
   cancelMcpResponseBody,
   guardedMcpFetch,
+  mcpJsonRpcErrorPayloadForRequest,
+  mcpRequestReplayInfo,
   mcpSerializedSizeBytes
 } from "@opengeni/runtime/mcp-network";
 import { Buffer as Buffer4 } from "buffer";
@@ -8948,8 +8901,12 @@ var TOOLSPACE_AUTH_NEEDED_ERROR = {
   code: 40101,
   message: "Authentication required - a connection link was posted to the session."
 };
+var TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR = {
+  code: 40102,
+  message: "Tool outcome uncertain: the provider returned 401 after receiving the request. OpenGeni did not replay this call. Do not retry automatically; verify provider state before any new attempt."
+};
 var TOOLSPACE_NO_ACTIVE_TURN_MESSAGE = "no active turn - toolspace calls require an in-flight turn";
-var FIRST_PARTY_PROXY_IDS = /* @__PURE__ */ new Set(["files", "docs"]);
+var FIRST_PARTY_PROXY_IDS = /* @__PURE__ */ new Set(["files", "docs", "codex_apps"]);
 var TOOLSPACE_TOOL_LIST_TTL_MS = 3e4;
 var TOOLSPACE_TOOL_LIST_CACHE_MAX_ENTRIES = 2e3;
 var TOOLSPACE_TOOL_LIST_CACHE_MAX_BYTES = 64 * 1024 * 1024;
@@ -9462,6 +9419,9 @@ async function callRemoteTool(deps, server, toolName, args) {
     if (isToolspaceAuthNeededError(error)) {
       return mcpError(TOOLSPACE_AUTH_NEEDED_ERROR.message);
     }
+    if (isToolspaceOutcomeUncertainError(error)) {
+      return mcpError(TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.message);
+    }
     deps.observability?.warn("toolspace upstream tool call failed", {
       serverId: server.config.id,
       toolName,
@@ -9588,7 +9548,7 @@ function connectionBrokerFetch(baseFetch, input) {
     ownerHasWorkspaceMembership: delegatedOwnerHasMembership
   });
   return async (requestInput, init) => {
-    const request = await mcpRequestInfo(requestInput, init);
+    const request = await mcpRequestReplayInfo(requestInput, init);
     const destinationUrl = mcpRequestDestinationUrl(requestInput);
     const resolverSubjectId = connectionRef.subjectScope !== "subject" && hostCredentialPort ? input.grant.subjectId : void 0;
     const resolve = async (forceRefresh) => {
@@ -9613,10 +9573,22 @@ function connectionBrokerFetch(baseFetch, input) {
     );
     if (response.status === 401) {
       await cancelMcpResponseBody(response);
-      const refreshed = await resolve(true);
+      let refreshed;
+      try {
+        refreshed = await resolve(true);
+      } catch {
+        refreshed = authNeededFromStatus(input.config, first, "refresh_failed");
+      }
       if (refreshed.status === "auth_needed") {
+        if (!request.replaySafeAfter401) {
+          await publishToolspaceAuthNeeded(input, request, refreshed);
+          return toolspaceMcpOutcomeUncertainResponse(request);
+        }
         return await authNeededFetchResponse(input, request, refreshed);
       }
+      if (!request.replaySafeAfter401) {
+        return toolspaceMcpOutcomeUncertainResponse(request);
+      }
       const retry = await baseFetch(
         fetchInputForAttempt(requestInput),
         withConnectionHeaders(requestInput, init, refreshed.headers)
@@ -9664,6 +9636,13 @@ function authNeededFromStatus(config, first, reason) {
   };
 }
 async function authNeededFetchResponse(input, request, auth) {
+  await publishToolspaceAuthNeeded(input, request, auth);
+  if (request.method === "tools/call") {
+    return toolspaceMcpErrorResponse(request.id, TOOLSPACE_AUTH_NEEDED_ERROR);
+  }
+  return new Response("Authentication required for MCP server connection", { status: 401 });
+}
+async function publishToolspaceAuthNeeded(input, request, auth) {
   await appendAndPublishEvents3(
     input.deps.db,
     input.deps.bus,
@@ -9689,42 +9668,30 @@ async function authNeededFetchResponse(input, request, auth) {
       }
     ]
   ).catch(() => void 0);
-  if (request.method === "tools/call") {
-    return new Response(
-      JSON.stringify({
-        jsonrpc: "2.0",
-        id: request.id ?? null,
-        error: {
-          code: TOOLSPACE_AUTH_NEEDED_ERROR.code,
-          message: TOOLSPACE_AUTH_NEEDED_ERROR.message
-        }
-      }),
-      {
-        status: 200,
-        headers: { "content-type": "application/json" }
-      }
-    );
-  }
-  return new Response("Authentication required for MCP server connection", { status: 401 });
 }
-async function mcpRequestInfo(input, init) {
-  const body2 = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
-  if (!body2) {
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(body2);
-    const method = typeof parsed.method === "string" ? parsed.method : void 0;
-    const id = typeof parsed.id === "string" || typeof parsed.id === "number" || parsed.id === null ? parsed.id : void 0;
-    const toolName = method === "tools/call" && typeof parsed.params?.name === "string" ? parsed.params.name : void 0;
-    return {
-      ...method ? { method } : {},
-      ...id !== void 0 ? { id } : {},
-      ...toolName ? { toolName } : {}
-    };
-  } catch {
-    return {};
-  }
+function toolspaceMcpErrorResponse(id, error) {
+  return new Response(
+    JSON.stringify({
+      jsonrpc: "2.0",
+      id: id ?? null,
+      error
+    }),
+    {
+      status: 200,
+      headers: { "content-type": "application/json" }
+    }
+  );
+}
+function toolspaceMcpOutcomeUncertainResponse(request) {
+  return new Response(
+    JSON.stringify(
+      mcpJsonRpcErrorPayloadForRequest(request, TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR)
+    ),
+    {
+      status: 200,
+      headers: { "content-type": "application/json" }
+    }
+  );
 }
 function withConnectionHeaders(input, init, authHeaders) {
   const headers = new Headers(
@@ -9745,6 +9712,13 @@ function isToolspaceAuthNeededError(error) {
   const code = error.code;
   return code === TOOLSPACE_AUTH_NEEDED_ERROR.code && (error.message === TOOLSPACE_AUTH_NEEDED_ERROR.message || error.message === `MCP error ${TOOLSPACE_AUTH_NEEDED_ERROR.code}: ${TOOLSPACE_AUTH_NEEDED_ERROR.message}`);
 }
+function isToolspaceOutcomeUncertainError(error) {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const code = error.code;
+  return code === TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.code && (error.message === TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.message || error.message === `MCP error ${TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.code}: ${TOOLSPACE_TOOL_OUTCOME_UNCERTAIN_ERROR.message}`);
+}
 
 // src/app.ts
 import { boundedMcpRequest, McpPayloadTooLargeError as McpPayloadTooLargeError2 } from "@opengeni/runtime/mcp-network";
@@ -10166,6 +10140,8 @@ import {
   buildCodexTokenResolver,
   claimCodexResetRedemption,
   completeCodexResetRedemption,
+  clearCodexAppsCredential,
+  designateCodexAppsCredential,
   disconnectAllCodexAccounts,
   disconnectCodexAccount,
   encryptEnvironmentValue as encryptEnvironmentValue3,
@@ -10175,6 +10151,7 @@ import {
   fenceCodexResetRedemptionSend,
   getCodexResetRedemptionAttempt,
   getCodexCredentialStatus,
+  getCodexAppsSettings,
   getCodexRotationSettings,
   listPendingCodexCapacityWakeTargets,
   listCodexAccountStatuses,
@@ -10255,7 +10232,7 @@ async function verifyCodexRedemptionConfirmation(secret, token, now = Date.now()
 
 // src/routes/codex.ts
 var CODEX_PROVIDER_LABEL = "Codex subscription \xB7 no credits";
-function codexAccountJson(row) {
+function codexAccountJson(row, options = {}) {
   return {
     id: row.id,
     chatgptAccountId: row.chatgptAccountId,
@@ -10284,7 +10261,9 @@ function codexAccountJson(row) {
     resetCreditAvailableCount: row.resetCreditAvailableCount,
     resetCreditsCheckedAt: row.resetCreditsCheckedAt,
     // P3 rotation cooldown: when set and in the future, this account is cooling-down.
-    exhaustedUntil: row.exhaustedUntil
+    exhaustedUntil: row.exhaustedUntil,
+    appsDesignated: options.appsCredentialId === row.id,
+    canEnableApps: options.appsCredentialId === null && options.canManageApps === true && options.humanSubjectId !== null && options.humanSubjectId !== void 0 && row.connectedBySubjectId === options.humanSubjectId && row.status === "active"
   };
 }
 function codexUsageJson(payload) {
@@ -10378,6 +10357,23 @@ async function requireRedemptionHuman(c, deps, workspaceId) {
   }
   return { human, accountId: grant.accountId };
 }
+async function requireCodexAppsHuman(c, deps, workspaceId) {
+  if (c.req.header("authorization")) {
+    throw new HTTPException10(403, {
+      message: "authorization bearer is not allowed for Codex Apps designation"
+    });
+  }
+  requireSameOriginBrowserMutation(c, deps);
+  const human = await managedCookieHuman(c, deps);
+  if (!human) {
+    throw new HTTPException10(401, { message: "managed browser session required" });
+  }
+  const grant = await requireAccessGrant2(c, deps, workspaceId, "connections:write");
+  if (grant.subjectId !== human.subjectId) {
+    throw new HTTPException10(403, { message: "managed browser identity mismatch" });
+  }
+  return { human, accountId: grant.accountId };
+}
 function cachedUsage(row) {
   const fiveHour = buildCodexUsageWindowFromCache(
     row.primaryUsedPercent,
@@ -10733,15 +10729,32 @@ function registerCodexRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/codex/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
-    const [accounts, rotation] = await Promise.all([
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:read");
+    const [accounts, rotation, apps, human] = await Promise.all([
       listCodexAccountStatuses(db, workspaceId),
-      getCodexRotationSettings(db, workspaceId)
+      getCodexRotationSettings(db, workspaceId),
+      getCodexAppsSettings(db, workspaceId),
+      managedCookieHuman(c, deps)
     ]);
     const activeAccountId = rotation?.activeCredentialId ?? null;
+    const humanSubjectId = human?.subjectId === grant.subjectId ? human.subjectId : null;
+    const canManageApps = humanSubjectId !== null && hasPermission6(grant.permissions, "connections:write");
     return c.json({
-      accounts: accounts.map(codexAccountJson),
+      accounts: accounts.map(
+        (account) => codexAccountJson(account, {
+          appsCredentialId: apps.credentialId,
+          canManageApps: settings.codexConnectedAppsEnabled && canManageApps,
+          humanSubjectId
+        })
+      ),
       activeAccountId,
+      apps: {
+        available: settings.codexConnectedAppsEnabled,
+        credentialId: apps.credentialId,
+        version: apps.version,
+        designatedAt: apps.designatedAt,
+        canDisable: canManageApps && apps.credentialId !== null
+      },
       settings: {
         rotationEnabled: rotation?.rotationEnabled ?? false,
         // sharded-rotation policy: rotation-enabled always behaves as sticky-sharded; report the
@@ -10751,6 +10764,72 @@ function registerCodexRoutes(app, deps) {
       }
     });
   });
+  app.post("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    if (!settings.codexConnectedAppsEnabled) {
+      throw new HTTPException10(409, { message: "Codex Apps is disabled for this deployment" });
+    }
+    const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
+    const parsed = z.object({
+      accountId: z.string().uuid(),
+      expectedVersion: z.number().int().nonnegative()
+    }).safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException10(400, { message: "accountId and expectedVersion are required" });
+    }
+    const result = await designateCodexAppsCredential(db, {
+      accountId,
+      workspaceId,
+      credentialId: parsed.data.accountId,
+      subjectId: human.subjectId,
+      expectedVersion: parsed.data.expectedVersion
+    });
+    if (result.kind === "not_found") {
+      throw new HTTPException10(404, { message: "codex account not found" });
+    }
+    if (result.kind === "not_owner") {
+      throw new HTTPException10(403, {
+        message: "only the managed human who connected this subscription may designate it"
+      });
+    }
+    if (result.kind === "forbidden") {
+      throw new HTTPException10(403, { message: "missing permission: connections:write" });
+    }
+    if (result.kind === "unavailable") {
+      throw new HTTPException10(409, { message: "codex account requires relogin" });
+    }
+    const response = {
+      credentialId: result.credentialId,
+      version: result.version,
+      designatedAt: result.designatedAt,
+      changed: result.kind === "updated"
+    };
+    return result.kind === "updated" ? c.json(response) : c.json(response, 409);
+  });
+  app.delete("/v1/workspaces/:workspaceId/codex/apps", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const { human, accountId } = await requireCodexAppsHuman(c, deps, workspaceId);
+    const parsed = z.object({ expectedVersion: z.number().int().nonnegative() }).safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      throw new HTTPException10(400, { message: "expectedVersion is required" });
+    }
+    const result = await clearCodexAppsCredential(db, {
+      accountId,
+      workspaceId,
+      subjectId: human.subjectId,
+      expectedVersion: parsed.data.expectedVersion
+    });
+    if (result.kind === "forbidden") {
+      throw new HTTPException10(403, { message: "missing permission: connections:write" });
+    }
+    const response = {
+      credentialId: result.credentialId,
+      version: result.version,
+      designatedAt: result.designatedAt,
+      changed: result.kind === "updated"
+    };
+    return result.kind === "conflict" ? c.json(response, 409) : c.json(response);
+  });
   app.post("/v1/workspaces/:workspaceId/codex/accounts/:accountId/activate", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
@@ -10859,13 +10938,13 @@ function registerCodexRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/codex/accounts/:accountId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
     const accountId = c.req.param("accountId");
     const mutation = await withCodexCapacityMutation(
       db,
       { workspaceId, reason: "codex_credential_disconnected" },
       async (tx) => {
-        const result2 = await disconnectCodexAccount(tx, workspaceId, accountId);
+        const result2 = await disconnectCodexAccount(tx, workspaceId, accountId, grant.subjectId);
         return { result: result2, changed: result2.removed };
       }
     );
@@ -10880,12 +10959,12 @@ function registerCodexRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/codex", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
     const mutation = await withCodexCapacityMutation(
       db,
       { workspaceId, reason: "codex_credentials_disconnected" },
       async (tx) => {
-        const result2 = await disconnectAllCodexAccounts(tx, workspaceId);
+        const result2 = await disconnectAllCodexAccounts(tx, workspaceId, grant.subjectId);
         return { result: result2, changed: result2.removed > 0 };
       }
     );
@@ -23868,17 +23947,871 @@ function registerInsightsRoutes(app, deps) {
 
 // src/routes/transcriptions.ts
 import {
-  resolveWorkspaceVoiceInputEnabled
+  resolveWorkspaceVoiceInputEnabled as resolveWorkspaceVoiceInputEnabled2
+} from "@opengeni/contracts";
+import { requireAccessGrant as requireAccessGrant23, TranscriptionServiceError as TranscriptionServiceError2 } from "@opengeni/core";
+import { getWorkspace as getWorkspace4 } from "@opengeni/db";
+
+// src/routes/transcription-recordings.ts
+import { createHash as createHash11 } from "crypto";
+import {
+  CreateTranscriptionRecordingRequest,
+  FinalizeTranscriptionRecordingRequest,
+  resolveWorkspaceVoiceInputEnabled,
+  TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS,
+  TRANSCRIPTION_RECORDING_RECOVERY_RETRY_AFTER_MILLISECONDS
 } from "@opengeni/contracts";
-import { requireAccessGrant as requireAccessGrant22, TranscriptionServiceError } from "@opengeni/core";
+import {
+  isAcceptedMimeType,
+  normalizeMimeType,
+  requireAccessGrant as requireAccessGrant22,
+  TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS,
+  TranscriptionServiceError
+} from "@opengeni/core";
+import {
+  claimNextTranscriptionRecordingSegment,
+  claimTranscriptionRecordingAssembly,
+  completeTranscriptionRecordingAssembly,
+  completeTranscriptionRecordingChunk,
+  completeTranscriptionRecordingSegment,
+  completeTranscriptionRecordingSegmentPreparation,
+  createTranscriptionRecording,
+  discardTranscriptionRecording,
+  failTranscriptionRecordingAssembly,
+  failTranscriptionRecordingSegment,
+  getTranscriptionRecording,
+  listTranscriptionRecordings,
+  listTranscriptionRecordingChunks,
+  markTranscriptionRecordingObjectCleaned,
+  markTranscriptionRecordingObjectsCleaned,
+  reserveTranscriptionRecordingChunk,
+  reserveTranscriptionRecordingSegment,
+  startTranscriptionRecordingSegmentProviderCall,
+  transcriptionRecordingObjectKeys,
+  TranscriptionRecordingConflictError,
+  TranscriptionRecordingNotFoundError,
+  TranscriptionRecordingStateError
+} from "@opengeni/db";
 import { getWorkspace as getWorkspace3 } from "@opengeni/db";
+
+// src/transcription/segmenter.ts
+import { spawn } from "child_process";
+import { createWriteStream } from "fs";
+import { mkdtemp, readFile as readFile2, readdir, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { once } from "events";
+var STDERR_MAX_BYTES = 64 * 1024;
+var TranscriptionSegmenterError = class extends Error {
+  constructor(message, code, retryable) {
+    super(message);
+    this.code = code;
+    this.retryable = retryable;
+  }
+  name = "TranscriptionSegmenterError";
+};
+function createFfmpegTranscriptionSegmenter(input) {
+  let availability = null;
+  return {
+    available() {
+      availability ??= commandSucceeds(input.ffmpegPath, ["-version"]);
+      return availability;
+    },
+    async *segment(request) {
+      if (request.signal?.aborted) {
+        throw new TranscriptionSegmenterError(
+          "Audio segmentation was cancelled",
+          "cancelled",
+          true
+        );
+      }
+      if (!Number.isSafeInteger(request.providerSegmentSeconds) || request.providerSegmentSeconds <= 0 || !Number.isSafeInteger(request.totalDurationMilliseconds) || request.totalDurationMilliseconds <= 0) {
+        throw new TranscriptionSegmenterError(
+          "Audio segmentation bounds are invalid",
+          "invalid_audio",
+          false
+        );
+      }
+      if (Math.ceil(request.totalDurationMilliseconds / (request.providerSegmentSeconds * 1e3)) > 1e3) {
+        throw new TranscriptionSegmenterError(
+          "Audio exceeds the bounded segment projection",
+          "too_large",
+          false
+        );
+      }
+      const directory = await mkdtemp(join(tmpdir(), "opengeni-transcription-"));
+      const inputPath = join(
+        directory,
+        `recording.${extensionForMimeType(request.sourceMimeType)}`
+      );
+      const outputPattern = join(directory, "segment-%06d.wav");
+      try {
+        await writeChunks(inputPath, request.chunks, request.signal);
+        const result = await runCommand(
+          input.ffmpegPath,
+          [
+            "-nostdin",
+            "-hide_banner",
+            "-loglevel",
+            "error",
+            "-y",
+            "-i",
+            inputPath,
+            "-map",
+            "0:a:0",
+            "-vn",
+            "-ac",
+            "1",
+            "-ar",
+            "16000",
+            "-c:a",
+            "pcm_s16le",
+            "-f",
+            "segment",
+            "-segment_time",
+            String(request.providerSegmentSeconds),
+            "-reset_timestamps",
+            "1",
+            outputPattern
+          ],
+          request.signal
+        );
+        if (result.cancelled) {
+          throw new TranscriptionSegmenterError(
+            "Audio segmentation was cancelled",
+            "cancelled",
+            true
+          );
+        }
+        if (result.spawnError) {
+          throw new TranscriptionSegmenterError(
+            "Audio segmentation is unavailable",
+            "unavailable",
+            true
+          );
+        }
+        if (result.exitCode !== 0) {
+          throw new TranscriptionSegmenterError(
+            result.stderr || "Audio could not be decoded",
+            "invalid_audio",
+            false
+          );
+        }
+        const files = (await readdir(directory)).filter((file) => /^segment-[0-9]{6}\.wav$/.test(file)).sort();
+        if (files.length === 0 || files.length > 1e3) {
+          throw new TranscriptionSegmenterError(
+            "Audio did not produce a bounded segment set",
+            "invalid_audio",
+            false
+          );
+        }
+        const segmentMilliseconds = request.providerSegmentSeconds * 1e3;
+        for (let segmentNumber = 0; segmentNumber < files.length; segmentNumber += 1) {
+          if (request.signal?.aborted) {
+            throw new TranscriptionSegmenterError(
+              "Audio segmentation was cancelled",
+              "cancelled",
+              true
+            );
+          }
+          const bytes = new Uint8Array(await readFile2(join(directory, files[segmentNumber])));
+          if (bytes.byteLength === 0) {
+            throw new TranscriptionSegmenterError(
+              "Audio produced an empty segment",
+              "invalid_audio",
+              false
+            );
+          }
+          const startMilliseconds = segmentNumber * segmentMilliseconds;
+          const remaining = request.totalDurationMilliseconds - startMilliseconds;
+          if (remaining <= 0) {
+            throw new TranscriptionSegmenterError(
+              "Audio segment count exceeds the declared duration",
+              "invalid_audio",
+              false
+            );
+          }
+          yield {
+            segmentNumber,
+            startMilliseconds,
+            durationMilliseconds: Math.min(segmentMilliseconds, remaining),
+            mimeType: "audio/wav",
+            bytes
+          };
+        }
+      } catch (error) {
+        if (error instanceof TranscriptionSegmenterError) throw error;
+        throw new TranscriptionSegmenterError(
+          error instanceof Error ? error.message : "Audio segmentation failed",
+          request.signal?.aborted ? "cancelled" : "unknown",
+          true
+        );
+      } finally {
+        await rm(directory, { recursive: true, force: true }).catch(() => void 0);
+      }
+    }
+  };
+}
+async function writeChunks(path, chunks, signal) {
+  const stream = createWriteStream(path, { flags: "wx" });
+  try {
+    for await (const chunk of chunks) {
+      if (signal?.aborted) {
+        throw new TranscriptionSegmenterError(
+          "Audio segmentation was cancelled",
+          "cancelled",
+          true
+        );
+      }
+      if (!stream.write(chunk)) await once(stream, "drain");
+    }
+    stream.end();
+    await once(stream, "close");
+  } catch (error) {
+    stream.destroy();
+    throw error;
+  }
+}
+function extensionForMimeType(mimeType) {
+  switch (mimeType.trim().toLowerCase().split(";", 1)[0]) {
+    case "audio/mp4":
+    case "audio/m4a":
+      return "mp4";
+    case "audio/ogg":
+      return "ogg";
+    case "audio/mpeg":
+    case "audio/mp3":
+      return "mp3";
+    case "audio/wav":
+    case "audio/x-wav":
+      return "wav";
+    case "audio/webm":
+    default:
+      return "webm";
+  }
+}
+async function commandSucceeds(command, args) {
+  const result = await runCommand(command, args);
+  return !result.spawnError && result.exitCode === 0;
+}
+async function runCommand(command, args, signal) {
+  return await new Promise((resolve) => {
+    const child = spawn(command, args, { stdio: ["ignore", "ignore", "pipe"] });
+    let stderr = Buffer.alloc(0);
+    let spawnError = false;
+    let settled = false;
+    const onAbort = () => child.kill("SIGKILL");
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+    child.stderr.on("data", (chunk) => {
+      if (stderr.byteLength >= STDERR_MAX_BYTES) return;
+      const remaining = STDERR_MAX_BYTES - stderr.byteLength;
+      stderr = Buffer.concat([stderr, Buffer.from(chunk).subarray(0, remaining)]);
+    });
+    child.once("error", () => {
+      spawnError = true;
+    });
+    child.once("close", (exitCode) => {
+      if (settled) return;
+      settled = true;
+      signal?.removeEventListener("abort", onAbort);
+      resolve({
+        exitCode,
+        stderr: stderr.toString("utf8").trim(),
+        spawnError,
+        cancelled: signal?.aborted ?? false
+      });
+    });
+  });
+}
+
+// src/routes/transcription-recordings.ts
+var CHUNK_SHA256_HEADER = "x-opengeni-chunk-sha256";
+var CHUNK_START_HEADER = "x-opengeni-chunk-start-milliseconds";
+var CHUNK_DURATION_HEADER = "x-opengeni-chunk-duration-milliseconds";
+var PROCESSING_LEASE_MILLISECONDS = 15 * 60 * 1e3;
+var RecordingProcessingError = class extends Error {
+  constructor(message, code, retryable) {
+    super(message);
+    this.code = code;
+    this.retryable = retryable;
+  }
+  name = "RecordingProcessingError";
+};
+function registerResumableTranscriptionRoutes(app, deps) {
+  app.get("/v1/workspaces/:workspaceId/transcription-recordings", async (c) => {
+    try {
+      const authority = await requireRecordingAuthority(c, deps, false);
+      return c.json({
+        recordings: await listTranscriptionRecordings(deps.db, {
+          workspaceId: authority.workspaceId,
+          subjectId: authority.subjectId
+        })
+      });
+    } catch (error) {
+      return routeError(c, error);
+    }
+  });
+  app.post("/v1/workspaces/:workspaceId/transcription-recordings", async (c) => {
+    try {
+      const authority = await requireRecordingAuthority(c, deps, true);
+      if (!await resumableAvailable(deps, authority.workspaceId)) {
+        return c.json({ code: "unavailable" }, 503);
+      }
+      const parsed = CreateTranscriptionRecordingRequest.safeParse(await jsonBody(c));
+      if (!parsed.success) return c.json({ code: "invalid_request" }, 400);
+      const mimeType = normalizeMimeType(parsed.data.mimeType);
+      if (!isAcceptedMimeType(mimeType, deps.transcription.limits().acceptedMimeTypes)) {
+        return c.json({ code: "not_supported" }, 415);
+      }
+      const recording = await createTranscriptionRecording(deps.db, {
+        ...authority,
+        recordingId: parsed.data.recordingId,
+        mimeType,
+        expiresAt: new Date(Date.now() + deps.settings.voiceInputResumableRetentionSeconds * 1e3)
+      });
+      return c.json(recording, 201);
+    } catch (error) {
+      return routeError(c, error);
+    }
+  });
+  app.get("/v1/workspaces/:workspaceId/transcription-recordings/:recordingId", async (c) => {
+    try {
+      const authority = await requireRecordingAuthority(c, deps, false);
+      const response = await getTranscriptionRecording(deps.db, {
+        ...authority,
+        recordingId: uuidParam(c, "recordingId")
+      });
+      return c.json(withRecoveryRetryHint(await cleanupTerminalObjects(deps, authority, response)));
+    } catch (error) {
+      return routeError(c, error);
+    }
+  });
+  app.put(
+    "/v1/workspaces/:workspaceId/transcription-recordings/:recordingId/chunks/:chunkNumber",
+    async (c) => {
+      try {
+        const authority = await requireRecordingAuthority(c, deps, true);
+        if (!deps.objectStorage || !deps.settings.voiceInputResumableEnabled) {
+          return c.json({ code: "unavailable" }, 503);
+        }
+        const chunkNumber = nonnegativeInteger(c.req.param("chunkNumber"));
+        const startMilliseconds = headerInteger(c, CHUNK_START_HEADER, true);
+        const durationMilliseconds = headerInteger(c, CHUNK_DURATION_HEADER, true);
+        const declaredSha256 = c.req.header(CHUNK_SHA256_HEADER)?.trim().toLowerCase() ?? "";
+        if (!/^[0-9a-f]{64}$/.test(declaredSha256)) {
+          return c.json({ code: "invalid_request" }, 400);
+        }
+        const body2 = await readBoundedBody(
+          c.req.raw,
+          deps.settings.voiceInputResumableMaxChunkSizeBytes
+        );
+        const sha256 = sha256Hex2(body2);
+        if (sha256 !== declaredSha256) {
+          return c.json({ code: "conflict" }, 409);
+        }
+        const existing = await getTranscriptionRecording(deps.db, {
+          ...authority,
+          recordingId: uuidParam(c, "recordingId")
+        });
+        if (normalizeMimeType(c.req.header("content-type") ?? "") !== normalizeMimeType(existing.recording.mimeType)) {
+          return c.json({ code: "not_supported" }, 415);
+        }
+        const reservation = await reserveTranscriptionRecordingChunk(deps.db, {
+          ...authority,
+          recordingId: existing.recording.id,
+          chunkNumber,
+          byteLength: body2.byteLength,
+          sha256,
+          startMilliseconds,
+          durationMilliseconds,
+          maxTotalBytes: deps.settings.voiceInputResumableMaxSizeBytes,
+          maxDurationMilliseconds: deps.settings.voiceInputResumableMaxDurationSeconds * 1e3
+        });
+        if (!reservation.deduplicated) {
+          try {
+            await deps.objectStorage.putObject({
+              key: reservation.chunk.objectKey,
+              contentType: existing.recording.mimeType,
+              body: body2,
+              sha256
+            });
+          } catch {
+            throw new RecordingProcessingError("Chunk upload failed", "network", true);
+          }
+        }
+        const completed = await completeTranscriptionRecordingChunk(deps.db, {
+          workspaceId: authority.workspaceId,
+          subjectId: authority.subjectId,
+          recordingId: existing.recording.id,
+          chunkNumber
+        });
+        const response = {
+          recording: completed.recording.recording,
+          chunk: {
+            chunkNumber: completed.chunk.chunkNumber,
+            byteLength: completed.chunk.byteLength,
+            sha256: completed.chunk.sha256,
+            startMilliseconds: completed.chunk.startMilliseconds,
+            durationMilliseconds: completed.chunk.durationMilliseconds,
+            deduplicated: reservation.deduplicated || completed.deduplicated
+          }
+        };
+        return c.json(response);
+      } catch (error) {
+        return routeError(c, error);
+      }
+    }
+  );
+  app.post(
+    "/v1/workspaces/:workspaceId/transcription-recordings/:recordingId/finalize",
+    async (c) => {
+      const owner = correlationId(c);
+      let authority = null;
+      let generation = 0;
+      try {
+        authority = await requireRecordingAuthority(c, deps, true);
+        if (!await resumableAvailable(deps, authority.workspaceId)) {
+          return c.json({ code: "unavailable" }, 503);
+        }
+        const parsed = FinalizeTranscriptionRecordingRequest.safeParse(await jsonBody(c));
+        if (!parsed.success) return c.json({ code: "invalid_request" }, 400);
+        const recordingId = uuidParam(c, "recordingId");
+        const claim = await claimTranscriptionRecordingAssembly(deps.db, {
+          workspaceId: authority.workspaceId,
+          subjectId: authority.subjectId,
+          recordingId,
+          owner,
+          ...parsed.data,
+          staleBefore: new Date(Date.now() - PROCESSING_LEASE_MILLISECONDS)
+        });
+        generation = claim.generation;
+        if (!claim.claimed) {
+          const response = withRecoveryRetryHint(claim.recording);
+          return c.json(response, claim.recording.recording.state === "segmenting" ? 202 : 200);
+        }
+        for (const key of claim.staleObjectKeys) {
+          try {
+            await deps.objectStorage.deleteObject(key);
+            await markTranscriptionRecordingObjectCleaned(deps.db, {
+              workspaceId: authority.workspaceId,
+              subjectId: authority.subjectId,
+              recordingId,
+              objectKey: key
+            });
+          } catch {
+          }
+        }
+        const chunks = await listTranscriptionRecordingChunks(deps.db, {
+          workspaceId: authority.workspaceId,
+          subjectId: authority.subjectId,
+          recordingId
+        });
+        const providerMaxSegmentSeconds = deps.transcription.limits().maxDurationSeconds;
+        const minimumBoundedSegmentSeconds = Math.ceil(
+          claim.recording.recording.totalDurationMilliseconds / 1e3 / 1e3
+        );
+        if (providerMaxSegmentSeconds < minimumBoundedSegmentSeconds) {
+          throw new RecordingProcessingError(
+            "Recording cannot fit the bounded provider segment projection",
+            "too_large",
+            false
+          );
+        }
+        const providerSegmentSeconds = Math.min(
+          TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS,
+          providerMaxSegmentSeconds
+        );
+        for await (const segment of deps.transcriptionSegmenter.segment({
+          sourceMimeType: claim.recording.recording.mimeType,
+          totalDurationMilliseconds: claim.recording.recording.totalDurationMilliseconds,
+          providerSegmentSeconds,
+          chunks: verifiedChunkBytes(deps, chunks, c.req.raw.signal),
+          signal: c.req.raw.signal
+        })) {
+          const sha256 = sha256Hex2(segment.bytes);
+          const reservation = await reserveTranscriptionRecordingSegment(deps.db, {
+            ...authority,
+            recordingId,
+            owner,
+            generation,
+            segmentNumber: segment.segmentNumber,
+            byteLength: segment.bytes.byteLength,
+            sha256,
+            startMilliseconds: segment.startMilliseconds,
+            durationMilliseconds: segment.durationMilliseconds
+          });
+          try {
+            await deps.objectStorage.putObject({
+              key: reservation.objectKey,
+              contentType: segment.mimeType,
+              body: segment.bytes,
+              sha256
+            });
+          } catch {
+            throw new RecordingProcessingError("Segment upload failed", "network", true);
+          }
+          await completeTranscriptionRecordingSegmentPreparation(deps.db, {
+            workspaceId: authority.workspaceId,
+            subjectId: authority.subjectId,
+            recordingId,
+            owner,
+            generation,
+            segmentNumber: segment.segmentNumber
+          });
+        }
+        return c.json(
+          await completeTranscriptionRecordingAssembly(deps.db, {
+            workspaceId: authority.workspaceId,
+            subjectId: authority.subjectId,
+            recordingId,
+            owner,
+            generation
+          })
+        );
+      } catch (error) {
+        if (authority && generation > 0) {
+          const failure = processingFailure(error);
+          const persisted = await failTranscriptionRecordingAssembly(deps.db, {
+            workspaceId: authority.workspaceId,
+            subjectId: authority.subjectId,
+            recordingId: uuidParam(c, "recordingId"),
+            owner,
+            generation,
+            errorCode: failure.code,
+            retryable: failure.retryable
+          }).catch(() => null);
+          if (persisted) return c.json(persisted);
+        }
+        return routeError(c, error);
+      }
+    }
+  );
+  app.post(
+    "/v1/workspaces/:workspaceId/transcription-recordings/:recordingId/process-next",
+    async (c) => {
+      let authority = null;
+      let attemptId = null;
+      let segmentNumber = null;
+      try {
+        authority = await requireRecordingAuthority(c, deps, true);
+        const service = deps.transcription;
+        if (!deps.objectStorage || !service || !await service.available({ workspaceId: authority.workspaceId })) {
+          return c.json({ code: "unavailable" }, 503);
+        }
+        const selectedProvider = service.selectProvider ? await service.selectProvider({ workspaceId: authority.workspaceId }) : "host";
+        if (!selectedProvider) return c.json({ code: "unavailable" }, 503);
+        attemptId = correlationId(c);
+        const claim = await claimNextTranscriptionRecordingSegment(deps.db, {
+          workspaceId: authority.workspaceId,
+          subjectId: authority.subjectId,
+          recordingId: uuidParam(c, "recordingId"),
+          attemptId,
+          providerId: selectedProvider,
+          staleBefore: new Date(Date.now() - PROCESSING_LEASE_MILLISECONDS),
+          providerDeadlineAt: new Date(Date.now() + PROCESSING_LEASE_MILLISECONDS)
+        });
+        if (!claim.claimed || !claim.segment) {
+          const cleaned = await cleanupTerminalObjects(deps, authority, claim.recording);
+          return c.json(
+            withRecoveryRetryHint(cleaned),
+            cleaned.recording.state === "transcribing" ? 202 : 200
+          );
+        }
+        segmentNumber = claim.segment.segmentNumber;
+        const stored = await deps.objectStorage?.getObjectBytes(claim.segment.objectKey);
+        if (!stored) {
+          throw new RecordingProcessingError("Provider segment is missing", "invalid_audio", false);
+        }
+        if (stored.bytes.byteLength !== claim.segment.byteLength || sha256Hex2(stored.bytes) !== claim.segment.sha256) {
+          throw new RecordingProcessingError(
+            "Provider segment failed integrity verification",
+            "invalid_audio",
+            false
+          );
+        }
+        const providerStartedAt = /* @__PURE__ */ new Date();
+        const providerDeadlineAt = new Date(
+          providerStartedAt.getTime() + TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS
+        );
+        await startTranscriptionRecordingSegmentProviderCall(deps.db, {
+          workspaceId: authority.workspaceId,
+          subjectId: authority.subjectId,
+          recordingId: uuidParam(c, "recordingId"),
+          segmentNumber,
+          attemptId,
+          providerStartedAt,
+          providerDeadlineAt
+        });
+        const result = await service.transcribe({
+          workspaceId: authority.workspaceId,
+          accountId: authority.accountId,
+          audio: stored.bytes,
+          mimeType: "audio/wav",
+          durationSeconds: claim.segment.durationMilliseconds / 1e3,
+          requestId: attemptId,
+          providerDeadlineAt,
+          ...claim.segment.providerId && claim.segment.providerId !== "host" ? { providerId: claim.segment.providerId } : {}
+        });
+        const completed = await completeTranscriptionRecordingSegment(deps.db, {
+          workspaceId: authority.workspaceId,
+          subjectId: authority.subjectId,
+          recordingId: uuidParam(c, "recordingId"),
+          segmentNumber,
+          attemptId,
+          text: result.text,
+          languages: result.languages,
+          providerId: claim.segment.providerId ?? result.providerId
+        });
+        return c.json(await cleanupTerminalObjects(deps, authority, completed));
+      } catch (error) {
+        if (authority && attemptId && segmentNumber !== null) {
+          const failure = processingFailure(error);
+          const persisted = await failTranscriptionRecordingSegment(deps.db, {
+            workspaceId: authority.workspaceId,
+            subjectId: authority.subjectId,
+            recordingId: uuidParam(c, "recordingId"),
+            segmentNumber,
+            attemptId,
+            errorCode: failure.code,
+            retryable: failure.retryable
+          }).catch(() => null);
+          if (persisted) return c.json(persisted);
+        }
+        return routeError(c, error);
+      }
+    }
+  );
+  app.delete("/v1/workspaces/:workspaceId/transcription-recordings/:recordingId", async (c) => {
+    try {
+      const authority = await requireRecordingAuthority(c, deps, false);
+      const discarded = await discardTranscriptionRecording(deps.db, {
+        workspaceId: authority.workspaceId,
+        subjectId: authority.subjectId,
+        recordingId: uuidParam(c, "recordingId")
+      });
+      return c.json(await cleanupTerminalObjects(deps, authority, discarded));
+    } catch (error) {
+      return routeError(c, error);
+    }
+  });
+}
+function withRecoveryRetryHint(response) {
+  if (response.recording.state === "segmenting" || response.recording.state === "transcribing") {
+    return {
+      ...response,
+      retryAfterMilliseconds: TRANSCRIPTION_RECORDING_RECOVERY_RETRY_AFTER_MILLISECONDS
+    };
+  }
+  return response;
+}
+async function requireRecordingAuthority(c, deps, requirePolicy) {
+  const workspaceId = c.req.param("workspaceId");
+  if (!workspaceId) {
+    throw new TranscriptionRecordingNotFoundError("Workspace not found");
+  }
+  const grant = await requireAccessGrant22(c, deps, workspaceId, "sessions:create");
+  if (requirePolicy) {
+    const workspace = await getWorkspace3(deps.db, workspaceId);
+    if (!workspace) throw new TranscriptionRecordingNotFoundError("Workspace not found");
+    if (resolveWorkspaceVoiceInputEnabled(workspace.settings) === false) {
+      throw new RecordingProcessingError("Voice input is disabled", "policy_blocked", false);
+    }
+  }
+  return {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId
+  };
+}
+async function resumableAvailable(deps, workspaceId) {
+  return Boolean(
+    deps.settings.voiceInputResumableEnabled && deps.objectStorage && deps.transcription && deps.transcriptionSegmenter && await deps.transcription.available({ workspaceId }) && await deps.transcriptionSegmenter.available()
+  );
+}
+async function cleanupTerminalObjects(deps, authority, response) {
+  if (!deps.objectStorage || response.recording.objectsCleaned || response.recording.state !== "complete" && response.recording.state !== "discarded" && !(response.recording.state === "failed" && !response.recording.retryable)) {
+    return response;
+  }
+  try {
+    const keys = await transcriptionRecordingObjectKeys(deps.db, {
+      workspaceId: authority.workspaceId,
+      subjectId: authority.subjectId,
+      recordingId: response.recording.id
+    });
+    let current = response;
+    for (const key of keys) {
+      await deps.objectStorage.deleteObject(key);
+      current = await markTranscriptionRecordingObjectCleaned(deps.db, {
+        workspaceId: authority.workspaceId,
+        subjectId: authority.subjectId,
+        recordingId: response.recording.id,
+        objectKey: key
+      });
+    }
+    if (current.recording.objectsCleaned) return current;
+    return await markTranscriptionRecordingObjectsCleaned(deps.db, {
+      workspaceId: authority.workspaceId,
+      subjectId: authority.subjectId,
+      recordingId: response.recording.id
+    });
+  } catch {
+    return response;
+  }
+}
+async function* verifiedChunkBytes(deps, chunks, signal) {
+  for (const chunk of chunks) {
+    if (signal.aborted) {
+      throw new RecordingProcessingError("Audio assembly was cancelled", "cancelled", true);
+    }
+    let stored;
+    try {
+      stored = await deps.objectStorage.getObjectBytes(chunk.objectKey);
+    } catch {
+      throw new RecordingProcessingError("Chunk download failed", "network", true);
+    }
+    if (!stored) {
+      throw new RecordingProcessingError("Chunk is missing", "invalid_audio", false);
+    }
+    if (stored.bytes.byteLength !== chunk.byteLength || sha256Hex2(stored.bytes) !== chunk.sha256) {
+      throw new RecordingProcessingError(
+        "Chunk integrity verification failed",
+        "invalid_audio",
+        false
+      );
+    }
+    yield stored.bytes;
+  }
+}
+function processingFailure(error) {
+  if (error instanceof RecordingProcessingError) {
+    return { code: error.code, retryable: error.retryable };
+  }
+  if (error instanceof TranscriptionSegmenterError) {
+    return { code: error.code, retryable: error.retryable };
+  }
+  if (error instanceof TranscriptionServiceError) {
+    return {
+      code: error.code,
+      retryable: error.retryable || error.code === "cancelled" || error.code === "network" || error.code === "timeout" || error.code === "unavailable" || error.code === "provider"
+    };
+  }
+  if (error instanceof DOMException && error.name === "AbortError") {
+    return { code: "cancelled", retryable: true };
+  }
+  return { code: "unknown", retryable: true };
+}
+function routeError(c, error) {
+  if (error instanceof TranscriptionRecordingNotFoundError) {
+    return c.json({ code: "not_found" }, 404);
+  }
+  if (error instanceof TranscriptionRecordingConflictError) {
+    return c.json({ code: "conflict" }, 409);
+  }
+  if (error instanceof TranscriptionRecordingStateError) {
+    return c.json({ code: "invalid_state" }, 409);
+  }
+  if (error instanceof RecordingProcessingError) {
+    const status = error.code === "policy_blocked" ? 403 : error.code === "not_supported" ? 415 : error.code === "too_large" ? 413 : error.code === "invalid_audio" ? 400 : error.code === "unavailable" ? 503 : 502;
+    return c.json({ code: error.code }, status);
+  }
+  return c.json({ code: "unknown" }, 500);
+}
+async function jsonBody(c) {
+  try {
+    return await c.req.json();
+  } catch {
+    return null;
+  }
+}
+function correlationId(c) {
+  const value = c.req.header("x-opengeni-correlation-id")?.trim();
+  return value && /^[A-Za-z0-9._:-]{1,128}$/.test(value) ? valueAsUuid(value) : crypto.randomUUID();
+}
+function valueAsUuid(value) {
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
+    return value;
+  }
+  const hex = createHash11("sha256").update(value).digest("hex").slice(0, 32);
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+function nonnegativeInteger(value) {
+  if (!/^(0|[1-9][0-9]*)$/.test(value)) {
+    throw new RecordingProcessingError("Invalid integer", "invalid_audio", false);
+  }
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed)) {
+    throw new RecordingProcessingError("Invalid integer", "invalid_audio", false);
+  }
+  return parsed;
+}
+function uuidParam(c, name) {
+  const value = c.req.param(name);
+  if (!value || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
+    throw new TranscriptionRecordingNotFoundError("Recording not found");
+  }
+  return value;
+}
+function headerInteger(c, name, allowZero) {
+  const raw = c.req.header(name) ?? "";
+  const value = nonnegativeInteger(raw);
+  if (!allowZero && value === 0) {
+    throw new RecordingProcessingError("Invalid integer", "invalid_audio", false);
+  }
+  return value;
+}
+async function readBoundedBody(request, maxBytes) {
+  const contentLength = Number(request.headers.get("content-length"));
+  if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+    throw new RecordingProcessingError("Chunk is too large", "too_large", false);
+  }
+  if (!request.body) {
+    throw new RecordingProcessingError("Chunk is required", "invalid_audio", false);
+  }
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      if (request.signal.aborted) {
+        throw new RecordingProcessingError("Chunk upload was cancelled", "cancelled", true);
+      }
+      const next = await reader.read();
+      if (next.done) break;
+      total += next.value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        throw new RecordingProcessingError("Chunk is too large", "too_large", false);
+      }
+      chunks.push(next.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  if (total === 0) {
+    throw new RecordingProcessingError("Chunk is required", "invalid_audio", false);
+  }
+  const body2 = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body2.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body2;
+}
+function sha256Hex2(bytes) {
+  return createHash11("sha256").update(bytes).digest("hex");
+}
+
+// src/routes/transcriptions.ts
 function registerTranscriptionRoutes(app, deps) {
+  registerResumableTranscriptionRoutes(app, deps);
   app.post("/v1/workspaces/:workspaceId/transcriptions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant22(c, deps, workspaceId, "sessions:create");
-    const workspace = await getWorkspace3(deps.db, workspaceId);
+    const grant = await requireAccessGrant23(c, deps, workspaceId, "sessions:create");
+    const workspace = await getWorkspace4(deps.db, workspaceId);
     if (!workspace) return c.json({ code: "not_found" }, 404);
-    if (resolveWorkspaceVoiceInputEnabled(workspace.settings) === false) {
+    if (resolveWorkspaceVoiceInputEnabled2(workspace.settings) === false) {
       return c.json({ code: "policy_blocked" }, 403);
     }
     const service = deps.transcription;
@@ -23902,7 +24835,7 @@ function registerTranscriptionRoutes(app, deps) {
       };
       return c.json(response);
     } catch (error) {
-      if (error instanceof TranscriptionServiceError) {
+      if (error instanceof TranscriptionServiceError2) {
         return c.json({ code: error.code }, error.status);
       }
       if (isAbort(error)) return c.json({ code: "cancelled" }, 499);
@@ -23913,7 +24846,7 @@ function registerTranscriptionRoutes(app, deps) {
 async function audioRequest(request, maxSizeBytes) {
   const contentLength = Number(request.headers.get("content-length"));
   if (Number.isFinite(contentLength) && contentLength > maxSizeBytes + 64 * 1024) {
-    throw new TranscriptionServiceError({
+    throw new TranscriptionServiceError2({
       code: "too_large",
       message: "Audio is too large."
     });
@@ -23923,13 +24856,13 @@ async function audioRequest(request, maxSizeBytes) {
     const form = await request.formData();
     const audio = form.get("audio");
     if (!(audio instanceof File)) {
-      throw new TranscriptionServiceError({
+      throw new TranscriptionServiceError2({
         code: "invalid_audio",
         message: "Audio file is required."
       });
     }
     if (audio.size > maxSizeBytes) {
-      throw new TranscriptionServiceError({
+      throw new TranscriptionServiceError2({
         code: "too_large",
         message: "Audio is too large."
       });
@@ -23943,7 +24876,7 @@ async function audioRequest(request, maxSizeBytes) {
   }
   const mimeType = contentType.split(";", 1)[0]?.trim() ?? "";
   if (!mimeType.toLowerCase().startsWith("audio/")) {
-    throw new TranscriptionServiceError({
+    throw new TranscriptionServiceError2({
       code: "not_supported",
       message: "Unsupported audio format."
     });
@@ -23957,7 +24890,7 @@ async function audioRequest(request, maxSizeBytes) {
 }
 async function readBounded(body2, maxSizeBytes, signal) {
   if (!body2)
-    throw new TranscriptionServiceError({
+    throw new TranscriptionServiceError2({
       code: "invalid_audio",
       message: "Audio is required."
     });
@@ -23972,7 +24905,7 @@ async function readBounded(body2, maxSizeBytes, signal) {
       size += next.value.byteLength;
       if (size > maxSizeBytes) {
         await reader.cancel();
-        throw new TranscriptionServiceError({
+        throw new TranscriptionServiceError2({
           code: "too_large",
           message: "Audio is too large."
         });
@@ -23994,7 +24927,7 @@ function durationValue(value) {
   if (value == null || value.trim() === "") return void 0;
   const duration = Number(value);
   if (!Number.isFinite(duration)) {
-    throw new TranscriptionServiceError({
+    throw new TranscriptionServiceError2({
       code: "invalid_audio",
       message: "Invalid audio duration."
     });
@@ -24013,19 +24946,21 @@ import { resolveVoiceInputProviderRegistry } from "@opengeni/config";
 import { VOICE_INPUT_ACCEPTED_MIME_TYPES } from "@opengeni/contracts";
 import {
   filenameForMimeType,
-  isAcceptedMimeType,
-  normalizeMimeType,
-  TranscriptionServiceError as TranscriptionServiceError4
+  isAcceptedMimeType as isAcceptedMimeType2,
+  normalizeMimeType as normalizeMimeType2,
+  TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS as TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS2,
+  TranscriptionServiceError as TranscriptionServiceError5
 } from "@opengeni/core";
 
 // src/transcription/providers/openai.ts
-import { TranscriptionServiceError as TranscriptionServiceError2 } from "@opengeni/core";
+import { TranscriptionServiceError as TranscriptionServiceError3 } from "@opengeni/core";
 function createOpenAiTranscriptionProvider(input) {
   const fetchImpl = input.fetch ?? fetch;
   return {
     id: "openai",
+    supportsServerDeadline: true,
     available: () => true,
-    async transcribe({ audio, mimeType, filename, signal }) {
+    async transcribe({ audio, mimeType, filename, requestId, signal }) {
       const form = new FormData();
       form.append("file", audioBlob(audio, mimeType), filename);
       form.append("model", input.model);
@@ -24033,7 +24968,11 @@ function createOpenAiTranscriptionProvider(input) {
       try {
         response = await fetchImpl(`${input.baseUrl}/audio/transcriptions`, {
           method: "POST",
-          headers: { Authorization: `Bearer ${input.apiKey}` },
+          headers: {
+            Authorization: `Bearer ${input.apiKey}`,
+            // Observability only; the upstream API is not treated as idempotent.
+            "x-opengeni-request-id": requestId
+          },
           body: form,
           ...signal ? { signal } : {}
         });
@@ -24043,7 +24982,7 @@ function createOpenAiTranscriptionProvider(input) {
       if (!response.ok) throw responseError(response.status);
       const body2 = await response.json().catch(() => null);
       if (!body2 || typeof body2.text !== "string") {
-        throw new TranscriptionServiceError2({
+        throw new TranscriptionServiceError3({
           code: "provider",
           message: "Invalid transcription response."
         });
@@ -24060,31 +24999,31 @@ function audioBlob(audio, mimeType) {
 }
 function responseError(status) {
   if (status === 401 || status === 403) {
-    return new TranscriptionServiceError2({
+    return new TranscriptionServiceError3({
       code: "unavailable",
       message: "Transcription is unavailable."
     });
   }
   if (status === 413) {
-    return new TranscriptionServiceError2({
+    return new TranscriptionServiceError3({
       code: "too_large",
       message: "Audio is too large."
     });
   }
   if (status === 400 || status === 422) {
-    return new TranscriptionServiceError2({
+    return new TranscriptionServiceError3({
       code: "invalid_audio",
       message: "Audio could not be transcribed."
     });
   }
   if (status === 408 || status === 504) {
-    return new TranscriptionServiceError2({
+    return new TranscriptionServiceError3({
       code: "timeout",
       message: "Transcription timed out.",
       retryable: true
     });
   }
-  return new TranscriptionServiceError2({
+  return new TranscriptionServiceError3({
     code: status >= 500 ? "unavailable" : "provider",
     message: "Transcription provider failed.",
     retryable: status >= 500
@@ -24092,12 +25031,12 @@ function responseError(status) {
 }
 function fetchError(error) {
   if (error instanceof DOMException && error.name === "AbortError") {
-    return new TranscriptionServiceError2({
+    return new TranscriptionServiceError3({
       code: "cancelled",
       message: "Transcription was cancelled."
     });
   }
-  return new TranscriptionServiceError2({
+  return new TranscriptionServiceError3({
     code: "network",
     message: "Transcription provider is unreachable.",
     retryable: true
@@ -24110,11 +25049,12 @@ function createAzureOpenAiTranscriptionProvider(input) {
   const url = `${input.endpoint}/openai/deployments/${encodeURIComponent(input.deployment)}/audio/transcriptions?api-version=${encodeURIComponent(input.apiVersion)}`;
   return {
     id: "azure-openai",
+    supportsServerDeadline: true,
     available: () => Boolean(input.apiKey || input.adToken),
-    async transcribe({ audio, mimeType, filename, signal }) {
+    async transcribe({ audio, mimeType, filename, requestId, signal }) {
       const form = new FormData();
       form.append("file", new Blob([Uint8Array.from(audio).buffer], { type: mimeType }), filename);
-      const headers = input.apiKey ? { "api-key": input.apiKey } : { Authorization: `Bearer ${input.adToken}` };
+      const headers = input.apiKey ? { "api-key": input.apiKey, "x-opengeni-request-id": requestId } : { Authorization: `Bearer ${input.adToken}`, "x-opengeni-request-id": requestId };
       let response;
       try {
         response = await fetchImpl(url, {
@@ -24142,7 +25082,7 @@ function createAzureOpenAiTranscriptionProvider(input) {
 // src/transcription/providers/codex-subscription.ts
 import { CODEX_CLIENT_VERSION as CODEX_CLIENT_VERSION3, CODEX_ORIGINATOR } from "@opengeni/codex/constants";
 import {
-  TranscriptionServiceError as TranscriptionServiceError3
+  TranscriptionServiceError as TranscriptionServiceError4
 } from "@opengeni/core";
 import { buildCodexTokenResolver as buildCodexTokenResolver3, listCodexAccountStatuses as listCodexAccountStatuses3 } from "@opengeni/db";
 var TRANSCRIBE_URL = "https://chatgpt.com/backend-api/transcribe";
@@ -24160,14 +25100,15 @@ function createCodexSubscriptionTranscriptionProvider(input) {
   });
   return {
     id: "codex-subscription",
+    supportsServerDeadline: true,
     experimental: true,
     available: probe,
-    async transcribe({ audio, mimeType, filename, workspaceId, signal }) {
+    async transcribe({ audio, mimeType, filename, workspaceId, requestId, signal }) {
       const account = (await listCodexAccountStatuses3(input.db, workspaceId)).find(
         (candidate) => candidate.isActive && candidate.status === "active"
       );
       if (!account) {
-        throw new TranscriptionServiceError3({
+        throw new TranscriptionServiceError4({
           code: "unavailable",
           message: "Transcription is unavailable."
         });
@@ -24177,7 +25118,7 @@ function createCodexSubscriptionTranscriptionProvider(input) {
       try {
         token = await resolver.getToken();
       } catch {
-        throw new TranscriptionServiceError3({
+        throw new TranscriptionServiceError4({
           code: "unavailable",
           message: "Transcription is unavailable."
         });
@@ -24196,7 +25137,9 @@ function createCodexSubscriptionTranscriptionProvider(input) {
             ...accountId ? { "ChatGPT-Account-ID": accountId } : {},
             originator: CODEX_ORIGINATOR,
             "User-Agent": `${CODEX_ORIGINATOR}/${CODEX_CLIENT_VERSION3}`,
-            version: CODEX_CLIENT_VERSION3
+            version: CODEX_CLIENT_VERSION3,
+            // Observability only; the upstream API is not treated as idempotent.
+            "x-opengeni-request-id": requestId
           },
           body: form,
           ...signal ? { signal } : {}
@@ -24255,6 +25198,8 @@ function createTranscriptionService(input) {
     maxSizeBytes: input.settings.voiceInputMaxSizeBytes,
     acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES]
   };
+  const providerRequestTimeoutMilliseconds = input.providerRequestTimeoutMilliseconds ?? TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS2;
+  const now = input.now ?? (() => /* @__PURE__ */ new Date());
   return {
     limits: () => limits,
     async available(context) {
@@ -24262,43 +25207,81 @@ function createTranscriptionService(input) {
         Boolean
       );
     },
+    async selectProvider(context) {
+      return (await firstAvailable(providers, context))?.id ?? null;
+    },
     async transcribe(request) {
-      const mimeType = normalizeMimeType(request.mimeType);
-      if (!isAcceptedMimeType(mimeType, limits.acceptedMimeTypes)) {
-        throw new TranscriptionServiceError4({
+      const mimeType = normalizeMimeType2(request.mimeType);
+      if (!isAcceptedMimeType2(mimeType, limits.acceptedMimeTypes)) {
+        throw new TranscriptionServiceError5({
           code: "not_supported",
           message: "Unsupported audio format."
         });
       }
       if (request.audio.byteLength > limits.maxSizeBytes) {
-        throw new TranscriptionServiceError4({
+        throw new TranscriptionServiceError5({
           code: "too_large",
           message: "Audio is too large."
         });
       }
       if (request.durationSeconds !== void 0 && (!Number.isFinite(request.durationSeconds) || request.durationSeconds < 0 || request.durationSeconds > limits.maxDurationSeconds)) {
-        throw new TranscriptionServiceError4({
+        throw new TranscriptionServiceError5({
           code: "invalid_audio",
           message: "Invalid audio duration."
         });
       }
-      const provider = await firstAvailable(providers, {
-        workspaceId: request.workspaceId
-      });
+      const provider = request.providerId ? await exactAvailable(providers, request.providerId, { workspaceId: request.workspaceId }) : await firstAvailable(providers, { workspaceId: request.workspaceId });
       if (!provider) {
-        throw new TranscriptionServiceError4({
+        throw new TranscriptionServiceError5({
           code: "unavailable",
           message: "Transcription is unavailable."
         });
       }
+      if (provider.supportsServerDeadline !== true) {
+        throw new TranscriptionServiceError5({
+          code: "unavailable",
+          message: "Transcription provider does not support bounded requests."
+        });
+      }
       const startedAt = performance.now();
-      const result = await provider.transcribe({
-        audio: request.audio,
-        mimeType,
-        filename: filenameForMimeType(mimeType),
-        workspaceId: request.workspaceId,
-        signal: request.signal
-      });
+      const remainingMilliseconds = request.providerDeadlineAt ? remainingTranscriptionProviderRequestMilliseconds(request.providerDeadlineAt, now()) : providerRequestTimeoutMilliseconds;
+      if (request.providerDeadlineAt && (!Number.isFinite(remainingMilliseconds) || remainingMilliseconds <= 0)) {
+        throw new TranscriptionServiceError5({
+          code: "timeout",
+          message: "Transcription provider deadline expired.",
+          retryable: true
+        });
+      }
+      const deadline = createProviderRequestDeadline(request.signal, remainingMilliseconds);
+      let result;
+      try {
+        result = await provider.transcribe({
+          audio: request.audio,
+          mimeType,
+          filename: filenameForMimeType(mimeType),
+          workspaceId: request.workspaceId,
+          requestId: request.requestId,
+          signal: deadline.signal
+        });
+        if (deadline.timedOut && !request.signal?.aborted) {
+          throw new TranscriptionServiceError5({
+            code: "timeout",
+            message: "Transcription provider timed out.",
+            retryable: true
+          });
+        }
+      } catch (error) {
+        if (deadline.timedOut && !request.signal?.aborted) {
+          throw new TranscriptionServiceError5({
+            code: "timeout",
+            message: "Transcription provider timed out.",
+            retryable: true
+          });
+        }
+        throw error;
+      } finally {
+        deadline.dispose();
+      }
       return {
         ...result,
         providerId: provider.id,
@@ -24308,15 +25291,50 @@ function createTranscriptionService(input) {
     }
   };
 }
+function remainingTranscriptionProviderRequestMilliseconds(providerDeadlineAt, now) {
+  return providerDeadlineAt.getTime() - now.getTime();
+}
+function createProviderRequestDeadline(parentSignal, timeoutMilliseconds) {
+  const controller = new AbortController();
+  let timedOut = false;
+  const timeout = setTimeout(
+    () => {
+      timedOut = true;
+      controller.abort(new DOMException("Transcription provider timed out", "TimeoutError"));
+    },
+    Math.max(1, Math.ceil(timeoutMilliseconds))
+  );
+  const abortFromParent = () => {
+    controller.abort(parentSignal?.reason);
+  };
+  if (parentSignal) {
+    if (parentSignal.aborted) abortFromParent();
+    else parentSignal.addEventListener("abort", abortFromParent, { once: true });
+  }
+  return {
+    signal: controller.signal,
+    get timedOut() {
+      return timedOut;
+    },
+    dispose: () => {
+      clearTimeout(timeout);
+      parentSignal?.removeEventListener("abort", abortFromParent);
+    }
+  };
+}
 async function firstAvailable(providers, context) {
   for (const provider of providers) {
     if (await provider.available(context)) return provider;
   }
   return null;
 }
+async function exactAvailable(providers, providerId, context) {
+  const provider = providers.find((candidate) => candidate.id === providerId);
+  return provider && await provider.available(context) ? provider : null;
+}
 
 // src/integrations/slack-interactions.ts
-import { createHash as createHash11, createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash12, createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import {
   DEFAULT_FIRST_PARTY_MCP_TOOLS as DEFAULT_FIRST_PARTY_MCP_TOOLS2,
   hasOpenGeniSlackReactionScope,
@@ -24342,7 +25360,7 @@ import {
   getSlackInteractionByClientEventId,
   getSlackInteractionByRoute,
   getSessionEventByClientEventId,
-  getWorkspace as getWorkspace4,
+  getWorkspace as getWorkspace5,
   getWorkspaceGrant as getWorkspaceGrant6,
   listSessionEventPage as listSessionEventPage3,
   listSessionHumanInputRequests as listSessionHumanInputRequests2,
@@ -24360,7 +25378,7 @@ import {
   controlHumanSessionWorkstream as controlHumanSessionWorkstream3,
   createSessionForRequest as createSessionForRequest3,
   hasPermission as hasPermission14,
-  requireAccessGrant as requireAccessGrant23
+  requireAccessGrant as requireAccessGrant24
 } from "@opengeni/core";
 import { publishDurableSessionEvents as publishDurableSessionEvents3 } from "@opengeni/events";
 import { HTTPException as HTTPException33 } from "hono/http-exception";
@@ -24464,7 +25482,7 @@ function slackReactionInboxEntry(payload, bot, settings) {
   if (!settings.enabled || !event || event.type !== "reaction_added" || item?.type !== "message" || !teamId || !eventId || !userId || userId === bot.botUserId || !reaction || reaction !== settings.emoji || !channelId || !workspaceSlackReactionChannelAllowed(settings, channelId) || !timestamp) {
     return null;
   }
-  const stableReactionIdentity = createHash11("sha256").update([teamId, userId, channelId, timestamp, reaction].join("\n")).digest("hex");
+  const stableReactionIdentity = createHash12("sha256").update([teamId, userId, channelId, timestamp, reaction].join("\n")).digest("hex");
   return {
     providerEventId: eventId,
     providerMessageId: `reaction:${stableReactionIdentity}`,
@@ -24498,7 +25516,7 @@ function registerSlackInteractionRoutes(app, deps) {
     const event = record3(payload.event);
     if (event?.type === "reaction_added") {
       const [workspace, connection] = await Promise.all([
-        getWorkspace4(deps.db, installation.workspaceId),
+        getWorkspace5(deps.db, installation.workspaceId),
         getConnectionMetadata4(deps.db, installation.workspaceId, installation.connectionId, null)
       ]);
       if (!workspace || !connection || !hasOpenGeniSlackReactionScope(connection.grantedScopes)) {
@@ -24597,7 +25615,7 @@ function registerSlackInteractionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/integrations/slack/user-links", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant23(c, deps, workspaceId, "sessions:create");
+    const grant = await requireAccessGrant24(c, deps, workspaceId, "sessions:create");
     const body2 = record3(await c.req.json().catch(() => null));
     const linkToken = boundedString(body2?.linkToken, 2048);
     const signingSecret = deps.settings.slackSigningSecret;
@@ -24630,7 +25648,7 @@ function registerSlackInteractionRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/integrations/slack/user-links/:slackUserId",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      await requireAccessGrant23(c, deps, workspaceId, "connections:write");
+      await requireAccessGrant24(c, deps, workspaceId, "connections:write");
       const connectionId = boundedString(c.req.query("connectionId"), 64);
       if (!connectionId) throw new HTTPException33(400, { message: "connectionId is required" });
       return c.json({
@@ -24645,7 +25663,7 @@ function registerSlackInteractionRoutes(app, deps) {
   );
   app.get("/v1/workspaces/:workspaceId/integrations/slack/reaction-channels", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant23(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant24(c, deps, workspaceId, "workspace:admin");
     const connectionId = boundedString(c.req.query("connectionId"), 64);
     if (!connectionId) throw new HTTPException33(400, { message: "connectionId is required" });
     const cursor = boundedString(c.req.query("cursor"), 1024);
@@ -24881,7 +25899,7 @@ async function processSlackInboxEntry(deps, entry) {
 }
 async function processSlackReactionInboxEntry(deps, entry) {
   const [workspace, connection, link] = await Promise.all([
-    getWorkspace4(deps.db, entry.workspaceId),
+    getWorkspace5(deps.db, entry.workspaceId),
     getConnectionMetadata4(deps.db, entry.workspaceId, entry.connectionId, null),
     getSlackBotUserLink(deps.db, entry.workspaceId, entry.connectionId, entry.slackUserId)
   ]);
@@ -25465,7 +26483,7 @@ function slackRouteKey(channelId, threadTs) {
   return `${channelId}:${threadTs}`;
 }
 function deterministicUuid(value) {
-  const bytes = createHash11("sha256").update(value).digest().subarray(0, 16);
+  const bytes = createHash12("sha256").update(value).digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -25584,7 +26602,11 @@ import {
 import { workflowIdForSession as workflowIdForSession2 } from "@opengeni/core";
 var API_MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
 function apiRequestBodyLimitBytes(settings) {
-  return Math.max(API_MAX_REQUEST_BODY_BYTES, settings.voiceInputMaxSizeBytes + 64 * 1024);
+  return Math.max(
+    API_MAX_REQUEST_BODY_BYTES,
+    settings.voiceInputMaxSizeBytes + 64 * 1024,
+    (settings.voiceInputResumableMaxChunkSizeBytes ?? 0) + 64 * 1024
+  );
 }
 var API_PUBLIC_ERROR_MESSAGE_MAX_BYTES = 512;
 function createApp(deps) {
@@ -25654,6 +26676,9 @@ function createAppComposition(deps) {
     db: deps.db,
     ...deps.codexFetch ? { codexFetch: deps.codexFetch } : {}
   }) : deps.transcription;
+  const transcriptionSegmenter = deps.transcriptionSegmenter === void 0 ? createFfmpegTranscriptionSegmenter({
+    ffmpegPath: deps.settings.voiceInputFfmpegPath
+  }) : deps.transcriptionSegmenter;
   const routeDeps = {
     ...deps,
     observability,
@@ -25663,15 +26688,16 @@ function createAppComposition(deps) {
     documentIndexer,
     getDocumentServices,
     transcription,
+    transcriptionSegmenter,
     ...sandboxClient ? { sandboxClient } : {},
     resumeBoxById
   };
   const app = new Hono();
   const correlationIds = /* @__PURE__ */ new WeakMap();
   app.use("*", async (c, next) => {
-    const correlationId = boundedCorrelationId(c.req.header(OPENGENI_CORRELATION_HEADER)) ?? crypto.randomUUID();
-    correlationIds.set(c.req.raw, correlationId);
-    c.header(OPENGENI_CORRELATION_HEADER, correlationId);
+    const correlationId2 = boundedCorrelationId(c.req.header(OPENGENI_CORRELATION_HEADER)) ?? crypto.randomUUID();
+    correlationIds.set(c.req.raw, correlationId2);
+    c.header(OPENGENI_CORRELATION_HEADER, correlationId2);
     await next();
   });
   const corsHeaders = {
@@ -25721,7 +26747,7 @@ function createAppComposition(deps) {
   app.use("*", async (c, next) => {
     const url = new URL(c.req.url);
     const route = routeLabel(url.pathname);
-    const correlationId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
+    const correlationId2 = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
     const start = performance.now();
     const span = observability.startSpan(`HTTP ${c.req.method} ${route}`, {
       "http.request.method": c.req.method,
@@ -25751,7 +26777,7 @@ function createAppComposition(deps) {
         durationMs: Math.round(durationSeconds * 1e3),
         traceId: span.traceId,
         spanId: span.spanId,
-        correlationId
+        correlationId: correlationId2
       });
     } catch (error) {
       const status = httpStatusForError(error);
@@ -25782,7 +26808,7 @@ function createAppComposition(deps) {
         durationMs: Math.round(durationSeconds * 1e3),
         traceId: span.traceId,
         spanId: span.spanId,
-        correlationId,
+        correlationId: correlationId2,
         errorCode,
         errorClass: error instanceof Error ? error.name : "NonErrorThrown"
       });
@@ -25861,7 +26887,18 @@ function createAppComposition(deps) {
           available: await transcription?.available() ?? false,
           maxDurationSeconds: deps.settings.voiceInputMaxDurationSeconds,
           maxSizeBytes: deps.settings.voiceInputMaxSizeBytes,
-          acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES2]
+          acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES2],
+          ...deps.settings.voiceInputResumableEnabled && objectStorage && transcription && transcriptionSegmenter && await transcription.available() && await transcriptionSegmenter.available() ? {
+            resumable: {
+              maxDurationSeconds: deps.settings.voiceInputResumableMaxDurationSeconds,
+              maxSizeBytes: deps.settings.voiceInputResumableMaxSizeBytes,
+              maxChunkSizeBytes: deps.settings.voiceInputResumableMaxChunkSizeBytes,
+              providerSegmentSeconds: Math.min(
+                TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS2,
+                deps.settings.voiceInputMaxDurationSeconds
+              )
+            }
+          } : {}
         },
         productAccessMode: deps.settings.productAccessMode,
         auth: clientAuthConfig(deps.settings),
@@ -25927,7 +26964,7 @@ function createAppComposition(deps) {
         throw error;
       }
     }
-    const workspace = await getWorkspace5(routeDeps.db, workspaceId);
+    const workspace = await getWorkspace6(routeDeps.db, workspaceId);
     const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
     const transport = new WebStandardStreamableHTTPServerTransport3({
       enableJsonResponse: true
@@ -26018,7 +27055,7 @@ function appendVary(current, value) {
   return values.join(", ");
 }
 async function requireMcpAccessGrant(c, deps, workspaceId) {
-  const grant = await requireAccessGrant24(c, deps, workspaceId);
+  const grant = await requireAccessGrant25(c, deps, workspaceId);
   if (hasPermission15(grant.permissions, "workspace:read")) {
     return grant;
   }
@@ -26617,4 +27654,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-J4JS2F7L.js.map
+//# sourceMappingURL=chunk-HWXJW5C7.js.map