@opengeni/api-router 3.0.1 → 3.1.2

package/src/site-uploads.ts

@@ -1,5 +1,6 @@
 import { WorkspaceArtifactSourceBundle, type AccessGrant } from "@opengeni/contracts";
 import type { ApiRouteDeps, ObjectStorageDependency } from "@opengeni/core";
+import { retryWhileMissing } from "@opengeni/storage";
 import {
   createWorkspaceArtifactUpload,
   getWorkspaceArtifactUpload,
@@ -10,6 +11,7 @@ import {
   prepareWorkspaceArtifactContent,
   type PreparedWorkspaceArtifactContent,
 } from "./workspace-artifact-content";
+import { userContentSignedGetUrlOptions } from "./http/user-content";
 type Storage = NonNullable<ObjectStorageDependency>;
 export const MAX_SITE_SOURCE_BYTES = 64 * 1024 * 1024;
 
@@ -19,10 +21,15 @@ export async function validateSiteSource(storage: Storage, key: string, sizeByte
       "Editable source JSON must be at most 64 MiB. Exclude dependencies and build output; HTML has a separate storage limit.",
     );
   }
-  const content = await storage.getObjectBytes(key);
+  const content = await retryWhileMissing(() => storage.getObjectBytes(key));
+  if (!content) {
+    throw new WorkspaceArtifactOperationError(
+      "Site source is not available yet. Retry publication with the same upload.",
+    );
+  }
   try {
     WorkspaceArtifactSourceBundle.parse(
-      JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(content!.bytes)),
+      JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(content.bytes)),
     );
   } catch {
     throw new WorkspaceArtifactOperationError(
@@ -129,13 +136,22 @@ async function freeze(
     }
     decoder.decode();
   }
-  await storage.putObjectStreamIfAbsent({
+  const created = await storage.putObjectStreamIfAbsent({
     key: to,
     contentType,
     byteSize: head.ContentLength,
     chunks: chunks(),
   });
-  return (await storage.headObject(to))!.ContentLength!;
+  // A successful conditional PUT is the receipt. A following visibility miss
+  // cannot invalidate it. Only a conflict needs the existing winner's metadata.
+  if (created) return head.ContentLength;
+  const stored = await retryWhileMissing(() => storage.headObject!(to));
+  if (!stored || stored.ContentLength === undefined) {
+    throw new WorkspaceArtifactOperationError(
+      "Frozen Site upload is unavailable. Retry publication with the same upload.",
+    );
+  }
+  return stored.ContentLength;
 }
 type Input = Partial<Parameters<typeof prepareWorkspaceArtifactContent>[2]> & { uploadId?: string };
 export async function prepareWorkspaceArtifactPublication(
@@ -190,7 +206,13 @@ export async function workspaceArtifactDownloads(
   audience: "sandbox" | "public",
 ) {
   const [html, source] = await Promise.all([
-    storage.createGetUrl({ key: ref.contentKey, audience }),
+    // Site HTML runs publisher scripts; opened directly from storage it would
+    // render outside the console's opaque-origin frame, so it downloads.
+    storage.createGetUrl({
+      key: ref.contentKey,
+      audience,
+      ...userContentSignedGetUrlOptions("text/html", "site.html"),
+    }),
     ref.sourceKey ? storage.createGetUrl({ key: ref.sourceKey, audience }) : null,
   ]);
   return {

package/src/temporal-schedule-sync.ts

@@ -0,0 +1,74 @@
+import type { ScheduledTask } from "@opengeni/contracts";
+import { getScheduledTaskIncludingDeleted, type Database } from "@opengeni/db";
+import { sql } from "drizzle-orm";
+
+const LOCK_TIMEOUT = "5s";
+const WRITE_TIMEOUT_MS = 5_000;
+
+type TemporalScheduleSyncDependencies = {
+  db: Database;
+  withDeadline<T>(deadline: number, work: () => Promise<T>): Promise<T>;
+  upsert(task: ScheduledTask): Promise<void>;
+  /** Idempotent: an absent Temporal schedule is already removed. */
+  remove(temporalScheduleId: string): Promise<void>;
+};
+
+/**
+ * Serialize external writes across API replicas, independently of task edits.
+ * A queued sync rereads the newest committed row after acquiring this lock;
+ * input snapshots never become desired state. Cleanup uses the same key, so
+ * an in-flight upsert finishes before its tombstone's external deletion.
+ * Failure compensation commits before releasing the lock, so a queued writer
+ * cannot read the row being restored and then publish that failed edit.
+ *
+ * Deadlines bound both lock admission and network occupancy. A thrown network
+ * error retains its unknown-outcome semantics; this is not durable recovery
+ * for a process crash or a lost Temporal acknowledgement.
+ */
+export function createTemporalScheduleSynchronizer(deps: TemporalScheduleSyncDependencies) {
+  const write = async <T>(
+    temporalScheduleId: string,
+    work: (tx: Database) => Promise<T>,
+  ): Promise<T> =>
+    deps.db.transaction(async (tx) => {
+      await tx.execute(sql`select set_config('lock_timeout', ${LOCK_TIMEOUT}, true)`);
+      await tx.execute(sql`select pg_advisory_xact_lock(
+        hashtextextended(${`scheduled-task-temporal:${temporalScheduleId}`}, 0)
+      )`);
+      return await work(tx);
+    });
+
+  return {
+    async sync(
+      task: Pick<ScheduledTask, "id" | "workspaceId" | "temporalScheduleId">,
+      onFailure?: (tx: Database, error: unknown) => Promise<Error>,
+    ) {
+      const result = await write(task.temporalScheduleId, async (tx) => {
+        try {
+          await deps.withDeadline(Date.now() + WRITE_TIMEOUT_MS, async () => {
+            const current = await getScheduledTaskIncludingDeleted(tx, task.workspaceId, task.id);
+            if (current && current.temporalScheduleId !== task.temporalScheduleId)
+              throw new Error("Scheduled task Temporal identity changed");
+            if (!current || current.deletedAt !== null || current.schedule.type === "manual") {
+              await deps.remove(task.temporalScheduleId);
+              return;
+            }
+            const { deletedAt: _deletedAt, ...latest } = current;
+            await deps.upsert(latest);
+          });
+          return { ok: true as const };
+        } catch (error) {
+          return { ok: false as const, error: onFailure ? await onFailure(tx, error) : error };
+        }
+      });
+      // Throw after commit: throwing inside the transaction would also undo a
+      // successful compensation. A failed commit cannot claim that receipt.
+      if (!result.ok) throw result.error;
+    },
+    async remove(temporalScheduleId: string) {
+      await write(temporalScheduleId, async () =>
+        deps.withDeadline(Date.now() + WRITE_TIMEOUT_MS, () => deps.remove(temporalScheduleId)),
+      );
+    },
+  };
+}

package/src/transcription/billing-refusal.ts

@@ -0,0 +1,14 @@
+import type { TranscriptionBillingRefusedError } from "@opengeni/core";
+import type { Context } from "hono";
+
+/**
+ * Same body shape as session admission refusals (`code` + `message`, plus
+ * allowance `scope`/`resetsAt`), so SDK/React clients classify it as a
+ * definitive credit/allowance refusal rather than a retryable failure.
+ */
+export function transcriptionBillingRefusal(
+  c: Context,
+  error: TranscriptionBillingRefusedError,
+): Response {
+  return c.json({ code: error.code, message: error.message, ...error.details }, error.status);
+}

package/src/transcription/normalize.ts

@@ -0,0 +1,77 @@
+import { TranscriptionServiceError } from "@opengeni/core";
+import { createFfmpegTranscriptionSegmenter, TranscriptionSegmenterError } from "./segmenter";
+import { wavDurationSeconds } from "./wav-duration";
+
+/**
+ * Decode one uploaded recording to 16 kHz mono PCM WAV with a hard decode
+ * ceiling, and measure its duration from the bytes the server produced.
+ */
+export type TranscriptionAudioNormalizer = (input: {
+  audio: Uint8Array;
+  mimeType: string;
+  /** Longest accepted recording; anything longer is refused, never truncated. */
+  maxDurationSeconds: number;
+  signal?: AbortSignal | undefined;
+}) => Promise<{ bytes: Uint8Array; durationSeconds: number }>;
+
+/**
+ * ffmpeg decodes at most `maxDurationSeconds + 1` seconds (`-t`), so a long or
+ * hostile upload costs bounded CPU and disk. Output that reaches that ceiling
+ * was longer than the limit and is refused as `too_large` before any provider
+ * call, so the transcript the user receives is never silently cut short.
+ */
+export function createFfmpegAudioNormalizer(input: {
+  ffmpegPath: string;
+}): TranscriptionAudioNormalizer {
+  const segmenter = createFfmpegTranscriptionSegmenter({ ffmpegPath: input.ffmpegPath });
+  return async ({ audio, mimeType, maxDurationSeconds, signal }) => {
+    if (!Number.isFinite(maxDurationSeconds) || maxDurationSeconds <= 0) {
+      throw new TranscriptionServiceError({
+        code: "unavailable",
+        message: "Voice input duration limit is not configured.",
+      });
+    }
+    const decodeSeconds = Math.ceil(maxDurationSeconds) + 1;
+    // One segment strictly longer than the decode ceiling: never a second file.
+    const segmentSeconds = decodeSeconds + 1;
+    let normalized: Uint8Array | undefined;
+    try {
+      for await (const segment of segmenter.segment({
+        sourceMimeType: mimeType,
+        chunks: (async function* () {
+          yield audio;
+        })(),
+        providerSegmentSeconds: segmentSeconds,
+        totalDurationMilliseconds: segmentSeconds * 1_000,
+        maxDecodeSeconds: decodeSeconds,
+        ...(signal ? { signal } : {}),
+      })) {
+        if (normalized) {
+          throw new TranscriptionServiceError({ code: "too_large", message: "Audio is too long." });
+        }
+        normalized = segment.bytes;
+      }
+    } catch (error) {
+      if (error instanceof TranscriptionSegmenterError) {
+        throw new TranscriptionServiceError({
+          code: error.code === "unknown" ? "invalid_audio" : error.code,
+          message: "Audio could not be prepared for transcription.",
+          retryable: error.retryable,
+        });
+      }
+      throw error;
+    }
+    const durationSeconds = normalized ? wavDurationSeconds(normalized) : null;
+    if (!normalized || durationSeconds === null || !(durationSeconds > 0)) {
+      throw new TranscriptionServiceError({
+        code: "invalid_audio",
+        message: "Audio could not be decoded.",
+      });
+    }
+    // Reaching the decode ceiling (within one 20 ms frame) means the source ran past it.
+    if (durationSeconds > decodeSeconds - 0.02) {
+      throw new TranscriptionServiceError({ code: "too_large", message: "Audio is too long." });
+    }
+    return { bytes: normalized, durationSeconds };
+  };
+}

package/src/transcription/providers/azure-mai.ts

@@ -0,0 +1,98 @@
+import type { VoiceInputPricing } from "@opengeni/config";
+import type { TranscriptionProvider } from "@opengeni/core";
+import { createFfmpegAudioNormalizer } from "../normalize";
+import { fetchError, responseError } from "./openai";
+
+/** Azure Speech file transcription; credentials and model selection stay server-side. */
+export function createMaiTranscriptionProvider(input: {
+  endpoint: string;
+  apiKey: string;
+  apiVersion: string;
+  model: string;
+  pricing?: VoiceInputPricing | null;
+  ffmpegPath: string;
+  fetch?: typeof fetch;
+}): TranscriptionProvider {
+  const fetchImpl = input.fetch ?? fetch;
+  const normalize = createFfmpegAudioNormalizer({ ffmpegPath: input.ffmpegPath });
+  return {
+    id: "azure-mai",
+    supportsServerDeadline: true,
+    deploymentFunded: { model: input.model, pricing: input.pricing ?? null },
+    available: () => Boolean(input.apiKey),
+    async transcribe({ audio, mimeType, filename, requestId, signal }) {
+      let bytes = audio;
+      let contentType = mimeType;
+      let name = filename;
+      // Resumable segments and credit-billed one-shot uploads already arrive
+      // as server-normalized WAV. Anything else (credit billing off) gets the
+      // same bounded decoder before entering Speech's file API.
+      if (!["audio/wav", "audio/x-wav", "audio/mpeg", "audio/flac"].includes(mimeType)) {
+        const normalized = await normalize({
+          audio,
+          mimeType,
+          maxDurationSeconds: 600,
+          ...(signal ? { signal } : {}),
+        });
+        bytes = normalized.bytes;
+        contentType = "audio/wav";
+        name = "audio.wav";
+      }
+      const form = new FormData();
+      form.append("audio", new Blob([Uint8Array.from(bytes).buffer], { type: contentType }), name);
+      form.append(
+        "definition",
+        JSON.stringify({ enhancedMode: { enabled: true, model: input.model } }),
+      );
+      let response: Response;
+      try {
+        response = await fetchImpl(
+          `${input.endpoint.replace(/\/+$/, "")}/speechtotext/transcriptions:transcribe?api-version=${encodeURIComponent(input.apiVersion)}`,
+          {
+            method: "POST",
+            headers: {
+              "Ocp-Apim-Subscription-Key": input.apiKey,
+              "x-opengeni-request-id": requestId,
+            },
+            body: form,
+            ...(signal ? { signal } : {}),
+          },
+        );
+      } catch (error) {
+        throw fetchError(error);
+      }
+      if (!response.ok) throw responseError(response.status);
+      const body = await response.json().catch(() => null);
+      if (
+        !body ||
+        !Array.isArray(body.combinedPhrases) ||
+        !body.combinedPhrases.every(
+          (phrase: unknown) =>
+            typeof phrase === "object" &&
+            phrase !== null &&
+            "text" in phrase &&
+            typeof phrase.text === "string",
+        )
+      ) {
+        throw responseError(502);
+      }
+      return {
+        usage:
+          typeof body.durationMilliseconds === "number" &&
+          Number.isFinite(body.durationMilliseconds) &&
+          body.durationMilliseconds >= 0
+            ? { kind: "duration" as const, seconds: body.durationMilliseconds / 1000 }
+            : null,
+        text: body.combinedPhrases.map((phrase: { text: string }) => phrase.text).join("\n"),
+        languages: [
+          ...new Set<string>(
+            (Array.isArray(body.phrases) ? body.phrases : []).flatMap(
+              (phrase: { locale?: unknown }) =>
+                typeof phrase?.locale === "string" && phrase.locale ? [phrase.locale] : [],
+            ),
+          ),
+        ],
+      };
+    },
+  };
+}

package/src/transcription/providers/azure-openai.ts

@@ -1,5 +1,6 @@
+import { voiceInputModelReportsDurationOnly, type VoiceInputPricing } from "@opengeni/config";
 import type { TranscriptionProvider } from "@opengeni/core";
-import { fetchError, responseError } from "./openai";
+import { fetchError, parseTranscriptionResponseBody, responseError } from "./openai";
 
 export function createAzureOpenAiTranscriptionProvider(input: {
   endpoint: string;
@@ -7,17 +8,27 @@ export function createAzureOpenAiTranscriptionProvider(input: {
   apiVersion: string;
   apiKey: string | null;
   adToken: string | null;
+  /** Underlying model of the deployment; defaults to the deployment name. */
+  model?: string;
+  pricing?: VoiceInputPricing | null;
   fetch?: typeof fetch;
 }): TranscriptionProvider {
   const fetchImpl = input.fetch ?? fetch;
-  const url = `${input.endpoint}/openai/deployments/${encodeURIComponent(input.deployment)}/audio/transcriptions?api-version=${encodeURIComponent(input.apiVersion)}`;
+  const model = input.model ?? input.deployment;
+  const endpoint = input.endpoint.replace(/\/+$/, "");
+  const url = `${endpoint}/openai/deployments/${encodeURIComponent(input.deployment)}/audio/transcriptions?api-version=${encodeURIComponent(input.apiVersion)}`;
   return {
     id: "azure-openai",
     supportsServerDeadline: true,
+    deploymentFunded: { model, pricing: input.pricing ?? null },
     available: () => Boolean(input.apiKey || input.adToken),
     async transcribe({ audio, mimeType, filename, requestId, signal }) {
       const form = new FormData();
       form.append("file", new Blob([Uint8Array.from(audio).buffer], { type: mimeType }), filename);
+      // Whisper reports its billed audio duration only in verbose_json.
+      if (voiceInputModelReportsDurationOnly(model)) {
+        form.append("response_format", "verbose_json");
+      }
       const headers: Record<string, string> = input.apiKey
         ? { "api-key": input.apiKey, "x-opengeni-request-id": requestId }
         : { Authorization: `Bearer ${input.adToken}`, "x-opengeni-request-id": requestId };
@@ -34,13 +45,11 @@ export function createAzureOpenAiTranscriptionProvider(input: {
       }
       if (!response.ok) throw responseError(response.status);
       const body = await response.json().catch(() => null);
-      if (!body || typeof body.text !== "string") {
+      const parsed = parseTranscriptionResponseBody(body);
+      if (!parsed) {
         throw responseError(502);
       }
-      return {
-        text: body.text,
-        languages: typeof body.language === "string" && body.language ? [body.language] : [],
-      };
+      return parsed;
     },
   };
 }

package/src/transcription/providers/codex-subscription.ts

@@ -1,20 +1,151 @@
 import { CODEX_CLIENT_VERSION, CODEX_ORIGINATOR } from "@opengeni/codex/constants";
+import type { CodexFetch } from "@opengeni/codex";
 import type { Settings } from "@opengeni/config";
 import {
   type TranscriptionAvailabilityContext,
   type TranscriptionProvider,
   TranscriptionServiceError,
 } from "@opengeni/core";
-import { buildCodexTokenResolver, type Database, listCodexAccountStatuses } from "@opengeni/db";
-import { fetchError, responseError } from "./openai";
+import {
+  acquireSubscriptionCoreCodexOperationLease,
+  buildSubscriptionCoreCodexConnectionTokenResolver,
+  buildSubscriptionCoreCodexOperationFetch,
+  getWorkspace,
+  listSubscriptionCoreCodexOperationCandidates,
+  readCodexCutoverDisposition,
+  releaseSubscriptionCoreCodexOperationLease,
+  renewSubscriptionCoreCodexOperationLease,
+  type Database,
+  type SubscriptionCoreCodexOperationLeaseRef,
+  type SubscriptionCoreCodexOperationScope,
+} from "@opengeni/db";
+import { fetchError } from "./openai";
+import {
+  coreTranscriptionResult,
+  coreTranscriptionUnavailable,
+  withoutFallback,
+} from "./subscription-core";
 
 const TRANSCRIBE_URL = "https://chatgpt.com/backend-api/transcribe";
 
-async function workspaceHasActiveCodexAccount(db: Database, workspaceId: string): Promise<boolean> {
-  const account = (await listCodexAccountStatuses(db, workspaceId)).find(
-    (candidate) => candidate.isActive && candidate.status === "active",
+/**
+ * Codex transcription on the shared subscription core (M3 PR 2c, EP-N01..N04):
+ * a sessionless operation for the authenticated caller in an explicit
+ * account/workspace context, on a shared organization- or workspace-scoped
+ * connection only, under its own operation lease and the per-connection
+ * refresh lock. It never reads the legacy active pointer.
+ */
+async function transcribeOnCore(
+  input: { settings: Settings; db: Database; fetch: typeof fetch },
+  request: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    requestId: string;
+    send: (
+      accessToken: string,
+      accountId: string | null,
+      fetchImpl: CodexFetch,
+    ) => Promise<Response>;
+  },
+): Promise<{ text: string; languages: string[] }> {
+  const scope: SubscriptionCoreCodexOperationScope = {
+    kind: "workspace",
+    accountId: request.accountId,
+    workspaceId: request.workspaceId,
+    subjectId: request.subjectId,
+  };
+  const candidates = await listSubscriptionCoreCodexOperationCandidates(input.db, scope);
+  const operationId = crypto.randomUUID();
+  const attemptId = crypto.randomUUID();
+  for (const candidate of candidates) {
+    const ref: SubscriptionCoreCodexOperationLeaseRef = {
+      operationId,
+      attemptId,
+      operationKind: "transcription",
+      connectionId: candidate.connectionId,
+      holderId: `transcription:${request.requestId}`.slice(0, 256),
+      generation: 1,
+    };
+    const lease = await acquireSubscriptionCoreCodexOperationLease(input.db, scope, ref);
+    if (lease.kind !== "acquired") continue;
+    try {
+      const resolver = buildSubscriptionCoreCodexConnectionTokenResolver(
+        input.db,
+        input.settings,
+        scope,
+        candidate.connectionId,
+        ref,
+      );
+      const requestFetch = buildSubscriptionCoreCodexOperationFetch(
+        input.db,
+        scope,
+        ref,
+        candidate.connectionId,
+        input.fetch,
+        { requestId: `transcription:${request.requestId}` },
+      );
+      const dispatch = async (force: boolean): Promise<Response> => {
+        const token = force ? await resolver.refresh() : await resolver.getToken();
+        // Pre-dispatch fence: the exact operation lease must still be live.
+        if (!(await renewSubscriptionCoreCodexOperationLease(input.db, scope, ref))) {
+          throw coreTranscriptionUnavailable();
+        }
+        return await request.send(token.accessToken, token.chatgptAccountId, requestFetch);
+      };
+      let response: Response;
+      try {
+        response = await dispatch(false);
+        if (response.status === 401) {
+          await response.arrayBuffer();
+          response = await dispatch(true);
+        }
+      } catch (error) {
+        if (error instanceof TranscriptionServiceError) throw error;
+        // A provider transport failure keeps its classification but is never
+        // replayed through another provider.
+        throw withoutFallback(fetchError(error));
+      }
+      // Keep operation custody through parsing, not just response headers.
+      return await coreTranscriptionResult(response);
+    } finally {
+      await releaseSubscriptionCoreCodexOperationLease(input.db, scope, ref).catch(() => false);
+    }
+  }
+  throw coreTranscriptionUnavailable();
+}
+
+async function sendTranscription(
+  fetchImpl: CodexFetch,
+  input: {
+    accessToken: string;
+    chatgptAccountId: string | null;
+    audio: Uint8Array;
+    mimeType: string;
+    filename: string;
+    requestId: string;
+    signal?: AbortSignal | undefined;
+  },
+): Promise<Response> {
+  const form = new FormData();
+  form.append(
+    "file",
+    new Blob([Uint8Array.from(input.audio).buffer], { type: input.mimeType }),
+    input.filename,
   );
-  return account != null;
+  return await fetchImpl(TRANSCRIBE_URL, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${input.accessToken}`,
+      ...(input.chatgptAccountId ? { "ChatGPT-Account-ID": input.chatgptAccountId } : {}),
+      originator: CODEX_ORIGINATOR,
+      "User-Agent": `${CODEX_ORIGINATOR}/${CODEX_CLIENT_VERSION}`,
+      version: CODEX_CLIENT_VERSION,
+      "x-opengeni-request-id": input.requestId,
+    },
+    body: form,
+    ...(input.signal ? { signal: input.signal } : {}),
+  });
 }
 
 export function createCodexSubscriptionTranscriptionProvider(input: {
@@ -32,74 +163,66 @@ export function createCodexSubscriptionTranscriptionProvider(input: {
       // passes workspaceId so we only claim Codex when a subscription is
       // attached; otherwise OpenAI/Azure remain eligible.
       if (!context?.workspaceId) return true;
-      return await workspaceHasActiveCodexAccount(input.db, context.workspaceId);
+      const accountId =
+        (context as { accountId?: string }).accountId ??
+        (await getWorkspace(input.db, context.workspaceId))?.accountId;
+      // An unresolvable account fails closed rather than guessing a path.
+      if (!accountId) return false;
+      const disposition = await readCodexCutoverDisposition(
+        input.db,
+        accountId,
+        context.workspaceId,
+      );
+      // A disabled cutover row is maintenance: unavailable, no legacy read.
+      if (disposition === "maintenance") return false;
+      if (disposition === "core") {
+        const candidates = await listSubscriptionCoreCodexOperationCandidates(input.db, {
+          kind: "workspace",
+          accountId,
+          workspaceId: context.workspaceId,
+          subjectId: context.subjectId ?? "service:subscription-core",
+        });
+        return candidates.length > 0;
+      }
+      return false;
     });
   return {
     id: "codex-subscription",
     supportsServerDeadline: true,
     experimental: true,
     available: probe,
-    async transcribe({ audio, mimeType, filename, workspaceId, requestId, signal }) {
-      const account = (await listCodexAccountStatuses(input.db, workspaceId)).find(
-        (candidate) => candidate.isActive && candidate.status === "active",
+    async transcribe({
+      audio,
+      mimeType,
+      filename,
+      workspaceId,
+      accountId: organizationId,
+      subjectId,
+      requestId,
+      signal,
+    }) {
+      const disposition = await readCodexCutoverDisposition(input.db, organizationId, workspaceId);
+      if (disposition === "maintenance") throw coreTranscriptionUnavailable();
+
+      return await transcribeOnCore(
+        { settings: input.settings, db: input.db, fetch: fetchImpl },
+        {
+          accountId: organizationId,
+          workspaceId,
+          subjectId,
+          requestId,
+          send: async (accessToken, chatgptAccountId, requestFetch) =>
+            await sendTranscription(requestFetch, {
+              accessToken,
+              chatgptAccountId,
+              audio,
+              mimeType,
+              filename,
+              requestId,
+              signal,
+            }),
+        },
       );
-      if (!account) {
-        throw new TranscriptionServiceError({
-          fallbackSafe: true,
-          code: "unavailable",
-          message: "Transcription is unavailable.",
-        });
-      }
-      const resolver = buildCodexTokenResolver(input.db, input.settings, workspaceId, account.id);
-      let token: Awaited<ReturnType<typeof resolver.getToken>>;
-      try {
-        token = await resolver.getToken();
-      } catch {
-        throw new TranscriptionServiceError({
-          fallbackSafe: true,
-          code: "unavailable",
-          message: "Transcription is unavailable.",
-        });
-      }
-      const request = async (accessToken: string, accountId: string | null) => {
-        const form = new FormData();
-        form.append(
-          "file",
-          new Blob([Uint8Array.from(audio).buffer], { type: mimeType }),
-          filename,
-        );
-        return await fetchImpl(TRANSCRIBE_URL, {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${accessToken}`,
-            ...(accountId ? { "ChatGPT-Account-ID": accountId } : {}),
-            originator: CODEX_ORIGINATOR,
-            "User-Agent": `${CODEX_ORIGINATOR}/${CODEX_CLIENT_VERSION}`,
-            version: CODEX_CLIENT_VERSION,
-            // Observability only; the upstream API is not treated as idempotent.
-            "x-opengeni-request-id": requestId,
-          },
-          body: form,
-          ...(signal ? { signal } : {}),
-        });
-      };
-      let response: Response;
-      try {
-        response = await request(token.accessToken, token.chatgptAccountId);
-        if (response.status === 401) {
-          token = await resolver.refresh();
-          response = await request(token.accessToken, token.chatgptAccountId);
-        }
-      } catch (error) {
-        throw fetchError(error);
-      }
-      if (!response.ok) throw responseError(response.status);
-      const body = await response.json().catch(() => null);
-      if (!body || typeof body.text !== "string") throw responseError(502);
-      return {
-        text: body.text,
-        languages: typeof body.language === "string" && body.language ? [body.language] : [],
-      };
     },
   };
 }