@opengeni/api-router 0.26.1 → 0.30.1

package/src/routes/transcription-recordings.ts

@@ -362,12 +362,18 @@ export function registerResumableTranscriptionRoutes(app: Hono, deps: ApiRouteDe
         if (
           !deps.objectStorage ||
           !service ||
-          !(await service.available({ workspaceId: authority.workspaceId }))
+          !(await service.available({
+            workspaceId: authority.workspaceId,
+            subjectId: authority.subjectId,
+          }))
         ) {
           return c.json({ code: "unavailable" }, 503);
         }
         const selectedProvider = service.selectProvider
-          ? await service.selectProvider({ workspaceId: authority.workspaceId })
+          ? await service.selectProvider({
+              workspaceId: authority.workspaceId,
+              subjectId: authority.subjectId,
+            })
           : "host";
         if (!selectedProvider) return c.json({ code: "unavailable" }, 503);
         attemptId = correlationId(c);
@@ -418,6 +424,7 @@ export function registerResumableTranscriptionRoutes(app: Hono, deps: ApiRouteDe
         const result = await service.transcribe({
           workspaceId: authority.workspaceId,
           accountId: authority.accountId,
+          subjectId: authority.subjectId,
           audio: stored.bytes,
           mimeType: "audio/wav",
           durationSeconds: claim.segment.durationMilliseconds / 1_000,

package/src/routes/transcriptions.ts

@@ -18,7 +18,7 @@ export function registerTranscriptionRoutes(app: Hono, deps: ApiRouteDeps): void
       return c.json({ code: "policy_blocked" }, 403);
     }
     const service = deps.transcription;
-    if (!service || !(await service.available())) {
+    if (!service || !(await service.available({ workspaceId, subjectId: grant.subjectId }))) {
       return c.json({ code: "unavailable" }, 503);
     }
     try {
@@ -26,6 +26,7 @@ export function registerTranscriptionRoutes(app: Hono, deps: ApiRouteDeps): void
       const result = await service.transcribe({
         workspaceId,
         accountId: grant.accountId,
+        subjectId: grant.subjectId,
         audio: body.audio,
         mimeType: body.mimeType,
         durationSeconds: body.durationSeconds,

package/src/routes/video-generation.ts

@@ -10,10 +10,12 @@ import {
   getWorkspaceVideoGenerationPolicy,
   updateWorkspaceVideoGenerationPolicy,
   VideoGenerationConflictError,
+  workspaceXaiSubscriptionActive,
 } from "@opengeni/db";
 import {
   requireAccessGrant,
   VIDEO_GENERATION_MODEL_CATALOG,
+  videoGenerationModelSupportsFundingSource,
   videoGenerationCapabilitiesForPolicy,
   type ApiRouteDeps,
 } from "@opengeni/core";
@@ -23,14 +25,16 @@ import { HTTPException } from "hono/http-exception";
 export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/video-generation", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const [policy, connection] = await Promise.all([
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const [policy, connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVideoGenerationPolicy(deps.db, workspaceId),
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
+      workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
     ]);
     const fundingOptions = videoGenerationFundingOptions({
       managedConfigured: managedVideoGenerationConfigured(deps),
       workspaceGatewayConfigured: connection !== null,
+      supergrokConfigured,
     });
     const selectedFunding = fundingOptions.find((option) => option.source === policy.fundingSource);
     const capabilities =
@@ -56,10 +60,14 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     const payload = UpdateVideoGenerationPolicyRequest.parse(await c.req.json());
-    const connection = await getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId);
+    const [connection, supergrokConfigured] = await Promise.all([
+      getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
+      workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
+    ]);
     const fundingOptions = videoGenerationFundingOptions({
       managedConfigured: managedVideoGenerationConfigured(deps),
       workspaceGatewayConfigured: connection !== null,
+      supergrokConfigured,
     });
     const selectedFunding = fundingOptions.find(
       (option) => option.source === payload.fundingSource,
@@ -69,6 +77,15 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
         message: selectedFunding?.unavailableReason ?? "Video generation funding is unavailable",
       });
     }
+    if (
+      payload.enabledModelIds.some(
+        (modelId) => !videoGenerationModelSupportsFundingSource(modelId, payload.fundingSource),
+      )
+    ) {
+      throw new HTTPException(422, {
+        message: "The selected video model is unavailable for this funding source",
+      });
+    }
     try {
       const policy = await updateWorkspaceVideoGenerationPolicy(deps.db, {
         accountId: grant.accountId,
@@ -96,7 +113,10 @@ export function registerVideoGenerationRoutes(app: Hono, deps: ApiRouteDeps): vo
       workspaceId,
       c.req.param("operationId"),
     );
-    if (!summary) throw new HTTPException(404, { message: "video generation operation not found" });
+    if (!summary)
+      throw new HTTPException(404, {
+        message: "video generation operation not found",
+      });
     return c.json(VideoGenerationOperationSummary.parse(summary));
   });
 }
@@ -108,6 +128,7 @@ function managedVideoGenerationConfigured(deps: ApiRouteDeps): boolean {
 function videoGenerationFundingOptions(input: {
   managedConfigured: boolean;
   workspaceGatewayConfigured: boolean;
+  supergrokConfigured: boolean;
 }) {
   return [
     {
@@ -119,6 +140,15 @@ function videoGenerationFundingOptions(input: {
         ? null
         : "OpenGeni-managed video generation is not configured.",
     },
+    {
+      source: "supergrok_subscription" as const,
+      label: "SuperGrok",
+      description: "Uses your connected SuperGrok subscription.",
+      available: input.supergrokConfigured,
+      unavailableReason: input.supergrokConfigured
+        ? null
+        : "Connect an eligible SuperGrok account first.",
+    },
     {
       source: "workspace_gateway" as const,
       label: "Your Gateway",

package/src/routes/workspaces.ts

@@ -35,6 +35,7 @@ import {
   updateWorkspaceSettings,
   upsertWorkspaceModelPolicy,
   workspaceCodexSubscriptionActive,
+  workspaceXaiSubscriptionActive,
   workspaceVercelAiGatewayConnectionActive,
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
@@ -55,6 +56,7 @@ import { processTemporalScheduleCleanupClaims } from "../temporal-schedule-clean
 import {
   AI_GATEWAY_REALTIME_MODELS,
   CODEX_REALTIME_MODEL_ID,
+  SUPERGROK_REALTIME_MODEL_ID,
   canonicalizeConfiguredModelId,
   type Settings,
 } from "@opengeni/config";
@@ -165,10 +167,16 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
   // so bearer/federated definitions intentionally fail closed as not ready.
   app.get("/v1/workspaces/:workspaceId/model-catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const [policy, codexSubscriptionActive, workspaceGatewayConnectionActive] = await Promise.all([
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const [
+      policy,
+      codexSubscriptionActive,
+      xaiSubscriptionActive,
+      workspaceGatewayConnectionActive,
+    ] = await Promise.all([
       getWorkspaceModelPolicy(deps.db, workspaceId),
       workspaceCodexSubscriptionActive(deps.db, deps.settings, workspaceId),
+      workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
       workspaceVercelAiGatewayConnectionActive(deps.db, workspaceId),
     ]);
     c.header("cache-control", "private, no-store");
@@ -178,6 +186,7 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
           settings: deps.settings,
           policy,
           codexSubscriptionActive,
+          xaiSubscriptionActive,
           workspaceGatewayConnectionActive,
         }),
       ),
@@ -186,9 +195,10 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/realtime-model-catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const [codexConnected, workspaceGatewayConnected] = await Promise.all([
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const [codexConnected, supergrokConnected, workspaceGatewayConnected] = await Promise.all([
       workspaceCodexSubscriptionActive(deps.db, deps.settings, workspaceId),
+      workspaceXaiSubscriptionActive(deps.db, deps.settings, workspaceId, grant.subjectId),
       workspaceVercelAiGatewayConnectionActive(deps.db, workspaceId),
     ]);
     const availability = (
@@ -220,6 +230,14 @@ export function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void {
         ...availability(codexConnected, "Connect Codex to use this voice model"),
         recommended: false,
       },
+      {
+        id: SUPERGROK_REALTIME_MODEL_ID,
+        label: "Grok Voice Think Fast 2.0",
+        provider: "Connected SuperGrok" as const,
+        description: "Direct SuperGrok speech-to-speech",
+        ...availability(supergrokConnected, "Connect SuperGrok to use this voice model"),
+        recommended: false,
+      },
       ...gatewayModels.map((model) => ({
         id: model.workspaceModelId,
         label: model.label,

package/src/sandbox/channel-a.ts

@@ -64,6 +64,8 @@ import {
   ChannelAUnsupportedError,
   ChannelAUnavailableError,
   ChannelAValidationError,
+  BrowserControlRequestError,
+  BrowserControlTransportError,
   codemodeTokenFileFromEnvironment,
   withCodemodeTokenSession,
   withRunCredentialsSession,
@@ -104,11 +106,14 @@ export type ChannelAOperation =
   | "browser.suspend"
   | "browser.end"
   | "browser.read"
+  | "browser.action"
   | "browser.control"
+  | "browser.download.save"
   | "browser.attach"
   | "computer.create"
   | "computer.end"
   | "computer.read"
+  | "computer.action"
   | "computer.control"
   | "computer.attach";
 
@@ -122,6 +127,11 @@ export type ChannelAContext = {
   waitSignal?: AbortSignal | undefined;
   /** Bounded route identity for metrics and safe operator diagnostics. */
   operation?: ChannelAOperation | undefined;
+  /** The callback is an interaction-controller read or an exactly-once action.
+   * A controller transport failure may therefore rebuild the exact fenced
+   * provider handle and replay the request. Tab/lifecycle mutations that lack
+   * a controller operation id must never opt into this recovery. */
+  retryControllerTransport?: boolean | undefined;
 };
 
 export type ChannelAOperationFailureReason =
@@ -371,6 +381,8 @@ type ChannelAReadRecoveryOptions = {
   maxFreshHandleRetries?: 1 | 2;
   /** Never start another provider attempt after the originating request ends. */
   waitSignal?: AbortSignal | undefined;
+  /** Additional callback-specific failure that is safe to replay. */
+  retryableError?: ((error: unknown) => boolean) | undefined;
 };
 
 /** Retry a side-effect-free Channel-A read only after the caller has discarded
@@ -391,7 +403,9 @@ export async function runChannelAReadWithFreshHandleRetry<T>(
     try {
       return await run();
     } catch (error) {
-      if (!(error instanceof ChannelAUnavailableError) || retries >= maxFreshHandleRetries) {
+      const retryable =
+        error instanceof ChannelAUnavailableError || options.retryableError?.(error) === true;
+      if (!retryable || retries >= maxFreshHandleRetries) {
         throw error;
       }
       options.waitSignal?.throwIfAborted();
@@ -405,7 +419,17 @@ export function shouldEvictChannelAHandleAfterError(
   error: unknown,
   cacheKind: EstablishedHandleCacheKind,
 ): boolean {
-  return error instanceof ChannelAUnavailableError && cacheKind === "read";
+  return (
+    cacheKind === "read" &&
+    (error instanceof ChannelAUnavailableError || isRetryableControllerTransport(error))
+  );
+}
+
+function isRetryableControllerTransport(error: unknown): boolean {
+  return (
+    error instanceof BrowserControlTransportError ||
+    (error instanceof BrowserControlRequestError && error.retryable)
+  );
 }
 
 function evictEstablishedHandle(key: string, cacheKind: EstablishedHandleCacheKind): void {
@@ -941,6 +965,9 @@ async function withChannelAOperation<T>(
           {
             maxFreshHandleRetries: session.sandboxBackend === "modal" ? 2 : 1,
             ...(ctx.waitSignal ? { waitSignal: ctx.waitSignal } : {}),
+            ...(ctx.retryControllerTransport
+              ? { retryableError: isRetryableControllerTransport }
+              : {}),
           },
         )
       : await runProviderOperation();

package/src/sandbox/machines.ts

@@ -156,8 +156,8 @@ function machineStateFor(
 
 /**
  * Build the Machines dashboard response for a workspace. When `sessionId` is
- * supplied (an in-session view) the session's synthetic Modal group box is
- * prepended (`isSessionGroup:true`) and the active-sandbox pointer is echoed;
+ * supplied (an in-session view) the session's synthetic home group box is
+ * prepended when one exists (`isSessionGroup:true`) and the active-sandbox pointer is echoed;
  * without it (the pure workspace dashboard) `activeSandboxId` is null and only
  * the enrolled machines are listed.
  */
@@ -184,9 +184,9 @@ export async function listMachines(
 
   const machines: MachineView[] = [];
 
-  // The session's own Modal group box (synthetic): the default/home sandbox a
-  // null active pointer routes to. Only present in an in-session view.
-  if (session) {
+  // The session's own group box (synthetic): the default/home sandbox a null
+  // active pointer routes to. A backend:none session has no home box.
+  if (session && session.sandboxBackend !== "none") {
     const groupActive = activeSandboxId === null;
     const groupLease = await readLease(db, workspaceId, session.sandboxGroupId);
     machines.push(

package/src/sandbox/viewer.ts

@@ -891,8 +891,11 @@ export type TerminalStreamMint = {
   token: string;
   expiresAt: string;
   leaseEpoch: number;
+  transport: "pty-ws" | "relay-pty";
 };
 
+type SelfhostedStreamMint = Omit<TerminalStreamMint, "transport">;
+
 export type MintTerminalStreamInput = {
   accountId: string;
   workspaceId: string;
@@ -950,7 +953,7 @@ export async function mintTerminalStream(
   if (session.activeSandboxId) {
     const active = await getSandbox(db, workspaceId, session.activeSandboxId);
     if (active?.kind === "selfhosted") {
-      return await tryMintActiveSelfhostedStream(
+      const stream = await tryMintActiveSelfhostedStream(
         services,
         {
           session,
@@ -961,6 +964,7 @@ export async function mintTerminalStream(
         },
         input.resolveSelfhostedSession,
       );
+      return stream ? { ...stream, transport: "relay-pty" } : null;
     }
     // A Modal swap target (or unknown) falls through to the existing group-box path
     // (unchanged — Modal swap-target streaming is out of scope for this fix).
@@ -1052,6 +1056,7 @@ export async function mintTerminalStream(
       token: exposed.token,
       expiresAt: exposed.expiresAt,
       leaseEpoch: lease.leaseEpoch,
+      transport: "pty-ws",
     };
   } catch {
     // Any other failure degrades the terminal pty-ws cell to the sse-events
@@ -1107,7 +1112,7 @@ async function tryMintActiveSelfhostedStream(
   resolveSelfhostedSession?: (
     sandbox: SandboxRecord,
   ) => Promise<{ resolveExposedPort?: (port: number) => Promise<unknown> }>,
-): Promise<TerminalStreamMint | null> {
+): Promise<SelfhostedStreamMint | null> {
   const { settings, bus } = services;
   const { session, workspaceId, port, sandbox } = input;
   if (!sandbox.enrollmentId) {
@@ -1128,6 +1133,8 @@ async function tryMintActiveSelfhostedStream(
         controlRpcFactory: () => controlRpc(bus),
         agentId: sandbox.enrollmentId,
         epoch: session.activeEpoch,
+        // Stream authority rotates; terminal process identity does not.
+        terminalScopeId: session.id,
       });
       shSession = await client.resume({ agentId: sandbox.enrollmentId });
     }
@@ -1185,7 +1192,7 @@ export type MintSelfhostedStreamInput = {
 export async function mintSelfhostedStream(
   services: ViewerServices,
   input: MintSelfhostedStreamInput,
-): Promise<TerminalStreamMint | null> {
+): Promise<SelfhostedStreamMint | null> {
   const { settings } = services;
   const secret = resolveStreamTokenSecret(settings);
   if (!secret) {

package/src/slack-reaction-files.ts

@@ -0,0 +1,181 @@
+import { createHash } from "node:crypto";
+import type { FileResourceRef } from "@opengeni/contracts";
+import { completeFileUpload, prepareGeneratedWorkspaceFile, type Database } from "@opengeni/db";
+import type { ObjectHead, ObjectStorage } from "@opengeni/storage";
+import type { DownloadedSlackReactionImage } from "./integrations/slack-bot";
+
+const IMPORT_IDENTITY_VERSION = "slack-reaction-image-v1";
+const UPLOAD_INTENT_TTL_MS = 60 * 60_000;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+
+export type SlackReactionImageImportSource = Readonly<{
+  accountId: string;
+  workspaceId: string;
+  connectionId: string;
+  slackTeamId: string;
+  slackChannelId: string;
+  slackMessageTs: string;
+}>;
+
+export type ImportedSlackReactionImage = Readonly<{
+  resource: FileResourceRef;
+  filename: string;
+  contentType: "image/png" | "image/jpeg" | "image/webp";
+  sizeBytes: number;
+}>;
+
+export async function importSlackReactionImage(
+  dependencies: Readonly<{
+    db: Database;
+    objectStorage: ObjectStorage;
+    now?: () => Date;
+    prepareFile?: typeof prepareGeneratedWorkspaceFile;
+    completeFile?: typeof completeFileUpload;
+  }>,
+  source: SlackReactionImageImportSource,
+  image: DownloadedSlackReactionImage,
+  ordinal: number,
+): Promise<ImportedSlackReactionImage> {
+  if (!Number.isSafeInteger(ordinal) || ordinal < 1 || ordinal > 4) {
+    throw new RangeError("Slack reaction attachment ordinal is invalid");
+  }
+  const storage = dependencies.objectStorage;
+  if (!storage.headObject) {
+    throw new Error("Object storage lacks immutable object verification support");
+  }
+  if (image.bytes.byteLength < 1 || image.bytes.byteLength > 4 * 1024 * 1024) {
+    throw new Error("Slack reaction image size is invalid");
+  }
+  const sha256 = createHash("sha256").update(image.bytes).digest("hex");
+  const identity = slackReactionImageIdentity(source, image.fileId);
+  const fileId = deterministicUuid(`${identity}:file`);
+  const uploadId = deterministicUuid(`${identity}:upload`);
+  const safeFilename = safeSlackImageFilename(image.filename, image.contentType);
+  const objectKey = `workspaces/${source.workspaceId}/files/${fileId}/slack-reactions/${safeFilename}`;
+  const filename = safeFilename;
+  const prepared = await (dependencies.prepareFile ?? prepareGeneratedWorkspaceFile)(
+    dependencies.db,
+    {
+      accountId: source.accountId,
+      workspaceId: source.workspaceId,
+      fileId,
+      uploadId,
+      filename,
+      safeFilename,
+      contentType: image.contentType,
+      sizeBytes: image.bytes.byteLength,
+      sha256,
+      bucket: storage.bucket,
+      objectKey,
+      expiresAt: new Date((dependencies.now?.() ?? new Date()).getTime() + UPLOAD_INTENT_TTL_MS),
+    },
+  );
+
+  let file = prepared.file;
+  if (file.status !== "ready") {
+    const existing = await storage.headObject(objectKey);
+    if (existing) {
+      assertStoredSlackImage(existing, image, sha256);
+    } else if (storage.putObjectIfAbsent) {
+      await storage.putObjectIfAbsent({
+        key: objectKey,
+        contentType: image.contentType,
+        body: image.bytes,
+        sha256,
+      });
+      assertStoredSlackImage(await storage.headObject(objectKey), image, sha256);
+    } else {
+      await storage.putObject({
+        key: objectKey,
+        contentType: image.contentType,
+        body: image.bytes,
+        sha256,
+      });
+      assertStoredSlackImage(await storage.headObject(objectKey), image, sha256);
+    }
+    file = await (dependencies.completeFile ?? completeFileUpload)(
+      dependencies.db,
+      source.workspaceId,
+      uploadId,
+    );
+  } else {
+    assertStoredSlackImage(await storage.headObject(objectKey), image, sha256);
+  }
+
+  if (
+    file.id !== fileId ||
+    file.status !== "ready" ||
+    file.filename !== filename ||
+    file.safeFilename !== safeFilename ||
+    file.contentType !== image.contentType ||
+    file.sizeBytes !== image.bytes.byteLength ||
+    file.sha256 !== sha256
+  ) {
+    throw new Error("Imported Slack image differs from its immutable workspace file");
+  }
+  const mountPath = `attachments/slack/${String(ordinal).padStart(2, "0")}-${safeFilename}`;
+  return Object.freeze({
+    resource: Object.freeze({ kind: "file", fileId, mountPath }),
+    filename,
+    contentType: image.contentType,
+    sizeBytes: image.bytes.byteLength,
+  });
+}
+
+export function slackReactionImageIdentity(
+  source: SlackReactionImageImportSource,
+  slackFileId: string,
+): string {
+  return [
+    IMPORT_IDENTITY_VERSION,
+    source.workspaceId,
+    source.connectionId,
+    source.slackTeamId,
+    source.slackChannelId,
+    source.slackMessageTs,
+    slackFileId,
+  ].join(":");
+}
+
+export function safeSlackImageFilename(
+  value: string,
+  contentType: "image/png" | "image/jpeg" | "image/webp",
+): string {
+  const extension =
+    contentType === "image/png" ? ".png" : contentType === "image/jpeg" ? ".jpg" : ".webp";
+  const normalized = value
+    .normalize("NFKC")
+    .replace(/[\\/:*?"<>|\u0000-\u001f\u007f]+/gu, "-")
+    .replace(/\s+/gu, " ")
+    .trim();
+  const withoutKnownExtension = normalized.replace(/\.(?:png|jpe?g|webp)$/iu, "");
+  const stem = withoutKnownExtension.replace(/^[. -]+|[. ]+$/gu, "").slice(0, 180) || "slack-image";
+  return `${stem}${extension}`;
+}
+
+function assertStoredSlackImage(
+  head: ObjectHead | null,
+  image: DownloadedSlackReactionImage,
+  sha256: string,
+): void {
+  if (
+    !head ||
+    head.ContentLength !== image.bytes.byteLength ||
+    head.ContentType !== image.contentType ||
+    head.Metadata?.sha256 !== sha256 ||
+    typeof head.VersionToken !== "string" ||
+    head.VersionToken.length < 1
+  ) {
+    throw new Error("Stored Slack image differs from its immutable import");
+  }
+}
+
+function deterministicUuid(seed: string): string {
+  const bytes = createHash("sha256").update(seed, "utf8").digest().subarray(0, 16);
+  bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x50;
+  bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;
+  const hex = bytes.toString("hex");
+  const value = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+  if (!UUID_PATTERN.test(value)) throw new Error("Slack reaction file identity is invalid");
+  return value;
+}

package/src/transcription/providers/xai-subscription.ts

@@ -0,0 +1,110 @@
+import { type Settings } from "@opengeni/config";
+import {
+  type TranscriptionAvailabilityContext,
+  type TranscriptionProvider,
+  TranscriptionServiceError,
+} from "@opengeni/core";
+import { workspaceXaiSubscriptionActive, type Database } from "@opengeni/db";
+import {
+  XAI_CLIENT_MODE,
+  XAI_CLIENT_VERSION,
+  XAI_PUBLIC_API_BASE_URL,
+  type XaiFetch,
+} from "@opengeni/xai-subscription";
+import { buildXaiSubscriptionAuthorization } from "../../xai-subscription-auth";
+import { fetchError, responseError } from "./openai";
+
+const TRANSCRIBE_URL = `${XAI_PUBLIC_API_BASE_URL}/stt`;
+
+export function createXaiSubscriptionTranscriptionProvider(input: {
+  settings: Settings;
+  db: Database;
+  fetch?: typeof fetch;
+}): TranscriptionProvider {
+  const fetchImpl = input.fetch ?? fetch;
+  return {
+    id: "supergrok-subscription",
+    supportsServerDeadline: true,
+    experimental: true,
+    async available(context?: TranscriptionAvailabilityContext) {
+      if (!context?.workspaceId || !context.subjectId) {
+        return input.settings.supergrokSubscriptionEnabled;
+      }
+      return await workspaceXaiSubscriptionActive(
+        input.db,
+        input.settings,
+        context.workspaceId,
+        context.subjectId,
+      );
+    },
+    async transcribe({
+      audio,
+      mimeType,
+      filename,
+      workspaceId,
+      accountId,
+      subjectId,
+      requestId,
+      signal,
+    }) {
+      let auth: Awaited<ReturnType<typeof buildXaiSubscriptionAuthorization>>;
+      try {
+        auth = await buildXaiSubscriptionAuthorization({
+          db: input.db,
+          settings: input.settings,
+          accountId,
+          workspaceId,
+          subjectId,
+          shardKey: requestId,
+          sessionId: requestId,
+          ...(input.fetch ? { fetch: input.fetch as XaiFetch } : {}),
+        });
+      } catch {
+        throw new TranscriptionServiceError({
+          code: "unavailable",
+          message: "Transcription is unavailable.",
+        });
+      }
+      const request = async (accessToken: string) => {
+        const form = new FormData();
+        form.append(
+          "file",
+          new Blob([Uint8Array.from(audio).buffer], { type: mimeType }),
+          filename,
+        );
+        return await fetchImpl(TRANSCRIBE_URL, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "User-Agent": `opengeni/${XAI_CLIENT_VERSION}`,
+            "x-grok-client-version": XAI_CLIENT_VERSION,
+            "x-grok-client-identifier": "opengeni",
+            "x-grok-client-mode": XAI_CLIENT_MODE,
+            "x-grok-session-id": requestId,
+          },
+          body: form,
+          ...(signal ? { signal } : {}),
+        });
+      };
+      let response: Response;
+      try {
+        let token = await auth.context.getToken();
+        response = await request(token.accessToken);
+        if (response.status === 401) {
+          await response.body?.cancel().catch(() => undefined);
+          token = await auth.context.refresh();
+          response = await request(token.accessToken);
+        }
+      } catch (error) {
+        throw fetchError(error);
+      }
+      if (!response.ok) throw responseError(response.status);
+      const body = (await response.json().catch(() => null)) as Record<string, unknown> | null;
+      if (!body || typeof body.text !== "string") throw responseError(502);
+      return {
+        text: body.text,
+        languages: typeof body.language === "string" && body.language ? [body.language] : [],
+      };
+    },
+  };
+}