@opengeni/api-router 1.3.0 → 1.4.2

package/dist/{chunk-IZEGLLKZ.js → chunk-F3LQ6VWR.js}

@@ -6517,8 +6517,8 @@ import {
   canonicalPublicOrigin as canonicalPublicOrigin3,
   configuredAllowedReasoningEfforts,
   resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy2,
-  resolveVoiceInputProviderRegistry as resolveVoiceInputProviderRegistry2,
-  UnsupportedLatencyModeError as UnsupportedLatencyModeError2
+  UnsupportedLatencyModeError as UnsupportedLatencyModeError2,
+  voiceInputPricingIssues
 } from "@opengeni/config";
 import {
   AGENT_CAPABILITY_IDS,
@@ -6532,6 +6532,7 @@ import {
   resolveWorkspaceMemoryEnabled,
   resolveWorkspaceMemoryPromptMode,
   VOICE_INPUT_ACCEPTED_MIME_TYPES as VOICE_INPUT_ACCEPTED_MIME_TYPES2,
+  WorkspaceVoiceInputSettings as WorkspaceVoiceInputSettings3,
   TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS as TRANSCRIPTION_RECORDING_PROVIDER_SEGMENT_SECONDS2,
   ToolGatewayApprovalRequest as ToolGatewayApprovalRequest2,
   ToolGatewayCallRequest as ToolGatewayCallRequest2
@@ -6611,7 +6612,11 @@ import {
   ModelUnavailableError,
   ScheduledTaskTargetAccessChange
 } from "@opengeni/contracts";
-import { isDatabaseConnectionLoss, WorkspaceControlBusyError } from "@opengeni/db";
+import {
+  isDatabaseConnectionLoss,
+  nestedPostgresSqlState as nestedPostgresSqlState4,
+  WorkspaceControlBusyError
+} from "@opengeni/db";
 import { HTTPException as HTTPException20 } from "hono/http-exception";
 var ApiHttpError = class extends HTTPException20 {
   code;
@@ -6678,6 +6683,21 @@ function databaseUnavailableHttpError(error, method) {
     details: { code: DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE }
   });
 }
+var DATABASE_CONTENTION_ERROR_DETAIL_CODE = "DATABASE_CONTENTION";
+function databaseContentionHttpError(error, method, options = {}) {
+  if (error instanceof ApiHttpError) return null;
+  if (error instanceof HTTPException20 && error.status < 500) return null;
+  const sqlState = nestedPostgresSqlState4(error);
+  if (sqlState !== "40P01" && sqlState !== "40001") return null;
+  const safeMethod = method === "GET" || method === "HEAD" || method === "OPTIONS";
+  return new ApiHttpError(503, {
+    code: "upstream_unavailable",
+    message: "Opengeni hit transient database contention. Retry shortly.",
+    retryable: true,
+    outcomeUnknown: options.outcomeUnknown ?? !safeMethod,
+    details: { code: DATABASE_CONTENTION_ERROR_DETAIL_CODE, sqlState }
+  });
+}
 function agentConfigHttpError(error) {
   const cause = error instanceof AgentConfigError ? error : error instanceof HTTPException20 && error.cause instanceof AgentConfigError ? error.cause : null;
   if (!cause) return null;
@@ -7065,8 +7085,8 @@ import {
   CodexCompactionV2ProviderLockedError,
   ManagedAuthActorLeaseOutcomeUnknownError,
   hasPermission as hasPermission34,
-  requireAccessGrant as requireAccessGrant54,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization40,
+  requireAccessGrant as requireAccessGrant53,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization41,
   accountScopedApiKeyWorkspaceAuthority as accountScopedApiKeyWorkspaceAuthority10,
   requireAccessContext as requireAccessContext15,
   requirePermission as requirePermission13,
@@ -8515,7 +8535,7 @@ function startManagedSignInNotificationDelivery(db, transport) {
     if (active) return;
     active = true;
     try {
-      for (let count = 0; count < 10; count++)
+      for (let count2 = 0; count2 < 10; count2++)
         if (await deliverManagedSignInNotification(db, transport) === "outcome_unknown") break;
     } finally {
       active = false;
@@ -10277,9 +10297,9 @@ function dispositionFilenameParameters(filename) {
   const cleaned = Array.from(
     filename.replace(/[\u0000-\u001f\u007f/\\]+/g, "_").replace(/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, "_").trim()
   ).slice(0, DISPOSITION_FILENAME_MAX_CHARS).join("");
-  const ascii2 = cleaned.replace(/[^A-Za-z0-9._ -]+/g, "_").replace(/\s+/g, " ").trim().slice(0, DISPOSITION_FILENAME_MAX_CHARS) || "download";
-  if (!cleaned || ascii2 === cleaned) return `filename="${ascii2}"`;
-  return `filename="${ascii2}"; filename*=UTF-8''${encodeExtendedParameterValue(cleaned)}`;
+  const ascii3 = cleaned.replace(/[^A-Za-z0-9._ -]+/g, "_").replace(/\s+/g, " ").trim().slice(0, DISPOSITION_FILENAME_MAX_CHARS) || "download";
+  if (!cleaned || ascii3 === cleaned) return `filename="${ascii3}"`;
+  return `filename="${ascii3}"; filename*=UTF-8''${encodeExtendedParameterValue(cleaned)}`;
 }
 function userContentDispositionHeaders(contentType, filename) {
   if (!isActiveUserContentType(contentType)) return {};
@@ -10817,13 +10837,18 @@ import {
 import {
   freezeAgentLearningPolicy,
   withSessionRlsActorContext,
-  withCreditDebitAttribution
+  withCreditDebitAttribution,
+  currentCreditDebitAttribution
 } from "@opengeni/db";
 import { HTTPException as HTTPException21 } from "hono/http-exception";
+function creditDebitAttributionForGrant(grant) {
+  if (grant.principalKind === "agent_attempt") return currentCreditDebitAttribution();
+  return grant.principalKind === "human_session" ? { kind: "human", initiatingHumanSubjectId: grant.subjectId } : ["service", "api_key", "configured_key", "mcp_gateway"].includes(grant.principalKind ?? "") ? { kind: "service" } : { kind: "unknown" };
+}
 async function withAccessGrantSessionRlsContext(deps, grant, fn) {
   if (grant.principalKind !== "agent_attempt") {
     return await withCreditDebitAttribution(
-      grant.principalKind === "human_session" ? { kind: "human", initiatingHumanSubjectId: grant.subjectId } : grant.principalKind === "service" || grant.principalKind === "api_key" || grant.principalKind === "configured_key" || grant.principalKind === "mcp_gateway" ? { kind: "service" } : { kind: "unknown" },
+      creditDebitAttributionForGrant(grant),
       () => withSessionRlsActorContext({ subjectId: grant.subjectId }, fn)
     );
   }
@@ -11270,6 +11295,13 @@ function registerEditableArtifactRoutes(app, deps) {
     const body3 = await parseBoundedMaterializationRequest(context);
     const scope = editableArtifactScope({ accountId: grant.accountId, workspaceId });
     const actor = editableArtifactActorForGrant(grant, body3.replicaId);
+    if (!deps.settings.artifactMaterializerDeployed) {
+      throw new ApiHttpError(503, {
+        code: "upstream_unavailable",
+        message: "File export is not available on this deployment.",
+        retryable: false
+      });
+    }
     try {
       const result = await requireEditableArtifactExports(deps).enqueueMaterialization({
         scope,
@@ -11815,7 +11847,7 @@ import {
   confirmLegacyInstruction,
   getKnowledgeEntry,
   listKnowledgeEntries,
-  nestedPostgresSqlState as nestedPostgresSqlState4,
+  nestedPostgresSqlState as nestedPostgresSqlState5,
   saveKnowledgeEntry,
   saveAgentInstruction,
   getAgentInstruction,
@@ -11861,7 +11893,7 @@ function registerKnowledgeEntryTools(server, deps, grant, sessionId) {
           ]
         };
       }
-      const state = nestedPostgresSqlState4(error);
+      const state = nestedPostgresSqlState5(error);
       const message = surface === "instruction" ? state === "40001" ? "This instruction changed. Read its current content and baseline, then retry the same intended edit against that exact state." : state === "23505" ? "This instruction operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The instruction change is unavailable in this task's scope or Agent learning policy. Off disables authoring, not the task. Do not ask for approval to continue." : state === "22023" || state === "23514" ? `Invalid instruction change. Read the current instruction, use append for a new rule, or edit with one localized exact oldText match to update or remove text. Agents cannot replace the complete instruction. Each supplied text and the resulting instruction must stay within ${WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters, the same limit as the human editor.` : "Workspace instructions are temporarily unavailable. Retry the same operation ID only if the prior change may have succeeded." : state === "40001" ? "This entry changed. Read its current revision and retry your correction with the current version." : state === "23505" ? "This operation ID was already used with different input. Reuse it only for an exact retry." : state === "42501" ? "The entry, reference, or write is unavailable in this task's scope and Agent learning policy. Off disables saving, not your task. Do not ask for an approval to continue." : state === "22023" || state === "23514" ? "Invalid Knowledge entry or relationship. Check the referenced IDs and revision before retrying." : "Knowledge is temporarily unavailable. Your task can continue; retry the same operation ID if saving may have succeeded.";
       return {
         isError: true,
@@ -12406,7 +12438,7 @@ import { HTTPException as HTTPException22 } from "hono/http-exception";
 import {
   getScheduledScopedRigVersionMetadata,
   loadWorkspaceEnvironmentForRun,
-  nestedPostgresSqlState as nestedPostgresSqlState5
+  nestedPostgresSqlState as nestedPostgresSqlState6
 } from "@opengeni/db";
 async function loadSessionAttachVariableSetValues(db, settings, input) {
   const { accountId, workspaceId, session, subjectId } = input;
@@ -12456,7 +12488,7 @@ async function loadSessionAttachVariableSetValues(db, settings, input) {
         variableSetId,
         source
       });
-      if (nestedPostgresSqlState5(error) === "42501") {
+      if (nestedPostgresSqlState6(error) === "42501") {
         throw new ApiHttpError(403, {
           code: "forbidden",
           message: source === "sandbox_environment_default" ? "A default Variable Set of this session's Sandbox Environment is not available to this session." : "A Variable Set selected for this session is not available to this session.",
@@ -12470,7 +12502,7 @@ async function loadSessionAttachVariableSetValues(db, settings, input) {
   return values;
 }
 function logAttachFailure(message, error, context) {
-  const sqlState = nestedPostgresSqlState5(error);
+  const sqlState = nestedPostgresSqlState6(error);
   console.warn(`[session-attach] ${message}`, {
     ...context,
     ...sqlState ? { sqlState } : {},
@@ -12498,6 +12530,7 @@ import {
   SandboxResumeIdentityMismatchError,
   SandboxResumeIdentityUnavailableError,
   RoutingActiveRouteChangedError,
+  RoutingMutationOutputRejectedError,
   RoutingWorkspaceRootChangedError,
   SelfhostedWorkspaceRootChangedError,
   ChannelAConflictError,
@@ -13594,6 +13627,20 @@ function mapChannelAError(error, waitSignal) {
     });
   if (error instanceof SandboxResumeIdentityMismatchError || error instanceof SandboxResumeIdentityUnavailableError)
     return new HTTPException22(409, { message: error.message });
+  if (error instanceof RoutingMutationOutputRejectedError) {
+    const revoked = error.reasonCode === "authority_revoked";
+    return new ApiHttpError(revoked ? 403 : 409, {
+      code: revoked ? "forbidden" : "conflict",
+      message: error.message,
+      retryable: false,
+      outcomeUnknown: false,
+      details: {
+        code: error.code,
+        reasonCode: error.reasonCode,
+        physicalOutcome: "resolved"
+      }
+    });
+  }
   if (error instanceof RoutingActiveRouteChangedError || error instanceof RoutingWorkspaceRootChangedError || error instanceof SelfhostedWorkspaceRootChangedError || error instanceof ChannelAFileSystemRouteChangedError)
     return new ApiHttpError(409, {
       code: "conflict",
@@ -13660,6 +13707,13 @@ function channelAOperationFailureDiagnostic(error, waitSignal) {
       errorCode: "sandbox_channel_a_cancelled"
     };
   }
+  if (error instanceof RoutingMutationOutputRejectedError) {
+    return {
+      reason: "request_rejected",
+      status: error.reasonCode === "authority_revoked" ? 403 : 409,
+      errorCode: "sandbox_channel_a_operation_failed"
+    };
+  }
   if (error instanceof SandboxProviderReadLockUnavailableError) {
     return {
       reason: "provider_read_busy",
@@ -15507,8 +15561,8 @@ function tokenHash(value) {
 function mcpOAuthRegistrationClientKey(c, trust) {
   return `mcp-oauth-registration:${trustedRequestSourceRateLimitKey(c, trust)}`;
 }
-function expiresIn(seconds) {
-  return new Date(Date.now() + seconds * 1e3);
+function expiresIn(seconds2) {
+  return new Date(Date.now() + seconds2 * 1e3);
 }
 function authorizationRedirect(redirectUri, params) {
   const url = new URL(redirectUri);
@@ -16872,7 +16926,10 @@ import {
 } from "@opengeni/db/organization-integration-policy";
 import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { parseIntegrationsOauthClientsJson } from "@opengeni/config";
+import {
+  findIntegrationsOauthClient,
+  parseIntegrationsOauthClientsJson
+} from "@opengeni/config";
 import {
   OAuthStartResponse,
   selectCanonicalPersonalSlackConnection
@@ -17002,7 +17059,11 @@ import {
 import { OPENGENI_PERSONAL_SLACK_MCP_URL } from "@opengeni/contracts";
 import { HTTPException as HTTPException31 } from "hono/http-exception";
 import { z as z25 } from "zod";
-import { GMAIL_REST_MCP_TOOLS, gmailToolSupportsScopes } from "@opengeni/runtime/gmail-rest-mcp";
+import {
+  GMAIL_REST_MCP_TOOLS,
+  gmailToolAvailableOnDeployment,
+  gmailToolSupportsScopes
+} from "@opengeni/runtime/gmail-rest-mcp";
 
 // src/integrations/provider-domain.ts
 import { HTTPException as HTTPException30 } from "hono/http-exception";
@@ -17137,10 +17198,12 @@ var OFFICIAL_GMAIL_PROFILE = {
       }
       return { gmailEmail: payload.emailAddress };
     },
-    toolsForScopes: (scopes) => {
-      return GMAIL_REST_MCP_TOOLS.filter((tool) => gmailToolSupportsScopes(tool.name, scopes)).map(
-        ({ name, description }) => ({ name, ...description ? { description } : {} })
-      );
+    toolsForScopes: (scopes, deployment) => {
+      return GMAIL_REST_MCP_TOOLS.filter(
+        (tool) => gmailToolSupportsScopes(tool.name, scopes) && gmailToolAvailableOnDeployment(tool.name, {
+          watchTopicName: deployment.gmailWatchTopicName
+        })
+      ).map(({ name, description }) => ({ name, ...description ? { description } : {} }));
     }
   }
 };
@@ -18472,7 +18535,6 @@ function operatorClientForAs(settings, as) {
   };
 }
 function operatorClientEntryFor(settings, candidates) {
-  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
   const candidateOrigins = candidates.flatMap((candidate) => {
     try {
       return [new URL(candidate).origin];
@@ -18489,22 +18551,10 @@ function operatorClientEntryFor(settings, candidates) {
       return resolved;
     }
   }
-  const configured2 = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
-  const exactKeys = uniqueStrings(
-    candidates.flatMap((candidate) => [candidate, normalizedIssuerKey(candidate)])
+  return findIntegrationsOauthClient(
+    parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson),
+    candidates
   );
-  for (const key of exactKeys) {
-    const entry2 = configured2[key];
-    if (entry2) {
-      return entry2;
-    }
-  }
-  for (const [key, entry2] of Object.entries(configured2)) {
-    if (normalizedCandidates.has(normalizedIssuerKey(key))) {
-      return entry2;
-    }
-  }
-  return null;
 }
 function gmailOAuthClientConfigured(settings) {
   const entry2 = operatorClientEntryFor(settings, ["https://accounts.google.com"]);
@@ -19122,7 +19172,8 @@ async function verifyMcpToolsListNonFatal(observability, settings, state, token,
       grantRejected = local.isRejectedGrant?.(payload) ?? false;
       providerIdentity = local.validateIdentity(payload);
       const verifiedTools = local.toolsForScopes(
-        grantedScopes(token.scopeText, state.authorizeScopes, profile)
+        grantedScopes(token.scopeText, state.authorizeScopes, profile),
+        settings
       );
       if (local.required && verifiedTools.length === 0)
         throw new Error("Connector verification did not report an authorized tool scope");
@@ -20502,15 +20553,15 @@ import { COMMAND_OUTPUT_MAX_BYTES } from "@opengeni/db/session-background-comman
 var COMMAND_READ_MAX_WAIT_SECONDS = 50;
 var COMMAND_WAIT_DEFAULT_SECONDS = 45;
 async function readCommandWithWait(input) {
-  const seconds = input.waitSeconds ?? 0;
-  if (!Number.isInteger(seconds) || seconds < 0 || seconds > COMMAND_READ_MAX_WAIT_SECONDS) {
+  const seconds2 = input.waitSeconds ?? 0;
+  if (!Number.isInteger(seconds2) || seconds2 < 0 || seconds2 > COMMAND_READ_MAX_WAIT_SECONDS) {
     throw new Error("waitSeconds must be between 0 and 50");
   }
   if (input.maxOutputBytes !== void 0 && (!Number.isInteger(input.maxOutputBytes) || input.maxOutputBytes < 4 || input.maxOutputBytes > COMMAND_OUTPUT_MAX_BYTES)) {
     throw new Error("maxOutputBytes must be between 4 and 65536");
   }
   const started2 = Date.now();
-  const deadline = started2 + seconds * 1e3;
+  const deadline = started2 + seconds2 * 1e3;
   let unsubscribe;
   let wake;
   let changed2 = false;
@@ -20521,7 +20572,7 @@ async function readCommandWithWait(input) {
   };
   input.signal?.addEventListener("abort", notify);
   try {
-    if (seconds > 0) {
+    if (seconds2 > 0) {
       try {
         unsubscribe = await input.subscribe((events) => {
           if (events.some(
@@ -20541,7 +20592,7 @@ async function readCommandWithWait(input) {
         return {
           ...result,
           waitedMs: Date.now() - started2,
-          timedOut: seconds > 0 && expired && !result.terminal && result.chunks.length === 0 && !result.hasMore,
+          timedOut: seconds2 > 0 && expired && !result.terminal && result.chunks.length === 0 && !result.hasMore,
           aborted: input.signal?.aborted ?? false,
           liveFanout
         };
@@ -22021,7 +22072,7 @@ function buildScheduledTaskDetailMcp(task, budget, reducedForBytes) {
         deliveredCount: resources.length,
         originalBytes: jsonBytes(task.agentConfig.resources),
         truncatedIdentityFieldCount: resourceProjections.reduce(
-          (count, projection) => count + projection.truncatedFieldCount,
+          (count2, projection) => count2 + projection.truncatedFieldCount,
           0
         )
       },
@@ -22030,7 +22081,7 @@ function buildScheduledTaskDetailMcp(task, budget, reducedForBytes) {
         deliveredCount: tools.length,
         originalBytes: jsonBytes(task.agentConfig.tools),
         truncatedIdentityFieldCount: toolProjections.reduce(
-          (count, projection) => count + projection.truncatedFieldCount,
+          (count2, projection) => count2 + projection.truncatedFieldCount,
           0
         )
       },
@@ -25033,9 +25084,9 @@ function slackRetryAfterMs(response) {
   if (response.status !== 429) return null;
   const raw = response.headers.get("retry-after");
   if (!raw || !/^\d+$/.test(raw)) return null;
-  const seconds = Number(raw);
-  if (!Number.isSafeInteger(seconds) || seconds < 1) return null;
-  return Math.min(seconds, 3600) * 1e3;
+  const seconds2 = Number(raw);
+  if (!Number.isSafeInteger(seconds2) || seconds2 < 1) return null;
+  return Math.min(seconds2, 3600) * 1e3;
 }
 function assertOpenGeniSlackBotScopes(grantedScopes2) {
   const policy = evaluateOpenGeniSlackBotScopes(grantedScopes2);
@@ -25613,11 +25664,11 @@ function nextSlackFilesListPage(payload, requested, returnedFileCount) {
   if (responseMetadata && Object.hasOwn(responseMetadata, "next_cursor")) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
-  const count = paging?.count;
+  const count2 = paging?.count;
   const total = paging?.total;
   const page2 = paging?.page;
   const pages = paging?.pages;
-  if (!positiveSafeInt(count) || !nonNegativeSafeInt(total) || !positiveSafeInt(page2) || !nonNegativeSafeInt(pages) || count !== requested.count || page2 !== requested.page || returnedFileCount > count || pages !== (total === 0 ? 0 : Math.ceil(total / count)) || page2 > Math.max(1, pages)) {
+  if (!positiveSafeInt(count2) || !nonNegativeSafeInt(total) || !positiveSafeInt(page2) || !nonNegativeSafeInt(pages) || count2 !== requested.count || page2 !== requested.page || returnedFileCount > count2 || pages !== (total === 0 ? 0 : Math.ceil(total / count2)) || page2 > Math.max(1, pages)) {
     throw new SlackBotProviderError("invalid_files_paging");
   }
   if (page2 >= pages) return null;
@@ -74235,7 +74286,7 @@ import {
   getOrganizationIntegrationPolicy,
   updateOrganizationIntegrationPolicy
 } from "@opengeni/db/organization-integration-policy";
-import { nestedPostgresSqlState as nestedPostgresSqlState6 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState7 } from "@opengeni/db";
 import { HTTPException as HTTPException46 } from "hono/http-exception";
 import { z as z32 } from "zod";
 async function authorizeOrganizationIntegrationAdministration(context, deps, accountId, mutation) {
@@ -74264,7 +74315,7 @@ async function policyResponse(readOrWrite) {
     return await readOrWrite();
   } catch (error) {
     if (error instanceof HTTPException46) throw error;
-    const state = nestedPostgresSqlState6(error);
+    const state = nestedPostgresSqlState7(error);
     if (state === "42501") {
       throw new HTTPException46(403, { message: "Organization administration required" });
     }
@@ -81187,7 +81238,7 @@ import {
   listAgentLearningOverrides,
   listKnowledgeEntryHistory,
   listKnowledgeReviewBatches,
-  nestedPostgresSqlState as nestedPostgresSqlState7,
+  nestedPostgresSqlState as nestedPostgresSqlState8,
   restoreKnowledgeEntry,
   reviewKnowledgeEntry,
   saveAgentLearningSettings,
@@ -81241,7 +81292,7 @@ function knowledgeHttpError(error) {
     throw new HTTPException57(422, {
       message: error.issues[0]?.message ?? "Invalid Knowledge request"
     });
-  const state = nestedPostgresSqlState7(error);
+  const state = nestedPostgresSqlState8(error);
   if (state === "40001" || state === "23505")
     throw new HTTPException57(409, { message: "This item changed. Refresh it and try again." });
   if (state === "42501")
@@ -83461,12 +83512,12 @@ function creditScopeMetadata(scope) {
 }
 function creditScopeFromMetadata(metadata) {
   if (!metadata || !Object.keys(metadata).some((key) => key.startsWith(prefix))) return void 0;
-  const count = Number(metadata[countKey]);
-  if (!Number.isInteger(count) || count < 1 || count > 24) {
+  const count2 = Number(metadata[countKey]);
+  if (!Number.isInteger(count2) || count2 < 1 || count2 > 24) {
     throw new Error("Invalid promotional credit snapshot");
   }
   let encoded = "";
-  for (let index = 0; index < count; index++) {
+  for (let index = 0; index < count2; index++) {
     const chunk = metadata[`${prefix}${index}`];
     if (!chunk) throw new Error("Incomplete promotional credit snapshot");
     encoded += chunk;
@@ -95517,7 +95568,7 @@ import {
   getPrReviewAppRegistrationSecret,
   listPrReviewAppRegistrations as listPrReviewAppRegistrations3,
   listPrReviewRepositoryBindings as listPrReviewRepositoryBindings2,
-  nestedPostgresSqlState as nestedPostgresSqlState9,
+  nestedPostgresSqlState as nestedPostgresSqlState10,
   recordAuditEvent as recordAuditEvent12,
   updatePrReviewAppRegistration,
   updatePrReviewRepositoryBinding
@@ -95733,7 +95784,7 @@ import {
   getAutomationSourceSecret as getAutomationSourceSecret2,
   listPrReviewAppRegistrations as listPrReviewAppRegistrations2,
   listPrReviewRepositoryBindings,
-  nestedPostgresSqlState as nestedPostgresSqlState8,
+  nestedPostgresSqlState as nestedPostgresSqlState9,
   PrReviewDispatchAuthorityError,
   recordAuditEvent as recordAuditEvent11,
   resolveManagedGitHubPrReviewRoute,
@@ -96774,7 +96825,7 @@ function registerPrReviewGitHubRoutes(app, deps) {
       if (error instanceof PrReviewDispatchAuthorityError) {
         throw new HTTPException76(409, { message: error.message });
       }
-      if (nestedPostgresSqlState8(error) === "23505") {
+      if (nestedPostgresSqlState9(error) === "23505") {
         throw new HTTPException76(409, {
           message: "One of these repositories is already connected to Opengeni Lens in another workspace"
         });
@@ -97519,7 +97570,7 @@ async function mapPrReviewUniqueConflict(operation, message) {
   try {
     return await operation;
   } catch (error) {
-    if (nestedPostgresSqlState9(error) === "23505") {
+    if (nestedPostgresSqlState10(error) === "23505") {
       throw new HTTPException77(409, { message });
     }
     throw error;
@@ -100182,219 +100233,10 @@ function registerScheduledTaskRoutes(app, deps) {
   });
 }
 
-// src/routes/sessions.ts
-import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
-import { assertGoalResumeAllowed as assertGoalResumeAllowed2, GoalResumeBlockedError } from "@opengeni/core";
-import { UnsupportedLatencyModeError } from "@opengeni/config";
-import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
-import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
-import * as sessionPreviewSchema from "@opengeni/db/schema";
-import { SessionMessageSearchRequest } from "@opengeni/contracts";
-import { scheduledSessionIds } from "@opengeni/db";
-import { isVerifiedDelegatedHumanAuthorization as isVerifiedDelegatedHumanAuthorization4, withSiteSessionOrigin as withSiteSessionOrigin3 } from "@opengeni/core";
-import { freezeSessionRealtimeConnectionAccounts } from "@opengeni/core";
-import { SandboxRecoveryRequest } from "@opengeni/contracts";
-import { getManagedHumanSandboxRecovery, consentManagedHumanSandboxRecovery } from "@opengeni/core";
-import { SandboxRecoveryConflictError } from "@opengeni/db";
-import { getSessionCodexAccounts } from "@opengeni/db";
-import { getToolActionReview, getToolReviewDetailsPage } from "@opengeni/db";
-import {
-  AcknowledgeStreamRequest,
-  ApplySessionGoalRevisionRequest,
-  ListSessionGoalRevisionsQuery,
-  RejectSessionGoalRevisionRequest,
-  RollbackSessionGoalRevisionRequest,
-  ActivateCodexRealtimeConnectionRequest,
-  AttachViewerRequest,
-  BeginSessionRealtimeRequest,
-  ClearSessionContextRequest,
-  CodexRealtimeWebrtcRequest,
-  GatewayRealtimeConnectRequest,
-  ClientSessionEvent,
-  CompactSessionContextRequest,
-  CreateSessionRequest as CreateSessionRequest2,
-  DeleteSessionQueueItemRequest,
-  EditSessionQueueItemRequest,
-  EndSessionRealtimeRequest,
-  FsDeleteRequest,
-  FsListBatchRequest,
-  FsListRequest,
-  FsMkdirRequest,
-  FsMoveRequest,
-  FsReadRequest,
-  FsWriteRequest,
-  ForkSessionRequest,
-  HumanInputRequestStatus,
-  GitDiffRequest,
-  GitReadBatchRequest,
-  GitLogRequest,
-  GitShowRequest,
-  GitStatusRequest,
-  MoveSessionQueueItemRequest,
-  PtyCloseRequest,
-  PtyOpenRequest,
-  PtyResizeRequest,
-  PtyWriteRequest,
-  PublishSandboxFileArtifactRequest,
-  RenewSessionRealtimeRequest,
-  SyncSessionRealtimeLedgerRequest,
-  SessionControlRequest,
-  SessionRetryRequest,
-  SESSION_EVENT_RAW_DELTA_TYPES as SESSION_EVENT_RAW_DELTA_TYPES2,
-  SessionEventPayloadMode as SessionEventPayloadMode2,
-  SessionEventReadDirection as SessionEventReadDirection2,
-  SessionEventReadMode as SessionEventReadMode2,
-  SessionEventLatestClass as SessionEventLatestClass2,
-  SessionEventResultMode as SessionEventResultMode2,
-  SessionScopeSubjectId,
-  SessionEventSemanticClass as SessionEventSemanticClass2,
-  SessionEventType as SessionEventType2,
-  SessionMcpServerId,
-  SaveNewSessionDraftRequest,
-  compactSessionEventResult as compactSessionEventResult3,
-  sessionEventLatestClassToSemanticClass as sessionEventLatestClassToSemanticClass2,
-  SaveComposerDraftRequest,
-  SubmitComposerDraftRequest,
-  SteerSessionQueueItemRequest,
-  SteerSessionMessageRequest,
-  TerminalExecRequest,
-  UpdateSessionChannelRequest,
-  UpdateSessionAttentionRequest,
-  UpdateSessionArchiveRequest,
-  UpdateSessionPinRequest,
-  UpdateSessionGoalRequest,
-  UpdateSessionMcpApprovalPolicyRequest,
-  UpdateSessionRequest,
-  UpdateSessionVariableSetsRequest,
-  UpdateSessionVisibilityRequest,
-  UpdateSessionToolPolicyRequest,
-  UpdateSessionAgentRequest,
-  AgentConfigError as AgentConfigError2,
-  ViewerHeartbeatRequest,
-  WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
-  WORK_CLAIM_CANONICAL_KEY_MAX_BYTES as WORK_CLAIM_CANONICAL_KEY_MAX_BYTES2,
-  WORK_CLAIM_DISCOVERY_LIMIT as WORK_CLAIM_DISCOVERY_LIMIT2,
-  WORK_CLAIM_NAMESPACE_MAX_BYTES as WORK_CLAIM_NAMESPACE_MAX_BYTES2,
-  WORK_DISCOVERY_QUERY_MAX_CHARS as WORK_DISCOVERY_QUERY_MAX_CHARS2,
-  WORK_DISCOVERY_RECENT_HOURS_MAX as WORK_DISCOVERY_RECENT_HOURS_MAX2,
-  WorkClaimSubjectFilter as WorkClaimSubjectFilterSchema,
-  WorkClaimSubjectType as WorkClaimSubjectType2,
-  normalizeWorkClaimCanonicalKey,
-  normalizeWorkClaimNamespace,
-  workspaceControlUtf8Bytes
-} from "@opengeni/contracts";
-import { streamTokenDegraded } from "@opengeni/config";
-import {
-  recordAuditEvent as recordAuditEvent13,
-  acceptSessionApprovalDecision as acceptSessionApprovalDecision2,
-  acceptSessionHumanInputResponse as acceptSessionHumanInputResponse2,
-  clearSessionGoal,
-  clearSessionContext,
-  getOpenPtySession,
-  getEnrollment as getEnrollment2,
-  getLiveEnrollmentConnection as getLiveEnrollmentConnection7,
-  getRetainedProcess,
-  getSandbox as getSandbox4,
-  getSession as getSession9,
-  readActiveSandbox as readActiveSandbox3,
-  deleteSessionTreeIfQuiescent,
-  getSessionEvent,
-  getSessionForSubject as getSessionForSubject2,
-  getSessionGoal as getSessionGoal2,
-  getLatestSessionModelContext,
-  getSessionHumanInputRequest,
-  getSessionGoalWithContinuation,
-  getSessionGoalRevision,
-  getSessionQueueSnapshot as getSessionQueueSnapshot2,
-  getStreamAcknowledgment,
-  insertPtySession,
-  listSessionEventPage as listSessionEventPage3,
-  listSessionHumanInputRequests,
-  listSessionGoalRevisionPage,
-  listSessionGoalRevisions,
-  rejectSessionGoalRevisionWithEvent,
-  listSessionIdsInGroup,
-  listSessionDiscoverySummaries as listSessionDiscoverySummaries2,
-  listSessionDiscoveryAncestorPaths,
-  listSessionsForSubject,
-  listSessionEntriesForSubject,
-  getLatestStartedSessionTurn,
-  listSessionTurns,
-  projectEffectiveControlForRelatedAccess as projectEffectiveControlForRelatedAccess2,
-  projectSessionForRelatedAccess as projectSessionForRelatedAccess2,
-  recordStreamAcknowledgment,
-  requestSessionCompaction,
-  switchSessionCodexAccount,
-  setSessionChannel as setSessionChannel2,
-  updateSessionVariableSets,
-  ChannelNotFoundError,
-  setSessionAttention,
-  setSessionArchive,
-  setSessionPin,
-  SessionAttentionVersionConflictError,
-  SessionArchiveVersionConflictError,
-  SessionPinVersionConflictError,
-  SessionPinAccessError,
-  SessionListAccessError,
-  SessionListCursorError,
-  SessionListCursorExpiredError,
-  decodeSessionListCursor,
-  revokeViewer,
-  setSessionGoalStatusWithEvent as setSessionGoalStatusWithEvent2,
-  upsertSessionGoalWithEvent as upsertSessionGoalWithEvent2,
-  updatePtySessionActivity,
-  QueueCommandConflictError,
-  beginSessionRealtimeInTransaction,
-  activateSessionRealtimeConnectionInTransaction,
-  claimSessionRealtimeConnectionInTransaction,
-  completeSessionRealtimeConnectionInTransaction,
-  endSessionRealtimeInTransaction,
-  failSessionRealtimeConnectionInTransaction,
-  NewSessionDraftConflictError,
-  SessionCommandIdempotencyError,
-  SessionControlConflictError,
-  SessionRealtimeConflictError,
-  SessionToolPolicyVersionConflictError,
-  SessionContextBusyError,
-  SessionVariableSetSelectionUnavailableError,
-  SessionCreateConnectionSelectionUnavailableError as SessionCreateConnectionSelectionUnavailableError2,
-  workspaceControlRequestLockTimeoutMs,
-  SessionTenancyAccessError,
-  SessionTenancyConflictError,
-  SessionTenancyInvalidRequestError,
-  SessionTenancyNotActivatedError,
-  HumanInputResponseValidationError as HumanInputResponseValidationError2,
-  SkillHumanResponseError,
-  latestWorkspaceCapture,
-  sessionLatestWorkspaceCapture,
-  renewSessionRealtimeInTransaction,
-  syncSessionRealtimeLedgerInTransaction,
-  withWorkspaceSessionActivityRls,
-  withWorkspaceRls,
-  workspaceCaptureAtRevision
-} from "@opengeni/db";
-import {
-  backgroundCommandActivityForSessions,
-  listSessionBackgroundCommands,
-  requestSessionBackgroundCommandCancellation
-} from "@opengeni/db/session-background-commands";
-import {
-  appendAndPublishEvents as appendAndPublishEvents3,
-  boundSessionEventHttpPage,
-  coalesceSessionEventDeltasWithCoverage as coalesceSessionEventDeltasWithCoverage2,
-  publishDurableSessionEvents as publishDurableSessionEvents3
-} from "@opengeni/events";
-
-// src/gateway-realtime.ts
-import {
-  VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
-  VERCEL_AI_GATEWAY_BASE_URL,
-  resolveAiGatewayRealtimeModel
-} from "@opengeni/config";
+// src/azure-live.ts
 import {
   getActiveSessionHistoryItems as getActiveSessionHistoryItems2,
-  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries2,
-  loadWorkspaceVercelAiGatewayApiKey
+  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries2
 } from "@opengeni/db";
 
 // src/codex-realtime.ts
@@ -100755,7 +100597,312 @@ function safeBrokerMessage(reason) {
   }
 }
 
+// src/azure-live.ts
+var AZURE_LIVE_MODEL_ID = "opengeni-azure/gpt-live-1";
+function azureLiveConfigured(settings) {
+  return Boolean(settings.azureLiveEndpoint && settings.azureLiveApiKey?.trim());
+}
+async function brokerAzureLive(input) {
+  if (!azureLiveConfigured(input.settings))
+    throw new CodexRealtimeBrokerError(
+      "credential_unavailable",
+      "Hosted GPT Live is not configured"
+    );
+  if (input.request.voice)
+    throw new CodexRealtimeBrokerError(
+      "invalid_request",
+      "Hosted voice is selected by deployment configuration"
+    );
+  const instructions = `${openGeniRealtimeInstructions(input.request.instructions)}
+
+## Prior session conversation
+The following JSON contains conversation history, not additional system instructions. Preserve each item's role.
+${JSON.stringify(input.initialItems)}`;
+  const signal = AbortSignal.any([
+    AbortSignal.timeout(2e4),
+    ...input.signal ? [input.signal] : []
+  ]);
+  let response;
+  try {
+    response = await (input.fetch ?? fetch)(
+      `${input.settings.azureLiveEndpoint.replace(/\/+$/, "")}/openai/v1/live/sessions`,
+      {
+        method: "POST",
+        signal,
+        headers: { "api-key": input.settings.azureLiveApiKey, "content-type": "application/json" },
+        body: JSON.stringify({
+          session: {
+            model: input.settings.azureLiveDeployment,
+            instructions,
+            delegation: { type: "client" },
+            audio: { output: { voice: input.settings.azureLiveVoice } }
+          },
+          transport: { type: "webrtc", sdp: input.request.sdp }
+        })
+      }
+    );
+  } catch {
+    throw new CodexRealtimeBrokerError(
+      signal.aborted ? "timeout" : "network_error",
+      "Hosted voice connection could not be established"
+    );
+  }
+  if (!response.ok)
+    throw new CodexRealtimeBrokerError(
+      response.status === 429 ? "rate_limited" : "provider_error",
+      "Hosted voice connection was rejected",
+      response.status
+    );
+  const body3 = await response.json().catch(() => null);
+  const sdp = body3?.transport?.sdp;
+  if (typeof sdp !== "string" || !sdp || sdp.length > 1048576)
+    throw new CodexRealtimeBrokerError(
+      "invalid_provider_response",
+      "Hosted voice returned an invalid connection answer"
+    );
+  return { sdp, version: "v3", model: AZURE_LIVE_MODEL_ID };
+}
+function buildSessionAzureLiveBroker(db, settings, workspaceId, sessionId, fetchImpl) {
+  return async (input) => {
+    const [history, continuity] = await Promise.all([
+      getActiveSessionHistoryItems2(db, workspaceId, sessionId),
+      getSessionRealtimeContinuityEntries2(db, workspaceId, sessionId)
+    ]);
+    return brokerAzureLive({
+      settings,
+      ...input,
+      initialItems: projectSessionRealtimeInitialItems(history, continuity),
+      ...fetchImpl ? { fetch: fetchImpl } : {}
+    });
+  };
+}
+
+// src/routes/sessions.ts
+import { getRetainedProviderCommand } from "@opengeni/db/retained-provider-commands";
+import { assertGoalResumeAllowed as assertGoalResumeAllowed2, GoalResumeBlockedError } from "@opengeni/core";
+import { UnsupportedLatencyModeError } from "@opengeni/config";
+import { searchSessionMessagesForSubject, SessionMessageSearchCursorError } from "@opengeni/db";
+import { listSessionEventSlices } from "@opengeni/db/session-event-slices";
+import * as sessionPreviewSchema from "@opengeni/db/schema";
+import { SessionMessageSearchRequest } from "@opengeni/contracts";
+import { requireWorkspace as requireWorkspace3, scheduledSessionIds } from "@opengeni/db";
+import { isVerifiedDelegatedHumanAuthorization as isVerifiedDelegatedHumanAuthorization4, withSiteSessionOrigin as withSiteSessionOrigin3 } from "@opengeni/core";
+import { freezeSessionRealtimeConnectionAccounts } from "@opengeni/core";
+import {
+  createRealtimeVoiceBilling,
+  RealtimeVoiceUnavailableError,
+  TranscriptionBillingRefusedError
+} from "@opengeni/core";
+
+// src/transcription/billing-refusal.ts
+function transcriptionBillingRefusal(c, error) {
+  return c.json({ code: error.code, message: error.message, ...error.details }, error.status);
+}
+
+// src/routes/sessions.ts
+import { SandboxRecoveryRequest } from "@opengeni/contracts";
+import { getManagedHumanSandboxRecovery, consentManagedHumanSandboxRecovery } from "@opengeni/core";
+import { SandboxRecoveryConflictError } from "@opengeni/db";
+import { getSessionCodexAccounts } from "@opengeni/db";
+import { getToolActionReview, getToolReviewDetailsPage } from "@opengeni/db";
+import {
+  AcknowledgeStreamRequest,
+  ApplySessionGoalRevisionRequest,
+  ListSessionGoalRevisionsQuery,
+  RejectSessionGoalRevisionRequest,
+  RollbackSessionGoalRevisionRequest,
+  ActivateCodexRealtimeConnectionRequest,
+  AttachViewerRequest,
+  BeginSessionRealtimeRequest,
+  ClearSessionContextRequest,
+  CodexRealtimeWebrtcRequest,
+  GatewayRealtimeConnectRequest,
+  ClientSessionEvent,
+  CompactSessionContextRequest,
+  CreateSessionRequest as CreateSessionRequest2,
+  DeleteSessionQueueItemRequest,
+  EditSessionQueueItemRequest,
+  EndSessionRealtimeRequest,
+  FsDeleteRequest,
+  FsListBatchRequest,
+  FsListRequest,
+  FsMkdirRequest,
+  FsMoveRequest,
+  FsReadRequest,
+  FsWriteRequest,
+  ForkSessionRequest,
+  HumanInputRequestStatus,
+  GitDiffRequest,
+  GitReadBatchRequest,
+  GitLogRequest,
+  GitShowRequest,
+  GitStatusRequest,
+  MoveSessionQueueItemRequest,
+  PtyCloseRequest,
+  PtyOpenRequest,
+  PtyResizeRequest,
+  PtyWriteRequest,
+  PublishSandboxFileArtifactRequest,
+  RenewSessionRealtimeRequest,
+  SyncSessionRealtimeLedgerRequest,
+  SessionControlRequest,
+  SessionRetryRequest,
+  SESSION_EVENT_RAW_DELTA_TYPES as SESSION_EVENT_RAW_DELTA_TYPES2,
+  SessionEventPayloadMode as SessionEventPayloadMode2,
+  SessionEventReadDirection as SessionEventReadDirection2,
+  SessionEventReadMode as SessionEventReadMode2,
+  SessionEventLatestClass as SessionEventLatestClass2,
+  SessionEventResultMode as SessionEventResultMode2,
+  SessionScopeSubjectId,
+  SessionEventSemanticClass as SessionEventSemanticClass2,
+  SessionEventType as SessionEventType2,
+  SessionMcpServerId,
+  SaveNewSessionDraftRequest,
+  compactSessionEventResult as compactSessionEventResult3,
+  sessionEventLatestClassToSemanticClass as sessionEventLatestClassToSemanticClass2,
+  SaveComposerDraftRequest,
+  SubmitComposerDraftRequest,
+  SteerSessionQueueItemRequest,
+  SteerSessionMessageRequest,
+  TerminalExecRequest,
+  UpdateSessionChannelRequest,
+  UpdateSessionAttentionRequest,
+  UpdateSessionArchiveRequest,
+  UpdateSessionPinRequest,
+  UpdateSessionGoalRequest,
+  UpdateSessionMcpApprovalPolicyRequest,
+  UpdateSessionRequest,
+  UpdateSessionVariableSetsRequest,
+  UpdateSessionVisibilityRequest,
+  UpdateSessionToolPolicyRequest,
+  UpdateSessionAgentRequest,
+  AgentConfigError as AgentConfigError2,
+  ViewerHeartbeatRequest,
+  WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
+  WORK_CLAIM_CANONICAL_KEY_MAX_BYTES as WORK_CLAIM_CANONICAL_KEY_MAX_BYTES2,
+  WORK_CLAIM_DISCOVERY_LIMIT as WORK_CLAIM_DISCOVERY_LIMIT2,
+  WORK_CLAIM_NAMESPACE_MAX_BYTES as WORK_CLAIM_NAMESPACE_MAX_BYTES2,
+  WORK_DISCOVERY_QUERY_MAX_CHARS as WORK_DISCOVERY_QUERY_MAX_CHARS2,
+  WORK_DISCOVERY_RECENT_HOURS_MAX as WORK_DISCOVERY_RECENT_HOURS_MAX2,
+  WorkClaimSubjectFilter as WorkClaimSubjectFilterSchema,
+  WorkClaimSubjectType as WorkClaimSubjectType2,
+  normalizeWorkClaimCanonicalKey,
+  normalizeWorkClaimNamespace,
+  workspaceControlUtf8Bytes
+} from "@opengeni/contracts";
+import { streamTokenDegraded } from "@opengeni/config";
+import {
+  recordAuditEvent as recordAuditEvent13,
+  acceptSessionApprovalDecision as acceptSessionApprovalDecision2,
+  acceptSessionHumanInputResponse as acceptSessionHumanInputResponse2,
+  clearSessionGoal,
+  clearSessionContext,
+  getOpenPtySession,
+  getEnrollment as getEnrollment2,
+  getLiveEnrollmentConnection as getLiveEnrollmentConnection7,
+  getRetainedProcess,
+  getSandbox as getSandbox4,
+  getSession as getSession9,
+  readActiveSandbox as readActiveSandbox3,
+  deleteSessionTreeIfQuiescent,
+  getSessionEvent,
+  getSessionForSubject as getSessionForSubject2,
+  getSessionGoal as getSessionGoal2,
+  getLatestSessionModelContext,
+  getSessionHumanInputRequest,
+  getSessionGoalWithContinuation,
+  getSessionGoalRevision,
+  getSessionQueueSnapshot as getSessionQueueSnapshot2,
+  getStreamAcknowledgment,
+  insertPtySession,
+  listSessionEventPage as listSessionEventPage3,
+  listSessionHumanInputRequests,
+  listSessionGoalRevisionPage,
+  listSessionGoalRevisions,
+  rejectSessionGoalRevisionWithEvent,
+  listSessionIdsInGroup,
+  listSessionDiscoverySummaries as listSessionDiscoverySummaries2,
+  listSessionDiscoveryAncestorPaths,
+  listSessionsForSubject,
+  listSessionEntriesForSubject,
+  getLatestStartedSessionTurn,
+  listSessionTurns,
+  projectEffectiveControlForRelatedAccess as projectEffectiveControlForRelatedAccess2,
+  projectSessionForRelatedAccess as projectSessionForRelatedAccess2,
+  recordStreamAcknowledgment,
+  requestSessionCompaction,
+  switchSessionCodexAccount,
+  setSessionChannel as setSessionChannel2,
+  updateSessionVariableSets,
+  ChannelNotFoundError,
+  setSessionAttention,
+  setSessionArchive,
+  setSessionPin,
+  SessionAttentionVersionConflictError,
+  SessionArchiveVersionConflictError,
+  SessionPinVersionConflictError,
+  SessionPinAccessError,
+  SessionListAccessError,
+  SessionListCursorError,
+  SessionListCursorExpiredError,
+  decodeSessionListCursor,
+  revokeViewer,
+  setSessionGoalStatusWithEvent as setSessionGoalStatusWithEvent2,
+  upsertSessionGoalWithEvent as upsertSessionGoalWithEvent2,
+  updatePtySessionActivity,
+  QueueCommandConflictError,
+  beginSessionRealtimeInTransaction,
+  activateSessionRealtimeConnectionInTransaction,
+  claimSessionRealtimeConnectionInTransaction,
+  completeSessionRealtimeConnectionInTransaction,
+  endSessionRealtimeInTransaction,
+  failSessionRealtimeConnectionInTransaction,
+  NewSessionDraftConflictError,
+  SessionCommandIdempotencyError,
+  SessionControlConflictError,
+  SessionRealtimeConflictError,
+  SessionToolPolicyVersionConflictError,
+  SessionContextBusyError,
+  SessionVariableSetSelectionUnavailableError,
+  SessionCreateConnectionSelectionUnavailableError as SessionCreateConnectionSelectionUnavailableError2,
+  workspaceControlRequestLockTimeoutMs,
+  SessionTenancyAccessError,
+  SessionTenancyConflictError,
+  SessionTenancyInvalidRequestError,
+  SessionTenancyNotActivatedError,
+  HumanInputResponseValidationError as HumanInputResponseValidationError2,
+  SkillHumanResponseError,
+  latestWorkspaceCapture,
+  sessionLatestWorkspaceCapture,
+  renewSessionRealtimeInTransaction,
+  syncSessionRealtimeLedgerInTransaction,
+  withWorkspaceSessionActivityRls,
+  withWorkspaceRls,
+  workspaceCaptureAtRevision
+} from "@opengeni/db";
+import {
+  backgroundCommandActivityForSessions,
+  listSessionBackgroundCommands,
+  requestSessionBackgroundCommandCancellation
+} from "@opengeni/db/session-background-commands";
+import {
+  appendAndPublishEvents as appendAndPublishEvents3,
+  boundSessionEventHttpPage,
+  coalesceSessionEventDeltasWithCoverage as coalesceSessionEventDeltasWithCoverage2,
+  publishDurableSessionEvents as publishDurableSessionEvents3
+} from "@opengeni/events";
+
 // src/gateway-realtime.ts
+import {
+  VERCEL_AI_GATEWAY_AI_SDK_BASE_URL,
+  VERCEL_AI_GATEWAY_BASE_URL,
+  resolveAiGatewayRealtimeModel
+} from "@opengeni/config";
+import {
+  getActiveSessionHistoryItems as getActiveSessionHistoryItems3,
+  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries3,
+  loadWorkspaceVercelAiGatewayApiKey
+} from "@opengeni/db";
 var GatewayRealtimeBrokerError = class extends Error {
   constructor(code, message, providerStatus = null) {
     super(message);
@@ -100780,10 +100927,11 @@ async function createGatewayRealtimeConnectionSecret(input) {
     );
   }
   const [history, continuity, minted] = await Promise.all([
-    getActiveSessionHistoryItems2(input.db, input.workspaceId, input.sessionId),
-    getSessionRealtimeContinuityEntries2(input.db, input.workspaceId, input.sessionId),
+    getActiveSessionHistoryItems3(input.db, input.workspaceId, input.sessionId),
+    getSessionRealtimeContinuityEntries3(input.db, input.workspaceId, input.sessionId),
     mintGatewayClientSecret({
       apiKey,
+      source: resolved.source,
       upstreamModelId: resolved.upstreamModelId,
       fetchImpl: input.fetchImpl ?? fetch
     })
@@ -100812,13 +100960,14 @@ async function mintGatewayClientSecret(input) {
   } catch {
     throw new GatewayRealtimeBrokerError(
       "provider_error",
-      "AI Gateway realtime token request failed"
+      "The voice provider could not be reached. Try again."
     );
   }
   if (!response.ok) {
+    const rejected = response.status === 401 || response.status === 403;
     throw new GatewayRealtimeBrokerError(
-      response.status === 401 || response.status === 403 ? "credential_unavailable" : "provider_error",
-      response.status === 401 || response.status === 403 ? "AI Gateway credentials were rejected" : "AI Gateway realtime token request failed",
+      rejected ? "credential_unavailable" : "provider_error",
+      rejected ? input.source === "managed" ? "Opengeni voice is temporarily unavailable. Try another voice model." : "Your AI Gateway key was rejected. Update it in workspace settings." : "The voice provider could not start a call. Try again.",
       response.status
     );
   }
@@ -100844,8 +100993,8 @@ async function mintGatewayClientSecret(input) {
 // src/xai-realtime.ts
 import { SUPERGROK_REALTIME_MODEL_ID } from "@opengeni/config";
 import {
-  getActiveSessionHistoryItems as getActiveSessionHistoryItems3,
-  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries3,
+  getActiveSessionHistoryItems as getActiveSessionHistoryItems4,
+  getSessionRealtimeContinuityEntries as getSessionRealtimeContinuityEntries4,
   getXaiSessionAccountPin,
   resolveXaiProviderAccountAuthoritySnapshotForAcceptance as resolveXaiProviderAccountAuthoritySnapshotForAcceptance3,
   setXaiSessionAccountPin
@@ -101054,8 +101203,8 @@ async function createXaiRealtimeConnectionSecret(input) {
     );
   }
   const [history, continuity, minted] = await Promise.all([
-    getActiveSessionHistoryItems3(input.db, input.workspaceId, input.sessionId),
-    getSessionRealtimeContinuityEntries3(input.db, input.workspaceId, input.sessionId),
+    getActiveSessionHistoryItems4(input.db, input.workspaceId, input.sessionId),
+    getSessionRealtimeContinuityEntries4(input.db, input.workspaceId, input.sessionId),
     mintXaiClientSecret({
       auth,
       fetchImpl: input.fetchImpl ?? fetch
@@ -101495,6 +101644,46 @@ function registerSessionRoutes(app, deps) {
     observability: deps.observability
   };
   const workspaceCaptureManifestCache = new WorkspaceCaptureManifestCache();
+  const realtimeVoiceBilling = createRealtimeVoiceBilling({ db, settings });
+  const realtimeVoiceRefusalResponse = (c, error) => {
+    if (error instanceof TranscriptionBillingRefusedError) {
+      return transcriptionBillingRefusal(c, error);
+    }
+    if (error instanceof RealtimeVoiceUnavailableError) {
+      return c.json(
+        {
+          error: {
+            status: 409,
+            code: "realtime_voice_unavailable",
+            message: error.message,
+            retryable: false,
+            details: { reason: error.code }
+          }
+        },
+        409
+      );
+    }
+    return null;
+  };
+  const settleRealtimeVoice = async (input) => {
+    try {
+      return await realtimeVoiceBilling.settle({
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        realtimeId: input.realtimeId,
+        callerSubjectId: input.grant.subjectId,
+        attribution: input.attribution
+      });
+    } catch (error) {
+      console.error("realtime voice settlement failed", {
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        realtimeId: input.realtimeId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return null;
+    }
+  };
   const withSiteCommandOrigin = (c, workspaceId, run) => withOptionalSiteCommandOrigin(
     db,
     workspaceId,
@@ -102143,18 +102332,26 @@ function registerSessionRoutes(app, deps) {
     if (!session) {
       throw new HTTPException88(404, { message: "session not found" });
     }
-    const activity = await backgroundCommandActivityForSessions(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      sessionIds: [sessionId]
-    });
-    const scheduleTargets = hasPermission23(grant.permissions, "scheduled_tasks:run") && hasPermission23(grant.permissions, "sessions:control") ? await scheduledSessionIds(db, workspaceId, [sessionId]) : /* @__PURE__ */ new Set();
+    const [activity, scheduleTargets, policy] = await Promise.all([
+      backgroundCommandActivityForSessions(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        sessionIds: [sessionId]
+      }),
+      hasPermission23(grant.permissions, "scheduled_tasks:run") && hasPermission23(grant.permissions, "sessions:control") ? scheduledSessionIds(db, workspaceId, [sessionId]) : Promise.resolve(/* @__PURE__ */ new Set()),
+      loadEffectivePolicyContext(deps, workspaceId, grant.subjectId, [session])
+    ]);
     return c.json(
-      await withEffectivePolicy(deps, workspaceId, grant.subjectId, {
-        ...session,
-        hasSchedules: scheduleTargets.has(sessionId),
-        ...activity.get(sessionId) ? { backgroundCommandActivity: activity.get(sessionId) } : {}
-      })
+      sessionWithEffectiveToolPolicy2(
+        {
+          ...session,
+          hasSchedules: scheduleTargets.has(sessionId),
+          ...activity.get(sessionId) ? { backgroundCommandActivity: activity.get(sessionId) } : {}
+        },
+        policy.workspaceServerIds,
+        policy.workspaceDefaultServerIds,
+        policy.effectiveToolsContext
+      )
     );
   });
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/model-context", async (c) => {
@@ -102298,6 +102495,18 @@ function registerSessionRoutes(app, deps) {
         message: "invalid session realtime request"
       });
     }
+    try {
+      await realtimeVoiceBilling.admit({
+        accountId: grant.accountId,
+        workspaceId,
+        model: parsed.data.model,
+        attribution: creditDebitAttributionForGrant(grant)
+      });
+    } catch (error) {
+      const refused = realtimeVoiceRefusalResponse(c, error);
+      if (refused) return refused;
+      throw error;
+    }
     try {
       const result = await withWorkspaceSessionActivityRls(db, workspaceId, async (scopedDb) => {
         const accounts = await freezeSessionRealtimeConnectionAccounts({
@@ -102342,6 +102551,14 @@ function registerSessionRoutes(app, deps) {
         });
       }
       try {
+        const settlement = await settleRealtimeVoice({
+          grant,
+          attribution: creditDebitAttributionForGrant(grant),
+          workspaceId,
+          sessionId,
+          realtimeId
+        });
+        const stop = settlement?.stop ?? null;
         const result = await withWorkspaceSessionActivityRls(
           db,
           workspaceId,
@@ -102350,12 +102567,17 @@ function registerSessionRoutes(app, deps) {
             sessionId,
             realtimeId,
             ownerSubjectId: grant.subjectId,
-            ...parsed.data
+            ...parsed.data,
+            extendLease: stop === null
           })
         );
         await publishRealtimeMutation(grant.accountId, workspaceId, sessionId, result);
         c.header("cache-control", "private, no-store");
-        return c.json({ mode: result.mode, replay: result.replay });
+        return c.json({
+          mode: result.mode,
+          replay: result.replay,
+          ...stop && result.mode.state === "active" ? { stop: { code: stop.code, message: stop.message } } : {}
+        });
       } catch (error) {
         throw sessionRealtimeHttpError(error);
       }
@@ -102390,6 +102612,13 @@ function registerSessionRoutes(app, deps) {
         })
       );
       await publishRealtimeMutation(grant.accountId, workspaceId, sessionId, result);
+      await settleRealtimeVoice({
+        grant,
+        attribution: creditDebitAttributionForGrant(grant),
+        workspaceId,
+        sessionId,
+        realtimeId
+      });
       c.header("cache-control", "private, no-store");
       return c.json({ mode: result.mode, replay: result.replay });
     } catch (error) {
@@ -102425,21 +102654,31 @@ function registerSessionRoutes(app, deps) {
       const claim = await withWorkspaceRls(
         db,
         workspaceId,
-        async (scopedDb) => scopedDb.transaction(
-          async (tx) => claimSessionRealtimeConnectionInTransaction(tx, {
-            workspaceId,
-            sessionId,
-            realtimeId,
-            operationId,
-            ownerSubjectId: grant.subjectId,
-            browserInstanceId,
-            ownerKey,
-            expectedVersion,
-            expectedConnectionEpoch,
-            rotate,
-            promotionMode: browserActivation === "required" ? "staged" : "legacy"
-          })
-        )
+        async (scopedDb) => scopedDb.transaction(async (tx) => {
+          const claimed = await claimSessionRealtimeConnectionInTransaction(
+            tx,
+            {
+              workspaceId,
+              sessionId,
+              realtimeId,
+              operationId,
+              ownerSubjectId: grant.subjectId,
+              browserInstanceId,
+              ownerKey,
+              expectedVersion,
+              expectedConnectionEpoch,
+              rotate,
+              promotionMode: browserActivation === "required" ? "staged" : "legacy"
+            }
+          );
+          if (claimed.mode.model !== "gpt-live-1-boulder-alpha" && claimed.mode.model !== AZURE_LIVE_MODEL_ID) {
+            throw new CodexRealtimeBrokerError(
+              "invalid_request",
+              "This voice model does not use WebRTC negotiation"
+            );
+          }
+          return claimed;
+        })
       );
       if (claim.replay) {
         if (claim.connection.state !== "ready" && claim.connection.state !== "active" || !claim.connection.sdpAnswer) {
@@ -102470,7 +102709,7 @@ function registerSessionRoutes(app, deps) {
         return c.json({
           sdp: claim.connection.sdpAnswer,
           version: "v3",
-          model: "gpt-live-1-boulder-alpha",
+          model: claim.mode.model,
           connectionId: claim.connection.id,
           connectionEpoch: claim.connection.connectionEpoch,
           startupFenceSequence: claim.connection.startupFenceSequence,
@@ -102478,13 +102717,34 @@ function registerSessionRoutes(app, deps) {
           replay: true
         });
       }
-      const broker = buildSessionCodexRealtimeBroker(
-        db,
-        settings,
-        workspaceId,
-        sessionId,
-        deps.codexFetch
-      );
+      try {
+        await realtimeVoiceBilling.admit({
+          accountId: grant.accountId,
+          workspaceId,
+          model: claim.mode.model,
+          attribution: creditDebitAttributionForGrant(grant)
+        });
+      } catch (error) {
+        const refused = realtimeVoiceRefusalResponse(c, error);
+        if (!refused) throw error;
+        await withWorkspaceRls(
+          db,
+          workspaceId,
+          async (scopedDb) => scopedDb.transaction(
+            async (tx) => failSessionRealtimeConnectionInTransaction(tx, {
+              workspaceId,
+              sessionId,
+              realtimeId,
+              connectionId: claim.connection.id,
+              operationId,
+              connectionEpoch: claim.connection.connectionEpoch,
+              failureCode: "billing_refused"
+            })
+          )
+        ).catch(() => void 0);
+        return refused;
+      }
+      const broker = (claim.mode.model === AZURE_LIVE_MODEL_ID ? buildSessionAzureLiveBroker : buildSessionCodexRealtimeBroker)(db, settings, workspaceId, sessionId, deps.codexFetch);
       try {
         const answer = await broker({
           request: providerRequest,
@@ -102524,6 +102784,13 @@ function registerSessionRoutes(app, deps) {
             })
           )
         ) : null;
+        await settleRealtimeVoice({
+          grant,
+          attribution: creditDebitAttributionForGrant(grant),
+          workspaceId,
+          sessionId,
+          realtimeId
+        });
         return c.json({
           ...answer,
           connectionId: completed.connection.id,
@@ -102626,6 +102893,12 @@ function registerSessionRoutes(app, deps) {
           "Realtime Gateway tokens are single-use; reconnect with a new operation"
         );
       }
+      await realtimeVoiceBilling.admit({
+        accountId: grant.accountId,
+        workspaceId,
+        model: claim.mode.model,
+        attribution: creditDebitAttributionForGrant(grant)
+      });
       const secret = await createGatewayRealtimeConnectionSecret({
         db,
         settings,
@@ -102651,6 +102924,13 @@ function registerSessionRoutes(app, deps) {
         )
       );
       connectionCompleted = true;
+      await settleRealtimeVoice({
+        grant,
+        attribution: creditDebitAttributionForGrant(grant),
+        workspaceId,
+        sessionId,
+        realtimeId
+      });
       return c.json({
         ...secret,
         connectionId: completed.connection.id,
@@ -102673,11 +102953,13 @@ function registerSessionRoutes(app, deps) {
               connectionId: claimed.connection.id,
               operationId,
               connectionEpoch: claimed.connection.connectionEpoch,
-              failureCode: error instanceof GatewayRealtimeBrokerError ? error.code : "gateway_error"
+              failureCode: error instanceof GatewayRealtimeBrokerError ? error.code : error instanceof TranscriptionBillingRefusedError || error instanceof RealtimeVoiceUnavailableError ? "billing_refused" : "gateway_error"
             })
           )
         ).catch(() => void 0);
       }
+      const refused = realtimeVoiceRefusalResponse(c, error);
+      if (refused) return refused;
       if (error instanceof SessionRealtimeConflictError) throw sessionRealtimeHttpError(error);
       if (!(error instanceof GatewayRealtimeBrokerError)) throw error;
       const status = error.code === "credential_unavailable" ? 409 : 502;
@@ -102883,23 +103165,31 @@ function registerSessionRoutes(app, deps) {
         });
       }
       try {
-        const result = await withWorkspaceSessionActivityRls(db, workspaceId, async (scopedDb) => {
-          await beforeCommit?.(scopedDb);
-          return syncSessionRealtimeLedgerInTransaction(
-            scopedDb,
-            {
-              workspaceId,
-              sessionId,
-              realtimeId,
-              ownerSubjectId: grant.subjectId,
-              ...parsed.data,
-              controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
-            },
-            captureLinked ? {
-              afterDelegationAdmission: async ({ turnId }) => captureLinked(scopedDb, sessionId, turnId)
-            } : {}
-          );
-        });
+        const result = await withWorkspaceSessionActivityRls(
+          db,
+          workspaceId,
+          async (scopedDb) => {
+            await beforeCommit?.(scopedDb);
+            return syncSessionRealtimeLedgerInTransaction(
+              scopedDb,
+              {
+                workspaceId,
+                sessionId,
+                realtimeId,
+                ownerSubjectId: grant.subjectId,
+                ...parsed.data,
+                controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
+              },
+              captureLinked ? {
+                afterDelegationAdmission: async ({ turnId }) => captureLinked(scopedDb, sessionId, turnId)
+              } : {}
+            );
+          },
+          void 0,
+          // External reauthorization takes the organization-membership lock,
+          // which precedes the tenancy fence and the canonical session prefix.
+          Boolean(beforeCommit)
+        );
         await publishRealtimeMutation(grant.accountId, workspaceId, sessionId, result);
         c.header("cache-control", "private, no-store");
         return c.json({ accepted: result.accepted, outbound: result.outbound });
@@ -105543,11 +105833,16 @@ function codexRealtimeHttpFailure(error) {
       return { status: 409, code: "conflict", retryable: false };
   }
 }
+var SESSION_REALTIME_USER_MESSAGES = {
+  REALTIME_ACTIVE: "Voice is already on for this session in another tab or window. End it there, or try again in a minute.",
+  CONTROL_NOT_ACTIVE: "Resume this session to start voice.",
+  SESSION_CANCELLED: "This session was cancelled, so voice can't start."
+};
 function sessionRealtimeHttpError(error) {
   if (error instanceof HTTPException88) return error;
   if (error instanceof SessionRealtimeConflictError) {
     return new HTTPException88(error.code === "REALTIME_NOT_FOUND" ? 404 : 409, {
-      message: error.message,
+      message: SESSION_REALTIME_USER_MESSAGES[error.code] ?? error.message,
       cause: error
     });
   }
@@ -106325,9 +106620,17 @@ function commandConflictResponse(c, error) {
   throw error;
 }
 async function loadEffectivePolicyContext(deps, workspaceId, subjectId, sessions) {
+  const workspaceRead = requireWorkspace3(deps.db, workspaceId);
+  void workspaceRead.catch(() => void 0);
   const [policy, effectiveToolsContext] = await Promise.all([
-    workspaceSessionToolPolicyContext(deps.db, workspaceId, deps.settings, subjectId),
-    workspaceSessionEffectiveToolsContext2(deps, workspaceId, subjectId, sessions)
+    workspaceSessionToolPolicyContext(
+      deps.db,
+      workspaceId,
+      deps.settings,
+      subjectId,
+      workspaceRead
+    ),
+    workspaceSessionEffectiveToolsContext2(deps, workspaceId, subjectId, sessions, workspaceRead)
   ]);
   return { ...policy, effectiveToolsContext };
 }
@@ -106798,6 +107101,11 @@ function socialHttpException(error) {
 }
 
 // src/routes/workspaces.ts
+import {
+  createRealtimeVoiceBilling as createRealtimeVoiceBilling2,
+  deploymentRealtimeVoice,
+  realtimeVoiceOfferProblem
+} from "@opengeni/core";
 import { withDirectModelProviders } from "@opengeni/config";
 import { listConnectionsMetadata as listConnectionsMetadata6 } from "@opengeni/db";
 import {
@@ -106866,9 +107174,9 @@ import {
   replayWorkspaceGatewayCustomModelCreate,
   replayWorkspaceOpenRouterCustomModelCreate,
   listWorkspacesForSubject as listWorkspacesForSubject2,
-  nestedPostgresSqlState as nestedPostgresSqlState11,
+  nestedPostgresSqlState as nestedPostgresSqlState12,
   removeWorkspaceMember,
-  requireWorkspace as requireWorkspace3,
+  requireWorkspace as requireWorkspace4,
   updateWorkspaceSettings,
   getRig,
   setWorkspaceDefaultRig,
@@ -106917,7 +107225,7 @@ import {
 } from "@opengeni/core";
 
 // src/workspace-deletion.ts
-import { deleteWorkspaceIfQuiescent, nestedPostgresSqlState as nestedPostgresSqlState10 } from "@opengeni/db";
+import { deleteWorkspaceIfQuiescent, nestedPostgresSqlState as nestedPostgresSqlState11 } from "@opengeni/db";
 import { HTTPException as HTTPException91 } from "hono/http-exception";
 
 // src/workspace-delete-observability.ts
@@ -106959,13 +107267,13 @@ function recordWorkspaceDeleteObservation(observability, identity2, observation)
       labels: { outcome: observation.outcome }
     });
   }
-  for (const [kind, count] of Object.entries(observation.inventory ?? {})) {
+  for (const [kind, count2] of Object.entries(observation.inventory ?? {})) {
     observability.observeHistogram({
       name: "opengeni_workspace_delete_inventory_rows",
       help: "Rows or live owners observed by workspace deletion preflight inventory class.",
       labels: { kind },
       buckets: INVENTORY_BUCKETS,
-      value: Math.max(0, Math.floor(count ?? 0))
+      value: Math.max(0, Math.floor(count2 ?? 0))
     });
   }
   observability.info("Workspace deletion phase", {
@@ -107007,7 +107315,7 @@ async function deleteWorkspaceForRequest(deps, input) {
       ...observer ? { observer } : {}
     });
   } catch (error) {
-    const state = nestedPostgresSqlState10(error);
+    const state = nestedPostgresSqlState11(error);
     if (state === "42501") {
       throw new HTTPException91(403, { message: "organization administration is not authorized" });
     }
@@ -107161,7 +107469,7 @@ function registerWorkspaceRoutes(app, deps) {
     ];
     if (readableWorkspaceIds.length > 0) {
       const workspaces = await Promise.all(
-        readableWorkspaceIds.map((workspaceId) => requireWorkspace3(deps.db, workspaceId))
+        readableWorkspaceIds.map((workspaceId) => requireWorkspace4(deps.db, workspaceId))
       );
       return c.json(workspaces.map((workspace) => Workspace.parse(workspace)));
     }
@@ -107278,7 +107586,7 @@ function registerWorkspaceRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant39(c, deps, workspaceId, "workspace:read");
-    return c.json(Workspace.parse(await requireWorkspace3(deps.db, workspaceId)));
+    return c.json(Workspace.parse(await requireWorkspace4(deps.db, workspaceId)));
   });
   app.patch("/v1/workspaces/:workspaceId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -107340,14 +107648,14 @@ function registerWorkspaceRoutes(app, deps) {
         deps.db,
         workspaceId,
         parsed.data,
-        { requireWorkspace: requireWorkspace3, updateWorkspaceSettings },
+        { requireWorkspace: requireWorkspace4, updateWorkspaceSettings },
         {
           controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs2()
         }
       );
       return c.json(Workspace.parse(workspace));
     } catch (error) {
-      if (nestedPostgresSqlState11(error) === "0A000") {
+      if (nestedPostgresSqlState12(error) === "0A000") {
         throw new HTTPException92(409, {
           message: "Memory settings moved to Settings > Agent learning. Refresh the app to change them."
         });
@@ -107543,7 +107851,7 @@ function registerWorkspaceRoutes(app, deps) {
       if (error instanceof WorkspaceGatewayCustomModelLimitError || error instanceof WorkspaceGatewayCustomModelHistoryLimitError) {
         throw new HTTPException92(422, { message: error.message });
       }
-      if (nestedPostgresSqlState11(error) === "23505") {
+      if (nestedPostgresSqlState12(error) === "23505") {
         throw new HTTPException92(422, {
           message: "Gateway custom model already exists"
         });
@@ -107672,7 +107980,7 @@ function registerWorkspaceRoutes(app, deps) {
       if (error instanceof WorkspaceOpenRouterCustomModelLimitError || error instanceof WorkspaceOpenRouterCustomModelHistoryLimitError) {
         throw new HTTPException92(422, { message: error.message });
       }
-      if (nestedPostgresSqlState11(error) === "23505") {
+      if (nestedPostgresSqlState12(error) === "23505") {
         throw new HTTPException92(422, {
           message: "OpenRouter custom model already exists"
         });
@@ -107735,16 +108043,37 @@ function registerWorkspaceRoutes(app, deps) {
       return credentialReady ? { available: true, unavailableReason: null } : { available: false, unavailableReason: credentialReason };
     };
     const gatewayModels = Object.values(AI_GATEWAY_REALTIME_MODELS);
-    const models = [
-      ...gatewayModels.map((model, index) => ({
+    const managedCandidates = [
+      {
+        id: AZURE_LIVE_MODEL_ID,
+        label: "GPT Live 1",
+        description: "Realtime voice with session delegation"
+      },
+      ...gatewayModels.map((model) => ({
         id: model.managedModelId,
         label: model.label,
+        description: model.description
+      }))
+    ].filter((model) => {
+      const voice = deploymentRealtimeVoice(deps.settings, model.id);
+      return voice !== null && realtimeVoiceOfferProblem(deps.settings, voice) === null;
+    }).filter(
+      (model, _index, offered) => offered.some((candidate) => candidate.id === AZURE_LIVE_MODEL_ID) ? model.id === AZURE_LIVE_MODEL_ID : true
+    );
+    const creditStanding = managedCandidates.length > 0 ? await createRealtimeVoiceBilling2({
+      db: deps.db,
+      settings: deps.settings
+    }).creditStanding(grant.accountId) : "none";
+    const hasCredits = creditStanding === "spendable";
+    const models = [
+      ...managedCandidates.map((model, index) => ({
+        ...model,
         provider: "OpenGeni",
-        description: model.description,
-        ...availability(
-          Boolean(deps.settings.vercelAiGatewayApiKey),
-          "Opengeni Gateway voice is not configured"
-        ),
+        ...hasCredits ? { available: true, unavailableReason: null, unavailableCode: null } : {
+          available: false,
+          unavailableReason: creditStanding === "promotional_only" ? "Promotional credits don't cover live voice. Add credits to use it." : "Add Opengeni credits to use live voice",
+          unavailableCode: "insufficient_credits"
+        },
         recommended: index === 0
       })),
       {
@@ -108090,7 +108419,7 @@ function rethrowWorkspaceMemberCandidateError(error) {
       message: "the workspace must keep at least one administrator"
     });
   }
-  const sqlState = nestedPostgresSqlState11(error);
+  const sqlState = nestedPostgresSqlState12(error);
   if (sqlState === "P0002") {
     throw new HTTPException92(404, { message: "workspace not found" });
   }
@@ -108155,7 +108484,7 @@ import {
   getWorkspace as getWorkspace6,
   getWorkspaceUsage,
   grantWorkspaceCredits,
-  nestedPostgresSqlState as nestedPostgresSqlState12,
+  nestedPostgresSqlState as nestedPostgresSqlState13,
   setMemberAllowance,
   setWorkspaceAllowance,
   withAccountRls as withAccountRls3,
@@ -108290,7 +108619,7 @@ async function lifecycle2(operation) {
   } catch (error) {
     if (error instanceof UsageAllowanceVersionConflictError)
       throw new HTTPException93(409, { message: error.message });
-    const state = nestedPostgresSqlState12(error);
+    const state = nestedPostgresSqlState13(error);
     if (state === "40001" || state === "23505")
       throw new HTTPException93(409, { message: "Allowance version or operation conflicts" });
     if (state === "42501")
@@ -110041,7 +110370,7 @@ import {
 } from "@opengeni/core";
 import {
   availableSlackBotConnectionMetadata as availableSlackBotConnectionMetadata2,
-  nestedPostgresSqlState as nestedPostgresSqlState13,
+  nestedPostgresSqlState as nestedPostgresSqlState14,
   readOrganizationSlackBotAccess,
   setOrganizationSlackBotAccess,
   sharedOrganizationSlackBots as sharedOrganizationSlackBots2
@@ -110071,7 +110400,7 @@ function registerSlackBotAccessRoutes(app, deps) {
         )
       );
     } catch (error) {
-      if (nestedPostgresSqlState13(error) === "42501")
+      if (nestedPostgresSqlState14(error) === "42501")
         throw new HTTPException99(404, { message: "Local bot installation unavailable" });
       throw error;
     }
@@ -110125,7 +110454,7 @@ function registerSlackBotAccessRoutes(app, deps) {
       return context.json(OpenGeniSlackBotOrganizationAccess.parse(result));
     } catch (error) {
       if (error instanceof HTTPException99) throw error;
-      if (nestedPostgresSqlState13(error) === "42501")
+      if (nestedPostgresSqlState14(error) === "42501")
         throw new HTTPException99(403, {
           message: "Organization administrator and a verified local bot installation required"
         });
@@ -110322,7 +110651,7 @@ import {
   getWorkspaceArtifact as getWorkspaceArtifact3,
   getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef3,
   listWorkspaceArtifacts as listWorkspaceArtifacts2,
-  nestedPostgresSqlState as nestedPostgresSqlState14,
+  nestedPostgresSqlState as nestedPostgresSqlState15,
   publishWorkspaceArtifactVersion as publishWorkspaceArtifactVersion2,
   rollbackWorkspaceArtifact as rollbackWorkspaceArtifact2,
   setWorkspaceArtifactStatus as setWorkspaceArtifactStatus2,
@@ -110369,7 +110698,7 @@ function workspaceArtifactErrorResponse(context, error) {
       422
     );
   }
-  if (nestedPostgresSqlState14(error) === "23505") {
+  if (nestedPostgresSqlState15(error) === "23505") {
     return context.json(
       {
         code: "WORKSPACE_ARTIFACT_CONFLICT",
@@ -110753,7 +111082,7 @@ import {
   getGeneratedImageArtifact as getGeneratedImageArtifact2,
   getSessionAuthorityProjection as getSessionAuthorityProjection3,
   listArtifactCatalogCandidates,
-  nestedPostgresSqlState as nestedPostgresSqlState15,
+  nestedPostgresSqlState as nestedPostgresSqlState16,
   updateArtifactPin,
   withSessionRlsActorContext as withSessionRlsActorContext9
 } from "@opengeni/db";
@@ -110888,7 +111217,7 @@ function registerArtifactCatalogRoutes(app, deps) {
           }
         );
       } catch (error) {
-        if (nestedPostgresSqlState15(error) === "42501")
+        if (nestedPostgresSqlState16(error) === "42501")
           throw new HTTPException103(404, { message: "Artifact not found" });
         throw error;
       }
@@ -111549,7 +111878,11 @@ import {
   resolveWorkspaceVoiceInputEnabled as resolveWorkspaceVoiceInputEnabled2,
   WorkspaceVoiceInputSettings as WorkspaceVoiceInputSettings2
 } from "@opengeni/contracts";
-import { requireAccessGrant as requireAccessGrant50, TranscriptionServiceError as TranscriptionServiceError2 } from "@opengeni/core";
+import {
+  requireAccessGrant as requireAccessGrant50,
+  TranscriptionBillingRefusedError as TranscriptionBillingRefusedError3,
+  TranscriptionServiceError as TranscriptionServiceError2
+} from "@opengeni/core";
 import { getWorkspace as getWorkspace10 } from "@opengeni/db";
 
 // src/routes/transcription-recordings.ts
@@ -111567,6 +111900,7 @@ import {
   normalizeMimeType,
   requireAccessGrant as requireAccessGrant49,
   TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS,
+  TranscriptionBillingRefusedError as TranscriptionBillingRefusedError2,
   TranscriptionServiceError
 } from "@opengeni/core";
 import { retryWhileMissing as retryWhileMissing7 } from "@opengeni/storage";
@@ -111598,6 +111932,38 @@ import {
 } from "@opengeni/db";
 import { getWorkspace as getWorkspace9 } from "@opengeni/db";
 
+// src/transcription/wav-duration.ts
+function wavDurationSeconds(bytes) {
+  if (bytes.byteLength < 12) return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (ascii2(bytes, 0) !== "RIFF" || ascii2(bytes, 8) !== "WAVE") return null;
+  let offset = 12;
+  let byteRate = null;
+  while (offset + 8 <= bytes.byteLength) {
+    const id = ascii2(bytes, offset);
+    const size = view.getUint32(offset + 4, true);
+    const body3 = offset + 8;
+    if (id === "fmt " && body3 + 12 <= bytes.byteLength) {
+      byteRate = view.getUint32(body3 + 8, true);
+    } else if (id === "data") {
+      if (!byteRate) return null;
+      const available = bytes.byteLength - body3;
+      const dataBytes = size === 0 || size === 4294967295 ? available : Math.min(size, available);
+      return dataBytes / byteRate;
+    }
+    offset = body3 + size + size % 2;
+  }
+  return null;
+}
+function ascii2(bytes, offset) {
+  return String.fromCharCode(
+    bytes[offset] ?? 0,
+    bytes[offset + 1] ?? 0,
+    bytes[offset + 2] ?? 0,
+    bytes[offset + 3] ?? 0
+  );
+}
+
 // src/transcription/segmenter.ts
 import { spawn } from "child_process";
 import { createWriteStream } from "fs";
@@ -111629,7 +111995,7 @@ function createFfmpegTranscriptionSegmenter(input) {
           true
         );
       }
-      if (!Number.isSafeInteger(request.providerSegmentSeconds) || request.providerSegmentSeconds <= 0 || !Number.isSafeInteger(request.totalDurationMilliseconds) || request.totalDurationMilliseconds <= 0) {
+      if (!Number.isSafeInteger(request.providerSegmentSeconds) || request.providerSegmentSeconds <= 0 || !Number.isSafeInteger(request.totalDurationMilliseconds) || request.totalDurationMilliseconds <= 0 || request.maxDecodeSeconds !== void 0 && (!Number.isSafeInteger(request.maxDecodeSeconds) || request.maxDecodeSeconds <= 0)) {
         throw new TranscriptionSegmenterError(
           "Audio segmentation bounds are invalid",
           "invalid_audio",
@@ -111661,6 +112027,8 @@ function createFfmpegTranscriptionSegmenter(input) {
             "-y",
             "-i",
             inputPath,
+            // Output-side ceiling: audio past it is never decoded or written.
+            ...request.maxDecodeSeconds !== void 0 ? ["-t", String(request.maxDecodeSeconds)] : [],
             "-map",
             "0:a:0",
             "-vn",
@@ -112123,7 +112491,9 @@ function registerResumableTranscriptionRoutes(app, deps) {
         const service = deps.transcription;
         if (!deps.objectStorage || !service || !await service.available({
           workspaceId: authority.workspaceId,
-          subjectId: authority.subjectId
+          subjectId: authority.subjectId,
+          preferredProvider: authority.voiceInput?.preferredProvider,
+          fallbackEnabled: authority.voiceInput?.fallbackEnabled
         })) {
           return c.json({ code: "unavailable" }, 503);
         }
@@ -112166,6 +112536,31 @@ function registerResumableTranscriptionRoutes(app, deps) {
             false
           );
         }
+        const segmentProviderId = claim.segment.providerId && claim.segment.providerId !== "host" ? claim.segment.providerId : null;
+        if (segmentProviderId && service.admit) {
+          try {
+            await service.admit({
+              providerId: segmentProviderId,
+              accountId: authority.accountId,
+              workspaceId: authority.workspaceId,
+              attribution: authority.attribution
+            });
+          } catch (error) {
+            if (!(error instanceof TranscriptionBillingRefusedError2)) throw error;
+            await failTranscriptionRecordingSegment(deps.db, {
+              workspaceId: authority.workspaceId,
+              subjectId: authority.subjectId,
+              recordingId: uuidParam3(c, "recordingId"),
+              segmentNumber,
+              attemptId,
+              fallbackProviderId: null,
+              // The real refusal, so a reloaded recording still explains it.
+              errorCode: error.code,
+              retryable: true
+            }).catch(() => null);
+            return transcriptionBillingRefusal(c, error);
+          }
+        }
         const providerStartedAt = /* @__PURE__ */ new Date();
         const providerDeadlineAt = new Date(
           providerStartedAt.getTime() + TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS
@@ -112188,7 +112583,17 @@ function registerResumableTranscriptionRoutes(app, deps) {
           durationSeconds: claim.segment.durationMilliseconds / 1e3,
           requestId: attemptId,
           providerDeadlineAt,
-          ...claim.segment.providerId && claim.segment.providerId !== "host" ? { providerId: claim.segment.providerId } : {}
+          deferBillingSettlement: true,
+          ...segmentProviderId ? { providerId: segmentProviderId } : {},
+          billing: {
+            // One settlement per prepared segment of this exact recording,
+            // however many provider attempts it takes. The recording id is
+            // client-chosen, so the unit id also binds its server creation
+            // time and the server-produced segment bytes.
+            sourceId: `${claim.recording.recording.id}:${Date.parse(claim.recording.recording.createdAt)}:${segmentNumber}:${claim.segment.sha256}`,
+            attribution: authority.attribution,
+            trustedDurationSeconds: wavDurationSeconds(stored.bytes) ?? void 0
+          }
         });
         const completed = await completeTranscriptionRecordingSegment(deps.db, {
           workspaceId: authority.workspaceId,
@@ -112200,6 +112605,7 @@ function registerResumableTranscriptionRoutes(app, deps) {
           languages: result.languages,
           providerId: claim.segment.providerId ?? result.providerId
         });
+        await result.settleBilling?.().catch(() => void 0);
         return c.json(await cleanupTerminalObjects(deps, authority, completed));
       } catch (error) {
         if (authority && attemptId && segmentNumber !== null) {
@@ -112223,6 +112629,9 @@ function registerResumableTranscriptionRoutes(app, deps) {
             errorCode: failure2.code,
             retryable: failure2.retryable
           }).catch(() => null);
+          if (error instanceof TranscriptionBillingRefusedError2) {
+            return transcriptionBillingRefusal(c, error);
+          }
           if (persisted) return c.json(persisted);
         }
         return routeError2(c, error);
@@ -112269,7 +112678,8 @@ async function requireRecordingAuthority(c, deps, requirePolicy) {
     voiceInput: WorkspaceVoiceInputSettings.safeParse(workspace?.settings.voiceInput).data,
     accountId: grant.accountId,
     workspaceId,
-    subjectId: grant.subjectId
+    subjectId: grant.subjectId,
+    attribution: creditDebitAttributionForGrant(grant)
   };
 }
 async function resumableAvailable(deps, workspaceId) {
@@ -112340,6 +112750,9 @@ function processingFailure(error) {
   if (error instanceof TranscriptionSegmenterError) {
     return { code: error.code, retryable: error.retryable };
   }
+  if (error instanceof TranscriptionBillingRefusedError2) {
+    return { code: error.code, retryable: true };
+  }
   if (error instanceof TranscriptionServiceError) {
     return {
       code: error.code,
@@ -112355,6 +112768,9 @@ function routeError2(c, error) {
   if (error instanceof TranscriptionRecordingNotFoundError) {
     return c.json({ code: "not_found" }, 404);
   }
+  if (error instanceof TranscriptionBillingRefusedError2) {
+    return transcriptionBillingRefusal(c, error);
+  }
   if (error instanceof TranscriptionRecordingConflictError) {
     return c.json({ code: "conflict" }, 409);
   }
@@ -112478,12 +112894,21 @@ function registerTranscriptionRoutes(app, deps) {
     }
     const preferences = WorkspaceVoiceInputSettings2.safeParse(workspace.settings.voiceInput).data;
     const service = deps.transcription;
-    if (!service || !await service.available({ workspaceId, subjectId: grant.subjectId })) {
+    if (!service || !await service.available({
+      workspaceId,
+      subjectId: grant.subjectId,
+      preferredProvider: preferences?.preferredProvider,
+      fallbackEnabled: preferences?.fallbackEnabled
+    })) {
       return c.json({ code: "unavailable" }, 503);
     }
     try {
       const body3 = await audioRequest(c.req.raw, service.limits().maxSizeBytes);
       const result = await service.transcribe({
+        billing: {
+          sourceId: crypto.randomUUID(),
+          attribution: creditDebitAttributionForGrant(grant)
+        },
         preferredProvider: preferences?.preferredProvider,
         fallbackEnabled: preferences?.fallbackEnabled,
         workspaceId,
@@ -112504,6 +112929,9 @@ function registerTranscriptionRoutes(app, deps) {
       if (error instanceof TranscriptionServiceError2) {
         return c.json({ code: error.code }, error.status);
       }
+      if (error instanceof TranscriptionBillingRefusedError3) {
+        return transcriptionBillingRefusal(c, error);
+      }
       if (isAbort3(error)) return c.json({ code: "cancelled" }, 499);
       return c.json({ code: "unknown" }, 500);
     }
@@ -112609,17 +113037,23 @@ function isAbort3(error) {
 
 // src/routes/session-artifact-associations.ts
 import {
-  requireAccessGrant as requireAccessGrant51,
+  fileOwnerContextForAccess as fileOwnerContextForAccess6,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization37,
   requirePermission as requirePermission12,
   requireSessionAuthorization as requireSessionAuthorization15,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError15,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError13
 } from "@opengeni/core";
 import {
+  getGeneratedImageArtifact as getGeneratedImageArtifact3,
+  getGeneratedVideoArtifact as getGeneratedVideoArtifact2,
+  getRetainedFileArtifact as getRetainedFileArtifact2,
   hasEditableArtifactSessionLink as hasEditableArtifactSessionLink2,
   hasWorkspaceArtifactSessionLink,
+  listArtifactCatalogCandidates as listArtifactCatalogCandidates2,
   transactionallyAuthorizeEditableArtifactActor,
-  withRlsContext as withRlsContext3
+  withRlsContext as withRlsContext3,
+  withSessionRlsActorContext as withSessionRlsActorContext10
 } from "@opengeni/db";
 import { HTTPException as HTTPException107 } from "hono/http-exception";
 import { z as z55 } from "zod";
@@ -112630,12 +113064,18 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/sessions/:sessionId/artifact-associations/:artifactId",
     async (context) => {
       const workspaceId = context.req.param("workspaceId");
-      const grant = await requireAccessGrant51(context, deps, workspaceId, "artifacts:read");
-      requirePermission12(grant, "sessions:read");
       const sessionId = context.req.param("sessionId");
       const artifactId2 = context.req.param("artifactId");
-      const kind = EditableArtifactId.safeParse(artifactId2).success ? "editable" : SessionId2.safeParse(artifactId2).success ? "site" : null;
       const requestedKind = context.req.query("kind");
+      const kind = EditableArtifactId.safeParse(artifactId2).success ? "editable" : SessionId2.safeParse(artifactId2).success ? requestedKind === "retained" ? "retained" : "site" : null;
+      const authorization = await requireAccessGrantAuthorization37(
+        context,
+        deps,
+        workspaceId,
+        kind === "retained" ? "files:read" : "artifacts:read"
+      );
+      const grant = authorization.grant;
+      requirePermission12(grant, "sessions:read");
       if (!SessionId2.safeParse(sessionId).success || !kind || requestedKind !== void 0 && requestedKind !== kind) {
         throw new HTTPException107(404, { message: "Artifact association not found" });
       }
@@ -112647,7 +113087,18 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
             surface: "http"
           });
           const scope = { accountId: grant.accountId, workspaceId };
-          const linked = kind === "editable" ? await hasEditableArtifactSessionLink2(deps.db, scope, sessionId, artifactId2) : await hasWorkspaceArtifactSessionLink(deps.db, workspaceId, sessionId, artifactId2);
+          const linked = kind === "editable" ? await hasEditableArtifactSessionLink2(deps.db, scope, sessionId, artifactId2) : kind === "retained" ? await hasRetainedArtifactSessionLink(
+            deps,
+            authorization,
+            workspaceId,
+            sessionId,
+            artifactId2.toLowerCase()
+          ) : await hasWorkspaceArtifactSessionLink(
+            deps.db,
+            workspaceId,
+            sessionId,
+            artifactId2
+          );
           if (!linked) throw new HTTPException107(404, { message: "Artifact association not found" });
           if (kind === "editable") {
             const decision = await withRlsContext3(
@@ -112679,6 +113130,38 @@ function registerSessionArtifactAssociationRoutes(app, deps) {
     }
   );
 }
+async function hasRetainedArtifactSessionLink(deps, authorization, workspaceId, sessionId, artifactId2) {
+  const image = await getGeneratedImageArtifact3(deps.db, workspaceId, artifactId2);
+  if (image) return image.sessionId === sessionId;
+  const video = await getGeneratedVideoArtifact2(deps.db, workspaceId, artifactId2);
+  if (video) return !video.artifact.deletedAt && video.artifact.sessionId === sessionId;
+  const file = await getRetainedFileArtifact2(deps.db, workspaceId, artifactId2);
+  if (!file) return false;
+  const grant = authorization.grant;
+  const actor = await fileOwnerContextForAccess6(deps, authorization, "files:read");
+  const candidates = await withSessionRlsActorContext10(
+    actor,
+    () => listArtifactCatalogCandidates2(
+      deps.db,
+      { accountId: grant.accountId, workspaceId },
+      {
+        query: {
+          sourceSessionId: sessionId,
+          q: file.file.filename.slice(0, 200),
+          sort: "newest",
+          status: "active",
+          limit: 100
+        },
+        kinds: ["file", "image"],
+        snapshotAt: (/* @__PURE__ */ new Date()).toISOString(),
+        limit: 201
+      }
+    )
+  );
+  return candidates.some(
+    (candidate) => candidate.origin === "sandbox_file" && candidate.id === artifactId2
+  );
+}
 
 // src/routes/video-generation.ts
 import {
@@ -112689,7 +113172,7 @@ import {
 } from "@opengeni/contracts";
 import {
   getVideoGenerationOperationSummary,
-  withSessionRlsActorContext as withSessionRlsActorContext10,
+  withSessionRlsActorContext as withSessionRlsActorContext11,
   getWorkspaceVercelAiGatewayConnectionMetadata,
   getWorkspaceVideoGenerationPolicy,
   updateWorkspaceVideoGenerationPolicy,
@@ -112697,9 +113180,9 @@ import {
   workspaceXaiSubscriptionActive as workspaceXaiSubscriptionActive2
 } from "@opengeni/db";
 import {
-  requireAccessGrant as requireAccessGrant52,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization37,
-  fileOwnerContextForAccess as fileOwnerContextForAccess6,
+  requireAccessGrant as requireAccessGrant51,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization38,
+  fileOwnerContextForAccess as fileOwnerContextForAccess7,
   requireWorkspaceSettingsGrant as requireWorkspaceSettingsGrant6,
   VIDEO_GENERATION_MODEL_CATALOG,
   videoGenerationModelSupportsFundingSource,
@@ -112709,7 +113192,7 @@ import { HTTPException as HTTPException108 } from "hono/http-exception";
 function registerVideoGenerationRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/video-generation", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant51(c, deps, workspaceId, "workspace:read");
     const [policy, connection, supergrokConfigured] = await Promise.all([
       getWorkspaceVideoGenerationPolicy(deps.db, workspaceId),
       getWorkspaceVercelAiGatewayConnectionMetadata(deps.db, workspaceId),
@@ -112783,9 +113266,9 @@ function registerVideoGenerationRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/video-generation/operations/:operationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization37(c, deps, workspaceId, "workspace:read");
-    const actor = await fileOwnerContextForAccess6(deps, access, "workspace:read");
-    const summary = await withSessionRlsActorContext10(
+    const access = await requireAccessGrantAuthorization38(c, deps, workspaceId, "workspace:read");
+    const actor = await fileOwnerContextForAccess7(deps, access, "workspace:read");
+    const summary = await withSessionRlsActorContext11(
       actor,
       () => getVideoGenerationOperationSummary(deps.db, workspaceId, c.req.param("operationId"))
     );
@@ -113983,7 +114466,7 @@ function registerManagedSignInMethodRoutes(app, deps) {
       select provider_id as provider, (provider_id <> 'credential' or length(password)>0) as usable from auth_identities where user_id=${actor.authUserId}`
     );
     const connected = (provider) => accounts.some((a) => a.provider === provider && a.usable) && projection.loginBindings.some((b) => b.providerId === provider && b.status === "active");
-    const count = ["credential", "google", "github"].filter(
+    const count2 = ["credential", "google", "github"].filter(
       (p) => connected(p) && configured(deps, p)
     ).length;
     return context.json(
@@ -113996,7 +114479,7 @@ function registerManagedSignInMethodRoutes(app, deps) {
           provider,
           connected: connected(provider),
           available: configured(deps, provider),
-          canDisconnect: provider !== "credential" && connected(provider) && count - (configured(deps, provider) ? 1 : 0) > 0,
+          canDisconnect: provider !== "credential" && connected(provider) && count2 - (configured(deps, provider) ? 1 : 0) > 0,
           implicitRelinkingSuppressed: !connected(provider) && projection.loginBindings.some(
             (b) => b.providerId === provider && b.status !== "active"
           )
@@ -114454,11 +114937,11 @@ import {
   getOrganizationPrivateSessionSettings,
   getSelfOrganizationInvitation,
   getOrganizationRetentionPolicy,
-  requireWorkspace as requireWorkspace4,
+  requireWorkspace as requireWorkspace5,
   listOrganizationAdministrationMembers,
   listOrganizationInvitations,
   listSelfOrganizationInvitations,
-  nestedPostgresSqlState as nestedPostgresSqlState16,
+  nestedPostgresSqlState as nestedPostgresSqlState17,
   prepareOrganizationUserSetupDelivery,
   revokeOrganizationInvitation,
   settleOrganizationUserSetupDelivery,
@@ -114507,7 +114990,7 @@ async function requireOrganizationKeyWorkspaceDeletion(context, deps, organizati
       message: "deleting an organization workspace requires an organization owner session or an organization API key with workspace:admin"
     });
   }
-  const workspace = await requireWorkspace4(deps.db, workspaceId).catch(() => null);
+  const workspace = await requireWorkspace5(deps.db, workspaceId).catch(() => null);
   if (!workspace || workspace.accountId !== organizationId2) {
     throw new HTTPException112(404, { message: "workspace not found" });
   }
@@ -114575,7 +115058,7 @@ function parseId(schema, value, label) {
   return parsed.data;
 }
 function rethrowMembershipError(error, resourceLimitMessage) {
-  const sqlState = nestedPostgresSqlState16(error);
+  const sqlState = nestedPostgresSqlState17(error);
   if (sqlState === "54000" && resourceLimitMessage) {
     throw new HTTPException112(409, {
       message: resourceLimitMessage
@@ -114681,7 +115164,7 @@ function registerOrganizationMembershipRoutes(app, deps) {
         })
       );
     } catch (error) {
-      if (nestedPostgresSqlState16(error) === "42501") {
+      if (nestedPostgresSqlState17(error) === "42501") {
         throw new HTTPException112(403, {
           message: "organization membership is not active"
         });
@@ -115321,7 +115804,7 @@ import {
   organizationWorkspaceInScope as organizationWorkspaceInScope4,
   hasPermission as hasPermission31,
   requireAccessContext as requireAccessContext13,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization38,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization39,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope3,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError16,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError14,
@@ -115474,7 +115957,7 @@ function registerOrganizationSessionRoutes(app, deps) {
 async function listWorkspaceSessionPage(c, deps, input) {
   let authorization;
   try {
-    authorization = await requireAccessGrantAuthorization38(
+    authorization = await requireAccessGrantAuthorization39(
       c,
       deps,
       input.workspace.id,
@@ -115824,7 +116307,7 @@ import {
   completeSelfServiceOrganizationSetup,
   completeOrganizationUserSetup,
   getSelfServiceOrganizationOnboardingState,
-  nestedPostgresSqlState as nestedPostgresSqlState17,
+  nestedPostgresSqlState as nestedPostgresSqlState18,
   preflightOrganizationUserSetup,
   previewOrganizationUserSetup,
   recordOrganizationSignupUseCase
@@ -115882,14 +116365,14 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
           useCase: parsed.data.useCase
         }).catch((error) => {
           console.warn("[api] could not record the signup use case", {
-            sqlState: nestedPostgresSqlState17(error) ?? null
+            sqlState: nestedPostgresSqlState18(error) ?? null
           });
         });
       }
       return context.json(completed);
     } catch (error) {
       recordOrganizationSetupOutcome(deps.observability, "failed");
-      const sqlState = nestedPostgresSqlState17(error);
+      const sqlState = nestedPostgresSqlState18(error);
       if (sqlState === "22023") {
         throw new HTTPException115(422, {
           message: "invalid organization setup request"
@@ -115969,7 +116452,7 @@ function registerManagedOnboardingRoutes(app, deps, options = {}) {
         )
       );
     } catch (error) {
-      const sqlState = nestedPostgresSqlState17(error);
+      const sqlState = nestedPostgresSqlState18(error);
       if (sqlState === "22023") {
         throw new HTTPException115(422, {
           message: "invalid account setup request"
@@ -116084,13 +116567,13 @@ import {
 import {
   issueManagedHumanUserResourceGrant,
   listManagedHumanUserResourceAuthorities,
-  requireAccessGrantAuthorization as requireAccessGrantAuthorization39,
+  requireAccessGrantAuthorization as requireAccessGrantAuthorization40,
   revokeManagedHumanUserResourceGrant,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError17,
   SessionAuthorizationUnavailableError as SessionAuthorizationUnavailableError15,
   SessionTenancyManagedHumanRequiredError as SessionTenancyManagedHumanRequiredError3
 } from "@opengeni/core";
-import { nestedPostgresSqlState as nestedPostgresSqlState18, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
+import { nestedPostgresSqlState as nestedPostgresSqlState19, SessionTenancyNotActivatedError as SessionTenancyNotActivatedError3 } from "@opengeni/db";
 import { HTTPException as HTTPException116 } from "hono/http-exception";
 import { z as z62 } from "zod";
 async function body2(context, schema) {
@@ -116105,10 +116588,10 @@ function lifecycleError(error) {
   if (error instanceof SessionAuthorizationUnavailableError15) {
     throw new HTTPException116(503, { message: "session authorization unavailable" });
   }
-  if (nestedPostgresSqlState18(error) === "42501") {
+  if (nestedPostgresSqlState19(error) === "42501") {
     throw new HTTPException116(403, { message: "user-resource authority denied" });
   }
-  if (nestedPostgresSqlState18(error) === "22023") {
+  if (nestedPostgresSqlState19(error) === "22023") {
     throw new HTTPException116(422, { message: "invalid user-resource request" });
   }
   throw error;
@@ -116124,7 +116607,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
     });
     if (!query.success) throw new HTTPException116(422, { message: "explicit scope=user required" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization39(
+    const access = await requireAccessGrantAuthorization40(
       context,
       deps,
       workspaceId,
@@ -116152,7 +116635,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
     const authorityId = z62.string().uuid().safeParse(context.req.param("authorityId"));
     if (!authorityId.success) throw new HTTPException116(422, { message: "invalid authority id" });
     const request = await body2(context, IssueUserResourceGrantRequest);
-    const access = await requireAccessGrantAuthorization39(
+    const access = await requireAccessGrantAuthorization40(
       context,
       deps,
       workspaceId,
@@ -116182,7 +116665,7 @@ function registerUserResourceAuthorityRoutes(app, deps) {
     const grantId = z62.string().uuid().safeParse(context.req.param("grantId"));
     if (!grantId.success) throw new HTTPException116(422, { message: "invalid grant id" });
     const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization39(
+    const access = await requireAccessGrantAuthorization40(
       context,
       deps,
       workspaceId,
@@ -116202,28 +116685,94 @@ function registerUserResourceAuthorityRoutes(app, deps) {
 }
 
 // src/transcription/service.ts
-import { resolveVoiceInputProviderRegistry } from "@opengeni/config";
+import {
+  resolveVoiceInputProviderRegistry,
+  voiceInputCreditBillingActive
+} from "@opengeni/config";
 import { VOICE_INPUT_ACCEPTED_MIME_TYPES } from "@opengeni/contracts";
+import { voiceTranscriptionSettlementKeys } from "@opengeni/db";
 import {
+  createVoiceInputBilling,
   filenameForMimeType,
   isAcceptedMimeType as isAcceptedMimeType2,
   normalizeMimeType as normalizeMimeType2,
   TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS as TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS2,
-  TranscriptionServiceError as TranscriptionServiceError6
+  TranscriptionServiceError as TranscriptionServiceError7
 } from "@opengeni/core";
 
-// src/transcription/providers/openai.ts
+// src/transcription/normalize.ts
 import { TranscriptionServiceError as TranscriptionServiceError3 } from "@opengeni/core";
+function createFfmpegAudioNormalizer(input) {
+  const segmenter = createFfmpegTranscriptionSegmenter({ ffmpegPath: input.ffmpegPath });
+  return async ({ audio, mimeType, maxDurationSeconds, signal }) => {
+    if (!Number.isFinite(maxDurationSeconds) || maxDurationSeconds <= 0) {
+      throw new TranscriptionServiceError3({
+        code: "unavailable",
+        message: "Voice input duration limit is not configured."
+      });
+    }
+    const decodeSeconds = Math.ceil(maxDurationSeconds) + 1;
+    const segmentSeconds = decodeSeconds + 1;
+    let normalized;
+    try {
+      for await (const segment of segmenter.segment({
+        sourceMimeType: mimeType,
+        chunks: async function* () {
+          yield audio;
+        }(),
+        providerSegmentSeconds: segmentSeconds,
+        totalDurationMilliseconds: segmentSeconds * 1e3,
+        maxDecodeSeconds: decodeSeconds,
+        ...signal ? { signal } : {}
+      })) {
+        if (normalized) {
+          throw new TranscriptionServiceError3({ code: "too_large", message: "Audio is too long." });
+        }
+        normalized = segment.bytes;
+      }
+    } catch (error) {
+      if (error instanceof TranscriptionSegmenterError) {
+        throw new TranscriptionServiceError3({
+          code: error.code === "unknown" ? "invalid_audio" : error.code,
+          message: "Audio could not be prepared for transcription.",
+          retryable: error.retryable
+        });
+      }
+      throw error;
+    }
+    const durationSeconds = normalized ? wavDurationSeconds(normalized) : null;
+    if (!normalized || durationSeconds === null || !(durationSeconds > 0)) {
+      throw new TranscriptionServiceError3({
+        code: "invalid_audio",
+        message: "Audio could not be decoded."
+      });
+    }
+    if (durationSeconds > decodeSeconds - 0.02) {
+      throw new TranscriptionServiceError3({ code: "too_large", message: "Audio is too long." });
+    }
+    return { bytes: normalized, durationSeconds };
+  };
+}
+
+// src/transcription/providers/openai.ts
+import {
+  voiceInputModelReportsDurationOnly
+} from "@opengeni/config";
+import { TranscriptionServiceError as TranscriptionServiceError4 } from "@opengeni/core";
 function createOpenAiTranscriptionProvider(input) {
   const fetchImpl = input.fetch ?? fetch;
   return {
     id: "openai",
     supportsServerDeadline: true,
+    deploymentFunded: { model: input.model, pricing: input.pricing ?? null },
     available: () => true,
     async transcribe({ audio, mimeType, filename, requestId, signal }) {
       const form = new FormData();
       form.append("file", audioBlob(audio, mimeType), filename);
       form.append("model", input.model);
+      if (voiceInputModelReportsDurationOnly(input.model)) {
+        form.append("response_format", "verbose_json");
+      }
       let response;
       try {
         response = await fetchImpl(`${input.baseUrl}/audio/transcriptions`, {
@@ -116241,50 +116790,89 @@ function createOpenAiTranscriptionProvider(input) {
       }
       if (!response.ok) throw responseError(response.status);
       const body3 = await response.json().catch(() => null);
-      if (!body3 || typeof body3.text !== "string") {
-        throw new TranscriptionServiceError3({
+      const parsed = parseTranscriptionResponseBody(body3);
+      if (!parsed) {
+        throw new TranscriptionServiceError4({
           code: "provider",
           message: "Invalid transcription response."
         });
       }
-      return {
-        text: body3.text,
-        languages: typeof body3.language === "string" && body3.language ? [body3.language] : []
-      };
+      return parsed;
     }
   };
 }
+function parseTranscriptionResponseBody(body3) {
+  if (!body3 || typeof body3 !== "object") return null;
+  const record6 = body3;
+  if (typeof record6.text !== "string") return null;
+  const languages = typeof record6.language === "string" && record6.language ? [record6.language] : Array.isArray(record6.languages) ? record6.languages.flatMap((language) => {
+    const code = typeof language === "string" ? language : language?.code;
+    return typeof code === "string" && code ? [code] : [];
+  }) : [];
+  return { text: record6.text, languages, usage: parseTranscriptionUsage(record6) };
+}
+function parseTranscriptionUsage(body3) {
+  const usage = body3.usage;
+  if (usage && typeof usage === "object") {
+    const record6 = usage;
+    if (record6.type === "tokens") {
+      const inputTokens = count(record6.input_tokens);
+      const outputTokens = count(record6.output_tokens);
+      if (inputTokens !== null && outputTokens !== null) {
+        const details = record6.input_token_details && typeof record6.input_token_details === "object" ? record6.input_token_details : {};
+        return {
+          kind: "tokens",
+          inputTokens,
+          audioInputTokens: count(details.audio_tokens) ?? 0,
+          textInputTokens: count(details.text_tokens) ?? 0,
+          outputTokens
+        };
+      }
+    }
+    if (record6.type === "duration" && seconds(record6.seconds) !== null) {
+      return { kind: "duration", seconds: seconds(record6.seconds) };
+    }
+  }
+  const duration = seconds(body3.duration);
+  return duration === null ? null : { kind: "duration", seconds: duration };
+}
+function count(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function seconds(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value < 86400 ? value : null;
+}
 function audioBlob(audio, mimeType) {
   return new Blob([Uint8Array.from(audio).buffer], { type: mimeType });
 }
 function responseError(status) {
   if (status === 401 || status === 403) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       fallbackSafe: true,
       code: "unavailable",
       message: "Transcription is unavailable."
     });
   }
   if (status === 413) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "too_large",
       message: "Audio is too large."
     });
   }
   if (status === 400 || status === 422) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "invalid_audio",
       message: "Audio could not be transcribed."
     });
   }
   if (status === 408 || status === 504) {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "timeout",
       message: "Transcription timed out.",
       retryable: true
     });
   }
-  return new TranscriptionServiceError3({
+  return new TranscriptionServiceError4({
     code: status >= 500 ? "unavailable" : "provider",
     message: "Transcription provider failed.",
     retryable: status >= 500
@@ -116292,29 +116880,105 @@ function responseError(status) {
 }
 function fetchError(error) {
   if (error instanceof DOMException && error.name === "AbortError") {
-    return new TranscriptionServiceError3({
+    return new TranscriptionServiceError4({
       code: "cancelled",
       message: "Transcription was cancelled."
     });
   }
-  return new TranscriptionServiceError3({
+  return new TranscriptionServiceError4({
     code: "network",
     message: "Transcription provider is unreachable.",
     retryable: true
   });
 }
 
+// src/transcription/providers/azure-mai.ts
+function createMaiTranscriptionProvider(input) {
+  const fetchImpl = input.fetch ?? fetch;
+  const normalize = createFfmpegAudioNormalizer({ ffmpegPath: input.ffmpegPath });
+  return {
+    id: "azure-mai",
+    supportsServerDeadline: true,
+    deploymentFunded: { model: input.model, pricing: input.pricing ?? null },
+    available: () => Boolean(input.apiKey),
+    async transcribe({ audio, mimeType, filename, requestId, signal }) {
+      let bytes = audio;
+      let contentType = mimeType;
+      let name = filename;
+      if (!["audio/wav", "audio/x-wav", "audio/mpeg", "audio/flac"].includes(mimeType)) {
+        const normalized = await normalize({
+          audio,
+          mimeType,
+          maxDurationSeconds: 600,
+          ...signal ? { signal } : {}
+        });
+        bytes = normalized.bytes;
+        contentType = "audio/wav";
+        name = "audio.wav";
+      }
+      const form = new FormData();
+      form.append("audio", new Blob([Uint8Array.from(bytes).buffer], { type: contentType }), name);
+      form.append(
+        "definition",
+        JSON.stringify({ enhancedMode: { enabled: true, model: input.model } })
+      );
+      let response;
+      try {
+        response = await fetchImpl(
+          `${input.endpoint.replace(/\/+$/, "")}/speechtotext/transcriptions:transcribe?api-version=${encodeURIComponent(input.apiVersion)}`,
+          {
+            method: "POST",
+            headers: {
+              "Ocp-Apim-Subscription-Key": input.apiKey,
+              "x-opengeni-request-id": requestId
+            },
+            body: form,
+            ...signal ? { signal } : {}
+          }
+        );
+      } catch (error) {
+        throw fetchError(error);
+      }
+      if (!response.ok) throw responseError(response.status);
+      const body3 = await response.json().catch(() => null);
+      if (!body3 || !Array.isArray(body3.combinedPhrases) || !body3.combinedPhrases.every(
+        (phrase) => typeof phrase === "object" && phrase !== null && "text" in phrase && typeof phrase.text === "string"
+      )) {
+        throw responseError(502);
+      }
+      return {
+        usage: typeof body3.durationMilliseconds === "number" && Number.isFinite(body3.durationMilliseconds) && body3.durationMilliseconds >= 0 ? { kind: "duration", seconds: body3.durationMilliseconds / 1e3 } : null,
+        text: body3.combinedPhrases.map((phrase) => phrase.text).join("\n"),
+        languages: [
+          ...new Set(
+            (Array.isArray(body3.phrases) ? body3.phrases : []).flatMap(
+              (phrase) => typeof phrase?.locale === "string" && phrase.locale ? [phrase.locale] : []
+            )
+          )
+        ]
+      };
+    }
+  };
+}
+
 // src/transcription/providers/azure-openai.ts
+import { voiceInputModelReportsDurationOnly as voiceInputModelReportsDurationOnly2 } from "@opengeni/config";
 function createAzureOpenAiTranscriptionProvider(input) {
   const fetchImpl = input.fetch ?? fetch;
-  const url = `${input.endpoint}/openai/deployments/${encodeURIComponent(input.deployment)}/audio/transcriptions?api-version=${encodeURIComponent(input.apiVersion)}`;
+  const model = input.model ?? input.deployment;
+  const endpoint = input.endpoint.replace(/\/+$/, "");
+  const url = `${endpoint}/openai/deployments/${encodeURIComponent(input.deployment)}/audio/transcriptions?api-version=${encodeURIComponent(input.apiVersion)}`;
   return {
     id: "azure-openai",
     supportsServerDeadline: true,
+    deploymentFunded: { model, pricing: input.pricing ?? null },
     available: () => Boolean(input.apiKey || input.adToken),
     async transcribe({ audio, mimeType, filename, requestId, signal }) {
       const form = new FormData();
       form.append("file", new Blob([Uint8Array.from(audio).buffer], { type: mimeType }), filename);
+      if (voiceInputModelReportsDurationOnly2(model)) {
+        form.append("response_format", "verbose_json");
+      }
       const headers = input.apiKey ? { "api-key": input.apiKey, "x-opengeni-request-id": requestId } : { Authorization: `Bearer ${input.adToken}`, "x-opengeni-request-id": requestId };
       let response;
       try {
@@ -116329,13 +116993,11 @@ function createAzureOpenAiTranscriptionProvider(input) {
       }
       if (!response.ok) throw responseError(response.status);
       const body3 = await response.json().catch(() => null);
-      if (!body3 || typeof body3.text !== "string") {
+      const parsed = parseTranscriptionResponseBody(body3);
+      if (!parsed) {
         throw responseError(502);
       }
-      return {
-        text: body3.text,
-        languages: typeof body3.language === "string" && body3.language ? [body3.language] : []
-      };
+      return parsed;
     }
   };
 }
@@ -116343,7 +117005,7 @@ function createAzureOpenAiTranscriptionProvider(input) {
 // src/transcription/providers/codex-subscription.ts
 import { CODEX_CLIENT_VERSION as CODEX_CLIENT_VERSION4, CODEX_ORIGINATOR } from "@opengeni/codex/constants";
 import {
-  TranscriptionServiceError as TranscriptionServiceError4
+  TranscriptionServiceError as TranscriptionServiceError5
 } from "@opengeni/core";
 import { buildCodexTokenResolver as buildCodexTokenResolver4, listCodexAccountStatuses as listCodexAccountStatuses3 } from "@opengeni/db";
 var TRANSCRIBE_URL = "https://chatgpt.com/backend-api/transcribe";
@@ -116369,7 +117031,7 @@ function createCodexSubscriptionTranscriptionProvider(input) {
         (candidate) => candidate.isActive && candidate.status === "active"
       );
       if (!account) {
-        throw new TranscriptionServiceError4({
+        throw new TranscriptionServiceError5({
           fallbackSafe: true,
           code: "unavailable",
           message: "Transcription is unavailable."
@@ -116380,7 +117042,7 @@ function createCodexSubscriptionTranscriptionProvider(input) {
       try {
         token = await resolver.getToken();
       } catch {
-        throw new TranscriptionServiceError4({
+        throw new TranscriptionServiceError5({
           fallbackSafe: true,
           code: "unavailable",
           message: "Transcription is unavailable."
@@ -116431,7 +117093,7 @@ function createCodexSubscriptionTranscriptionProvider(input) {
 
 // src/transcription/providers/xai-subscription.ts
 import {
-  TranscriptionServiceError as TranscriptionServiceError5
+  TranscriptionServiceError as TranscriptionServiceError6
 } from "@opengeni/core";
 import { workspaceXaiSubscriptionActive as workspaceXaiSubscriptionActive3 } from "@opengeni/db";
 import {
@@ -116480,7 +117142,7 @@ function createXaiSubscriptionTranscriptionProvider(input) {
           ...input.fetch ? { fetch: input.fetch } : {}
         });
       } catch {
-        throw new TranscriptionServiceError5({
+        throw new TranscriptionServiceError6({
           code: "unavailable",
           fallbackSafe: true,
           message: "Transcription is unavailable."
@@ -116511,7 +117173,7 @@ function createXaiSubscriptionTranscriptionProvider(input) {
         try {
           return await (refresh ? auth.context.refresh() : auth.context.getToken());
         } catch {
-          throw new TranscriptionServiceError5({
+          throw new TranscriptionServiceError6({
             code: "unavailable",
             message: "Reconnect the SuperGrok account to use transcription.",
             fallbackSafe: true
@@ -116528,7 +117190,7 @@ function createXaiSubscriptionTranscriptionProvider(input) {
           response = await request(token.accessToken);
         }
       } catch (error) {
-        if (error instanceof TranscriptionServiceError5) throw error;
+        if (error instanceof TranscriptionServiceError6) throw error;
         throw fetchError(error);
       }
       if (!response.ok) throw responseError(response.status);
@@ -116581,6 +117243,12 @@ function createTranscriptionService(input) {
             ...config,
             ...input.fetch ? { fetch: input.fetch } : {}
           });
+        case "azure-mai":
+          return createMaiTranscriptionProvider({
+            ...config,
+            ffmpegPath: input.settings.voiceInputFfmpegPath,
+            ...input.fetch ? { fetch: input.fetch } : {}
+          });
         case "azure-openai":
           return createAzureOpenAiTranscriptionProvider({
             ...config,
@@ -116611,32 +117279,113 @@ function createTranscriptionService(input) {
   };
   const providerRequestTimeoutMilliseconds = input.providerRequestTimeoutMilliseconds ?? TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS2;
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
+  const log = input.log ?? ((message, attributes) => {
+    console.error(message, attributes);
+  });
+  const billing = input.billing ?? createVoiceInputBilling({
+    db: input.db,
+    settings: input.settings,
+    onReconcileError: (error, scope) => {
+      log("Voice input charge reconciliation failed", {
+        ...scope,
+        errorClass: error instanceof Error ? error.name : "UnknownError",
+        error: boundedErrorMessage(error)
+      });
+    }
+  });
+  let normalizer = input.normalizeAudio;
+  const normalizeAudio = (request) => {
+    normalizer ??= createFfmpegAudioNormalizer({ ffmpegPath: input.settings.voiceInputFfmpegPath });
+    return normalizer(request);
+  };
+  const retryDelays = input.settlementRetryDelaysMilliseconds ?? [2e3, 15e3, 6e4];
+  const settleWithoutFailing = async (settlement) => {
+    try {
+      return (await billing.settle(settlement)).creditCostMicros;
+    } catch (error) {
+      reportUnsettled(settlement, error, 0, retryDelays.length > 0 && !deterministic(error));
+      if (!deterministic(error)) scheduleSettlementRetry(settlement, 0);
+      return 0;
+    }
+  };
+  const deterministic = (error) => error instanceof TranscriptionServiceError7;
+  const scheduleSettlementRetry = (settlement, attempt) => {
+    const delay = retryDelays[attempt];
+    if (delay === void 0) return;
+    const timer = setTimeout(() => {
+      void billing.settle(settlement).then(
+        () => {
+          log("Voice input charge settled on retry", {
+            ...settlementAttributes(settlement),
+            attempt: attempt + 1
+          });
+        },
+        (error) => {
+          const more = attempt + 1 < retryDelays.length;
+          reportUnsettled(settlement, error, attempt + 1, more);
+          if (more) scheduleSettlementRetry(settlement, attempt + 1);
+        }
+      );
+    }, delay);
+    timer.unref?.();
+  };
+  const reportUnsettled = (settlement, error, attempt, willRetry) => {
+    log(
+      willRetry ? "Voice input charge is unsettled after provider success; retrying" : "Voice input charge is UNSETTLED after provider success; manual reconciliation needed unless its usage receipt committed",
+      {
+        ...settlementAttributes(settlement),
+        attempt,
+        willRetry,
+        errorClass: error instanceof Error ? error.name : "UnknownError",
+        error: boundedErrorMessage(error)
+      }
+    );
+  };
+  const creditBillingActive = voiceInputCreditBillingActive(input.settings);
+  const chargeable = (provider) => creditBillingActive && provider.deploymentFunded !== void 0;
   return {
     limits: () => limits,
     async available(context) {
-      return (await Promise.all(providers.map((provider) => provider.available(context)))).some(
-        Boolean
+      return Boolean(
+        await firstAvailable(orderedProviders(providers, context ?? {}), context ?? {})
       );
     },
+    async availableProviderIds(context) {
+      const available = await Promise.all(
+        providers.map(async (provider) => {
+          try {
+            return await provider.available(context) ? provider.id : null;
+          } catch {
+            return null;
+          }
+        })
+      );
+      return available.filter((id) => id !== null);
+    },
     async selectProvider(context) {
       return (await firstAvailable(orderedProviders(providers, context), context))?.id ?? null;
     },
+    async admit({ providerId, accountId, workspaceId, attribution }) {
+      const provider = providers.find((candidate) => candidate.id === providerId);
+      if (!provider || !chargeable(provider)) return;
+      await billing.admit({ accountId, workspaceId, attribution });
+    },
     async transcribe(request) {
       const mimeType = normalizeMimeType2(request.mimeType);
       if (!isAcceptedMimeType2(mimeType, limits.acceptedMimeTypes)) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "not_supported",
           message: "Unsupported audio format."
         });
       }
       if (request.audio.byteLength > limits.maxSizeBytes) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "too_large",
           message: "Audio is too large."
         });
       }
       if (request.durationSeconds !== void 0 && (!Number.isFinite(request.durationSeconds) || request.durationSeconds < 0 || request.durationSeconds > limits.maxDurationSeconds)) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "invalid_audio",
           message: "Invalid audio duration."
         });
@@ -116646,22 +117395,51 @@ function createTranscriptionService(input) {
         subjectId: request.subjectId
       }) : await firstAvailable(orderedProviders(providers, request), request);
       if (!provider) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           fallbackSafe: true,
           code: "unavailable",
           message: "Transcription is unavailable."
         });
       }
       if (provider.supportsServerDeadline !== true) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "unavailable",
           message: "Transcription provider does not support bounded requests."
         });
       }
+      if (chargeable(provider)) {
+        if (!provider.deploymentFunded?.pricing || !request.billing) {
+          throw new TranscriptionServiceError7({
+            code: "unavailable",
+            message: "Transcription billing is not configured."
+          });
+        }
+        await billing.admit({
+          accountId: request.accountId,
+          workspaceId: request.workspaceId,
+          attribution: request.billing.attribution
+        });
+      }
+      let audio = request.audio;
+      let providerMimeType = mimeType;
+      let billingContext = request.billing;
+      let audioSeconds = request.durationSeconds ?? 0;
+      if (chargeable(provider) && billingContext?.trustedDurationSeconds === void 0) {
+        const normalized = await normalizeAudio({
+          audio,
+          mimeType,
+          maxDurationSeconds: limits.maxDurationSeconds,
+          ...request.signal ? { signal: request.signal } : {}
+        });
+        audio = normalized.bytes;
+        providerMimeType = "audio/wav";
+        audioSeconds = normalized.durationSeconds;
+        billingContext = { ...billingContext, trustedDurationSeconds: normalized.durationSeconds };
+      }
       const startedAt = performance.now();
       const remainingMilliseconds = request.providerDeadlineAt ? remainingTranscriptionProviderRequestMilliseconds(request.providerDeadlineAt, now()) : providerRequestTimeoutMilliseconds;
       if (request.providerDeadlineAt && (!Number.isFinite(remainingMilliseconds) || remainingMilliseconds <= 0)) {
-        throw new TranscriptionServiceError6({
+        throw new TranscriptionServiceError7({
           code: "timeout",
           message: "Transcription provider deadline expired.",
           retryable: true
@@ -116671,9 +117449,9 @@ function createTranscriptionService(input) {
       let result;
       try {
         result = await provider.transcribe({
-          audio: request.audio,
-          mimeType,
-          filename: filenameForMimeType(mimeType),
+          audio,
+          mimeType: providerMimeType,
+          filename: filenameForMimeType(providerMimeType),
           workspaceId: request.workspaceId,
           accountId: request.accountId,
           subjectId: request.subjectId,
@@ -116681,7 +117459,7 @@ function createTranscriptionService(input) {
           signal: deadline.signal
         });
         if (deadline.timedOut && !request.signal?.aborted) {
-          throw new TranscriptionServiceError6({
+          throw new TranscriptionServiceError7({
             code: "timeout",
             message: "Transcription provider timed out.",
             retryable: true
@@ -116689,13 +117467,13 @@ function createTranscriptionService(input) {
         }
       } catch (error) {
         if (deadline.timedOut && !request.signal?.aborted) {
-          throw new TranscriptionServiceError6({
+          throw new TranscriptionServiceError7({
             code: "timeout",
             message: "Transcription provider timed out.",
             retryable: true
           });
         }
-        if (error instanceof TranscriptionServiceError6 && error.fallbackSafe && !request.providerId && request.fallbackEnabled !== false && !request.signal?.aborted) {
+        if (error instanceof TranscriptionServiceError7 && error.fallbackSafe && !request.providerId && request.fallbackEnabled !== false && !request.signal?.aborted) {
           const excludedProviders = [...request.excludedProviders ?? [], provider.id];
           if (await firstAvailable(
             orderedProviders(providers, { ...request, excludedProviders }),
@@ -116708,11 +117486,30 @@ function createTranscriptionService(input) {
       } finally {
         deadline.dispose();
       }
+      const latencyMs = Math.round(performance.now() - startedAt);
+      let creditCostMicros = 0;
+      const settle = async () => {
+        if (chargeable(provider) && provider.deploymentFunded?.pricing && billingContext) {
+          creditCostMicros = await settleWithoutFailing({
+            accountId: request.accountId,
+            workspaceId: request.workspaceId,
+            providerId: provider.id,
+            model: provider.deploymentFunded.model,
+            pricing: provider.deploymentFunded.pricing,
+            usage: result.usage ?? null,
+            billing: billingContext
+          });
+        }
+      };
+      if (!request.deferBillingSettlement) await settle();
       return {
-        ...result,
+        text: result.text,
+        languages: result.languages,
         providerId: provider.id,
-        audioSeconds: request.durationSeconds ?? 0,
-        latencyMs: Math.round(performance.now() - startedAt)
+        audioSeconds,
+        latencyMs,
+        creditCostMicros,
+        ...request.deferBillingSettlement ? { settleBilling: settle } : {}
       };
     }
   };
@@ -116767,6 +117564,23 @@ async function exactAvailable(providers, providerId, context) {
   const provider = providers.find((candidate) => candidate.id === providerId);
   return provider && await provider.available(context) ? provider : null;
 }
+function settlementAttributes(settlement) {
+  const keys2 = voiceTranscriptionSettlementKeys({
+    workspaceId: settlement.workspaceId,
+    sourceId: settlement.billing.sourceId
+  });
+  return {
+    accountId: settlement.accountId,
+    workspaceId: settlement.workspaceId,
+    providerId: settlement.providerId,
+    sourceId: settlement.billing.sourceId,
+    usageIdempotencyKey: keys2.usageIdempotencyKey,
+    debitIdempotencyKey: keys2.debitIdempotencyKey
+  };
+}
+function boundedErrorMessage(error) {
+  return (error instanceof Error ? error.message : String(error)).slice(0, 500);
+}
 
 // src/integrations/slack-tool-review.ts
 function slackToolReviewCanDecide(review) {
@@ -116936,7 +117750,7 @@ import {
   getActorNewSessionModelChoice,
   hasPermission as hasPermission33,
   requireAccessContext as requireAccessContext14,
-  requireAccessGrant as requireAccessGrant53,
+  requireAccessGrant as requireAccessGrant52,
   requireSessionAuthorizationListScope as requireSessionAuthorizationListScope4,
   resolveWorkspaceCatalogSettings as resolveWorkspaceCatalogSettings9
 } from "@opengeni/core";
@@ -118103,7 +118917,7 @@ function registerSlackInteractionRoutes(app, deps) {
   );
   app.get("/v1/workspaces/:workspaceId/members/access-requests/slack", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant53(c, deps, workspaceId, "members:manage");
+    await requireAccessGrant52(c, deps, workspaceId, "members:manage");
     const workspace = await getWorkspace11(deps.db, workspaceId);
     const requests = await listPendingSlackUserLinkAccessRequests(deps.db, workspaceId);
     return c.json(
@@ -118119,7 +118933,7 @@ function registerSlackInteractionRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/members/access-requests/slack/:requestId/approve",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant53(c, deps, workspaceId, "members:manage");
+      const grant = await requireAccessGrant52(c, deps, workspaceId, "members:manage");
       const payload = await parseRequestJson(c, ApproveSlackUserLinkAccessRequest);
       const requestId = c.req.param("requestId");
       const requestTeam = await slackUserLinkAccessRequestTeam(deps.db, {
@@ -118159,7 +118973,7 @@ function registerSlackInteractionRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/members/access-requests/slack/:requestId/deny",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      const grant = await requireAccessGrant53(c, deps, workspaceId, "members:manage");
+      const grant = await requireAccessGrant52(c, deps, workspaceId, "members:manage");
       const payload = await parseRequestJson(c, SlackUserLinkAccessMutationRequest);
       try {
         const request = await denySlackUserLinkAccessRequest(deps.db, {
@@ -118182,7 +118996,7 @@ function registerSlackInteractionRoutes(app, deps) {
   );
   app.post("/v1/workspaces/:workspaceId/integrations/slack/user-links", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "sessions:create");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "sessions:create");
     const body3 = record5(await c.req.json().catch(() => null));
     const linkToken = boundedString(body3?.linkToken, 2048);
     const signingSecret = deps.settings.slackSigningSecret;
@@ -118238,7 +119052,7 @@ function registerSlackInteractionRoutes(app, deps) {
     "/v1/workspaces/:workspaceId/integrations/slack/user-links/:slackUserId",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      await requireAccessGrant53(c, deps, workspaceId, "connections:write");
+      await requireAccessGrant52(c, deps, workspaceId, "connections:write");
       const connectionId = boundedString(c.req.query("connectionId"), 64);
       if (!connectionId) throw new HTTPException117(400, { message: "connectionId is required" });
       return c.json({
@@ -118253,7 +119067,7 @@ function registerSlackInteractionRoutes(app, deps) {
   );
   app.get("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:admin");
     const connectionId = boundedString(c.req.query("connectionId"), 64);
     if (!connectionId) throw new HTTPException117(400, { message: "connectionId is required" });
     const routes = await listSlackChannelRoutes(
@@ -118284,7 +119098,7 @@ function registerSlackInteractionRoutes(app, deps) {
   });
   app.put("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:admin");
     const payload = await parseRequestJson(c, UpdateSlackChannelRoutesRequest);
     const home = { accountId: grant.accountId, workspaceId };
     const installation = await listSlackInstallationBindings2(deps.db, home);
@@ -118339,7 +119153,7 @@ function registerSlackInteractionRoutes(app, deps) {
   });
   app.get("/v1/workspaces/:workspaceId/integrations/slack/reaction-channels", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant53(c, deps, workspaceId, "workspace:admin");
+    const grant = await requireAccessGrant52(c, deps, workspaceId, "workspace:admin");
     const connectionId = boundedString(c.req.query("connectionId"), 64);
     if (!connectionId) throw new HTTPException117(400, { message: "connectionId is required" });
     const cursor = boundedString(c.req.query("cursor"), 1024);
@@ -122244,10 +123058,23 @@ function createAppComposition(deps) {
     }, MANAGED_AUTH_REAPER_INTERVAL_MS);
     timer.unref?.();
   }
+  if (deps.transcription === void 0) {
+    for (const issue of voiceInputPricingIssues(deps.settings)) {
+      observability.error(
+        `Voice input provider ${issue.providerId} is unavailable: ${issue.message}`,
+        {
+          providerId: issue.providerId,
+          env: issue.env,
+          reason: issue.reason
+        }
+      );
+    }
+  }
   const transcription = deps.transcription === void 0 ? createTranscriptionService({
     settings: deps.settings,
     db: deps.db,
-    ...deps.codexFetch ? { codexFetch: deps.codexFetch } : {}
+    ...deps.codexFetch ? { codexFetch: deps.codexFetch } : {},
+    log: (message, attributes) => observability.error(message, attributes)
   }) : deps.transcription;
   const transcriptionSegmenter = deps.transcriptionSegmenter === void 0 ? createFfmpegTranscriptionSegmenter({
     ffmpegPath: deps.settings.voiceInputFfmpegPath
@@ -122355,8 +123182,14 @@ function createAppComposition(deps) {
       "X-OpenGeni-Access-Key",
       "X-OpenGeni-Api-Contract",
       "X-OpenGeni-Actor-Epoch",
+      // Resumable voice-input chunk integrity/timing (cross-origin embeds).
+      "X-OpenGeni-Chunk-Duration-Milliseconds",
+      "X-OpenGeni-Chunk-Sha256",
+      "X-OpenGeni-Chunk-Start-Milliseconds",
       "X-OpenGeni-Correlation-Id",
       "X-OpenGeni-Session-Csrf",
+      // Session scope for a session proxy; the API itself ignores it.
+      "X-OpenGeni-Session-Id",
       "X-OpenGeni-Site-Id",
       "X-OpenGeni-Site-Version",
       "X-OpenGeni-Subject",
@@ -122803,6 +123636,8 @@ function createAppComposition(deps) {
       creditsAvailable: false
     });
     let modelSelectionForbidden = false;
+    let voiceInputAvailable = false;
+    let voiceInputProviders = [];
     const requestedWorkspaceId = c.req.query("workspaceId");
     if (requestedWorkspaceId !== void 0 && requestedWorkspaceId.trim() === "") {
       throw new HTTPException118(422, { message: "workspaceId must not be empty" });
@@ -122821,7 +123656,7 @@ function createAppComposition(deps) {
       }
       const workspaceId = requestedWorkspaceId ?? context?.defaultWorkspaceId;
       if (context && workspaceId) {
-        const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+        const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
         await withAccessGrantSessionRlsContext(routeDeps, grant, async () => {
           catalogSettings = (await resolveWorkspaceCatalogSettings10(deps.db, deps.settings, {
             accountId: grant.accountId,
@@ -122838,6 +123673,19 @@ function createAppComposition(deps) {
             selections = [];
           }
           const workspace = await getWorkspace12(deps.db, workspaceId);
+          const voicePreferences = WorkspaceVoiceInputSettings3.safeParse(
+            workspace?.settings.voiceInput
+          ).data;
+          const voiceContext = {
+            workspaceId,
+            subjectId: grant.subjectId,
+            preferredProvider: voicePreferences?.preferredProvider,
+            fallbackEnabled: voicePreferences?.fallbackEnabled
+          };
+          if (hasPermission34(grant.permissions, "sessions:create") && transcription) {
+            voiceInputProviders = await transcription.availableProviderIds?.(voiceContext) ?? [];
+            voiceInputAvailable = voiceInputProviders.length > 0 && await Promise.resolve(transcription.available(voiceContext)).catch(() => false);
+          }
           defaultSelection = await resolveDefaultSessionModelForSelections2(deps.db, {
             settings: catalogSettings,
             accountId: grant.accountId,
@@ -122893,14 +123741,12 @@ function createAppComposition(deps) {
           maxSizeBytes: objectStorage?.maxSinglePutSizeBytes ?? 5e9
         },
         voiceInput: {
-          providers: resolveVoiceInputProviderRegistry2(deps.settings).map(
-            (provider) => provider.id
-          ),
-          available: await transcription?.available() ?? false,
+          providers: voiceInputProviders,
+          available: voiceInputAvailable,
           maxDurationSeconds: deps.settings.voiceInputMaxDurationSeconds,
           maxSizeBytes: deps.settings.voiceInputMaxSizeBytes,
           acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES2],
-          ...deps.settings.voiceInputResumableEnabled && objectStorage && transcription && transcriptionSegmenter && await transcription.available() && await transcriptionSegmenter.available() ? {
+          ...deps.settings.voiceInputResumableEnabled && objectStorage && transcription && transcriptionSegmenter && voiceInputAvailable && await transcriptionSegmenter.available() ? {
             resumable: {
               maxDurationSeconds: deps.settings.voiceInputResumableMaxDurationSeconds,
               maxSizeBytes: deps.settings.voiceInputResumableMaxSizeBytes,
@@ -123009,7 +123855,7 @@ function createAppComposition(deps) {
   app.use("/v1/workspaces/:workspaceId/*", async (c, next) => {
     const workspaceId = c.req.param("workspaceId");
     if (workspaceRequestRequiresCodexAccountPrevalidation(c.req.raw)) {
-      const grant2 = await requireAccessGrant54(c, routeDeps, workspaceId);
+      const grant2 = await requireAccessGrant53(c, routeDeps, workspaceId);
       await validateCodexAccountTarget(c.req.raw);
       await withAccessGrantSessionRlsContext(routeDeps, grant2, next);
       return;
@@ -123019,7 +123865,7 @@ function createAppComposition(deps) {
       return;
     }
     const permission = c.req.method === "PUT" && /^\/v1\/workspaces\/[^/]+\/artifact-catalog\/[^/]+\/[^/]+\/pin$/.test(c.req.path) ? "artifacts:publish" : void 0;
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId, permission);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId, permission);
     await withAccessGrantSessionRlsContext(routeDeps, grant, next);
   });
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
@@ -123174,7 +124020,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/tools/catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123190,7 +124036,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/tools/calls", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123219,7 +124065,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/tools/approvals", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123248,7 +124094,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/tools/declarations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const authorization = await requireAccessGrantAuthorization40(
+    const authorization = await requireAccessGrantAuthorization41(
       c,
       routeDeps,
       workspaceId,
@@ -123264,7 +124110,7 @@ function createAppComposition(deps) {
   });
   app.all("/v1/workspaces/:workspaceId/codemode/sdk/*", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     const url = new URL(c.req.url);
     const prefix2 = `/v1/workspaces/${workspaceId}/codemode/sdk`;
     let forwarded;
@@ -123282,7 +124128,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/codemode/catalog", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
       throw new HTTPException118(403, { message: "Codemode access denied" });
     }
@@ -123294,7 +124140,7 @@ function createAppComposition(deps) {
   });
   app.post("/v1/workspaces/:workspaceId/codemode/calls", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
       throw new HTTPException118(403, { message: "Codemode access denied" });
     }
@@ -123314,7 +124160,7 @@ function createAppComposition(deps) {
   });
   app.get("/v1/workspaces/:workspaceId/codemode/calls/:operationId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant54(c, routeDeps, workspaceId);
+    const grant = await requireAccessGrant53(c, routeDeps, workspaceId);
     if (!isCodemodeGrant(grant)) {
       throw new HTTPException118(403, { message: "Codemode access denied" });
     }
@@ -123439,13 +124285,13 @@ function createAppComposition(deps) {
         latencyMode: rawError.latencyMode,
         allowedLatencyModes: [...rawError.allowedLatencyModes]
       }
-    }) : null) ?? requestBodyValidationHttpError(rawError) ?? invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ?? databaseUnavailableHttpError(rawError, c.req.method) ?? rawError;
+    }) : null) ?? requestBodyValidationHttpError(rawError) ?? invalidPathIdentifierHttpError(rawError, new URL(c.req.url).pathname) ?? databaseUnavailableHttpError(rawError, c.req.method) ?? databaseContentionHttpError(rawError, c.req.method) ?? rawError;
     const compactionLock = codexCompactionV2ProviderLockedError(error);
     const apiError = error instanceof ApiHttpError ? error : null;
     const status = compactionLock ? 422 : httpStatusForError(error);
     const code = compactionLock ? compactionLock.code : apiError?.code ?? errorCodeForStatus(status);
     if (status >= 500) logHttpFailure(c, status, code, rawError);
-    if (apiError?.details?.code === DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE) {
+    if (apiError?.details?.code === DATABASE_UNAVAILABLE_ERROR_DETAIL_CODE || apiError?.details?.code === DATABASE_CONTENTION_ERROR_DETAIL_CODE) {
       c.header("retry-after", "1");
     }
     const envelope = ErrorEnvelope.parse({
@@ -123511,7 +124357,7 @@ async function validateCodexAccountTarget(request) {
   }
 }
 async function requireMcpAccessGrantAuthorization(c, deps, workspaceId) {
-  const authorization = await requireAccessGrantAuthorization40(c, deps, workspaceId);
+  const authorization = await requireAccessGrantAuthorization41(c, deps, workspaceId);
   const grant = authorization.grant;
   if (hasPermission34(grant.permissions, "workspace:read")) {
     return authorization;
@@ -123666,6 +124512,8 @@ function assertConfiguredCodemodeSessionProxyPath(session, path, method) {
   }
 }
 function codemodeHttpError(error) {
+  const contention = databaseContentionHttpError(error, "POST", { outcomeUnknown: false });
+  if (contention) return contention;
   if (error instanceof SiteSessionPathError) {
     return new HTTPException118(404, { message: error.message, cause: error });
   }
@@ -124905,4 +125753,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession4 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-IZEGLLKZ.js.map
+//# sourceMappingURL=chunk-F3LQ6VWR.js.map