@opengeni/api-router 1.3.0 → 1.4.0

package/dist/{chunk-IZEGLLKZ.js → chunk-KKEXIBQG.js}

@@ -6517,8 +6517,8 @@ import {
   canonicalPublicOrigin as canonicalPublicOrigin3,
   configuredAllowedReasoningEfforts,
   resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy2,
-  resolveVoiceInputProviderRegistry as resolveVoiceInputProviderRegistry2,
-  UnsupportedLatencyModeError as UnsupportedLatencyModeError2
+  UnsupportedLatencyModeError as UnsupportedLatencyModeError2,
+  voiceInputPricingIssues
 } from "@opengeni/config";
 import {
   AGENT_CAPABILITY_IDS,
@@ -6532,6 +6532,7 @@ import {
   resolveWorkspaceMemoryEnabled,
   resolveWorkspaceMemoryPromptMode,
   VOICE_INPUT_ACCEPTED_MIME_TYPES as VOICE_INPUT_ACCEPTED_MIME_TYPES2,
+  WorkspaceVoiceInputSettings as WorkspaceVoiceInputSettings3,
   TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS as TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS2,
   ToolGatewayApprovalRequest as ToolGatewayApprovalRequest2,
   ToolGatewayCallRequest as ToolGatewayCallRequest2
@@ -7065,8 +7066,8 @@ import {
   CodexCompactionV2ProviderLockedError,
   ManagedAuthActorLeaseOutcomeUnknownError,
   hasPermission as hasPermission34,
-  requireAccessGrant as requireAccessGrant54,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization40,
+  requireAccessGrant as requireAccessGrant53,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization41,
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority10,
   requireAccessContext as requireAccessContext15,
   requirePermission as requirePermission13,
@@ -8515,7 +8516,7 @@ function startManagedSignInNotificationDelivery(db, transport) {
     if (active) return;
     active = true;
     try {
-      for (let count = 0; count < 10; count++)
+      for (let count2 = 0; count2 < 10; count2++)
         if (await deliverManagedSignInNotification(db, transport) === "outcome_unknown") break;
     } finally {
       active = false;
@@ -10277,9 +10278,9 @@ function dispositionFilenameParameters(filename) {
   const cleaned = Array.from(
     filename.replace(/[\u0000-\u001f\u007f/\\]+/g, "_").replace(/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, "_").trim()
   ).slice(0, DISPOSITION_FILENAME_MAX_CHARS).join("");
-  const ascii2 = cleaned.replace(/[^A-Za-z0-9._ -]+/g, "_").replace(/\s+/g, " ").trim().slice(0, DISPOSITION_FILENAME_MAX_CHARS) || "download";
-  if (!cleaned || ascii2 === cleaned) return `filename="${ascii2}"`;
-  return `filename="${ascii2}"; filename*=UTF-8''${encodeExtendedParameterValue(cleaned)}`;
+  const ascii3 = cleaned.replace(/[^A-Za-z0-9._ -]+/g, "_").replace(/\s+/g, " ").trim().slice(0, DISPOSITION_FILENAME_MAX_CHARS) || "download";
+  if (!cleaned || ascii3 === cleaned) return `filename="${ascii3}"`;
+  return `filename="${ascii3}"; filename*=UTF-8''${encodeExtendedParameterValue(cleaned)}`;
 }
 function userContentDispositionHeaders(contentType, filename) {
   if (!isActiveUserContentType(contentType)) return {};
@@ -10817,13 +10818,18 @@ import {
 import {
   freezeAgentLearningPolicy,
   withSessionRlsActorContext,
-  withCreditDebitAttribution
+  withCreditDebitAttribution,
+  currentCreditDebitAttribution
 } from "@opengeni/db";
 import { HTTPException as HTTPException21 } from "hono/http-exception";
+function creditDebitAttributionForGrant(grant) {
+  if (grant.principalKind === "agent_attempt") return currentCreditDebitAttribution();
+  return grant.principalKind === "human_session" ? { kind: "human", initiatingHumanSubjectId: grant.subjectId } : ["service", "api_key", "configured_key", "mcp_gateway"].includes(grant.principalKind ?? "") ? { kind: "service" } : { kind: "unknown" };
+}
 async function withAccessGrantSessionRlsContext(deps, grant, fn) {
   if (grant.principalKind !== "agent_attempt") {
     return await withCreditDebitAttribution(
-      grant.principalKind === "human_session" ? { kind: "human", initiatingHumanSubjectId: grant.subjectId } : grant.principalKind === "service" || grant.principalKind === "api_key" || grant.principalKind === "configured_key" || grant.principalKind === "mcp_gateway" ? { kind: "service" } : { kind: "unknown" },
+      creditDebitAttributionForGrant(grant),
       () => withSessionRlsActorContext({ subjectId: grant.subjectId }, fn)
     );
   }
@@ -11270,6 +11276,13 @@ function registerEditableArtifactRoutes(app, deps) {
     const body3 = await parseBoundedMaterializationRequest(context);
     const scope = editableArtifactScope({ accountId: grant.accountId, workspaceId });
     const actor = editableArtifactActorForGrant(grant, body3.replicaId);
+    if (!deps.settings.artifactMaterializerDeployed) {
+      throw new ApiHttpError(503, {
+        code: "upstream_unavailable",
+        message: "File export is not available on this deployment.",
+        retryable: false
+      });
+    }
     try {
       const result = await requireEditableArtifactExports(deps).enqueueMaterialization({
         scope,
@@ -12498,6 +12511,7 @@ import {
   SandboxResumeIdentityMismatchError,
   SandboxResumeIdentityUnavailableError,
   RoutingActiveRouteChangedError,
+  RoutingMutationOutputRejectedError,
   RoutingWorkspaceRootChangedError,
   SelfhostedWorkspaceRootChangedError,
   ChannelAConflictError,
@@ -13594,6 +13608,20 @@ function mapChannelAError(error, waitSignal) {
     });
   if (error instanceof SandboxResumeIdentityMismatchError || error instanceof SandboxResumeIdentityUnavailableError)
     return new HTTPException22(409, { message: error.message });
+  if (error instanceof RoutingMutationOutputRejectedError) {
+    const revoked = error.reasonCode === "authority_revoked";
+    return new ApiHttpError(revoked ? 403 : 409, {
+      code: revoked ? "forbidden" : "conflict",
+      message: error.message,
+      retryable: false,
+      outcomeUnknown: false,
+      details: {
+        code: error.code,
+        reasonCode: error.reasonCode,
+        physicalOutcome: "resolved"
+      }
+    });
+  }
   if (error instanceof RoutingActiveRouteChangedError || error instanceof RoutingWorkspaceRootChangedError || error instanceof SelfhostedWorkspaceRootChangedError || error instanceof ChannelAFileSystemRouteChangedError)
     return new ApiHttpError(409, {
       code: "conflict",
@@ -13660,6 +13688,13 @@ function channelAOperationFailureDiagnostic(error, waitSignal) {
       errorCode: "sandbox_channel_a_cancelled"
     };
   }
+  if (error instanceof RoutingMutationOutputRejectedError) {
+    return {
+      reason: "request_rejected",
+      status: error.reasonCode === "authority_revoked" ? 403 : 409,
+      errorCode: "sandbox_channel_a_operation_failed"
+    };
+  }
   if (error instanceof SandboxProviderReadLockUnavailableError) {
     return {
       reason: "provider_read_busy",
@@ -15507,8 +15542,8 @@ function tokenHash(value) {
 function mcpOAuthRegistrationClientKey(c, trust) {
   return `mcp-oauth-registration:${trustedRequestSourceRateLimitKey(c, trust)}`;
 }
-function expiresIn(seconds) {
-  return new Date(Date.now() + seconds * 1e3);
+function expiresIn(seconds2) {
+  return new Date(Date.now() + seconds2 * 1e3);
 }
 function authorizationRedirect(redirectUri, params) {
   const url = new URL(redirectUri);
@@ -17002,7 +17037,11 @@ import {
 import { OPENGENI_PERSONAL_SLACK_MCP_URL } from "@opengeni/contracts";
 import { HTTPException as HTTPException31 } from "hono/http-exception";
 import { z as z25 } from "zod";
-import { GMAIL_REST_MCP_TOOLS, gmailToolSupportsScopes } from "@opengeni/runtime/gmail-rest-mcp";
+import {
+  GMAIL_REST_MCP_TOOLS,
+  gmailToolAvailableOnDeployment,
+  gmailToolSupportsScopes
+} from "@opengeni/runtime/gmail-rest-mcp";
 
 // src/integrations/provider-domain.ts
 import { HTTPException as HTTPException30 } from "hono/http-exception";
@@ -17137,10 +17176,12 @@ var OFFICIAL_GMAIL_PROFILE = {
       }
       return { gmailEmail: payload.emailAddress };
     },
-    toolsForScopes: (scopes) => {
-      return GMAIL_REST_MCP_TOOLS.filter((tool) => gmailToolSupportsScopes(tool.name, scopes)).map(
-        ({ name, description }) => ({ name, ...description ? { description } : {} })
-      );
+    toolsForScopes: (scopes, deployment) => {
+      return GMAIL_REST_MCP_TOOLS.filter(
+        (tool) => gmailToolSupportsScopes(tool.name, scopes) && gmailToolAvailableOnDeployment(tool.name, {
+          watchTopicName: deployment.gmailWatchTopicName
+        })
+      ).map(({ name, description }) => ({ name, ...description ? { description } : {} }));
     }
   }
 };
@@ -19122,7 +19163,8 @@ async function verifyMcpToolsListNonFatal(observability, settings, state, token,
       grantRejected = local.isRejectedGrant?.(payload) ?? false;
       providerIdentity = local.validateIdentity(payload);
       const verifiedTools = local.toolsForScopes(
-        grantedScopes(token.scopeText, state.authorizeScopes, profile)
+        grantedScopes(token.scopeText, state.authorizeScopes, profile),
+        settings
       );
       if (local.required && verifiedTools.length === 0)
         throw new Error("Connector verification did not report an authorized tool scope");
@@ -20502,15 +20544,15 @@ import { COMMAND_OUTPUT_MAX_BYTES } from "@opengeni/db/session-background-comman
 var COMMAND_READ_MAX_WAIT_SECONDS = 50;
 var COMMAND_WAIT_DEFAULT_SECONDS = 45;
 async function readCommandWithWait(input) {
-  const seconds = input.waitSeconds ?? 0;
-  if (!Number.isInteger(seconds) || seconds < 0 || seconds > COMMAND_READ_MAX_WAIT_SECONDS) {
+  const seconds2 = input.waitSeconds ?? 0;
+  if (!Number.isInteger(seconds2) || seconds2 < 0 || seconds2 > COMMAND_READ_MAX_WAIT_SECONDS) {
     throw new Error("waitSeconds must be between 0 and 50");
   }
   if (input.maxOutputBytes !== void 0 && (!Number.isInteger(input.maxOutputBytes) || input.maxOutputBytes < 4 || input.maxOutputBytes > COMMAND_OUTPUT_MAX_BYTES)) {
     throw new Error("maxOutputBytes must be between 4 and 65536");
   }
   const started2 = Date.now();
-  const deadline = started2 + seconds * 1e3;
+  const deadline = started2 + seconds2 * 1e3;
   let unsubscribe;
   let wake;
   let changed2 = false;
@@ -20521,7 +20563,7 @@ async function readCommandWithWait(input) {
   };
   input.signal?.addEventListener("abort", notify);
   try {
-    if (seconds > 0) {
+    if (seconds2 > 0) {
       try {
         unsubscribe = await input.subscribe((events) => {
           if (events.some(
@@ -20541,7 +20583,7 @@ async function readCommandWithWait(input) {
         return {
           ...result,
           waitedMs: Date.now() - started2,
-          timedOut: seconds > 0 && expired && !result.terminal && result.chunks.length === 0 && !result.hasMore,
+          timedOut: seconds2 > 0 && expired && !result.terminal && result.chunks.length === 0 && !result.hasMore,
           aborted: input.signal?.aborted ?? false,
           liveFanout
         };
@@ -22021,7 +22063,7 @@ function buildScheduledTaskDetailMcp(task, budget, reducedForBytes) {
         deliveredCount: resources.length,
         originalBytes: jsonBytes(task.agentConfig.resources),
         truncatedIdentityFieldCount: resourceProjections.reduce(
-          (count, projection) => count + projection.truncatedFieldCount,
+          (count2, projection) => count2 + projection.truncatedFieldCount,
           0
         )
       },
@@ -22030,7 +22072,7 @@ function buildScheduledTaskDetailMcp(task, budget, reducedForBytes) {
         deliveredCount: tools.length,
         originalBytes: jsonBytes(task.agentConfig.tools),
         truncatedIdentityFieldCount: toolProjections.reduce(
-          (count, projection) => count + projection.truncatedFieldCount,
+          (count2, projection) => count2 + projection.truncatedFieldCount,
           0
         )
       },
@@ -25033,9 +25075,9 @@ function slackRetryAfterMs(response) {
   if (response.status !== 429) return null;
   const raw = response.headers.get("retry-after");
   if (!raw || !/^\d+$/.test(raw)) return null;
-  const seconds = Number(raw);
-  if (!Number.isSafeInteger(seconds) || seconds < 1) return null;
-  return Math.min(seconds, 3600) * 1e3;
+  const seconds2 = Number(raw);
+  if (!Number.isSafeInteger(seconds2) || seconds2 < 1) return null;
+  return Math.min(seconds2, 3600) * 1e3;
 }
 function assertOpenGeniSlackBotScopes(grantedScopes2) {
   const policy = evaluateOpenGeniSlackBotScopes(grantedScopes2);
@@ -25613,11 +25655,11 @@ function nextSlackFilesListPage(payload, requested, returnedFileCount) {
   if (responseMetadata && Object.hasOwn(responseMetadata, "next_cursor")) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
-  const count = paging?.count;
+  const count2 = paging?.count;
   const total = paging?.total;
   const page2 = paging?.page;
   const pages = paging?.pages;
-  if (!positiveSafeInt(count) || !nonNegativeSafeInt(total) || !positiveSafeInt(page2) || !nonNegativeSafeInt(pages) || count !== requested.count || page2 !== requested.page || returnedFileCount > count || pages !== (total === 0 ? 0 : Math.ceil(total / count)) || page2 > Math.max(1, pages)) {
+  if (!positiveSafeInt(count2) || !nonNegativeSafeInt(total) || !positiveSafeInt(page2) || !nonNegativeSafeInt(pages) || count2 !== requested.count || page2 !== requested.page || returnedFileCount > count2 || pages !== (total === 0 ? 0 : Math.ceil(total / count2)) || page2 > Math.max(1, pages)) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
   if (page2 >= pages) return null;
@@ -83461,12 +83503,12 @@ function creditScopeMetadata(scope) {
 }
 function creditScopeFromMetadata(metadata) {
   if (!metadata || !Object.keys(metadata).some((key) => key.startsWith(prefix))) return void 0;
-  const count = Number(metadata[countKey]);
-  if (!Number.isInteger(count) || count < 1 || count > 24) {
+  const count2 = Number(metadata[countKey]);
+  if (!Number.isInteger(count2) || count2 < 1 || count2 > 24) {
     throw new Error("Invalid promotional credit snapshot");
   }
   let encoded = "";
-  for (let index = 0; index < count; index++) {
+  for (let index = 0; index < count2; index++) {
     const chunk = metadata[`${prefix}${index}`];
     if (!chunk) throw new Error("Incomplete promotional credit snapshot");
     encoded += chunk;
@@ -100182,219 +100224,10 @@ function registerScheduledTaskRoutes(app, deps) {
   });
 }
 
-// src/routes/sessions.ts
-import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
-import { assertGoalResumeAllowed as assertGoalResumeAllowed2, GoalResumeBlockedError } from "@opengeni/core";
-import { UnsupportedLatencyModeError } from "@opengeni/config";
-import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
-import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
-import * as sessionPreviewSchema from "@opengeni/db/schema";
-import { SessionMessageSearchRequest } from "@opengeni/contracts";
-import { scheduledSessionIds } from "@opengeni/db";
-import { isVerifiedDelegatedHumanAuthorization as isVerifiedDelegatedHumanAuthorization4, withSiteSessionOrigin as withSiteSessionOrigin3 } from "@opengeni/core";
-import { freezeSessionRealtimeConnectionAccounts } from "@opengeni/core";
-import { SandboxRecoveryRequest } from "@opengeni/contracts";
-import { getManagedHumanSandboxRecovery, consentManagedHumanSandboxRecovery } from "@opengeni/core";
-import { SandboxRecoveryConflictError } from "@opengeni/db";
-import { getSessionCodexAccounts } from "@opengeni/db";
-import { getToolActionReview, getToolReviewDetailsPage } from "@opengeni/db";
-import {
-  AcknowledgeStreamRequest,
-  ApplySessionGoalRevisionRequest,
-  ListSessionGoalRevisionsQuery,
-  RejectSessionGoalRevisionRequest,
-  RollbackSessionGoalRevisionRequest,
-  ActivateCodexRealtimeConnectionRequest,
-  AttachViewerRequest,
-  BeginSessionRealtimeRequest,
-  ClearSessionContextRequest,
-  CodexRealtimeWebrtcRequest,
-  GatewayRealtimeConnectRequest,
-  ClientSessionEvent,
-  CompactSessionContextRequest,
-  CreateSessionRequest as CreateSessionRequest2,
-  DeleteSessionQueueItemRequest,
-  EditSessionQueueItemRequest,
-  EndSessionRealtimeRequest,
-  FsDeleteRequest,
-  FsListBatchRequest,
-  FsListRequest,
-  FsMkdirRequest,
-  FsMoveRequest,
-  FsReadRequest,
-  FsWriteRequest,
-  ForkSessionRequest,
-  HumanInputRequestStatus,
-  GitDiffRequest,
-  GitReadBatchRequest,
-  GitLogRequest,
-  GitShowRequest,
-  GitStatusRequest,
-  MoveSessionQueueItemRequest,
-  PtyCloseRequest,
-  PtyOpenRequest,
-  PtyResizeRequest,
-  PtyWriteRequest,
-  PublishSandboxFileArtifactRequest,
-  RenewSessionRealtimeRequest,
-  SyncSessionRealtimeLedgerRequest,
-  SessionControlRequest,
-  SessionRetryRequest,
-  SESSION_EVENT_RAW_DELTA_TYPES as SESSION_EVENT_RAW_DELTA_TYPES2,
-  SessionEventPayloadMode as SessionEventPayloadMode2,
-  SessionEventReadDirection as SessionEventReadDirection2,
-  SessionEventReadMode as SessionEventReadMode2,
-  SessionEventLatestClass as SessionEventLatestClass2,
-  SessionEventResultMode as SessionEventResultMode2,
-  SessionScopeSubjectId,
-  SessionEventSemanticClass as SessionEventSemanticClass2,
-  SessionEventType as SessionEventType2,
-  SessionMcpServerId,
-  SaveNewSessionDraftRequest,
-  compactSessionEventResult as compactSessionEventResult3,
-  sessionEventLatestClassToSemanticClass as sessionEventLatestClassToSemanticClass2,
-  SaveComposerDraftRequest,
-  SubmitComposerDraftRequest,
-  SteerSessionQueueItemRequest,
-  SteerSessionMessageRequest,
-  TerminalExecRequest,
-  UpdateSessionChannelRequest,
-  UpdateSessionAttentionRequest,
-  UpdateSessionArchiveRequest,
-  UpdateSessionPinRequest,
-  UpdateSessionGoalRequest,
-  UpdateSessionMcpApprovalPolicyRequest,
-  UpdateSessionRequest,
-  UpdateSessionVariableSetsRequest,
-  UpdateSessionVisibilityRequest,
-  UpdateSessionToolPolicyRequest,
-  UpdateSessionAgentRequest,
-  AgentConfigError as AgentConfigError2,
-  ViewerHeartbeatRequest,
-  WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
-  WORK_CLAIM_CANONICAL_KEY_MAX_BYTES as WORK_CLAIM_CANONICAL_KEY_MAX_BYTES2,
-  WORK_CLAIM_DISCOVERY_LIMIT as WORK_CLAIM_DISCOVERY_LIMIT2,
-  WORK_CLAIM_NAMESPACE_MAX_BYTES as WORK_CLAIM_NAMESPACE_MAX_BYTES2,
-  WORK_DISCOVERY_QUERY_MAX_CHARS as WORK_DISCOVERY_QUERY_MAX_CHARS2,
-  WORK_DISCOVERY_RECENT_HOURS_MAX as WORK_DISCOVERY_RECENT_HOURS_MAX2,
-  WorkClaimSubjectFilter as WorkClaimSubjectFilterSchema,
-  WorkClaimSubjectType as WorkClaimSubjectType2,
-  normalizeWorkClaimCanonicalKey,
-  normalizeWorkClaimNamespace,
-  workspaceControlUtf8Bytes
-} from "@opengeni/contracts";
-import { streamTokenDegraded } from "@opengeni/config";
-import {
-  recordAuditEvent as recordAuditEvent13,
-  acceptSessionApprovalDecision as acceptSessionApprovalDecision2,
-  acceptSessionHumanInputResponse as acceptSessionHumanInputResponse2,
-  clearSessionGoal,
-  clearSessionContext,
-  getOpenPtySession,
-  getEnrollment as getEnrollment2,
-  getLiveEnrollmentConnection as getLiveEnrollmentConnection7,
-  getRetainedProcess,
-  getSandbox as getSandbox4,
-  getSession as getSession9,
-  readActiveSandbox as readActiveSandbox3,
-  deleteSessionTreeIfQuiescent,
-  getSessionEvent,
-  getSessionForSubject as getSessionForSubject2,
-  getSessionGoal as getSessionGoal2,
-  getLatestSessionModelContext,
-  getSessionHumanInputRequest,
-  getSessionGoalWithContinuation,
-  getSessionGoalRevision,
-  getSessionQueueSnapshot as getSessionQueueSnapshot2,
-  getStreamAcknowledgment,
-  insertPtySession,
-  listSessionEventPage as listSessionEventPage3,
-  listSessionHumanInputRequests,
-  listSessionGoalRevisionPage,
-  listSessionGoalRevisions,
-  rejectSessionGoalRevisionWithEvent,
-  listSessionIdsInGroup,
-  listSessionDiscoverySummaries as listSessionDiscoverySummaries2,
-  listSessionDiscoveryAncestorPaths,
-  listSessionsForSubject,
-  listSessionEntriesForSubject,
-  getLatestStartedSessionTurn,
-  listSessionTurns,
-  projectEffectiveControlForRelatedAccess as projectEffectiveControlForRelatedAccess2,
-  projectSessionForRelatedAccess as projectSessionForRelatedAccess2,
-  recordStreamAcknowledgment,
-  requestSessionCompaction,
-  switchSessionCodexAccount,
-  setSessionChannel as setSessionChannel2,
-  updateSessionVariableSets,
-  ChannelNotFoundError,
-  setSessionAttention,
-  setSessionArchive,
-  setSessionPin,
-  SessionAttentionVersionConflictError,
-  SessionArchiveVersionConflictError,
-  SessionPinVersionConflictError,
-  SessionPinAccessError,
-  SessionListAccessError,
-  SessionListCursorError,
-  SessionListCursorExpiredError,
-  decodeSessionListCursor,
-  revokeViewer,
-  setSessionGoalStatusWithEvent as setSessionGoalStatusWithEvent2,
-  upsertSessionGoalWithEvent as upsertSessionGoalWithEvent2,
-  updatePtySessionActivity,
-  QueueCommandConflictError,
-  beginSessionRealtimeInTransaction,
-  activateSessionRealtimeConnectionInTransaction,
-  claimSessionRealtimeConnectionInTransaction,
-  completeSessionRealtimeConnectionInTransaction,
-  endSessionRealtimeInTransaction,
-  failSessionRealtimeConnectionInTransaction,
-  NewSessionDraftConflictError,
-  SessionCommandIdempotencyError,
-  SessionControlConflictError,
-  SessionRealtimeConflictError,
-  SessionToolPolicyVersionConflictError,
-  SessionContextBusyError,
-  SessionVariableSetSelectionUnavailableError,
-  SessionCreateConnectionSelectionUnavailableError as SessionCreateConnectionSelectionUnavailableError2,
-  workspaceControlRequestLockTimeoutMs,
-  SessionTenancyAccessError,
-  SessionTenancyConflictError,
-  SessionTenancyInvalidRequestError,
-  SessionTenancyNotActivatedError,
-  HumanInputResponseValidationError as HumanInputResponseValidationError2,
-  SkillHumanResponseError,
-  latestWorkspaceCapture,
-  sessionLatestWorkspaceCapture,
-  renewSessionRealtimeInTransaction,
-  syncSessionRealtimeLedgerInTransaction,
-  withWorkspaceSessionActivityRls,
-  withWorkspaceRls,
-  workspaceCaptureAtRevision
-} from "@opengeni/db";
-import {
-  backgroundCommandActivityForSessions,
-  listSessionBackgroundCommands,
-  requestSessionBackgroundCommandCancellation
-} from "@opengeni/db/session-background-commands";
-import {
-  appendAndPublishEvents as appendAndPublishEvents3,
-  boundSessionEventHttpPage,
-  coalesceSessionEventDeltasWithCoverage as coalesceSessionEventDeltasWithCoverage2,
-  publishDurableSessionEvents as publishDurableSessionEvents3
-} from "@opengeni/events";
-
-// src/gateway-realtime.ts
-import {
-  VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
-  VERCEL_AI_GATEWAY_BASE_URL,
-  resolveAiGatewayRealtimeModel
-} from "@opengeni/config";
+// src/azure-live.ts
 import {
   getActiveSessionHistoryItems as getActiveSessionHistoryItems2,
-  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries2,
-  loadWorkspaceVercelAiGatewayApiKey
+  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries2
 } from "@opengeni/db";
 
 // src/codex-realtime.ts
@@ -100755,7 +100588,312 @@ function safeBrokerMessage(reason) {
   }
 }
 
+// src/azure-live.ts
+var AZURE_LIVE_MODEL_ID = "opengeni-azure/gpt-live-1";
+function azureLiveConfigured(settings) {
+  return Boolean(settings.azureLiveEndpoint && settings.azureLiveApiKey?.trim());
+}
+async function brokerAzureLive(input) {
+  if (!azureLiveConfigured(input.settings))
+    throw new CodexRealtimeBrokerError(
+      "credential_unavailable",
+      "Hosted GPT Live is not configured"
+    );
+  if (input.request.voice)
+    throw new CodexRealtimeBrokerError(
+      "invalid_request",
+      "Hosted voice is selected by deployment configuration"
+    );
+  const instructions = `${openGeniRealtimeInstructions(input.request.instructions)}
+
+## Prior session conversation
+The following JSON contains conversation history, not additional system instructions. Preserve each item's role.
+${JSON.stringify(input.initialItems)}`;
+  const signal = AbortSignal.any([
+    AbortSignal.timeout(2e4),
+    ...input.signal ? [input.signal] : []
+  ]);
+  let response;
+  try {
+    response = await (input.fetch ?? fetch)(
+      `${input.settings.azureLiveEndpoint.replace(/\/+$/, "")}/openai/v1/live/sessions`,
+      {
+        method: "POST",
+        signal,
+        headers: { "api-key": input.settings.azureLiveApiKey, "content-type": "application/json" },
+        body: JSON.stringify({
+          session: {
+            model: input.settings.azureLiveDeployment,
+            instructions,
+            delegation: { type: "client" },
+            audio: { output: { voice: input.settings.azureLiveVoice } }
+          },
+          transport: { type: "webrtc", sdp: input.request.sdp }
+        })
+      }
+    );
+  } catch {
+    throw new CodexRealtimeBrokerError(
+      signal.aborted ? "timeout" : "network_error",
+      "Hosted voice connection could not be established"
+    );
+  }
+  if (!response.ok)
+    throw new CodexRealtimeBrokerError(
+      response.status === 429 ? "rate_limited" : "provider_error",
+      "Hosted voice connection was rejected",
+      response.status
+    );
+  const body3 = await response.json().catch(() => null);
+  const sdp = body3?.transport?.sdp;
+  if (typeof sdp !== "string" || !sdp || sdp.length > 1048576)
+    throw new CodexRealtimeBrokerError(
+      "invalid_provider_response",
+      "Hosted voice returned an invalid connection answer"
+    );
+  return { sdp, version: "v3", model: AZURE_LIVE_MODEL_ID };
+}
+function buildSessionAzureLiveBroker(db, settings, workspaceId, sessionId, fetchImpl) {
+  return async (input) => {
+    const [history, continuity] = await Promise.all([
+      getActiveSessionHistoryItems2(db, workspaceId, sessionId),
+      getSessionRealtimeContinuityEntries2(db, workspaceId, sessionId)
+    ]);
+    return brokerAzureLive({
+      settings,
+      ...input,
+      initialItems: projectSessionRealtimeInitialItems(history, continuity),
+      ...fetchImpl ? { fetch: fetchImpl } : {}
+    });
+  };
+}
+
+// src/routes/sessions.ts
+import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
+import { assertGoalResumeAllowed as assertGoalResumeAllowed2, GoalResumeBlockedError } from "@opengeni/core";
+import { UnsupportedLatencyModeError } from "@opengeni/config";
+import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
+import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
+import * as sessionPreviewSchema from "@opengeni/db/schema";
+import { SessionMessageSearchRequest } from "@opengeni/contracts";
+import { scheduledSessionIds } from "@opengeni/db";
+import { isVerifiedDelegatedHumanAuthorization as isVerifiedDelegatedHumanAuthorization4, withSiteSessionOrigin as withSiteSessionOrigin3 } from "@opengeni/core";
+import { freezeSessionRealtimeConnectionAccounts } from "@opengeni/core";
+import {
+  createRealtimeVoiceBilling,
+  RealtimeVoiceUnavailableError,
+  TranscriptionBillingRefusedError
+} from "@opengeni/core";
+
+// src/transcription/billing-refusal.ts
+function transcriptionBillingRefusal(c, error) {
+  return c.json({ code: error.code, message: error.message, ...error.details }, error.status);
+}
+
+// src/routes/sessions.ts
+import { SandboxRecoveryRequest } from "@opengeni/contracts";
+import { getManagedHumanSandboxRecovery, consentManagedHumanSandboxRecovery } from "@opengeni/core";
+import { SandboxRecoveryConflictError } from "@opengeni/db";
+import { getSessionCodexAccounts } from "@opengeni/db";
+import { getToolActionReview, getToolReviewDetailsPage } from "@opengeni/db";
+import {
+  AcknowledgeStreamRequest,
+  ApplySessionGoalRevisionRequest,
+  ListSessionGoalRevisionsQuery,
+  RejectSessionGoalRevisionRequest,
+  RollbackSessionGoalRevisionRequest,
+  ActivateCodexRealtimeConnectionRequest,
+  AttachViewerRequest,
+  BeginSessionRealtimeRequest,
+  ClearSessionContextRequest,
+  CodexRealtimeWebrtcRequest,
+  GatewayRealtimeConnectRequest,
+  ClientSessionEvent,
+  CompactSessionContextRequest,
+  CreateSessionRequest as CreateSessionRequest2,
+  DeleteSessionQueueItemRequest,
+  EditSessionQueueItemRequest,
+  EndSessionRealtimeRequest,
+  FsDeleteRequest,
+  FsListBatchRequest,
+  FsListRequest,
+  FsMkdirRequest,
+  FsMoveRequest,
+  FsReadRequest,
+  FsWriteRequest,
+  ForkSessionRequest,
+  HumanInputRequestStatus,
+  GitDiffRequest,
+  GitReadBatchRequest,
+  GitLogRequest,
+  GitShowRequest,
+  GitStatusRequest,
+  MoveSessionQueueItemRequest,
+  PtyCloseRequest,
+  PtyOpenRequest,
+  PtyResizeRequest,
+  PtyWriteRequest,
+  PublishSandboxFileArtifactRequest,
+  RenewSessionRealtimeRequest,
+  SyncSessionRealtimeLedgerRequest,
+  SessionControlRequest,
+  SessionRetryRequest,
+  SESSION_EVENT_RAW_DELTA_TYPES as SESSION_EVENT_RAW_DELTA_TYPES2,
+  SessionEventPayloadMode as SessionEventPayloadMode2,
+  SessionEventReadDirection as SessionEventReadDirection2,
+  SessionEventReadMode as SessionEventReadMode2,
+  SessionEventLatestClass as SessionEventLatestClass2,
+  SessionEventResultMode as SessionEventResultMode2,
+  SessionScopeSubjectId,
+  SessionEventSemanticClass as SessionEventSemanticClass2,
+  SessionEventType as SessionEventType2,
+  SessionMcpServerId,
+  SaveNewSessionDraftRequest,
+  compactSessionEventResult as compactSessionEventResult3,
+  sessionEventLatestClassToSemanticClass as sessionEventLatestClassToSemanticClass2,
+  SaveComposerDraftRequest,
+  SubmitComposerDraftRequest,
+  SteerSessionQueueItemRequest,
+  SteerSessionMessageRequest,
+  TerminalExecRequest,
+  UpdateSessionChannelRequest,
+  UpdateSessionAttentionRequest,
+  UpdateSessionArchiveRequest,
+  UpdateSessionPinRequest,
+  UpdateSessionGoalRequest,
+  UpdateSessionMcpApprovalPolicyRequest,
+  UpdateSessionRequest,
+  UpdateSessionVariableSetsRequest,
+  UpdateSessionVisibilityRequest,
+  UpdateSessionToolPolicyRequest,
+  UpdateSessionAgentRequest,
+  AgentConfigError as AgentConfigError2,
+  ViewerHeartbeatRequest,
+  WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
+  WORK_CLAIM_CANONICAL_KEY_MAX_BYTES as WORK_CLAIM_CANONICAL_KEY_MAX_BYTES2,
+  WORK_CLAIM_DISCOVERY_LIMIT as WORK_CLAIM_DISCOVERY_LIMIT2,
+  WORK_CLAIM_NAMESPACE_MAX_BYTES as WORK_CLAIM_NAMESPACE_MAX_BYTES2,
+  WORK_DISCOVERY_QUERY_MAX_CHARS as WORK_DISCOVERY_QUERY_MAX_CHARS2,
+  WORK_DISCOVERY_RECENT_HOURS_MAX as WORK_DISCOVERY_RECENT_HOURS_MAX2,
+  WorkClaimSubjectFilter as WorkClaimSubjectFilterSchema,
+  WorkClaimSubjectType as WorkClaimSubjectType2,
+  normalizeWorkClaimCanonicalKey,
+  normalizeWorkClaimNamespace,
+  workspaceControlUtf8Bytes
+} from "@opengeni/contracts";
+import { streamTokenDegraded } from "@opengeni/config";
+import {
+  recordAuditEvent as recordAuditEvent13,
+  acceptSessionApprovalDecision as acceptSessionApprovalDecision2,
+  acceptSessionHumanInputResponse as acceptSessionHumanInputResponse2,
+  clearSessionGoal,
+  clearSessionContext,
+  getOpenPtySession,
+  getEnrollment as getEnrollment2,
+  getLiveEnrollmentConnection as getLiveEnrollmentConnection7,
+  getRetainedProcess,
+  getSandbox as getSandbox4,
+  getSession as getSession9,
+  readActiveSandbox as readActiveSandbox3,
+  deleteSessionTreeIfQuiescent,
+  getSessionEvent,
+  getSessionForSubject as getSessionForSubject2,
+  getSessionGoal as getSessionGoal2,
+  getLatestSessionModelContext,
+  getSessionHumanInputRequest,
+  getSessionGoalWithContinuation,
+  getSessionGoalRevision,
+  getSessionQueueSnapshot as getSessionQueueSnapshot2,
+  getStreamAcknowledgment,
+  insertPtySession,
+  listSessionEventPage as listSessionEventPage3,
+  listSessionHumanInputRequests,
+  listSessionGoalRevisionPage,
+  listSessionGoalRevisions,
+  rejectSessionGoalRevisionWithEvent,
+  listSessionIdsInGroup,
+  listSessionDiscoverySummaries as listSessionDiscoverySummaries2,
+  listSessionDiscoveryAncestorPaths,
+  listSessionsForSubject,
+  listSessionEntriesForSubject,
+  getLatestStartedSessionTurn,
+  listSessionTurns,
+  projectEffectiveControlForRelatedAccess as projectEffectiveControlForRelatedAccess2,
+  projectSessionForRelatedAccess as projectSessionForRelatedAccess2,
+  recordStreamAcknowledgment,
+  requestSessionCompaction,
+  switchSessionCodexAccount,
+  setSessionChannel as setSessionChannel2,
+  updateSessionVariableSets,
+  ChannelNotFoundError,
+  setSessionAttention,
+  setSessionArchive,
+  setSessionPin,
+  SessionAttentionVersionConflictError,
+  SessionArchiveVersionConflictError,
+  SessionPinVersionConflictError,
+  SessionPinAccessError,
+  SessionListAccessError,
+  SessionListCursorError,
+  SessionListCursorExpiredError,
+  decodeSessionListCursor,
+  revokeViewer,
+  setSessionGoalStatusWithEvent as setSessionGoalStatusWithEvent2,
+  upsertSessionGoalWithEvent as upsertSessionGoalWithEvent2,
+  updatePtySessionActivity,
+  QueueCommandConflictError,
+  beginSessionRealtimeInTransaction,
+  activateSessionRealtimeConnectionInTransaction,
+  claimSessionRealtimeConnectionInTransaction,
+  completeSessionRealtimeConnectionInTransaction,
+  endSessionRealtimeInTransaction,
+  failSessionRealtimeConnectionInTransaction,
+  NewSessionDraftConflictError,
+  SessionCommandIdempotencyError,
+  SessionControlConflictError,
+  SessionRealtimeConflictError,
+  SessionToolPolicyVersionConflictError,
+  SessionContextBusyError,
+  SessionVariableSetSelectionUnavailableError,
+  SessionCreateConnectionSelectionUnavailableError as SessionCreateConnectionSelectionUnavailableError2,
+  workspaceControlRequestLockTimeoutMs,
+  SessionTenancyAccessError,
+  SessionTenancyConflictError,
+  SessionTenancyInvalidRequestError,
+  SessionTenancyNotActivatedError,
+  HumanInputResponseValidationError as HumanInputResponseValidationError2,
+  SkillHumanResponseError,
+  latestWorkspaceCapture,
+  sessionLatestWorkspaceCapture,
+  renewSessionRealtimeInTransaction,
+  syncSessionRealtimeLedgerInTransaction,
+  withWorkspaceSessionActivityRls,
+  withWorkspaceRls,
+  workspaceCaptureAtRevision
+} from "@opengeni/db";
+import {
+  backgroundCommandActivityForSessions,
+  listSessionBackgroundCommands,
+  requestSessionBackgroundCommandCancellation
+} from "@opengeni/db/session-background-commands";
+import {
+  appendAndPublishEvents as appendAndPublishEvents3,
+  boundSessionEventHttpPage,
+  coalesceSessionEventDeltasWithCoverage as coalesceSessionEventDeltasWithCoverage2,
+  publishDurableSessionEvents as publishDurableSessionEvents3
+} from "@opengeni/events";
+
 // src/gateway-realtime.ts
+import {
+  VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
+  VERCEL_AI_GATEWAY_BASE_URL,
+  resolveAiGatewayRealtimeModel
+} from "@opengeni/config";
+import {
+  getActiveSessionHistoryItems as getActiveSessionHistoryItems3,
+  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries3,
+  loadWorkspaceVercelAiGatewayApiKey
+} from "@opengeni/db";
 var GatewayRealtimeBrokerError = class extends Error {
   constructor(code, message, providerStatus = null) {
     super(message);
@@ -100780,8 +100918,8 @@ async function createGatewayRealtimeConnectionSecret(input) {
     );
   }
   const [history, continuity, minted] = await Promise.all([
-    getActiveSessionHistoryItems2(input.db, input.workspaceId, input.sessionId),
-    getSessionRealtimeContinuityEntries2(input.db, input.workspaceId, input.sessionId),
+    getActiveSessionHistoryItems3(input.db, input.workspaceId, input.sessionId),
+    getSessionRealtimeContinuityEntries3(input.db, input.workspaceId, input.sessionId),
     mintGatewayClientSecret({
       apiKey,
       upstreamModelId: resolved.upstreamModelId,
@@ -100844,8 +100982,8 @@ async function mintGatewayClientSecret(input) {
 // src/xai-realtime.ts
 import { SUPERGROK_REALTIME_MODEL_ID } from "@opengeni/config";
 import {
-  getActiveSessionHistoryItems as getActiveSessionHistoryItems3,
-  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries3,
+  getActiveSessionHistoryItems as getActiveSessionHistoryItems4,
+  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries4,
   getXaiSessionAccountPin,
   resolveXaiProviderAccountAuthoritySnapshotForAcceptance as resolveXaiProviderAccountAuthoritySnapshotForAcceptance3,
   setXaiSessionAccountPin
@@ -101054,8 +101192,8 @@ async function createXaiRealtimeConnectionSecret(input) {
     );
   }
   const [history, continuity, minted] = await Promise.all([
-    getActiveSessionHistoryItems3(input.db, input.workspaceId, input.sessionId),
-    getSessionRealtimeContinuityEntries3(input.db, input.workspaceId, input.sessionId),
+    getActiveSessionHistoryItems4(input.db, input.workspaceId, input.sessionId),
+    getSessionRealtimeContinuityEntries4(input.db, input.workspaceId, input.sessionId),
     mintXaiClientSecret({
       auth,
       fetchImpl: input.fetchImpl ?? fetch
@@ -101495,6 +101633,46 @@ function registerSessionRoutes(app, deps) {
     observability: deps.observability
   };
   const workspaceCaptureManifestCache = new WorkspaceCaptureManifestCache();
+  const realtimeVoiceBilling = createRealtimeVoiceBilling({ db, settings });
+  const realtimeVoiceRefusalResponse = (c, error) => {
+    if (error instanceof TranscriptionBillingRefusedError) {
+      return transcriptionBillingRefusal(c, error);
+    }
+    if (error instanceof RealtimeVoiceUnavailableError) {
+      return c.json(
+        {
+          error: {
+            status: 409,
+            code: "realtime_voice_unavailable",
+            message: error.message,
+            retryable: false,
+            details: { reason: error.code }
+          }
+        },
+        409
+      );
+    }
+    return null;
+  };
+  const settleRealtimeVoice = async (input) => {
+    try {
+      return await realtimeVoiceBilling.settle({
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        realtimeId: input.realtimeId,
+        callerSubjectId: input.grant.subjectId,
+        attribution: input.attribution
+      });
+    } catch (error) {
+      console.error("realtime voice settlement failed", {
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        realtimeId: input.realtimeId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return null;
+    }
+  };
   const withSiteCommandOrigin = (c, workspaceId, run) => withOptionalSiteCommandOrigin(
     db,
     workspaceId,
@@ -102298,6 +102476,18 @@ function registerSessionRoutes(app, deps) {
         message: "invalid session realtime request"
       });
     }
+    try {
+      await realtimeVoiceBilling.admit({
+        accountId: grant.accountId,
+        workspaceId,
+        model: parsed.data.model,
+        attribution: creditDebitAttributionForGrant(grant)
+      });
+    } catch (error) {
+      const refused = realtimeVoiceRefusalResponse(c, error);
+      if (refused) return refused;
+      throw error;
+    }
     try {
       const result = await withWorkspaceSessionActivityRls(db, workspaceId, async (scopedDb) => {
         const accounts = await freezeSessionRealtimeConnectionAccounts({
@@ -102342,6 +102532,14 @@ function registerSessionRoutes(app, deps) {
         });
       }
       try {
+        const settlement = await settleRealtimeVoice({
+          grant,
+          attribution: creditDebitAttributionForGrant(grant),
+          workspaceId,
+          sessionId,
+          realtimeId
+        });
+        const stop = settlement?.stop ?? null;
         const result = await withWorkspaceSessionActivityRls(
           db,
           workspaceId,
@@ -102350,12 +102548,17 @@ function registerSessionRoutes(app, deps) {
             sessionId,
             realtimeId,
             ownerSubjectId: grant.subjectId,
-            ...parsed.data
+            ...parsed.data,
+            extendLease: stop === null
           })
         );
         await publishRealtimeMutation(grant.accountId, workspaceId, sessionId, result);
         c.header("cache-control", "private, no-store");
-        return c.json({ mode: result.mode, replay: result.replay });
+        return c.json({
+          mode: result.mode,
+          replay: result.replay,
+          ...stop && result.mode.state === "active" ? { stop: { code: stop.code, message: stop.message } } : {}
+        });
       } catch (error) {
         throw sessionRealtimeHttpError(error);
       }
@@ -102390,6 +102593,13 @@ function registerSessionRoutes(app, deps) {
         })
       );
       await publishRealtimeMutation(grant.accountId, workspaceId, sessionId, result);
+      await settleRealtimeVoice({
+        grant,
+        attribution: creditDebitAttributionForGrant(grant),
+        workspaceId,
+        sessionId,
+        realtimeId
+      });
       c.header("cache-control", "private, no-store");
       return c.json({ mode: result.mode, replay: result.replay });
     } catch (error) {
@@ -102425,21 +102635,31 @@ function registerSessionRoutes(app, deps) {
       const claim = await withWorkspaceRls(
         db,
         workspaceId,
-        async (scopedDb) => scopedDb.transaction(
-          async (tx) => claimSessionRealtimeConnectionInTransaction(tx, {
-            workspaceId,
-            sessionId,
-            realtimeId,
-            operationId,
-            ownerSubjectId: grant.subjectId,
-            browserInstanceId,
-            ownerKey,
-            expectedVersion,
-            expectedConnectionEpoch,
-            rotate,
-            promotionMode: browserActivation === "required" ? "staged" : "legacy"
-          })
-        )
+        async (scopedDb) => scopedDb.transaction(async (tx) => {
+          const claimed = await claimSessionRealtimeConnectionInTransaction(
+            tx,
+            {
+              workspaceId,
+              sessionId,
+              realtimeId,
+              operationId,
+              ownerSubjectId: grant.subjectId,
+              browserInstanceId,
+              ownerKey,
+              expectedVersion,
+              expectedConnectionEpoch,
+              rotate,
+              promotionMode: browserActivation === "required" ? "staged" : "legacy"
+            }
+          );
+          if (claimed.mode.model !== "gpt-live-1-boulder-alpha" && claimed.mode.model !== AZURE_LIVE_MODEL_ID) {
+            throw new CodexRealtimeBrokerError(
+              "invalid_request",
+              "This voice model does not use WebRTC negotiation"
+            );
+          }
+          return claimed;
+        })
       );
       if (claim.replay) {
         if (claim.connection.state !== "ready" && claim.connection.state !== "active" || !claim.connection.sdpAnswer) {
@@ -102470,7 +102690,7 @@ function registerSessionRoutes(app, deps) {
         return c.json({
           sdp: claim.connection.sdpAnswer,
           version: "v3",
-          model: "gpt-live-1-boulder-alpha",
+          model: claim.mode.model,
           connectionId: claim.connection.id,
           connectionEpoch: claim.connection.connectionEpoch,
           startupFenceSequence: claim.connection.startupFenceSequence,
@@ -102478,13 +102698,34 @@ function registerSessionRoutes(app, deps) {
           replay: true
         });
       }
-      const broker = buildSessionCodexRealtimeBroker(
-        db,
-        settings,
-        workspaceId,
-        sessionId,
-        deps.codexFetch
-      );
+      try {
+        await realtimeVoiceBilling.admit({
+          accountId: grant.accountId,
+          workspaceId,
+          model: claim.mode.model,
+          attribution: creditDebitAttributionForGrant(grant)
+        });
+      } catch (error) {
+        const refused = realtimeVoiceRefusalResponse(c, error);
+        if (!refused) throw error;
+        await withWorkspaceRls(
+          db,
+          workspaceId,
+          async (scopedDb) => scopedDb.transaction(
+            async (tx) => failSessionRealtimeConnectionInTransaction(tx, {
+              workspaceId,
+              sessionId,
+              realtimeId,
+              connectionId: claim.connection.id,
+              operationId,
+              connectionEpoch: claim.connection.connectionEpoch,
+              failureCode: "billing_refused"
+            })
+          )
+        ).catch(() => void 0);
+        return refused;
+      }
+      const broker = (claim.mode.model === AZURE_LIVE_MODEL_ID ? buildSessionAzureLiveBroker : buildSessionCodexRealtimeBroker)(db, settings, workspaceId, sessionId, deps.codexFetch);
       try {
         const answer = await broker({
           request: providerRequest,
@@ -102524,6 +102765,13 @@ function registerSessionRoutes(app, deps) {
             })
           )
         ) : null;
+        await settleRealtimeVoice({
+          grant,
+          attribution: creditDebitAttributionForGrant(grant),
+          workspaceId,
+          sessionId,
+          realtimeId
+        });
         return c.json({
           ...answer,
           connectionId: completed.connection.id,
@@ -102626,6 +102874,12 @@ function registerSessionRoutes(app, deps) {
           "Realtime Gateway tokens are single-use; reconnect with a new operation"
         );
       }
+      await realtimeVoiceBilling.admit({
+        accountId: grant.accountId,
+        workspaceId,
+        model: claim.mode.model,
+        attribution: creditDebitAttributionForGrant(grant)
+      });
       const secret = await createGatewayRealtimeConnectionSecret({
         db,
         settings,
@@ -102651,6 +102905,13 @@ function registerSessionRoutes(app, deps) {
         )
       );
       connectionCompleted = true;
+      await settleRealtimeVoice({
+        grant,
+        attribution: creditDebitAttributionForGrant(grant),
+        workspaceId,
+        sessionId,
+        realtimeId
+      });
       return c.json({
         ...secret,
         connectionId: completed.connection.id,
@@ -102673,11 +102934,13 @@ function registerSessionRoutes(app, deps) {
               connectionId: claimed.connection.id,
               operationId,
               connectionEpoch: claimed.connection.connectionEpoch,
-              failureCode: error instanceof GatewayRealtimeBrokerError ? error.code : "gateway_error"
+              failureCode: error instanceof GatewayRealtimeBrokerError ? error.code : error instanceof TranscriptionBillingRefusedError || error instanceof RealtimeVoiceUnavailableError ? "billing_refused" : "gateway_error"
             })
           )
         ).catch(() => void 0);
       }
+      const refused = realtimeVoiceRefusalResponse(c, error);
+      if (refused) return refused;
       if (error instanceof SessionRealtimeConflictError) throw sessionRealtimeHttpError(error);
       if (!(error instanceof GatewayRealtimeBrokerError)) throw error;
       const status = error.code === "credential_unavailable" ? 409 : 502;
@@ -106798,6 +107061,11 @@ function socialHttpException(error) {
 }
 
 // src/routes/workspaces.ts
+import {
+  createRealtimeVoiceBilling as createRealtimeVoiceBilling2,
+  deploymentRealtimeVoice,
+  realtimeVoiceOfferProblem
+} from "@opengeni/core";
 import { withDirectModelProviders } from "@opengeni/config";
 import { listConnectionsMetadata as listConnectionsMetadata6 } from "@opengeni/db";
 import {
@@ -106959,13 +107227,13 @@ function recordWorkspaceDeleteObservation(observability, identity2, observation)
       labels: { outcome: observation.outcome }
     });
   }
-  for (const [kind, count] of Object.entries(observation.inventory ?? {})) {
+  for (const [kind, count2] of Object.entries(observation.inventory ?? {})) {
     observability.observeHistogram({
       name: "opengeni_workspace_delete_inventory_rows",
       help: "Rows or live owners observed by workspace deletion preflight inventory class.",
       labels: { kind },
       buckets: INVENTORY_BUCKETS,
-      value: Math.max(0, Math.floor(count ?? 0))
+      value: Math.max(0, Math.floor(count2 ?? 0))
     });
   }
   observability.info("Workspace deletion phase", {
@@ -107735,16 +108003,36 @@ function registerWorkspaceRoutes(app, deps) {
       return credentialReady ? { available: true, unavailableReason: null } : { available: false, unavailableReason: credentialReason };
     };
     const gatewayModels = Object.values(AI_GATEWAY_REALTIME_MODELS);
-    const models = [
-      ...gatewayModels.map((model, index) => ({
+    const managedCandidates = [
+      {
+        id: AZURE_LIVE_MODEL_ID,
+        label: "GPT Live 1",
+        description: "Realtime voice with session delegation"
+      },
+      ...gatewayModels.map((model) => ({
         id: model.managedModelId,
         label: model.label,
+        description: model.description
+      }))
+    ].filter((model) => {
+      const voice = deploymentRealtimeVoice(deps.settings, model.id);
+      return voice !== null && realtimeVoiceOfferProblem(deps.settings, voice) === null;
+    }).filter(
+      (model, _index, offered) => offered.some((candidate) => candidate.id === AZURE_LIVE_MODEL_ID) ? model.id === AZURE_LIVE_MODEL_ID : true
+    );
+    const hasCredits = managedCandidates.length > 0 && await createRealtimeVoiceBilling2({
+      db: deps.db,
+      settings: deps.settings
+    }).hasSpendableCredits(grant.accountId);
+    const models = [
+      ...managedCandidates.map((model, index) => ({
+        ...model,
         provider: "OpenGeni",
-        description: model.description,
-        ...availability(
-          Boolean(deps.settings.vercelAiGatewayApiKey),
-          "Opengeni Gateway voice is not configured"
-        ),
+        ...hasCredits ? { available: true, unavailableReason: null, unavailableCode: null } : {
+          available: false,
+          unavailableReason: "Add Opengeni credits to use live voice",
+          unavailableCode: "insufficient_credits"
+        },
         recommended: index === 0
       })),
       {
@@ -111549,7 +111837,11 @@ import {
   resolveWorkspaceVoiceInputEnabled as resolveWorkspaceVoiceInputEnabled2,
   WorkspaceVoiceInputSettings as WorkspaceVoiceInputSettings2
 } from "@opengeni/contracts";
-import { requireAccessGrant as requireAccessGrant50, TranscriptionServiceError as TranscriptionServiceError2 } from "@opengeni/core";
+import {
+  requireAccessGrant as requireAccessGrant50,
+  TranscriptionBillingRefusedError as TranscriptionBillingRefusedError3,
+  TranscriptionServiceError as TranscriptionServiceError2
+} from "@opengeni/core";
 import { getWorkspace as getWorkspace10 } from "@opengeni/db";
 
 // src/routes/transcription-recordings.ts
@@ -111567,6 +111859,7 @@ import {
   normalizeMimeType,
   requireAccessGrant as requireAccessGrant49,
   TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS,
+  TranscriptionBillingRefusedError as TranscriptionBillingRefusedError2,
   TranscriptionServiceError
 } from "@opengeni/core";
 import { retryWhileMissing as retryWhileMissing7 } from "@opengeni/storage";
@@ -111598,6 +111891,38 @@ import {
 } from "@opengeni/db";
 import { getWorkspace as getWorkspace9 } from "@opengeni/db";
 
+// src/transcription/wav-duration.ts
+function wavDurationSeconds(bytes) {
+  if (bytes.byteLength < 12) return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (ascii2(bytes, 0) !== "RIFF" || ascii2(bytes, 8) !== "WAVE") return null;
+  let offset = 12;
+  let byteRate = null;
+  while (offset + 8 <= bytes.byteLength) {
+    const id = ascii2(bytes, offset);
+    const size = view.getUint32(offset + 4, true);
+    const body3 = offset + 8;
+    if (id === "fmt " && body3 + 12 <= bytes.byteLength) {
+      byteRate = view.getUint32(body3 + 8, true);
+    } else if (id === "data") {
+      if (!byteRate) return null;
+      const available = bytes.byteLength - body3;
+      const dataBytes = size === 0 || size === 4294967295 ? available : Math.min(size, available);
+      return dataBytes / byteRate;
+    }
+    offset = body3 + size + size % 2;
+  }
+  return null;
+}
+function ascii2(bytes, offset) {
+  return String.fromCharCode(
+    bytes[offset] ?? 0,
+    bytes[offset + 1] ?? 0,
+    bytes[offset + 2] ?? 0,
+    bytes[offset + 3] ?? 0
+  );
+}
+
 // src/transcription/segmenter.ts
 import { spawn } from "child_process";
 import { createWriteStream } from "fs";
@@ -111629,7 +111954,7 @@ function createFfmpegTranscriptionSegmenter(input) {
           true
         );
       }
-      if (!Number.isSafeInteger(request.providerSegmentSeconds) || request.providerSegmentSeconds <= 0 || !Number.isSafeInteger(request.totalDurationMilliseconds) || request.totalDurationMilliseconds <= 0) {
+      if (!Number.isSafeInteger(request.providerSegmentSeconds) || request.providerSegmentSeconds <= 0 || !Number.isSafeInteger(request.totalDurationMilliseconds) || request.totalDurationMilliseconds <= 0 || request.maxDecodeSeconds !== void 0 && (!Number.isSafeInteger(request.maxDecodeSeconds) || request.maxDecodeSeconds <= 0)) {
         throw new TranscriptionSegmenterError(
           "Audio segmentation bounds are invalid",
           "invalid_audio",
@@ -111661,6 +111986,8 @@ function createFfmpegTranscriptionSegmenter(input) {
             "-y",
             "-i",
             inputPath,
+            // Output-side ceiling: audio past it is never decoded or written.
+            ...request.maxDecodeSeconds !== void 0 ? ["-t", String(request.maxDecodeSeconds)] : [],
             "-map",
             "0:a:0",
             "-vn",
@@ -112123,7 +112450,9 @@ function registerResumableTranscriptionRoutes(app, deps) {
         const service = deps.transcription;
         if (!deps.objectStorage || !service || !await service.available({
           workspaceId: authority.workspaceId,
-          subjectId: authority.subjectId
+          subjectId: authority.subjectId,
+          preferredProvider: authority.voiceInput?.preferredProvider,
+          fallbackEnabled: authority.voiceInput?.fallbackEnabled
         })) {
           return c.json({ code: "unavailable" }, 503);
         }
@@ -112166,6 +112495,31 @@ function registerResumableTranscriptionRoutes(app, deps) {
             false
           );
         }
+        const segmentProviderId = claim.segment.providerId && claim.segment.providerId !== "host" ? claim.segment.providerId : null;
+        if (segmentProviderId && service.admit) {
+          try {
+            await service.admit({
+              providerId: segmentProviderId,
+              accountId: authority.accountId,
+              workspaceId: authority.workspaceId,
+              attribution: authority.attribution
+            });
+          } catch (error) {
+            if (!(error instanceof TranscriptionBillingRefusedError2)) throw error;
+            await failTranscriptionRecordingSegment(deps.db, {
+              workspaceId: authority.workspaceId,
+              subjectId: authority.subjectId,
+              recordingId: uuidParam3(c, "recordingId"),
+              segmentNumber,
+              attemptId,
+              fallbackProviderId: null,
+              // The real refusal, so a reloaded recording still explains it.
+              errorCode: error.code,
+              retryable: true
+            }).catch(() => null);
+            return transcriptionBillingRefusal(c, error);
+          }
+        }
         const providerStartedAt = /* @__PURE__ */ new Date();
         const providerDeadlineAt = new Date(
           providerStartedAt.getTime() + TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS
@@ -112188,7 +112542,17 @@ function registerResumableTranscriptionRoutes(app, deps) {
           durationSeconds: claim.segment.durationMilliseconds / 1e3,
           requestId: attemptId,
           providerDeadlineAt,
-          ...claim.segment.providerId && claim.segment.providerId !== "host" ? { providerId: claim.segment.providerId } : {}
+          deferBillingSettlement: true,
+          ...segmentProviderId ? { providerId: segmentProviderId } : {},
+          billing: {
+            // One settlement per prepared segment of this exact recording,
+            // however many provider attempts it takes. The recording id is
+            // client-chosen, so the unit id also binds its server creation
+            // time and the server-produced segment bytes.
+            sourceId: `${claim.recording.recording.id}:${Date.parse(claim.recording.recording.createdAt)}:${segmentNumber}:${claim.segment.sha256}`,
+            attribution: authority.attribution,
+            trustedDurationSeconds: wavDurationSeconds(stored.bytes) ?? void 0
+          }
         });
         const completed = await completeTranscriptionRecordingSegment(deps.db, {
           workspaceId: authority.workspaceId,
@@ -112200,6 +112564,7 @@ function registerResumableTranscriptionRoutes(app, deps) {
           languages: result.languages,
           providerId: claim.segment.providerId ?? result.providerId
         });
+        await result.settleBilling?.().catch(() => void 0);
         return c.json(await cleanupTerminalObjects(deps, authority, completed));
       } catch (error) {
         if (authority && attemptId && segmentNumber !== null) {
@@ -112223,6 +112588,9 @@ function registerResumableTranscriptionRoutes(app, deps) {
             errorCode: failure2.code,
             retryable: failure2.retryable
           }).catch(() => null);
+          if (error instanceof TranscriptionBillingRefusedError2) {
+            return transcriptionBillingRefusal(c, error);
+          }
           if (persisted) return c.json(persisted);
         }
         return routeError2(c, error);
@@ -112269,7 +112637,8 @@ async function requireRecordingAuthority(c, deps, requirePolicy) {
     voiceInput: WorkspaceVoiceInputSettings.safeParse(workspace?.settings.voiceInput).data,
     accountId: grant.accountId,
     workspaceId,
-    subjectId: grant.subjectId
+    subjectId: grant.subjectId,
+    attribution: creditDebitAttributionForGrant(grant)
   };
 }
 async function resumableAvailable(deps, workspaceId) {
@@ -112340,6 +112709,9 @@ function processingFailure(error) {
   if (error instanceof TranscriptionSegmenterError) {
     return { code: error.code, retryable: error.retryable };
   }
+  if (error instanceof TranscriptionBillingRefusedError2) {
+    return { code: error.code, retryable: true };
+  }
   if (error instanceof TranscriptionServiceError) {
     return {
       code: error.code,
@@ -112355,6 +112727,9 @@ function routeError2(c, error) {
   if (error instanceof TranscriptionRecordingNotFoundError) {
     return c.json({ code: "not_found" }, 404);
   }
+  if (error instanceof TranscriptionBillingRefusedError2) {
+    return transcriptionBillingRefusal(c, error);
+  }
   if (error instanceof TranscriptionRecordingConflictError) {
     return c.json({ code: "conflict" }, 409);
   }
@@ -112478,12 +112853,21 @@ function registerTranscriptionRoutes(app, deps) {
     }
     const preferences = WorkspaceVoiceInputSettings2.safeParse(workspace.settings.voiceInput).data;
     const service = deps.transcription;
-    if (!service || !await service.available({ workspaceId, subjectId: grant.subjectId })) {
+    if (!service || !await service.available({
+      workspaceId,
+      subjectId: grant.subjectId,
+      preferredProvider: preferences?.preferredProvider,
+      fallbackEnabled: preferences?.fallbackEnabled
+    })) {
       return c.json({ code: "unavailable" }, 503);
     }
     try {
       const body3 = await audioRequest(c.req.raw, service.limits().maxSizeBytes);
       const result = await service.transcribe({
+        billing: {
+          sourceId: crypto.randomUUID(),
+          attribution: creditDebitAttributionForGrant(grant)
+        },
         preferredProvider: preferences?.preferredProvider,
         fallbackEnabled: preferences?.fallbackEnabled,
         workspaceId,
@@ -112504,6 +112888,9 @@ function registerTranscriptionRoutes(app, deps) {
       if (error instanceof TranscriptionServiceError2) {
         return c.json({ code: error.code }, error.status);
       }
+      if (error instanceof TranscriptionBillingRefusedError3) {
+        return transcriptionBillingRefusal(c, error);
+      }
       if (isAbort3(error)) return c.json({ code: "cancelled" }, 499);
       return c.json({ code: "unknown" }, 500);
     }
@@ -112609,17 +112996,23 @@ function isAbort3(error) {
 
 // src/routes/session-artifact-associations.ts
 import {
-  requireAccessGrant as requireAccessGrant51,
+  fileOwnerContextForAccess as fileOwnerContextForAccess6,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization37,
   requirePermission as requirePermission12,
   requireSessionAuthorization as requireSessionAuthorization15,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError15,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError13
 } from "@opengeni/core";
 import {
+  getGeneratedImageArtifact as getGeneratedImageArtifact3,
+  getGeneratedVideoArtifact as getGeneratedVideoArtifact2,
+  getRetainedFileArtifact as getRetainedFileArtifact2,
   hasEditableArtifactSessionLink as hasEditableArtifactSessionLink2,
   hasWorkspaceArtifactSessionLink,
+  listArtifactCatalogCandidates as listArtifactCatalogCandidates2,
   transactionallyAuthorizeEditableArtifactActor,
-  withRlsContext as withRlsContext3
+  withRlsContext as withRlsContext3,
+  withSessionRlsActorContext as withSessionRlsActorContext10
 } from "@opengeni/db";
 import { HTTPException as HTTPException107 } from "hono/http-exception";
 import { z as z55 } from "zod";
@@ -112630,12 +113023,18 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/sessions/:sessionId/artifact-associations/:artifactId",
     async (context) => {
       const workspaceId = context.req.param("workspaceId");
-      const grant = await requireAccessGrant51(context, deps, workspaceId, "artifacts:read");
-      requirePermission12(grant, "sessions:read");
       const sessionId = context.req.param("sessionId");
       const artifactId2 = context.req.param("artifactId");
-      const kind = EditableArtifactId.safeParse(artifactId2).success ? "editable" : SessionId2.safeParse(artifactId2).success ? "site" : null;
       const requestedKind = context.req.query("kind");
+      const kind = EditableArtifactId.safeParse(artifactId2).success ? "editable" : SessionId2.safeParse(artifactId2).success ? requestedKind === "retained" ? "retained" : "site" : null;
+      const authorization = await requireAccessGrantAuthorization37(
+        context,
+        deps,
+        workspaceId,
+        kind === "retained" ? "files:read" : "artifacts:read"
+      );
+      const grant = authorization.grant;
+      requirePermission12(grant, "sessions:read");
       if (!SessionId2.safeParse(sessionId).success || !kind || requestedKind !== void 0 && requestedKind !== kind) {
         throw new HTTPException107(404, { message: "Artifact association not found" });
       }
@@ -112647,7 +113046,18 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
             surface: "http"
           });
           const scope = { accountId: grant.accountId, workspaceId };
-          const linked = kind === "editable" ? await hasEditableArtifactSessionLink2(deps.db, scope, sessionId, artifactId2) : await hasWorkspaceArtifactSessionLink(deps.db, workspaceId, sessionId, artifactId2);
+          const linked = kind === "editable" ? await hasEditableArtifactSessionLink2(deps.db, scope, sessionId, artifactId2) : kind === "retained" ? await hasRetainedArtifactSessionLink(
+            deps,
+            authorization,
+            workspaceId,
+            sessionId,
+            artifactId2.toLowerCase()
+          ) : await hasWorkspaceArtifactSessionLink(
+            deps.db,
+            workspaceId,
+            sessionId,
+            artifactId2
+          );
           if (!linked) throw new HTTPException107(404, { message: "Artifact association not found" });
           if (kind === "editable") {
             const decision = await withRlsContext3(
@@ -112679,6 +113089,38 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
     }
   );
 }
+async function hasRetainedArtifactSessionLink(deps, authorization, workspaceId, sessionId, artifactId2) {
+  const image = await getGeneratedImageArtifact3(deps.db, workspaceId, artifactId2);
+  if (image) return image.sessionId === sessionId;
+  const video = await getGeneratedVideoArtifact2(deps.db, workspaceId, artifactId2);
+  if (video) return !video.artifact.deletedAt && video.artifact.sessionId === sessionId;
+  const file = await getRetainedFileArtifact2(deps.db, workspaceId, artifactId2);
+  if (!file) return false;
+  const grant = authorization.grant;
+  const actor = await fileOwnerContextForAccess6(deps, authorization, "files:read");
+  const candidates = await withSessionRlsActorContext10(
+    actor,
+    () => listArtifactCatalogCandidates2(
+      deps.db,
+      { accountId: grant.accountId, workspaceId },
+      {
+        query: {
+          sourceSessionId: sessionId,
+          q: file.file.filename.slice(0, 200),
+          sort: "newest",
+          status: "active",
+          limit: 100
+        },
+        kinds: ["file", "image"],
+        snapshotAt: (/* @__PURE__ */ new Date()).toISOString(),
+        limit: 201
+      }
+    )
+  );
+  return candidates.some(
+    (candidate) => candidate.origin === "sandbox_file" && candidate.id === artifactId2
+  );
+}
 
 // src/routes/video-generation.ts
 import {
@@ -112689,7 +113131,7 @@ import {
 } from "@opengeni/contracts";
 import {
   getVideoGenerationOperationSummary,
-  withSessionRlsActorContext as withSessionRlsActorContext10,
+  withSessionRlsActorContext as withSessionRlsActorContext11,
   getWorkspaceVercelAiGatewayConnectionMetadata,
   getWorkspaceVideoGenerationPolicy,
   updateWorkspaceVideoGenerationPolicy,
@@ -112697,9 +113139,9 @@ import {
   workspaceXaiSubscriptionActive as workspaceXaiSubscriptionActive2
 } from "@opengeni/db";
 import {
-  requireAccessGrant as requireAccessGrant52,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization37,
-  fileOwnerContextForAccess as fileOwnerContextForAccess6,
+  requireAccessGrant as requireAccessGrant51,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization38,
+  fileOwnerContextForAccess as fileOwnerContextForAccess7,
   requireWorkspaceSettingsGrant as requireWorkspaceSettingsGrant6,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
@@ -112709,7 +113151,7 @@ import { HTTPException as HTTPException108 } from "hono/http-exception";
 function registerVideoGenerationRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/video-generation", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant51(c, deps, workspaceId, "workspace:read");
     const [policy, connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVideoGenerationPolicy(deps.db, workspaceId),
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
@@ -112783,9 +113225,9 @@ function registerVideoGenerationRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/video-generation/operations/:operationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization37(c, deps, workspaceId, "workspace:read");
-    const actor = await fileOwnerContextForAccess6(deps, access, "workspace:read");
-    const summary = await withSessionRlsActorContext10(
+    const access = await requireAccessGrantAuthorization38(c, deps, workspaceId, "workspace:read");
+    const actor = await fileOwnerContextForAccess7(deps, access, "workspace:read");
+    const summary = await withSessionRlsActorContext11(
       actor,
       () => getVideoGenerationOperationSummary(deps.db, workspaceId, c.req.param("operationId"))
     );
@@ -113983,7 +114425,7 @@ function registerManagedSignInMethodRoutes(app, deps) {
       select provider_id as provider, (provider_id <> 'credential' or length(password)>0) as usable from auth_identities where user_id=${actor.authUserId}`
     );
     const connected = (provider) => accounts.some((a) => a.provider === provider && a.usable) && projection.loginBindings.some((b) => b.providerId === provider && b.status === "active");
-    const count = ["credential", "google", "github"].filter(
+    const count2 = ["credential", "google", "github"].filter(
       (p) => connected(p) && configured(deps, p)
     ).length;
     return context.json(
@@ -113996,7 +114438,7 @@ function registerManagedSignInMethodRoutes(app, deps) {
           provider,
           connected: connected(provider),
           available: configured(deps, provider),
-          canDisconnect: provider !== "credential" && connected(provider) && count - (configured(deps, provider) ? 1 : 0) > 0,
+          canDisconnect: provider !== "credential" && connected(provider) && count2 - (configured(deps, provider) ? 1 : 0) > 0,
           implicitRelinkingSuppressed: !connected(provider) && projection.loginBindings.some(
             (b) => b.providerId === provider && b.status !== "active"
           )
@@ -115321,7 +115763,7 @@ import {
   organizationWorkspaceInScope as organizationWorkspaceInScope4,
   hasPermission as hasPermission31,
   requireAccessContext as requireAccessContext13,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization38,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization39,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope3,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError16,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError14,
@@ -115474,7 +115916,7 @@ function registerOrganizationSessionRoutes(app, deps) {
 async function listWorkspaceSessionPage(c, deps, input) {
   let authorization;
   try {
-    authorization = await requireAccessGrantAuthorization38(
+    authorization = await requireAccessGrantAuthorization39(
       c,
       deps,
       input.workspace.id,
@@ -116084,7 +116526,7 @@ import {
 import {
   issueManagedHumanUserResourceGrant,
   listManagedHumanUserResourceAuthorities,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization39,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization40,
   revokeManagedHumanUserResourceGrant,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError17,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError15,
@@ -116124,7 +116566,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
     });
     if (!query.success) throw new HTTPException116(422, { message: "explicit scope=user required" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization39(
+    const access = await requireAccessGrantAuthorization40(
       context,
       deps,
       workspaceId,
@@ -116152,7 +116594,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
     const authorityId = z62.string().uuid().safeParse(context.req.param("authorityId"));
     if (!authorityId.success) throw new HTTPException116(422, { message: "invalid authority id" });
     const request = await body2(context, IssueUserResourceGrantRequest);
-    const access = await requireAccessGrantAuthorization39(
+    const access = await requireAccessGrantAuthorization40(
       context,
       deps,
       workspaceId,
@@ -116182,7 +116624,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
     const grantId = z62.string().uuid().safeParse(context.req.param("grantId"));
     if (!grantId.success) throw new HTTPException116(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization39(
+    const access = await requireAccessGrantAuthorization40(
       context,
       deps,
       workspaceId,
@@ -116202,28 +116644,94 @@ function registerUserResourceAuthorityRoutes(app, deps) {
 }
 
 // src/transcription/service.ts
-import { resolveVoiceInputProviderRegistry } from "@opengeni/config";
+import {
+  resolveVoiceInputProviderRegistry,
+  voiceInputCreditBillingActive
+} from "@opengeni/config";
 import { VOICE_INPUT_ACCEPTED_MIME_TYPES } from "@opengeni/contracts";
+import { voiceTranscriptionSettlementKeys } from "@opengeni/db";
 import {
+  createVoiceInputBilling,
   filenameForMimeType,
   isAcceptedMimeType as isAcceptedMimeType2,
   normalizeMimeType as normalizeMimeType2,
   TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS as TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS2,
-  TranscriptionServiceError as TranscriptionServiceError6
+  TranscriptionServiceError as TranscriptionServiceError7
 } from "@opengeni/core";
 
-// src/transcription/providers/openai.ts
+// src/transcription/normalize.ts
 import { TranscriptionServiceError as TranscriptionServiceError3 } from "@opengeni/core";
+function createFfmpegAudioNormalizer(input) {
+  const segmenter = createFfmpegTranscriptionSegmenter({ ffmpegPath: input.ffmpegPath });
+  return async ({ audio, mimeType, maxDurationSeconds, signal }) => {
+    if (!Number.isFinite(maxDurationSeconds) || maxDurationSeconds <= 0) {
+      throw new TranscriptionServiceError3({
+        code: "unavailable",
+        message: "Voice input duration limit is not configured."
+      });
+    }
+    const decodeSeconds = Math.ceil(maxDurationSeconds) + 1;
+    const segmentSeconds = decodeSeconds + 1;
+    let normalized;
+    try {
+      for await (const segment of segmenter.segment({
+        sourceMimeType: mimeType,
+        chunks: async function* () {
+          yield audio;
+        }(),
+        providerSegmentSeconds: segmentSeconds,
+        totalDurationMilliseconds: segmentSeconds * 1e3,
+        maxDecodeSeconds: decodeSeconds,
+        ...signal ? { signal } : {}
+      })) {
+        if (normalized) {
+          throw new TranscriptionServiceError3({ code: "too_large", message: "Audio is too long." });
+        }
+        normalized = segment.bytes;
+      }
+    } catch (error) {
+      if (error instanceof TranscriptionSegmenterError) {
+        throw new TranscriptionServiceError3({
+          code: error.code === "unknown" ? "invalid_audio" : error.code,
+          message: "Audio could not be prepared for transcription.",
+          retryable: error.retryable
+        });
+      }
+      throw error;
+    }
+    const durationSeconds = normalized ? wavDurationSeconds(normalized) : null;
+    if (!normalized || durationSeconds === null || !(durationSeconds > 0)) {
+      throw new TranscriptionServiceError3({
+        code: "invalid_audio",
+        message: "Audio could not be decoded."
+      });
+    }
+    if (durationSeconds > decodeSeconds - 0.02) {
+      throw new TranscriptionServiceError3({ code: "too_large", message: "Audio is too long." });
+    }
+    return { bytes: normalized, durationSeconds };
+  };
+}
+
+// src/transcription/providers/openai.ts
+import {
+  voiceInputModelReportsDurationOnly
+} from "@opengeni/config";
+import { TranscriptionServiceError as TranscriptionServiceError4 } from "@opengeni/core";
 function createOpenAiTranscriptionProvider(input) {
   const fetchImpl = input.fetch ?? fetch;
   return {
     id: "openai",
     supportsServerDeadline: true,
+    deploymentFunded: { model: input.model, pricing: input.pricing ?? null },
     available: () => true,
     async transcribe({ audio, mimeType, filename, requestId, signal }) {
       const form = new FormData();
       form.append("file", audioBlob(audio, mimeType), filename);
       form.append("model", input.model);
+      if (voiceInputModelReportsDurationOnly(input.model)) {
+        form.append("response_format", "verbose_json");
+      }
       let response;
       try {
         response = await fetchImpl(`${input.baseUrl}/audio/transcriptions`, {
@@ -116241,50 +116749,89 @@ function createOpenAiTranscriptionProvider(input) {
       }
       if (!response.ok) throw responseError(response.status);
       const body3 = await response.json().catch(() => null);
-      if (!body3 || typeof body3.text !== "string") {
-        throw new TranscriptionServiceError3({
+      const parsed = parseTranscriptionResponseBody(body3);
+      if (!parsed) {
+        throw new TranscriptionServiceError4({
           code: "provider",
           message: "Invalid transcription response."
         });
       }
-      return {
-        text: body3.text,
-        languages: typeof body3.language === "string" && body3.language ? [body3.language] : []
-      };
+      return parsed;
     }
   };
 }
+function parseTranscriptionResponseBody(body3) {
+  if (!body3 || typeof body3 !== "object") return null;
+  const record6 = body3;
+  if (typeof record6.text !== "string") return null;
+  const languages = typeof record6.language === "string" && record6.language ? [record6.language] : Array.isArray(record6.languages) ? record6.languages.flatMap((language) => {
+    const code = typeof language === "string" ? language : language?.code;
+    return typeof code === "string" && code ? [code] : [];
+  }) : [];
+  return { text: record6.text, languages, usage: parseTranscriptionUsage(record6) };
+}
+function parseTranscriptionUsage(body3) {
+  const usage = body3.usage;
+  if (usage && typeof usage === "object") {
+    const record6 = usage;
+    if (record6.type === "tokens") {
+      const inputTokens = count(record6.input_tokens);
+      const outputTokens = count(record6.output_tokens);
+      if (inputTokens !== null && outputTokens !== null) {
+        const details = record6.input_token_details && typeof record6.input_token_details === "object" ? record6.input_token_details : {};
+        return {
+          kind: "tokens",
+          inputTokens,
+          audioInputTokens: count(details.audio_tokens) ?? 0,
+          textInputTokens: count(details.text_tokens) ?? 0,
+          outputTokens
+        };
+      }
+    }
+    if (record6.type === "duration" && seconds(record6.seconds) !== null) {
+      return { kind: "duration", seconds: seconds(record6.seconds) };
+    }
+  }
+  const duration = seconds(body3.duration);
+  return duration === null ? null : { kind: "duration", seconds: duration };
+}
+function count(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function seconds(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value < 86400 ? value : null;
+}
 function audioBlob(audio, mimeType) {
   return new Blob([Uint8Array.from(audio).buffer], { type: mimeType });
 }
 function responseError(status) {
   if (status === 401 || status === 403) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       fallbackSafe: true,
       code: "unavailable",
       message: "Transcription is unavailable."
     });
   }
   if (status === 413) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "too_large",
       message: "Audio is too large."
     });
   }
   if (status === 400 || status === 422) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "invalid_audio",
       message: "Audio could not be transcribed."
     });
   }
   if (status === 408 || status === 504) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "timeout",
       message: "Transcription timed out.",
       retryable: true
     });
   }
-  return new TranscriptionServiceError3({
+  return new TranscriptionServiceError4({
     code: status >= 500 ? "unavailable" : "provider",
     message: "Transcription provider failed.",
     retryable: status >= 500
@@ -116292,29 +116839,105 @@ function responseError(status) {
 }
 function fetchError(error) {
   if (error instanceof DOMException && error.name === "AbortError") {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "cancelled",
       message: "Transcription was cancelled."
     });
   }
-  return new TranscriptionServiceError3({
+  return new TranscriptionServiceError4({
     code: "network",
     message: "Transcription provider is unreachable.",
     retryable: true
   });
 }
 
+// src/transcription/providers/azure-mai.ts
+function createMaiTranscriptionProvider(input) {
+  const fetchImpl = input.fetch ?? fetch;
+  const normalize = createFfmpegAudioNormalizer({ ffmpegPath: input.ffmpegPath });
+  return {
+    id: "azure-mai",
+    supportsServerDeadline: true,
+    deploymentFunded: { model: input.model, pricing: input.pricing ?? null },
+    available: () => Boolean(input.apiKey),
+    async transcribe({ audio, mimeType, filename, requestId, signal }) {
+      let bytes = audio;
+      let contentType = mimeType;
+      let name = filename;
+      if (!["audio/wav", "audio/x-wav", "audio/mpeg", "audio/flac"].includes(mimeType)) {
+        const normalized = await normalize({
+          audio,
+          mimeType,
+          maxDurationSeconds: 600,
+          ...signal ? { signal } : {}
+        });
+        bytes = normalized.bytes;
+        contentType = "audio/wav";
+        name = "audio.wav";
+      }
+      const form = new FormData();
+      form.append("audio", new Blob([Uint8Array.from(bytes).buffer], { type: contentType }), name);
+      form.append(
+        "definition",
+        JSON.stringify({ enhancedMode: { enabled: true, model: input.model } })
+      );
+      let response;
+      try {
+        response = await fetchImpl(
+          `${input.endpoint.replace(/\/+$/, "")}/speechtotext/transcriptions:transcribe?api-version=${encodeURIComponent(input.apiVersion)}`,
+          {
+            method: "POST",
+            headers: {
+              "Ocp-Apim-Subscription-Key": input.apiKey,
+              "x-opengeni-request-id": requestId
+            },
+            body: form,
+            ...signal ? { signal } : {}
+          }
+        );
+      } catch (error) {
+        throw fetchError(error);
+      }
+      if (!response.ok) throw responseError(response.status);
+      const body3 = await response.json().catch(() => null);
+      if (!body3 || !Array.isArray(body3.combinedPhrases) || !body3.combinedPhrases.every(
+        (phrase) => typeof phrase === "object" && phrase !== null && "text" in phrase && typeof phrase.text === "string"
+      )) {
+        throw responseError(502);
+      }
+      return {
+        usage: typeof body3.durationMilliseconds === "number" && Number.isFinite(body3.durationMilliseconds) && body3.durationMilliseconds >= 0 ? { kind: "duration", seconds: body3.durationMilliseconds / 1e3 } : null,
+        text: body3.combinedPhrases.map((phrase) => phrase.text).join("\n"),
+        languages: [
+          ...new Set(
+            (Array.isArray(body3.phrases) ? body3.phrases : []).flatMap(
+              (phrase) => typeof phrase?.locale === "string" && phrase.locale ? [phrase.locale] : []
+            )
+          )
+        ]
+      };
+    }
+  };
+}
+
 // src/transcription/providers/azure-openai.ts
+import { voiceInputModelReportsDurationOnly as voiceInputModelReportsDurationOnly2 } from "@opengeni/config";
 function createAzureOpenAiTranscriptionProvider(input) {
   const fetchImpl = input.fetch ?? fetch;
-  const url = `${input.endpoint}/openai/deployments/${encodeURIComponent(input.deployment)}/audio/transcriptions?api-version=${encodeURIComponent(input.apiVersion)}`;
+  const model = input.model ?? input.deployment;
+  const endpoint = input.endpoint.replace(/\/+$/, "");
+  const url = `${endpoint}/openai/deployments/${encodeURIComponent(input.deployment)}/audio/transcriptions?api-version=${encodeURIComponent(input.apiVersion)}`;
   return {
     id: "azure-openai",
     supportsServerDeadline: true,
+    deploymentFunded: { model, pricing: input.pricing ?? null },
     available: () => Boolean(input.apiKey || input.adToken),
     async transcribe({ audio, mimeType, filename, requestId, signal }) {
       const form = new FormData();
       form.append("file", new Blob([Uint8Array.from(audio).buffer], { type: mimeType }), filename);
+      if (voiceInputModelReportsDurationOnly2(model)) {
+        form.append("response_format", "verbose_json");
+      }
       const headers = input.apiKey ? { "api-key": input.apiKey, "x-opengeni-request-id": requestId } : { Authorization: `Bearer ${input.adToken}`, "x-opengeni-request-id": requestId };
       let response;
       try {
@@ -116329,13 +116952,11 @@ function createAzureOpenAiTranscriptionProvider(input) {
       }
       if (!response.ok) throw responseError(response.status);
       const body3 = await response.json().catch(() => null);
-      if (!body3 || typeof body3.text !== "string") {
+      const parsed = parseTranscriptionResponseBody(body3);
+      if (!parsed) {
         throw responseError(502);
       }
-      return {
-        text: body3.text,
-        languages: typeof body3.language === "string" && body3.language ? [body3.language] : []
-      };
+      return parsed;
     }
   };
 }
@@ -116343,7 +116964,7 @@ function createAzureOpenAiTranscriptionProvider(input) {
 // src/transcription/providers/codex-subscription.ts
 import { CODEX_CLIENT_VERSION as CODEX_CLIENT_VERSION4, CODEX_ORIGINATOR } from "@opengeni/codex/constants";
 import {
-  TranscriptionServiceError as TranscriptionServiceError4
+  TranscriptionServiceError as TranscriptionServiceError5
 } from "@opengeni/core";
 import { buildCodexTokenResolver as buildCodexTokenResolver4, listCodexAccountStatuses as listCodexAccountStatuses3 } from "@opengeni/db";
 var TRANSCRIBE_URL = "https://chatgpt.com/backend-api/transcribe";
@@ -116369,7 +116990,7 @@ function createCodexSubscriptionTranscriptionProvider(input) {
         (candidate) => candidate.isActive && candidate.status === "active"
       );
       if (!account) {
-        throw new TranscriptionServiceError4({
+        throw new TranscriptionServiceError5({
           fallbackSafe: true,
           code: "unavailable",
           message: "Transcription is unavailable."
@@ -116380,7 +117001,7 @@ function createCodexSubscriptionTranscriptionProvider(input) {
       try {
         token = await resolver.getToken();
       } catch {
-        throw new TranscriptionServiceError4({
+        throw new TranscriptionServiceError5({
           fallbackSafe: true,
           code: "unavailable",
           message: "Transcription is unavailable."
@@ -116431,7 +117052,7 @@ function createCodexSubscriptionTranscriptionProvider(input) {
 
 // src/transcription/providers/xai-subscription.ts
 import {
-  TranscriptionServiceError as TranscriptionServiceError5
+  TranscriptionServiceError as TranscriptionServiceError6
 } from "@opengeni/core";
 import { workspaceXaiSubscriptionActive as workspaceXaiSubscriptionActive3 } from "@opengeni/db";
 import {
@@ -116480,7 +117101,7 @@ function createXaiSubscriptionTranscriptionProvider(input) {
           ...input.fetch ? { fetch: input.fetch } : {}
         });
       } catch {
-        throw new TranscriptionServiceError5({
+        throw new TranscriptionServiceError6({
           code: "unavailable",
           fallbackSafe: true,
           message: "Transcription is unavailable."
@@ -116511,7 +117132,7 @@ function createXaiSubscriptionTranscriptionProvider(input) {
         try {
           return await (refresh ? auth.context.refresh() : auth.context.getToken());
         } catch {
-          throw new TranscriptionServiceError5({
+          throw new TranscriptionServiceError6({
             code: "unavailable",
             message: "Reconnect the SuperGrok account to use transcription.",
             fallbackSafe: true
@@ -116528,7 +117149,7 @@ function createXaiSubscriptionTranscriptionProvider(input) {
           response = await request(token.accessToken);
         }
       } catch (error) {
-        if (error instanceof TranscriptionServiceError5) throw error;
+        if (error instanceof TranscriptionServiceError6) throw error;
         throw fetchError(error);
       }
       if (!response.ok) throw responseError(response.status);
@@ -116581,6 +117202,12 @@ function createTranscriptionService(input) {
             ...config,
             ...input.fetch ? { fetch: input.fetch } : {}
           });
+        case "azure-mai":
+          return createMaiTranscriptionProvider({
+            ...config,
+            ffmpegPath: input.settings.voiceInputFfmpegPath,
+            ...input.fetch ? { fetch: input.fetch } : {}
+          });
         case "azure-openai":
           return createAzureOpenAiTranscriptionProvider({
             ...config,
@@ -116611,32 +117238,113 @@ function createTranscriptionService(input) {
   };
   const providerRequestTimeoutMilliseconds = input.providerRequestTimeoutMilliseconds ?? TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS2;
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
+  const log = input.log ?? ((message, attributes) => {
+    console.error(message, attributes);
+  });
+  const billing = input.billing ?? createVoiceInputBilling({
+    db: input.db,
+    settings: input.settings,
+    onReconcileError: (error, scope) => {
+      log("Voice input charge reconciliation failed", {
+        ...scope,
+        errorClass: error instanceof Error ? error.name : "UnknownError",
+        error: boundedErrorMessage(error)
+      });
+    }
+  });
+  let normalizer = input.normalizeAudio;
+  const normalizeAudio = (request) => {
+    normalizer ??= createFfmpegAudioNormalizer({ ffmpegPath: input.settings.voiceInputFfmpegPath });
+    return normalizer(request);
+  };
+  const retryDelays = input.settlementRetryDelaysMilliseconds ?? [2e3, 15e3, 6e4];
+  const settleWithoutFailing = async (settlement) => {
+    try {
+      return (await billing.settle(settlement)).creditCostMicros;
+    } catch (error) {
+      reportUnsettled(settlement, error, 0, retryDelays.length > 0 && !deterministic(error));
+      if (!deterministic(error)) scheduleSettlementRetry(settlement, 0);
+      return 0;
+    }
+  };
+  const deterministic = (error) => error instanceof TranscriptionServiceError7;
+  const scheduleSettlementRetry = (settlement, attempt) => {
+    const delay = retryDelays[attempt];
+    if (delay === void 0) return;
+    const timer = setTimeout(() => {
+      void billing.settle(settlement).then(
+        () => {
+          log("Voice input charge settled on retry", {
+            ...settlementAttributes(settlement),
+            attempt: attempt + 1
+          });
+        },
+        (error) => {
+          const more = attempt + 1 < retryDelays.length;
+          reportUnsettled(settlement, error, attempt + 1, more);
+          if (more) scheduleSettlementRetry(settlement, attempt + 1);
+        }
+      );
+    }, delay);
+    timer.unref?.();
+  };
+  const reportUnsettled = (settlement, error, attempt, willRetry) => {
+    log(
+      willRetry ? "Voice input charge is unsettled after provider success; retrying" : "Voice input charge is UNSETTLED after provider success; manual reconciliation needed unless its usage receipt committed",
+      {
+        ...settlementAttributes(settlement),
+        attempt,
+        willRetry,
+        errorClass: error instanceof Error ? error.name : "UnknownError",
+        error: boundedErrorMessage(error)
+      }
+    );
+  };
+  const creditBillingActive = voiceInputCreditBillingActive(input.settings);
+  const chargeable = (provider) => creditBillingActive && provider.deploymentFunded !== void 0;
   return {
     limits: () => limits,
     async available(context) {
-      return (await Promise.all(providers.map((provider) => provider.available(context)))).some(
-        Boolean
+      return Boolean(
+        await firstAvailable(orderedProviders(providers, context ?? {}), context ?? {})
       );
     },
+    async availableProviderIds(context) {
+      const available = await Promise.all(
+        providers.map(async (provider) => {
+          try {
+            return await provider.available(context) ? provider.id : null;
+          } catch {
+            return null;
+          }
+        })
+      );
+      return available.filter((id) => id !== null);
+    },
     async selectProvider(context) {
       return (await firstAvailable(orderedProviders(providers, context), context))?.id ?? null;
     },
+    async admit({ providerId, accountId, workspaceId, attribution }) {
+      const provider = providers.find((candidate) => candidate.id === providerId);
+      if (!provider || !chargeable(provider)) return;
+      await billing.admit({ accountId, workspaceId, attribution });
+    },
     async transcribe(request) {
       const mimeType = normalizeMimeType2(request.mimeType);
       if (!isAcceptedMimeType2(mimeType, limits.acceptedMimeTypes)) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "not_supported",
           message: "Unsupported audio format."
         });
       }
       if (request.audio.byteLength > limits.maxSizeBytes) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "too_large",
           message: "Audio is too large."
         });
       }
       if (request.durationSeconds !== void 0 && (!Number.isFinite(request.durationSeconds) || request.durationSeconds < 0 || request.durationSeconds > limits.maxDurationSeconds)) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "invalid_audio",
           message: "Invalid audio duration."
         });
@@ -116646,22 +117354,51 @@ function createTranscriptionService(input) {
         subjectId: request.subjectId
       }) : await firstAvailable(orderedProviders(providers, request), request);
       if (!provider) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           fallbackSafe: true,
           code: "unavailable",
           message: "Transcription is unavailable."
         });
       }
       if (provider.supportsServerDeadline !== true) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "unavailable",
           message: "Transcription provider does not support bounded requests."
         });
       }
+      if (chargeable(provider)) {
+        if (!provider.deploymentFunded?.pricing || !request.billing) {
+          throw new TranscriptionServiceError7({
+            code: "unavailable",
+            message: "Transcription billing is not configured."
+          });
+        }
+        await billing.admit({
+          accountId: request.accountId,
+          workspaceId: request.workspaceId,
+          attribution: request.billing.attribution
+        });
+      }
+      let audio = request.audio;
+      let providerMimeType = mimeType;
+      let billingContext = request.billing;
+      let audioSeconds = request.durationSeconds ?? 0;
+      if (chargeable(provider) && billingContext?.trustedDurationSeconds === void 0) {
+        const normalized = await normalizeAudio({
+          audio,
+          mimeType,
+          maxDurationSeconds: limits.maxDurationSeconds,
+          ...request.signal ? { signal: request.signal } : {}
+        });
+        audio = normalized.bytes;
+        providerMimeType = "audio/wav";
+        audioSeconds = normalized.durationSeconds;
+        billingContext = { ...billingContext, trustedDurationSeconds: normalized.durationSeconds };
+      }
       const startedAt = performance.now();
       const remainingMilliseconds = request.providerDeadlineAt ? remainingTranscriptionProviderRequestMilliseconds(request.providerDeadlineAt, now()) : providerRequestTimeoutMilliseconds;
       if (request.providerDeadlineAt && (!Number.isFinite(remainingMilliseconds) || remainingMilliseconds <= 0)) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "timeout",
           message: "Transcription provider deadline expired.",
           retryable: true
@@ -116671,9 +117408,9 @@ function createTranscriptionService(input) {
       let result;
       try {
         result = await provider.transcribe({
-          audio: request.audio,
-          mimeType,
-          filename: filenameForMimeType(mimeType),
+          audio,
+          mimeType: providerMimeType,
+          filename: filenameForMimeType(providerMimeType),
           workspaceId: request.workspaceId,
           accountId: request.accountId,
           subjectId: request.subjectId,
@@ -116681,7 +117418,7 @@ function createTranscriptionService(input) {
           signal: deadline.signal
         });
         if (deadline.timedOut && !request.signal?.aborted) {
-          throw new TranscriptionServiceError6({
+          throw new TranscriptionServiceError7({
             code: "timeout",
             message: "Transcription provider timed out.",
             retryable: true
@@ -116689,13 +117426,13 @@ function createTranscriptionService(input) {
         }
       } catch (error) {
         if (deadline.timedOut && !request.signal?.aborted) {
-          throw new TranscriptionServiceError6({
+          throw new TranscriptionServiceError7({
             code: "timeout",
             message: "Transcription provider timed out.",
             retryable: true
           });
         }
-        if (error instanceof TranscriptionServiceError6 && error.fallbackSafe && !request.providerId && request.fallbackEnabled !== false && !request.signal?.aborted) {
+        if (error instanceof TranscriptionServiceError7 && error.fallbackSafe && !request.providerId && request.fallbackEnabled !== false && !request.signal?.aborted) {
           const excludedProviders = [...request.excludedProviders ?? [], provider.id];
           if (await firstAvailable(
             orderedProviders(providers, { ...request, excludedProviders }),
@@ -116708,11 +117445,30 @@ function createTranscriptionService(input) {
       } finally {
         deadline.dispose();
       }
+      const latencyMs = Math.round(performance.now() - startedAt);
+      let creditCostMicros = 0;
+      const settle = async () => {
+        if (chargeable(provider) && provider.deploymentFunded?.pricing && billingContext) {
+          creditCostMicros = await settleWithoutFailing({
+            accountId: request.accountId,
+            workspaceId: request.workspaceId,
+            providerId: provider.id,
+            model: provider.deploymentFunded.model,
+            pricing: provider.deploymentFunded.pricing,
+            usage: result.usage ?? null,
+            billing: billingContext
+          });
+        }
+      };
+      if (!request.deferBillingSettlement) await settle();
       return {
-        ...result,
+        text: result.text,
+        languages: result.languages,
         providerId: provider.id,
-        audioSeconds: request.durationSeconds ?? 0,
-        latencyMs: Math.round(performance.now() - startedAt)
+        audioSeconds,
+        latencyMs,
+        creditCostMicros,
+        ...request.deferBillingSettlement ? { settleBilling: settle } : {}
       };
     }
   };
@@ -116767,6 +117523,23 @@ async function exactAvailable(providers, providerId, context) {
   const provider = providers.find((candidate) => candidate.id === providerId);
   return provider && await provider.available(context) ? provider : null;
 }
+function settlementAttributes(settlement) {
+  const keys2 = voiceTranscriptionSettlementKeys({
+    workspaceId: settlement.workspaceId,
+    sourceId: settlement.billing.sourceId
+  });
+  return {
+    accountId: settlement.accountId,
+    workspaceId: settlement.workspaceId,
+    providerId: settlement.providerId,
+    sourceId: settlement.billing.sourceId,
+    usageIdempotencyKey: keys2.usageIdempotencyKey,
+    debitIdempotencyKey: keys2.debitIdempotencyKey
+  };
+}
+function boundedErrorMessage(error) {
+  return (error instanceof Error ? error.message : String(error)).slice(0, 500);
+}
 
 // src/integrations/slack-tool-review.ts
 function slackToolReviewCanDecide(review) {
@@ -116936,7 +117709,7 @@ import {
   getActorNewSessionModelChoice,
   hasPermission as hasPermission33,
   requireAccessContext as requireAccessContext14,
-  requireAccessGrant as requireAccessGrant53,
+  requireAccessGrant as requireAccessGrant52,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope4,
   resolveWorkspaceCatalogSettings as resolveWorkspaceCatalogSettings9
 } from "@opengeni/core";
@@ -118103,7 +118876,7 @@ function registerSlackInteractionRoutes(app, deps) {
   );
   app.get("/v1/workspaces/:workspaceId/members/access-requests/slack", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant53(c, deps, workspaceId, "members:manage");
+    await requireAccessGrant52(c, deps, workspaceId, "members:manage");
     const workspace = await getWorkspace11(deps.db, workspaceId);
     const requests = await listPendingSlackUserLinkAccessRequests(deps.db, workspaceId);
     return c.json(
@@ -118119,7 +118892,7 @@ function registerSlackInteractionRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/members/access-requests/slack/:requestId/approve",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant53(c, deps, workspaceId, "members:manage");
+      const grant = await requireAccessGrant52(c, deps, workspaceId, "members:manage");
       const payload = await parseRequestJson(c, ApproveSlackUserLinkAccessRequest);
       const requestId = c.req.param("requestId");
       const requestTeam = await slackUserLinkAccessRequestTeam(deps.db, {
@@ -118159,7 +118932,7 @@ function registerSlackInteractionRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/members/access-requests/slack/:requestId/deny",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant53(c, deps, workspaceId, "members:manage");
+      const grant = await requireAccessGrant52(c, deps, workspaceId, "members:manage");
       const payload = await parseRequestJson(c, SlackUserLinkAccessMutationRequest);
       try {
         const request = await denySlackUserLinkAccessRequest(deps.db, {
@@ -118182,7 +118955,7 @@ function registerSlackInteractionRoutes(app, deps) {
   );
   app.post("/v1/workspaces/:workspaceId/integrations/slack/user-links", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "sessions:create");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "sessions:create");
     const body3 = record5(await c.req.json().catch(() => null));
     const linkToken = boundedString(body3?.linkToken, 2048);
     const signingSecret = deps.settings.slackSigningSecret;
@@ -118238,7 +119011,7 @@ function registerSlackInteractionRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/integrations/slack/user-links/:slackUserId",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      await requireAccessGrant53(c, deps, workspaceId, "connections:write");
+      await requireAccessGrant52(c, deps, workspaceId, "connections:write");
       const connectionId = boundedString(c.req.query("connectionId"), 64);
       if (!connectionId) throw new HTTPException117(400, { message: "connectionId is required" });
       return c.json({
@@ -118253,7 +119026,7 @@ function registerSlackInteractionRoutes(app, deps) {
   );
   app.get("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:admin");
     const connectionId = boundedString(c.req.query("connectionId"), 64);
     if (!connectionId) throw new HTTPException117(400, { message: "connectionId is required" });
     const routes = await listSlackChannelRoutes(
@@ -118284,7 +119057,7 @@ function registerSlackInteractionRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:admin");
     const payload = await parseRequestJson(c, UpdateSlackChannelRoutesRequest);
     const home = { accountId: grant.accountId, workspaceId };
     const installation = await listSlackInstallationBindings2(deps.db, home);
@@ -118339,7 +119112,7 @@ function registerSlackInteractionRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/integrations/slack/reaction-channels", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:admin");
     const connectionId = boundedString(c.req.query("connectionId"), 64);
     if (!connectionId) throw new HTTPException117(400, { message: "connectionId is required" });
     const cursor = boundedString(c.req.query("cursor"), 1024);
@@ -122244,10 +123017,23 @@ function createAppComposition(deps) {
     }, MANAGED_AUTH_REAPER_INTERVAL_MS);
     timer.unref?.();
   }
+  if (deps.transcription === void 0) {
+    for (const issue of voiceInputPricingIssues(deps.settings)) {
+      observability.error(
+        `Voice input provider ${issue.providerId} is unavailable: ${issue.message}`,
+        {
+          providerId: issue.providerId,
+          env: issue.env,
+          reason: issue.reason
+        }
+      );
+    }
+  }
   const transcription = deps.transcription === void 0 ? createTranscriptionService({
     settings: deps.settings,
     db: deps.db,
-    ...deps.codexFetch ? { codexFetch: deps.codexFetch } : {}
+    ...deps.codexFetch ? { codexFetch: deps.codexFetch } : {},
+    log: (message, attributes) => observability.error(message, attributes)
   }) : deps.transcription;
   const transcriptionSegmenter = deps.transcriptionSegmenter === void 0 ? createFfmpegTranscriptionSegmenter({
     ffmpegPath: deps.settings.voiceInputFfmpegPath
@@ -122357,6 +123143,8 @@ function createAppComposition(deps) {
       "X-OpenGeni-Actor-Epoch",
       "X-OpenGeni-Correlation-Id",
       "X-OpenGeni-Session-Csrf",
+      // Session scope for a session proxy; the API itself ignores it.
+      "X-OpenGeni-Session-Id",
       "X-OpenGeni-Site-Id",
       "X-OpenGeni-Site-Version",
       "X-OpenGeni-Subject",
@@ -122803,6 +123591,8 @@ function createAppComposition(deps) {
       creditsAvailable: false
     });
     let modelSelectionForbidden = false;
+    let voiceInputAvailable = false;
+    let voiceInputProviders = [];
     const requestedWorkspaceId = c.req.query("workspaceId");
     if (requestedWorkspaceId !== void 0 && requestedWorkspaceId.trim() === "") {
       throw new HTTPException118(422, { message: "workspaceId must not be empty" });
@@ -122821,7 +123611,7 @@ function createAppComposition(deps) {
       }
       const workspaceId = requestedWorkspaceId ?? context?.defaultWorkspaceId;
       if (context && workspaceId) {
-        const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+        const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
         await withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
           catalogSettings = (await resolveWorkspaceCatalogSettings10(deps.db, deps.settings, {
             accountId: grant.accountId,
@@ -122838,6 +123628,19 @@ function createAppComposition(deps) {
             selections = [];
           }
           const workspace = await getWorkspace12(deps.db, workspaceId);
+          const voicePreferences = WorkspaceVoiceInputSettings3.safeParse(
+            workspace?.settings.voiceInput
+          ).data;
+          const voiceContext = {
+            workspaceId,
+            subjectId: grant.subjectId,
+            preferredProvider: voicePreferences?.preferredProvider,
+            fallbackEnabled: voicePreferences?.fallbackEnabled
+          };
+          if (hasPermission34(grant.permissions, "sessions:create") && transcription) {
+            voiceInputProviders = await transcription.availableProviderIds?.(voiceContext) ?? [];
+            voiceInputAvailable = voiceInputProviders.length > 0 && await Promise.resolve(transcription.available(voiceContext)).catch(() => false);
+          }
           defaultSelection = await resolveDefaultSessionModelForSelections2(deps.db, {
             settings: catalogSettings,
             accountId: grant.accountId,
@@ -122893,14 +123696,12 @@ function createAppComposition(deps) {
           maxSizeBytes: objectStorage?.maxSinglePutSizeBytes ?? 5e9
         },
         voiceInput: {
-          providers: resolveVoiceInputProviderRegistry2(deps.settings).map(
-            (provider) => provider.id
-          ),
-          available: await transcription?.available() ?? false,
+          providers: voiceInputProviders,
+          available: voiceInputAvailable,
           maxDurationSeconds: deps.settings.voiceInputMaxDurationSeconds,
           maxSizeBytes: deps.settings.voiceInputMaxSizeBytes,
           acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES2],
-          ...deps.settings.voiceInputResumableEnabled && objectStorage && transcription && transcriptionSegmenter && await transcription.available() && await transcriptionSegmenter.available() ? {
+          ...deps.settings.voiceInputResumableEnabled && objectStorage && transcription && transcriptionSegmenter && voiceInputAvailable && await transcriptionSegmenter.available() ? {
             resumable: {
               maxDurationSeconds: deps.settings.voiceInputResumableMaxDurationSeconds,
               maxSizeBytes: deps.settings.voiceInputResumableMaxSizeBytes,
@@ -123009,7 +123810,7 @@ function createAppComposition(deps) {
   app.use("/v1/workspaces/:workspaceId/*", async (c, next) => {
     const workspaceId = c.req.param("workspaceId");
     if (workspaceRequestRequiresCodexAccountPrevalidation(c.req.raw)) {
-      const grant2 = await requireAccessGrant54(c, routeDeps, workspaceId);
+      const grant2 = await requireAccessGrant53(c, routeDeps, workspaceId);
       await validateCodexAccountTarget(c.req.raw);
       await withAccessGrantSessionRlsContext(routeDeps, grant2, next);
       return;
@@ -123019,7 +123820,7 @@ function createAppComposition(deps) {
       return;
     }
     const permission = c.req.method === "PUT" && /^\/v1\/workspaces\/[^/]+\/artifact-catalog\/[^/]+\/[^/]+\/pin$/.test(c.req.path) ? "artifacts:publish" : void 0;
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId, permission);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId, permission);
     await withAccessGrantSessionRlsContext(routeDeps, grant, next);
   });
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
@@ -123174,7 +123975,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/tools/catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123190,7 +123991,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/tools/calls", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123219,7 +124020,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/tools/approvals", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123248,7 +124049,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/tools/declarations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123264,7 +124065,7 @@ function createAppComposition(deps) {
   });
   app.all("/v1/workspaces/:workspaceId/codemode/sdk/*", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     const url = new URL(c.req.url);
     const prefix2 = `/v1/workspaces/${workspaceId}/codemode/sdk`;
     let forwarded;
@@ -123282,7 +124083,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/codemode/catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
       throw new HTTPException118(403, { message: "Codemode access denied" });
     }
@@ -123294,7 +124095,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/codemode/calls", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
       throw new HTTPException118(403, { message: "Codemode access denied" });
     }
@@ -123314,7 +124115,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/codemode/calls/:operationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
       throw new HTTPException118(403, { message: "Codemode access denied" });
     }
@@ -123511,7 +124312,7 @@ async function validateCodexAccountTarget(request) {
   }
 }
 async function requireMcpAccessGrantAuthorization(c, deps, workspaceId) {
-  const authorization = await requireAccessGrantAuthorization40(c, deps, workspaceId);
+  const authorization = await requireAccessGrantAuthorization41(c, deps, workspaceId);
   const grant = authorization.grant;
   if (hasPermission34(grant.permissions, "workspace:read")) {
     return authorization;
@@ -124905,4 +125706,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-IZEGLLKZ.js.map
+//# sourceMappingURL=chunk-KKEXIBQG.js.map