@opengeni/core 1.3.0 → 1.4.0

package/dist/index.js

@@ -837,6 +837,7 @@ function expandApiIntegrationAccountRoutes(input) {
 }
 
 // src/domain/session-connection-accounts.ts
+import { allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession4 } from "@opengeni/config";
 import { requireSession as requireSession3, requireWorkspace as requireWorkspace6 } from "@opengeni/db";
 
 // src/domain/capabilities.ts
@@ -4834,6 +4835,7 @@ import {
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX as ORGANIZATION_GATEWAY_MODEL_ID_PREFIX2,
   ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX as ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX2,
   allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession3,
+  deploymentUnavailableFirstPartyMcpTools,
   resolveFirstPartyMcpToolPolicy,
   policyProviderIdForModel,
   resolveTurnExecutionPolicyV1,
@@ -5370,6 +5372,7 @@ import {
   readActiveSandbox,
   retainWorkspaceMutationProcess,
   SandboxRetainedProcessPromotionFencedError,
+  SandboxWorkspaceMutationOutputRejectedError,
   retainedProcessSettlementIdentity,
   settleRetainedProcess,
   verifyDirectWorkspaceMutationSettlement,
@@ -5382,6 +5385,7 @@ import {
   NatsControlRpc,
   NatsOpStreamTransport,
   RoutingSandboxSession,
+  RoutingMutationOutputRejectedError,
   resolveModalCheckpointProviderBindingForSession
 } from "@opengeni/runtime/sandbox";
 var retainWorkspaceProviderCommand = createProviderCommandRetainer(
@@ -5540,22 +5544,35 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       throw new Error(
         "Outcome-unknown command settlement requires its exact retained invocation"
       );
-    await verifyDirectWorkspaceMutationSettlement(db, {
-      accountId: ids.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      requestId: ids.directRequest.requestId,
-      holderId: ids.directRequest.holderId,
-      initiatorSubjectId: ids.resourceSubjectId,
-      sandboxGroupId: homeLease.sandboxGroupId,
-      expectedEpoch: backend.leaseEpoch,
-      expectedInstanceId: backend.providerInstanceId,
-      routeTargetId: exactAdmission.routeTargetId,
-      routeEpoch: exactAdmission.routeEpoch,
-      admission: exactAdmission,
-      operation: op,
-      outcome
-    });
+    try {
+      await verifyDirectWorkspaceMutationSettlement(db, {
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        requestId: ids.directRequest.requestId,
+        holderId: ids.directRequest.holderId,
+        initiatorSubjectId: ids.resourceSubjectId,
+        sandboxGroupId: homeLease.sandboxGroupId,
+        expectedEpoch: backend.leaseEpoch,
+        expectedInstanceId: backend.providerInstanceId,
+        routeTargetId: exactAdmission.routeTargetId,
+        routeEpoch: exactAdmission.routeEpoch,
+        admission: exactAdmission,
+        operation: op,
+        outcome
+      });
+    } catch (error) {
+      if (error instanceof SandboxWorkspaceMutationOutputRejectedError && error.matchesPhysicalSettlement({
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        admission: exactAdmission,
+        operation: op,
+        outcome
+      })) {
+        throw new RoutingMutationOutputRejectedError(op, error.code, { cause: error });
+      }
+      throw error;
+    }
   } : void 0;
   const beforeProcessMutation = homeLease ? async ({
     op,
@@ -5578,15 +5595,28 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     if (!admission || typeof admission !== "object" || typeof admission.id !== "string" || typeof admission.workspaceGeneration !== "number") {
       throw new Error("API retained-process mutation settlement lacked its exact admission");
     }
-    await verifyRetainedProcessMutationSettlement(db, {
-      accountId: ids.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      processId: process.id,
-      admission,
-      operation: op,
-      outcome
-    });
+    try {
+      await verifyRetainedProcessMutationSettlement(db, {
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        processId: process.id,
+        admission,
+        operation: op,
+        outcome
+      });
+    } catch (error) {
+      if (error instanceof SandboxWorkspaceMutationOutputRejectedError && error.matchesPhysicalSettlement({
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        admission,
+        operation: op,
+        outcome
+      })) {
+        throw new RoutingMutationOutputRejectedError(op, error.code, { cause: error });
+      }
+      throw error;
+    }
   } : void 0;
   const settleProcess = homeLease ? async ({
     backend,
@@ -7802,7 +7832,8 @@ import {
   allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession2,
   codeSearchDeploymentPolicy,
   resolveModelProviderForTurn as resolveModelProviderForTurn2,
-  resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret2
+  resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret2,
+  webSearchToolPlan
 } from "@opengeni/config";
 import {
   AGENT_SKILL_MANAGE_TOOL_NAMES,
@@ -8076,9 +8107,14 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
   const sandboxAvailable = context !== void 0 && sandboxBackend !== "none";
   const supportsImages = model?.model.api === "responses" && model.model.capabilities.inputModalities.includes("image");
   const hostedToolNames = [];
+  const webSearchPlan = context ? webSearchToolPlan(context.settings, {
+    hostedWebSearch: model?.model.hostedWebSearch ?? context.settings.webSearchEnabled,
+    transportHostedSearch: model?.provider.kind === "xai-subscription"
+  }) : { hostedWebSearch: false, providerTools: [] };
   if (model?.provider.kind === "xai-subscription") {
     if (context?.settings.webSearchEnabled) hostedToolNames.push("web_search", "x_search");
-  } else if (model?.model.hostedWebSearch) hostedToolNames.push("web_search");
+  } else if (model?.model.hostedWebSearch && webSearchPlan.hostedWebSearch)
+    hostedToolNames.push("web_search");
   const mediaAttachment = context?.mediaAttachments?.get(session.id) ?? (context?.objectStorageAvailable === false ? { image: null, video: false } : void 0);
   const media = resolveAgentMediaToolSurface(session.agent, mediaAttachment);
   hostedToolNames.push(...media.hosted);
@@ -8087,7 +8123,8 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
     "list_models",
     "skill_read",
     ...AGENT_SKILL_MANAGE_TOOL_NAMES,
-    ...media.runtime
+    ...media.runtime,
+    ...webSearchPlan.providerTools
   ] : [];
   const sandboxToolNames = sandboxAvailable ? [
     "exec_command",
@@ -8146,6 +8183,7 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
     "skill_read",
     "request_human_input",
     "list_models",
+    ...webSearchPlan.providerTools,
     ...toolRefs.some((ref) => ref.id === "opengeni" && ref.eager === true) || !progressiveDisclosure ? firstPartyMcpTools.filter((name) => !interactionNames.has(name) || !progressiveDisclosure) : [],
     ...!progressiveDisclosure ? runtimeToolNames : []
   ]);
@@ -8155,7 +8193,7 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
       ...session.toolPolicy.mode !== "workspace_default" ? session.tools.map((tool) => tool.id) : []
     ]),
     hasSkills: context ? sessionHasSkills(session, context) : false,
-    webSearch: hostedToolNames.includes("web_search"),
+    webSearch: hostedToolNames.includes("web_search") || webSearchPlan.providerTools.length > 0,
     humanInput: context?.humanInputEnabled ?? false,
     media: media.toolsKnown ? media.hosted.length + media.runtime.length > 0 : void 0,
     routerInHistory: context?.routerInHistory === true || context?.routerHistorySessionIds?.has(session.id) === true,
@@ -10167,6 +10205,12 @@ async function withSessionCreateUsageRecording(input) {
 }
 async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspaceId, rawPayload, authorization, agentChildPresentation, requestOptions = {}) {
   const payload = CreateSessionRequest.parse(rawPayload);
+  if (payload.firstPartyMcpTools) {
+    const unavailable = deploymentUnavailableFirstPartyMcpTools(unresolvedDeps.settings);
+    payload.firstPartyMcpTools = payload.firstPartyMcpTools.filter(
+      (tool) => !unavailable.has(tool)
+    );
+  }
   const surface = resolveTurnSurface({
     grant,
     authorization,
@@ -11464,6 +11508,10 @@ async function acceptSessionUserMessageInFileScope(deps, grant, workspaceId, ses
         (await requireWorkspace5(db, workspaceId)).settings
       )
     });
+    const existingEffectiveFirstPartyTools = allowedFirstPartyMcpToolsForSession3(
+      settings,
+      existingSession.firstPartyMcpTools
+    );
     const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
       db,
       accountId: grant.accountId,
@@ -11473,7 +11521,7 @@ async function acceptSessionUserMessageInFileScope(deps, grant, workspaceId, ses
       resources: [...existingSession.resources, ...requestedResources],
       source: connectionDelegationSource,
       targetSessionId: sessionId,
-      googleDrivePublicationEnabled: existingSession.firstPartyMcpTools.includes("editable_artifact_export") && existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("artifacts:read") && existingSession.firstPartyMcpPermissions.includes("artifacts:publish")),
+      googleDrivePublicationEnabled: existingEffectiveFirstPartyTools.includes("editable_artifact_export") && existingEffectiveFirstPartyTools.includes("editable_artifact_export_status") && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("artifacts:read") && existingSession.firstPartyMcpPermissions.includes("artifacts:publish")),
       atlassianEnabled: existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("connections:read")),
       ...input.connectionAccounts ? { authoritySelections: input.connectionAccounts } : {}
     });
@@ -12329,6 +12377,10 @@ async function freezeSessionRealtimeConnectionAccounts(input) {
       (await requireWorkspace6(db, workspaceId)).settings
     )
   });
+  const effectiveFirstPartyTools = allowedFirstPartyMcpToolsForSession4(
+    settings,
+    session.firstPartyMcpTools
+  );
   return await freezeConnectionAccounts({
     db,
     settings: runtimeSettings,
@@ -12338,7 +12390,7 @@ async function freezeSessionRealtimeConnectionAccounts(input) {
     resources: session.resources,
     source: personalConnectionDelegationSourceForGrant(grant),
     targetSessionId: sessionId,
-    googleDrivePublicationEnabled: session.firstPartyMcpTools.includes("editable_artifact_export") && session.firstPartyMcpTools.includes("editable_artifact_export_status") && (!session.firstPartyMcpPermissions?.length || session.firstPartyMcpPermissions.includes("artifacts:read") && session.firstPartyMcpPermissions.includes("artifacts:publish")),
+    googleDrivePublicationEnabled: effectiveFirstPartyTools.includes("editable_artifact_export") && effectiveFirstPartyTools.includes("editable_artifact_export_status") && (!session.firstPartyMcpPermissions?.length || session.firstPartyMcpPermissions.includes("artifacts:read") && session.firstPartyMcpPermissions.includes("artifacts:publish")),
     atlassianEnabled: session.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) && (!session.firstPartyMcpPermissions?.length || session.firstPartyMcpPermissions.includes("connections:read"))
   });
 }
@@ -12603,6 +12655,652 @@ async function searchKnowledgeEntries(db, context, input, embedder, settings) {
   );
 }
 
+// src/domain/voice-input-billing.ts
+import {
+  calculateVoiceInputCost,
+  configuredStaticUsageLimits as configuredStaticUsageLimits2,
+  voiceInputCreditBillingActive,
+  voiceInputPricingHasTokenRates
+} from "@opengeni/config";
+import {
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse2,
+  checkWorkspaceAllowance as checkWorkspaceAllowance3,
+  creditDebitAttributionMetadata,
+  getSpendableCreditBalance as getSpendableCreditBalance3,
+  listUnsettledVoiceTranscriptionCharges,
+  recordUsageEvent as recordUsageEvent3,
+  sumUsageQuantity as sumUsageQuantity3,
+  VOICE_TRANSCRIPTION_DEBIT_TYPE,
+  VOICE_TRANSCRIPTION_SOURCE_TYPE,
+  voiceTranscriptionSettlementKeys
+} from "@opengeni/db";
+
+// src/transcription.ts
+var TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS = 10 * 60 * 1e3;
+var TranscriptionBillingRefusedError = class extends Error {
+  status;
+  code;
+  details;
+  constructor(input) {
+    super(input.message);
+    this.name = "TranscriptionBillingRefusedError";
+    this.code = input.code;
+    this.status = input.code === "monthly_model_cost_limit" ? 429 : 402;
+    this.details = input.details ?? {};
+  }
+};
+var TranscriptionServiceError = class extends Error {
+  code;
+  status;
+  retryable;
+  /** Explicit rejection before any transcription result; safe to try another provider. */
+  fallbackSafe;
+  constructor(input) {
+    super(input.message);
+    this.name = "TranscriptionServiceError";
+    this.code = input.code;
+    this.status = input.status ?? statusForVoiceInputError(input.code);
+    this.retryable = input.retryable ?? false;
+    this.fallbackSafe = input.fallbackSafe ?? false;
+  }
+};
+function statusForVoiceInputError(code) {
+  switch (code) {
+    case "permission_denied":
+      return 403;
+    case "policy_blocked":
+      return 403;
+    case "not_supported":
+      return 415;
+    case "unavailable":
+      return 503;
+    case "too_large":
+      return 413;
+    case "invalid_audio":
+      return 400;
+    case "timeout":
+      return 504;
+    case "cancelled":
+      return 499;
+    case "network":
+    case "provider":
+      return 502;
+    case "unknown":
+    default:
+      return 500;
+  }
+}
+function normalizeMimeType(mimeType) {
+  return mimeType.trim().toLowerCase();
+}
+function isAcceptedMimeType(mimeType, accepted) {
+  const normalized = normalizeMimeType(mimeType);
+  if (accepted.some((candidate) => normalizeMimeType(candidate) === normalized)) {
+    return true;
+  }
+  const bare = normalized.split(";")[0]?.trim() ?? normalized;
+  return accepted.some((candidate) => {
+    const allowed = normalizeMimeType(candidate);
+    return allowed === bare || allowed.split(";")[0]?.trim() === bare;
+  });
+}
+function filenameForMimeType(mimeType) {
+  const bare = normalizeMimeType(mimeType).split(";")[0] ?? "audio/webm";
+  switch (bare) {
+    case "audio/mp4":
+    case "audio/m4a":
+      return "audio.mp4";
+    case "audio/ogg":
+      return "audio.ogg";
+    case "audio/mpeg":
+    case "audio/mp3":
+      return "audio.mp3";
+    case "audio/wav":
+    case "audio/x-wav":
+      return "audio.wav";
+    case "audio/webm":
+    default:
+      return "audio.webm";
+  }
+}
+
+// src/domain/voice-input-billing.ts
+var VOICE_INPUT_DEBIT_TYPE = VOICE_TRANSCRIPTION_DEBIT_TYPE;
+var VOICE_INPUT_SOURCE_TYPE = VOICE_TRANSCRIPTION_SOURCE_TYPE;
+function voiceInputBillableUsage(input) {
+  if (input.usage?.kind === "tokens" && voiceInputPricingHasTokenRates(input.pricing)) {
+    return { usage: input.usage, basis: "provider_tokens" };
+  }
+  if (input.usage?.kind === "duration") {
+    return { usage: input.usage, basis: "provider_duration" };
+  }
+  if (input.trustedDurationSeconds !== void 0 && Number.isFinite(input.trustedDurationSeconds) && input.trustedDurationSeconds >= 0) {
+    return {
+      usage: { kind: "duration", seconds: input.trustedDurationSeconds },
+      basis: "server_duration"
+    };
+  }
+  throw new TranscriptionServiceError({
+    code: "provider",
+    message: "Transcription usage was not reported."
+  });
+}
+function initiatingHuman(attribution) {
+  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
+}
+function startOfUtcMonth2() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+function createVoiceInputBilling(deps) {
+  const reconcileInterval = deps.reconcileIntervalMilliseconds ?? 5 * 6e4;
+  const lastReconciled = /* @__PURE__ */ new Map();
+  const reconcileDue = (key) => {
+    const now = Date.now();
+    const last = lastReconciled.get(key);
+    if (last !== void 0 && now - last < reconcileInterval) return false;
+    if (lastReconciled.size >= 1e4) lastReconciled.clear();
+    lastReconciled.set(key, now);
+    return true;
+  };
+  return {
+    async admit({ accountId, workspaceId, attribution }) {
+      if (!voiceInputCreditBillingActive(deps.settings)) return;
+      if (attribution.kind === "unknown") {
+        throw new TranscriptionServiceError({
+          code: "policy_blocked",
+          status: 403,
+          message: "Voice input payer could not be verified."
+        });
+      }
+      if (reconcileDue(`${accountId}:${workspaceId}`)) {
+        await reconcileUnsettledVoiceInputCharges(deps.db, { accountId, workspaceId }).catch(
+          (error) => {
+            deps.onReconcileError?.(error, { accountId, workspaceId });
+          }
+        );
+      }
+      const balance = await getSpendableCreditBalance3(deps.db, accountId);
+      if (balance.balanceMicros <= 0) {
+        throw new TranscriptionBillingRefusedError({
+          code: "insufficient_credits",
+          message: "Voice input needs Opengeni credits. Add credits to continue."
+        });
+      }
+      const refusal = await checkWorkspaceAllowance3(deps.db, {
+        accountId,
+        workspaceId,
+        subjectId: initiatingHuman(attribution)
+      });
+      if (refusal) {
+        throw new TranscriptionBillingRefusedError({
+          code: refusal.code,
+          message: refusal.message,
+          details: {
+            scope: refusal.scope,
+            resetsAt: refusal.resetsAt,
+            ...refusal.subjectId ? { subjectId: refusal.subjectId } : {}
+          }
+        });
+      }
+      if (deps.settings.usageLimitsMode === "static" || deps.settings.usageLimitsMode === "managed") {
+        const cap = configuredStaticUsageLimits2(deps.settings).maxMonthlyCostMicrosPerAccount;
+        if (cap) {
+          const used = await sumUsageQuantity3(deps.db, {
+            accountId,
+            eventType: "model.cost",
+            since: startOfUtcMonth2()
+          });
+          if (used >= cap) {
+            throw new TranscriptionBillingRefusedError({
+              code: "monthly_model_cost_limit",
+              message: "The monthly model cost limit has been reached."
+            });
+          }
+        }
+      }
+    },
+    async settle(input) {
+      if (!voiceInputCreditBillingActive(deps.settings)) return { creditCostMicros: 0 };
+      const { usage, basis } = voiceInputBillableUsage({
+        pricing: input.pricing,
+        usage: input.usage,
+        trustedDurationSeconds: input.billing.trustedDurationSeconds
+      });
+      const cost = calculateVoiceInputCost(input.pricing, usage);
+      return await settleVoiceInputUsage(deps.db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        providerId: input.providerId,
+        model: input.model,
+        billing: input.billing,
+        usage,
+        basis,
+        providerCostMicros: cost.providerCostMicros,
+        creditCostMicros: cost.creditCostMicros
+      });
+    }
+  };
+}
+async function settleVoiceInputUsage(db, input) {
+  const attribution = input.billing.attribution;
+  const keys = voiceTranscriptionSettlementKeys({
+    workspaceId: input.workspaceId,
+    sourceId: input.billing.sourceId
+  });
+  const receipt2 = await recordUsageEvent3(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    eventType: "model.cost",
+    quantity: input.creditCostMicros,
+    unit: "usd_micros",
+    sourceResourceType: VOICE_TRANSCRIPTION_SOURCE_TYPE,
+    sourceResourceId: input.billing.sourceId,
+    idempotencyKey: keys.usageIdempotencyKey,
+    // The API is the writer; the payer is the trusted attribution snapshot.
+    initiator: { kind: "service", subjectId: "api:voice-input" },
+    initiatorContext: { creditDebitAttribution: attribution }
+  });
+  const amount = Number(receipt2.quantity);
+  if (amount > 0) {
+    await applyCreditDebitAfterUse2(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      type: VOICE_TRANSCRIPTION_DEBIT_TYPE,
+      amountMicros: amount,
+      sourceType: VOICE_TRANSCRIPTION_SOURCE_TYPE,
+      sourceId: input.billing.sourceId,
+      idempotencyKey: keys.debitIdempotencyKey,
+      metadata: {
+        providerId: input.providerId,
+        model: input.model,
+        basis: input.basis,
+        providerCostMicros: input.providerCostMicros,
+        ...input.usage.kind === "tokens" ? {
+          inputTokens: input.usage.inputTokens,
+          audioInputTokens: input.usage.audioInputTokens,
+          textInputTokens: input.usage.textInputTokens,
+          outputTokens: input.usage.outputTokens
+        } : { audioMilliseconds: Math.ceil(input.usage.seconds * 1e3) },
+        ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata(attribution)
+      }
+    });
+  }
+  return { creditCostMicros: amount };
+}
+async function reconcileUnsettledVoiceInputCharges(db, input) {
+  const pending = await listUnsettledVoiceTranscriptionCharges(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    ...input.minAgeMilliseconds !== void 0 ? { minAgeMilliseconds: input.minAgeMilliseconds } : {}
+  });
+  for (const charge of pending) {
+    await applyCreditDebitAfterUse2(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      type: VOICE_TRANSCRIPTION_DEBIT_TYPE,
+      amountMicros: charge.amountMicros,
+      sourceType: VOICE_TRANSCRIPTION_SOURCE_TYPE,
+      sourceId: charge.sourceId,
+      idempotencyKey: voiceTranscriptionSettlementKeys({
+        workspaceId: input.workspaceId,
+        sourceId: charge.sourceId
+      }).debitIdempotencyKey,
+      metadata: {
+        basis: "reconciled_receipt",
+        ...charge.attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata(charge.attribution)
+      }
+    });
+  }
+  return { reconciled: pending.length };
+}
+
+// src/domain/web-search-billing.ts
+import {
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse3,
+  checkWorkspaceAllowance as checkWorkspaceAllowance4,
+  creditDebitAttributionForTurn as creditDebitAttributionForTurn2,
+  creditDebitAttributionMetadata as creditDebitAttributionMetadata2,
+  getSpendableCreditBalance as getSpendableCreditBalance4,
+  recordUsageEvent as recordUsageEvent4,
+  withRlsContext
+} from "@opengeni/db";
+var WEB_SEARCH_DEBIT_TYPE = "web_search_debit";
+var WEB_SEARCH_SOURCE_TYPE = "web_search";
+var WEB_SEARCH_BILLING_INITIATOR = "worker:web-search";
+function webSearchCreditBillingActive(settings) {
+  return settings.billingMode === "stripe" || settings.usageLimitsMode === "managed";
+}
+var WebSearchBillingRefusedError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "WebSearchBillingRefusedError";
+  }
+};
+function createWebSearchBilling(deps) {
+  const active = webSearchCreditBillingActive(deps.settings);
+  const attributionByTurn = /* @__PURE__ */ new Map();
+  const attributionFor = (scope) => {
+    let attribution = attributionByTurn.get(scope.turnId);
+    if (!attribution) {
+      attribution = creditDebitAttributionForTurn2(deps.db, scope);
+      attributionByTurn.set(scope.turnId, attribution);
+      attribution.catch(() => attributionByTurn.delete(scope.turnId));
+    }
+    return attribution;
+  };
+  return {
+    active,
+    async admit(scope, expectedProviderMicros) {
+      if (!active || expectedProviderMicros <= 0) return;
+      const attribution = await attributionFor(scope);
+      const balance = await getSpendableCreditBalance4(deps.db, scope.accountId);
+      if (balance.balanceMicros <= 0) {
+        throw new WebSearchBillingRefusedError(
+          "insufficient_credits",
+          "Web search needs Opengeni credits, and this account has none left."
+        );
+      }
+      const refusal = await checkWorkspaceAllowance4(deps.db, {
+        accountId: scope.accountId,
+        workspaceId: scope.workspaceId,
+        subjectId: attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null
+      });
+      if (refusal) throw new WebSearchBillingRefusedError("allowance_exhausted", refusal.message);
+    },
+    async settle(scope, cost) {
+      const shared = {
+        accountId: scope.accountId,
+        workspaceId: scope.workspaceId,
+        sessionId: scope.sessionId,
+        turnId: scope.turnId,
+        turnAttemptId: scope.attemptId,
+        sourceResourceType: WEB_SEARCH_SOURCE_TYPE,
+        sourceResourceId: `${scope.attemptId}:${cost.operationId}`
+      };
+      await recordUsageEvent4(deps.db, {
+        ...shared,
+        eventType: `web_search.${cost.operation}_requests`,
+        quantity: 1,
+        unit: "request",
+        idempotencyKey: `usage:web_search.${cost.operation}_requests:${shared.sourceResourceId}`
+      });
+      if (!active || cost.creditMicros <= 0) return;
+      const attribution = await attributionFor(scope);
+      await withRlsContext(
+        deps.db,
+        { accountId: scope.accountId, workspaceId: scope.workspaceId },
+        async (tx) => {
+          await recordUsageEvent4(tx, {
+            ...shared,
+            eventType: "web_search.cost",
+            quantity: cost.creditMicros,
+            unit: "usd_micros",
+            idempotencyKey: `usage:web_search.cost:${shared.sourceResourceId}`,
+            initiator: { kind: "service", subjectId: WEB_SEARCH_BILLING_INITIATOR },
+            initiatorContext: { creditDebitAttribution: attribution }
+          });
+          await applyCreditDebitAfterUse3(tx, {
+            accountId: scope.accountId,
+            workspaceId: scope.workspaceId,
+            type: WEB_SEARCH_DEBIT_TYPE,
+            amountMicros: cost.creditMicros,
+            sourceType: WEB_SEARCH_SOURCE_TYPE,
+            sourceId: shared.sourceResourceId,
+            idempotencyKey: `credit:${WEB_SEARCH_DEBIT_TYPE}:${shared.sourceResourceId}`,
+            metadata: {
+              // turnId lets the allowance trigger resolve the causal human
+              // from the immutable turn receipt.
+              ...creditDebitAttributionMetadata2(attribution),
+              provider: cost.provider,
+              operation: cost.operation,
+              providerCostMicros: cost.providerMicros,
+              marginBps: cost.marginBps,
+              basis: cost.basis
+            }
+          });
+        }
+      );
+    }
+  };
+}
+
+// src/domain/realtime-voice-billing.ts
+import {
+  AI_GATEWAY_REALTIME_MODELS,
+  AZURE_LIVE_REALTIME_MODEL_ID,
+  configuredStaticUsageLimits as configuredStaticUsageLimits3,
+  parseRealtimeVoicePricingJson,
+  parseRealtimeVoicePricingTableJson,
+  realtimeVoiceMinuteCreditMicros,
+  realtimeVoiceStartedMinutes,
+  voiceInputCreditBillingActive as voiceInputCreditBillingActive2
+} from "@opengeni/config";
+import {
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse4,
+  checkWorkspaceAllowance as checkWorkspaceAllowance5,
+  creditDebitAttributionMetadata as creditDebitAttributionMetadata3,
+  existingUsageEventIdempotencyKeys,
+  getSpendableCreditBalance as getSpendableCreditBalance5,
+  loadSessionRealtimeBillingFacts,
+  recordUsageEvent as recordUsageEvent5,
+  sumUsageQuantity as sumUsageQuantity4,
+  withRlsContext as withRlsContext2
+} from "@opengeni/db";
+var REALTIME_VOICE_DEBIT_TYPE = "voice_realtime_debit";
+var REALTIME_VOICE_SOURCE_TYPE = "voice_realtime";
+function deploymentRealtimeVoice(settings, model) {
+  const azureConfigured = Boolean(settings.azureLiveEndpoint && settings.azureLiveApiKey?.trim());
+  if (model === AZURE_LIVE_REALTIME_MODEL_ID) {
+    return {
+      provider: "azure-live",
+      configured: azureConfigured,
+      pricing: parseRealtimeVoicePricingJson(settings.azureLivePricingJson)
+    };
+  }
+  for (const gateway of Object.values(AI_GATEWAY_REALTIME_MODELS)) {
+    if (gateway.managedModelId !== model) continue;
+    return {
+      provider: "ai-gateway",
+      configured: Boolean(settings.vercelAiGatewayApiKey),
+      pricing: parseRealtimeVoicePricingTableJson(settings.aiGatewayRealtimePricingJson)[gateway.upstreamModelId] ?? null
+    };
+  }
+  return null;
+}
+var RealtimeVoiceUnavailableError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  name = "RealtimeVoiceUnavailableError";
+};
+function realtimeVoiceOfferProblem(settings, voice) {
+  if (!voice.configured) {
+    return new RealtimeVoiceUnavailableError(
+      "not_configured",
+      "Opengeni live voice is not configured on this deployment."
+    );
+  }
+  if (voiceInputCreditBillingActive2(settings) && !voice.pricing) {
+    return new RealtimeVoiceUnavailableError(
+      "pricing_unconfigured",
+      "Opengeni live voice is not available on this deployment yet."
+    );
+  }
+  return null;
+}
+var REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE = "Live voice needs Opengeni credits. Add credits to continue.";
+function startOfUtcMonth3(now) {
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+function initiatingHuman2(attribution) {
+  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
+}
+function createRealtimeVoiceBilling(deps) {
+  const billingActive = () => voiceInputCreditBillingActive2(deps.settings);
+  async function refusal(input) {
+    const balance = await getSpendableCreditBalance5(deps.db, input.accountId);
+    if (balance.balanceMicros <= 0) {
+      return new TranscriptionBillingRefusedError({
+        code: "insufficient_credits",
+        message: REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE
+      });
+    }
+    const allowance = await checkWorkspaceAllowance5(deps.db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: initiatingHuman2(input.attribution)
+    });
+    if (allowance) {
+      return new TranscriptionBillingRefusedError({
+        code: allowance.code,
+        message: allowance.message,
+        details: {
+          scope: allowance.scope,
+          resetsAt: allowance.resetsAt,
+          ...allowance.subjectId ? { subjectId: allowance.subjectId } : {}
+        }
+      });
+    }
+    if (deps.settings.usageLimitsMode === "static" || deps.settings.usageLimitsMode === "managed") {
+      const cap = configuredStaticUsageLimits3(deps.settings).maxMonthlyCostMicrosPerAccount;
+      if (cap) {
+        const used = await sumUsageQuantity4(deps.db, {
+          accountId: input.accountId,
+          eventType: "model.cost",
+          since: startOfUtcMonth3(input.now)
+        });
+        if (used >= cap) {
+          return new TranscriptionBillingRefusedError({
+            code: "monthly_model_cost_limit",
+            message: "The monthly model cost limit has been reached."
+          });
+        }
+      }
+    }
+    return null;
+  }
+  return {
+    /**
+     * Throws RealtimeVoiceUnavailableError when the deployment cannot offer
+     * the model and TranscriptionBillingRefusedError for a credit refusal.
+     * Workspace-funded models are always admitted here.
+     */
+    async admit(input) {
+      const voice = deploymentRealtimeVoice(deps.settings, input.model);
+      if (!voice) return;
+      const problem = realtimeVoiceOfferProblem(deps.settings, voice);
+      if (problem) throw problem;
+      if (!billingActive()) return;
+      const refused = await refusal({ ...input, now: input.now ?? /* @__PURE__ */ new Date() });
+      if (refused) throw refused;
+    },
+    /** Spendable credits are positive (always true when credits are not enforced). */
+    async hasSpendableCredits(accountId) {
+      if (!billingActive()) return true;
+      const balance = await getSpendableCreditBalance5(deps.db, accountId);
+      return balance.balanceMicros > 0;
+    },
+    /**
+     * Settle every started minute observed so far for one live-voice mode and
+     * report whether the call must stop. Safe to call repeatedly and
+     * concurrently: receipts and debits are idempotent per (connection, minute).
+     */
+    async settle(input) {
+      const now = input.now ?? /* @__PURE__ */ new Date();
+      if (!billingActive()) return { debitedMicros: 0, stop: null };
+      const facts = await loadSessionRealtimeBillingFacts(deps.db, { ...input, now });
+      if (!facts) return { debitedMicros: 0, stop: null };
+      const voice = deploymentRealtimeVoice(deps.settings, facts.model);
+      if (!voice) return { debitedMicros: 0, stop: null };
+      if (!voice.pricing) {
+        return {
+          debitedMicros: 0,
+          stop: new RealtimeVoiceUnavailableError(
+            "pricing_unconfigured",
+            "Opengeni live voice is no longer available on this deployment."
+          )
+        };
+      }
+      const attribution = input.callerSubjectId === facts.ownerSubjectId ? input.attribution : { kind: "unknown" };
+      const cost = realtimeVoiceMinuteCreditMicros(voice.pricing);
+      const minutes = facts.connections.flatMap(
+        (connection) => Array.from(
+          { length: realtimeVoiceStartedMinutes(connection.startedAt, connection.observedUntil) },
+          (_, index) => ({
+            connectionId: connection.id,
+            minute: index + 1,
+            startsAt: new Date(connection.startedAt.getTime() + index * 6e4),
+            key: `voice.realtime_cost:${connection.id}:${index + 1}`
+          })
+        )
+      );
+      const recorded = await existingUsageEventIdempotencyKeys(deps.db, {
+        accountId: facts.accountId,
+        workspaceId: facts.workspaceId,
+        keys: minutes.map((minute) => minute.key)
+      });
+      let debitedMicros = 0;
+      for (const minute of minutes) {
+        if (recorded.has(minute.key)) continue;
+        debitedMicros += await withRlsContext2(
+          deps.db,
+          { accountId: facts.accountId, workspaceId: facts.workspaceId },
+          async (tx) => {
+            const sourceId = `${minute.connectionId}:${minute.minute}`;
+            const receipt2 = await recordUsageEvent5(tx, {
+              accountId: facts.accountId,
+              workspaceId: facts.workspaceId,
+              sessionId: facts.sessionId,
+              eventType: "model.cost",
+              quantity: cost.creditCostMicros,
+              unit: "usd_micros",
+              sourceResourceType: REALTIME_VOICE_SOURCE_TYPE,
+              sourceResourceId: sourceId,
+              idempotencyKey: minute.key,
+              occurredAt: minute.startsAt,
+              initiator: { kind: "service", subjectId: "api:voice-realtime" },
+              initiatorContext: { creditDebitAttribution: attribution }
+            });
+            const amount = Number(receipt2.quantity);
+            if (amount <= 0) return 0;
+            const debit = await applyCreditDebitAfterUse4(tx, {
+              accountId: facts.accountId,
+              workspaceId: facts.workspaceId,
+              type: REALTIME_VOICE_DEBIT_TYPE,
+              amountMicros: amount,
+              sourceType: REALTIME_VOICE_SOURCE_TYPE,
+              sourceId,
+              idempotencyKey: `credit:${REALTIME_VOICE_DEBIT_TYPE}:${sourceId}`,
+              occurredAt: minute.startsAt,
+              metadata: {
+                provider: voice.provider,
+                model: facts.model,
+                realtimeId: facts.realtimeId,
+                connectionId: minute.connectionId,
+                minute: minute.minute,
+                basis: "server_observed_started_minute",
+                providerCostMicros: cost.providerCostMicros,
+                ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata3(attribution)
+              }
+            });
+            return debit.debitedMicros;
+          }
+        );
+      }
+      const stop = facts.state === "active" ? await refusal({
+        accountId: facts.accountId,
+        workspaceId: facts.workspaceId,
+        attribution,
+        now
+      }) : null;
+      return { debitedMicros, stop };
+    }
+  };
+}
+
 // src/workflow-wake-contract.ts
 var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
 var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
@@ -12704,83 +13402,6 @@ function createUserPresenceRecorder(options) {
   };
 }
 
-// src/transcription.ts
-var TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS = 10 * 60 * 1e3;
-var TranscriptionServiceError = class extends Error {
-  code;
-  status;
-  retryable;
-  /** Explicit rejection before any transcription result; safe to try another provider. */
-  fallbackSafe;
-  constructor(input) {
-    super(input.message);
-    this.name = "TranscriptionServiceError";
-    this.code = input.code;
-    this.status = input.status ?? statusForVoiceInputError(input.code);
-    this.retryable = input.retryable ?? false;
-    this.fallbackSafe = input.fallbackSafe ?? false;
-  }
-};
-function statusForVoiceInputError(code) {
-  switch (code) {
-    case "permission_denied":
-      return 403;
-    case "policy_blocked":
-      return 403;
-    case "not_supported":
-      return 415;
-    case "unavailable":
-      return 503;
-    case "too_large":
-      return 413;
-    case "invalid_audio":
-      return 400;
-    case "timeout":
-      return 504;
-    case "cancelled":
-      return 499;
-    case "network":
-    case "provider":
-      return 502;
-    case "unknown":
-    default:
-      return 500;
-  }
-}
-function normalizeMimeType(mimeType) {
-  return mimeType.trim().toLowerCase();
-}
-function isAcceptedMimeType(mimeType, accepted) {
-  const normalized = normalizeMimeType(mimeType);
-  if (accepted.some((candidate) => normalizeMimeType(candidate) === normalized)) {
-    return true;
-  }
-  const bare = normalized.split(";")[0]?.trim() ?? normalized;
-  return accepted.some((candidate) => {
-    const allowed = normalizeMimeType(candidate);
-    return allowed === bare || allowed.split(";")[0]?.trim() === bare;
-  });
-}
-function filenameForMimeType(mimeType) {
-  const bare = normalizeMimeType(mimeType).split(";")[0] ?? "audio/webm";
-  switch (bare) {
-    case "audio/mp4":
-    case "audio/m4a":
-      return "audio.mp4";
-    case "audio/ogg":
-      return "audio.ogg";
-    case "audio/mpeg":
-    case "audio/mp3":
-      return "audio.mp3";
-    case "audio/wav":
-    case "audio/x-wav":
-      return "audio.wav";
-    case "audio/webm":
-    default:
-      return "audio.webm";
-  }
-}
-
 // src/goal-admission.ts
 import {
   isModelAvailableForNewSelection as isModelAvailableForNewSelection2,
@@ -12799,13 +13420,13 @@ import { getWorkspaceModelPolicy as getWorkspaceModelPolicy3 } from "@opengeni/d
 // src/billing/agent-run-admission.ts
 import {
   canonicalizeConfiguredModelId as canonicalizeConfiguredModelId4,
-  configuredStaticUsageLimits as configuredStaticUsageLimits2
+  configuredStaticUsageLimits as configuredStaticUsageLimits4
 } from "@opengeni/config";
 import {
-  checkWorkspaceAllowance as checkWorkspaceAllowance3,
-  getSpendableCreditBalance as getSpendableCreditBalance3,
+  checkWorkspaceAllowance as checkWorkspaceAllowance6,
+  getSpendableCreditBalance as getSpendableCreditBalance6,
   isCodexBilledTurn as isCodexBilledTurn2,
-  sumUsageQuantity as sumUsageQuantity3
+  sumUsageQuantity as sumUsageQuantity5
 } from "@opengeni/db";
 async function agentRunAdmissionDenial(services, input) {
   const codexBilled = await isCodexBilledTurn2({
@@ -12829,7 +13450,7 @@ async function agentRunAdmissionDenial(services, input) {
       });
       if (!decision.allowed) return "insufficient_credits";
     } else {
-      const balance = await getSpendableCreditBalance3(
+      const balance = await getSpendableCreditBalance6(
         services.db,
         input.accountId,
         canonicalizeConfiguredModelId4(services.settings, input.model)
@@ -12838,7 +13459,7 @@ async function agentRunAdmissionDenial(services, input) {
     }
   }
   if (!externallyBilled) {
-    const refusal = await checkWorkspaceAllowance3(services.db, {
+    const refusal = await checkWorkspaceAllowance6(services.db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       subjectId: input.initiatingHumanSubjectId ?? null
@@ -12848,22 +13469,22 @@ async function agentRunAdmissionDenial(services, input) {
   if (services.settings.usageLimitsMode !== "static" && services.settings.usageLimitsMode !== "managed") {
     return null;
   }
-  const limits = configuredStaticUsageLimits2(services.settings);
+  const limits = configuredStaticUsageLimits4(services.settings);
   if (!externallyBilled && limits.maxMonthlyCostMicrosPerAccount) {
-    const used = await sumUsageQuantity3(services.db, {
+    const used = await sumUsageQuantity5(services.db, {
       accountId: input.accountId,
       eventType: "model.cost",
-      since: startOfUtcMonth2()
+      since: startOfUtcMonth4()
     });
     if (used >= limits.maxMonthlyCostMicrosPerAccount) {
       return "monthly_model_cost_limit";
     }
   }
   if (limits.maxMonthlyAgentRunsPerWorkspace) {
-    const used = await sumUsageQuantity3(services.db, {
+    const used = await sumUsageQuantity5(services.db, {
       workspaceId: input.workspaceId,
       eventType: "agent_run.created",
-      since: startOfUtcMonth2()
+      since: startOfUtcMonth4()
     });
     if (used + input.requestedAgentRuns > limits.maxMonthlyAgentRunsPerWorkspace) {
       return "monthly_agent_run_limit";
@@ -12871,7 +13492,7 @@ async function agentRunAdmissionDenial(services, input) {
   }
   return null;
 }
-function startOfUtcMonth2() {
+function startOfUtcMonth4() {
   const now = /* @__PURE__ */ new Date();
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
 }
@@ -15581,7 +16202,7 @@ import {
   SCHEDULED_TASK_OCCURRENCE_PAYLOAD_INGRESS_HEADROOM_BYTES
 } from "@opengeni/contracts";
 import {
-  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession4,
+  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession5,
   resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy2
 } from "@opengeni/config";
 import {
@@ -15689,7 +16310,7 @@ async function scheduledConnectionTools(db, workspaceId, settings, target, taskT
   }).toolRefs;
 }
 function scheduledConnectionSurfaceEligibility(settings, target) {
-  const tools = target?.firstPartyMcpTools ?? resolveFirstPartyMcpToolPolicy2(settings).default;
+  const tools = allowedFirstPartyMcpToolsForSession5(settings, target?.firstPartyMcpTools);
   const permissions = target?.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS3;
   return {
     googleDrivePublicationEnabled: tools.includes("editable_artifact_export") && tools.includes("editable_artifact_export_status") && permissions.includes("artifacts:read") && permissions.includes("artifacts:publish"),
@@ -16014,7 +16635,7 @@ async function frozenScheduledTaskCreatorPolicy(input) {
   restricted ||= Boolean(
     turnPolicy.kind === "valid" && turnPolicy.policy.credentialRestriction === "developer_setup" || sessionPolicy.kind === "valid" && sessionPolicy.policy.credentialRestriction === "developer_setup"
   );
-  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession4(
+  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession5(
     input.settings,
     session.firstPartyMcpTools
   );
@@ -17315,7 +17936,7 @@ function trimmedScheduledTaskName(name) {
 
 // src/domain/scheduled-task-access.ts
 import {
-  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession5,
+  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession6,
   resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy3
 } from "@opengeni/config";
 import {
@@ -17420,7 +18041,7 @@ function sameMembers(left, right) {
 function planScheduledTaskOpenGeniTools(input) {
   const stored = input.creatorPolicy?.firstPartyMcpTools;
   if (!stored) return { missing: [], policy: null };
-  const effective = new Set(allowedFirstPartyMcpToolsForSession5(input.settings, stored));
+  const effective = new Set(allowedFirstPartyMcpToolsForSession6(input.settings, stored));
   const missing = resolveFirstPartyMcpToolPolicy3(input.settings).default.filter(
     (tool) => !effective.has(tool) && !input.leaveOut?.has(tool)
   );
@@ -17939,7 +18560,7 @@ function orderScheduledTaskAccessAttention(items) {
 }
 
 // src/domain/insights.ts
-import { configuredStaticUsageLimits as configuredStaticUsageLimits3 } from "@opengeni/config";
+import { configuredStaticUsageLimits as configuredStaticUsageLimits5 } from "@opengeni/config";
 import {
   WorkspaceInsightsSnapshot
 } from "@opengeni/contracts";
@@ -18070,7 +18691,7 @@ function cacheHitPct(cached2, input) {
 function startOfUtcDay(date) {
   return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
 }
-function startOfUtcMonth3(date) {
+function startOfUtcMonth5(date) {
   return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));
 }
 function startOfUtcYear(date) {
@@ -18099,7 +18720,7 @@ function resolveRangeWindow(range, now) {
       cacheSeriesLabel = "Cache hit % / UTC day";
       break;
     case "month":
-      since = startOfUtcMonth3(now);
+      since = startOfUtcMonth5(now);
       rangeLabel = "This month (UTC)";
       priorLabel = "Prior equal window";
       seriesLabel = "Credit $ / UTC day";
@@ -18230,7 +18851,7 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
         until: window.until,
         priorSince: window.priorSince,
         priorUntil: window.priorUntil,
-        monthSince: startOfUtcMonth3(now),
+        monthSince: startOfUtcMonth5(now),
         granularity: input.range === "today" ? "hour" : "day",
         warmGroupLimit: 24
       })
@@ -18473,7 +19094,7 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
       billing: fact ? billingPathOf(fact.billingPath) : null
     };
   });
-  const limits = configuredStaticUsageLimits3(settings);
+  const limits = configuredStaticUsageLimits5(settings);
   const floor = floorRows.filter((row) => {
     if (!model) return true;
     return row.model === model;
@@ -20721,7 +21342,7 @@ async function submitComposerDraftForRequest(deps, grant, workspaceId, sessionId
 import { DraftTimelineAnnotations as DraftTimelineAnnotations3 } from "@opengeni/contracts";
 import { HTTPException as HTTPException30 } from "hono/http-exception";
 import {
-  checkWorkspaceAllowance as checkWorkspaceAllowance4,
+  checkWorkspaceAllowance as checkWorkspaceAllowance7,
   deleteSessionQueueItemInTransaction,
   editQueuedTurnInTransaction,
   getComposerDraftInTransaction as getComposerDraftInTransaction2,
@@ -20819,7 +21440,7 @@ async function assertFreshAgentCommandAllowance(tx, deps, context, targetSession
     }
   }
   const frozen = await frozenInitiatorForCommandActor2(tx, context.workspaceId, agentActor(context));
-  const refusal = await checkWorkspaceAllowance4(tx, {
+  const refusal = await checkWorkspaceAllowance7(tx, {
     accountId: target.accountId,
     workspaceId: context.workspaceId,
     subjectId: initiatingHumanForAllowance(frozen)
@@ -22142,7 +22763,6 @@ import { createPinnedIntegrationTransport as createPinnedIntegrationTransport2 }
 import {
   buildConnectionTokenResolver,
   getConnectionMetadata as getConnectionMetadata5,
-  listConnectionsMetadata as listConnectionsMetadata4,
   listEnabledMcpCapabilityServers as listEnabledMcpCapabilityServers3,
   listConnectorToolPermissionPolicies,
   listChangedConnectorToolPermissions,
@@ -22155,6 +22775,7 @@ import {
 import { HTTPException as HTTPException32 } from "hono/http-exception";
 import {
   GMAIL_REST_MCP_TOOLS,
+  gmailToolAvailableOnDeployment,
   gmailToolSupportsScopes,
   isOfficialGmailMcpConfig,
   isOfficialSlackMcpConfig
@@ -22240,11 +22861,12 @@ async function resolveTarget2(input) {
     throw new HTTPException32(403, {
       message: "Only the authenticated connection owner may manage personal tool permissions"
     });
-  const visible = ref ? await listConnectionsMetadata4(
-    input.db,
-    input.workspaceId,
-    input.personalOwnerVerified ? input.grant.subjectId : null
-  ) : [];
+  const source = personalConnectionDelegationSourceForGrant(input.grant);
+  const visible = ref ? await visibleMcpAccountConnections(input.db, {
+    accountId: input.grant.accountId,
+    workspaceId: input.workspaceId,
+    source: input.personalOwnerVerified && source.kind === "subject" ? source : { kind: "none" }
+  }) : [];
   const bindings = mcpAccountBindingsFromVisibleConnections({
     accountId: input.grant.accountId,
     workspaceId: input.workspaceId,
@@ -22286,15 +22908,20 @@ async function resolveTarget2(input) {
     listedTools: null
   };
 }
-function reviewedConnectorToolCatalog(server, grantedScopes) {
-  const tools = isOfficialGmailMcpConfig(server.url, server.connectionRef) ? GMAIL_REST_MCP_TOOLS.filter((tool) => gmailToolSupportsScopes(tool.name, grantedScopes)) : isOfficialSlackMcpConfig(server.url, server.connectionRef) ? slackRestMcpToolsForScopes(grantedScopes) : null;
+function reviewedConnectorToolCatalog(server, grantedScopes, deployment) {
+  const tools = isOfficialGmailMcpConfig(server.url, server.connectionRef) ? GMAIL_REST_MCP_TOOLS.filter(
+    (tool) => gmailToolSupportsScopes(tool.name, grantedScopes) && gmailToolAvailableOnDeployment(tool.name, {
+      watchTopicName: deployment.gmailWatchTopicName
+    })
+  ) : isOfficialSlackMcpConfig(server.url, server.connectionRef) ? slackRestMcpToolsForScopes(grantedScopes) : null;
   return tools?.filter((tool) => !server.allowedTools || server.allowedTools.includes(tool.name)) ?? null;
 }
 async function listTools(input, target) {
   if (target.listedTools !== null) return target.listedTools;
   const reviewed = reviewedConnectorToolCatalog(
     target.server,
-    target.connection?.grantedScopes ?? []
+    target.connection?.grantedScopes ?? [],
+    input.settings
   );
   if (reviewed !== null) return reviewed;
   let headers = { ...target.server.headers };
@@ -22303,7 +22930,9 @@ async function listTools(input, target) {
       input.db,
       input.settings
     )({
-      workspaceId: input.workspaceId,
+      // The selected account's credentials remain in its origin workspace;
+      // approval preferences remain scoped to the workspace being configured.
+      workspaceId: target.connection?.workspaceId ?? input.workspaceId,
       ...target.connection?.subjectId ? { subjectId: input.grant.subjectId } : {},
       serverId: target.server.id,
       toolName: "tools/list",
@@ -22560,7 +23189,11 @@ export {
   PR_REVIEW_AUTOMATION_SETUP,
   ProductionEditableArtifactSnapshotVerifier,
   PublicSkillSearchError,
+  REALTIME_VOICE_DEBIT_TYPE,
+  REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE,
+  REALTIME_VOICE_SOURCE_TYPE,
   RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY,
+  RealtimeVoiceUnavailableError,
   SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
   SESSION_CREATED_BY_KINDS,
   SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS,
@@ -22579,14 +23212,20 @@ export {
   SystemEditableArtifactLiveScheduler,
   TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS,
   TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS,
+  TranscriptionBillingRefusedError,
   TranscriptionServiceError,
   USER_PRESENCE_FLUSH_DELAY_MS,
   USER_PRESENCE_THROTTLE_MS,
   VIDEO_GENERATION_ADAPTER_VERSION,
   VIDEO_GENERATION_MODEL_CATALOG,
+  VOICE_INPUT_DEBIT_TYPE,
+  VOICE_INPUT_SOURCE_TYPE,
+  WEB_SEARCH_DEBIT_TYPE,
+  WEB_SEARCH_SOURCE_TYPE,
   WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES,
   WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES,
   WebCryptoEditableArtifactLiveTokens,
+  WebSearchBillingRefusedError,
   WorkspaceInsightsFilterValidationError,
   acceptSessionUserMessage,
   acceptSessionUserMessageWithOutcome,
@@ -22679,12 +23318,15 @@ export {
   createCompanyProfileDurableLearningAdapter,
   createGitHubSkillSourceClient,
   createPublicSkillSearchClient,
+  createRealtimeVoiceBilling,
   createRigForApi,
   createRigVersionForApi,
   createSessionForRequest,
   createSessionForRequestWithOutcome,
   createUserPresenceRecorder,
   createValidatedScheduledTask,
+  createVoiceInputBilling,
+  createWebSearchBilling,
   creationInitiatorForGrant,
   creditsDefaultSessionModel,
   decodeEditableArtifactBrokerHint,
@@ -22697,6 +23339,7 @@ export {
   deleteHumanQueuePrompt,
   deleteRigForApi,
   deleteScheduledTaskLifecycle,
+  deploymentRealtimeVoice,
   describeConfiguredExportFormats,
   describeEditableArtifactExportFormats,
   directPersonalConnectionSubjectId,
@@ -22920,6 +23563,8 @@ export {
   readSessionAttachmentFiles,
   readSessionLineage,
   readSkill,
+  realtimeVoiceOfferProblem,
+  reconcileUnsettledVoiceInputCharges,
   recordManagedAuthLoggedFailure,
   recordRigAuditEvent,
   recordSessionCreated,
@@ -23056,6 +23701,7 @@ export {
   settingsWithRigProviderImage,
   settingsWithSessionMcpServerMetadata,
   settingsWithWorkspaceSandboxImage,
+  settleVoiceInputUsage,
   signedJsonAutomationAdapter,
   skillBundleHash,
   stableJson,
@@ -23113,6 +23759,8 @@ export {
   videoGenerationProviderIdempotencyKey,
   videoGenerationRequestDigest,
   visibleMcpAccountConnections,
+  voiceInputBillableUsage,
+  webSearchCreditBillingActive,
   withAgentConfigHttpErrors,
   withDefaultEnabledCapabilityMcpTools,
   withFrozenPersonalConnectionDelegations,