@opengeni/core 1.3.0 → 1.4.2

package/dist/index.js

@@ -837,6 +837,7 @@ function expandApiIntegrationAccountRoutes(input) {
 }
 
 // src/domain/session-connection-accounts.ts
+import { allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession4 } from "@opengeni/config";
 import { requireSession as requireSession3, requireWorkspace as requireWorkspace6 } from "@opengeni/db";
 
 // src/domain/capabilities.ts
@@ -844,7 +845,11 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { isDeepStrictEqual } from "util";
 import { withLockedCapabilityInstallation } from "@opengeni/db/capability-reconciliation";
-import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import {
+  environmentsEncryptionKeyBytes,
+  findIntegrationsOauthClient,
+  parseIntegrationsOauthClientsJson
+} from "@opengeni/config";
 import { pinnedFetch } from "@opengeni/network";
 import {
   CapabilityCatalogItem,
@@ -2026,6 +2031,7 @@ async function buildCapabilityCatalog(input) {
     listEnabledMcpCapabilityServers(input.db, input.workspaceId)
   ]);
   const runnableCapabilityIds = new Set(runnableMcpServers.map((server) => server.capabilityId));
+  const operatorOAuthClientConfigured = operatorOAuthClientResolver(input.settings);
   const catalogInstallations = capabilityInstallations.filter(
     (installation) => installation.kind === "mcp"
   );
@@ -2063,13 +2069,33 @@ async function buildCapabilityCatalog(input) {
         notes: "This installed connection is unavailable. Review its connection settings."
       }
     } : projected;
-    return applyCapabilityLifecycle(runtimeProjected);
+    return applyCapabilityLifecycle(
+      applyOperatorOAuthClientRequirement(runtimeProjected, operatorOAuthClientConfigured)
+    );
   }).sort(compareCatalogItems);
   return {
     items,
     installations: catalogInstallations
   };
 }
+function operatorOAuthClientResolver(settings) {
+  let configured = {};
+  try {
+    configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
+  } catch {
+  }
+  return (issuer) => findIntegrationsOauthClient(configured, [issuer]) !== null;
+}
+function applyOperatorOAuthClientRequirement(item, configured) {
+  if (item.kind !== "mcp") return item;
+  const requirement = item.metadata.oauthClientRequirement;
+  const issuer = requirement && typeof requirement === "object" && !Array.isArray(requirement) ? requirement.issuer : void 0;
+  if (typeof issuer !== "string" || !issuer) return item;
+  return {
+    ...item,
+    runtime: { ...item.runtime, operatorOAuthClient: { configured: configured(issuer) } }
+  };
+}
 async function createCatalogItem(input) {
   const id = input.payload.id?.trim() || generatedCapabilityId(input.payload);
   if (id.startsWith("skill:")) {
@@ -4834,6 +4860,7 @@ import {
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX as ORGANIZATION_GATEWAY_MODEL_ID_PREFIX2,
   ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX as ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX2,
   allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession3,
+  deploymentUnavailableFirstPartyMcpTools,
   resolveFirstPartyMcpToolPolicy,
   policyProviderIdForModel,
   resolveTurnExecutionPolicyV1,
@@ -5370,6 +5397,7 @@ import {
   readActiveSandbox,
   retainWorkspaceMutationProcess,
   SandboxRetainedProcessPromotionFencedError,
+  SandboxWorkspaceMutationOutputRejectedError,
   retainedProcessSettlementIdentity,
   settleRetainedProcess,
   verifyDirectWorkspaceMutationSettlement,
@@ -5382,6 +5410,7 @@ import {
   NatsControlRpc,
   NatsOpStreamTransport,
   RoutingSandboxSession,
+  RoutingMutationOutputRejectedError,
   resolveModalCheckpointProviderBindingForSession
 } from "@opengeni/runtime/sandbox";
 var retainWorkspaceProviderCommand = createProviderCommandRetainer(
@@ -5540,22 +5569,35 @@ function wrapChannelABoxWithRouting(services, ids, established) {
       throw new Error(
         "Outcome-unknown command settlement requires its exact retained invocation"
       );
-    await verifyDirectWorkspaceMutationSettlement(db, {
-      accountId: ids.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      requestId: ids.directRequest.requestId,
-      holderId: ids.directRequest.holderId,
-      initiatorSubjectId: ids.resourceSubjectId,
-      sandboxGroupId: homeLease.sandboxGroupId,
-      expectedEpoch: backend.leaseEpoch,
-      expectedInstanceId: backend.providerInstanceId,
-      routeTargetId: exactAdmission.routeTargetId,
-      routeEpoch: exactAdmission.routeEpoch,
-      admission: exactAdmission,
-      operation: op,
-      outcome
-    });
+    try {
+      await verifyDirectWorkspaceMutationSettlement(db, {
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        requestId: ids.directRequest.requestId,
+        holderId: ids.directRequest.holderId,
+        initiatorSubjectId: ids.resourceSubjectId,
+        sandboxGroupId: homeLease.sandboxGroupId,
+        expectedEpoch: backend.leaseEpoch,
+        expectedInstanceId: backend.providerInstanceId,
+        routeTargetId: exactAdmission.routeTargetId,
+        routeEpoch: exactAdmission.routeEpoch,
+        admission: exactAdmission,
+        operation: op,
+        outcome
+      });
+    } catch (error) {
+      if (error instanceof SandboxWorkspaceMutationOutputRejectedError && error.matchesPhysicalSettlement({
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        admission: exactAdmission,
+        operation: op,
+        outcome
+      })) {
+        throw new RoutingMutationOutputRejectedError(op, error.code, { cause: error });
+      }
+      throw error;
+    }
   } : void 0;
   const beforeProcessMutation = homeLease ? async ({
     op,
@@ -5578,15 +5620,28 @@ function wrapChannelABoxWithRouting(services, ids, established) {
     if (!admission || typeof admission !== "object" || typeof admission.id !== "string" || typeof admission.workspaceGeneration !== "number") {
       throw new Error("API retained-process mutation settlement lacked its exact admission");
     }
-    await verifyRetainedProcessMutationSettlement(db, {
-      accountId: ids.accountId,
-      workspaceId: ids.workspaceId,
-      sessionId: ids.sessionId,
-      processId: process.id,
-      admission,
-      operation: op,
-      outcome
-    });
+    try {
+      await verifyRetainedProcessMutationSettlement(db, {
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        sessionId: ids.sessionId,
+        processId: process.id,
+        admission,
+        operation: op,
+        outcome
+      });
+    } catch (error) {
+      if (error instanceof SandboxWorkspaceMutationOutputRejectedError && error.matchesPhysicalSettlement({
+        accountId: ids.accountId,
+        workspaceId: ids.workspaceId,
+        admission,
+        operation: op,
+        outcome
+      })) {
+        throw new RoutingMutationOutputRejectedError(op, error.code, { cause: error });
+      }
+      throw error;
+    }
   } : void 0;
   const settleProcess = homeLease ? async ({
     backend,
@@ -6677,15 +6732,13 @@ import {
 import {
   listConnectionsMetadata as listConnectionsMetadata3,
   getDeploymentModelCatalog,
-  listWorkspaceProviderCustomModels,
+  listWorkspaceProviderCustomModelsByKind,
   getWorkspaceProviderCustomModelForExecution,
   lockActiveWorkspaceProviderCustomModelForAdmission,
   getWorkspaceGatewayCustomModelForExecution,
   getWorkspaceOpenRouterCustomModelForExecution,
   getOrganizationModelProviderCustomModelForExecution,
-  listWorkspaceGatewayCustomModels,
-  listWorkspaceOpenRouterCustomModels,
-  listOrganizationModelProviderCustomModelsForWorkspace,
+  getOrganizationModelProviderCatalogForWorkspace,
   lockActiveOrganizationModelProviderCustomModelForAdmission
 } from "@opengeni/db";
 function isWorkspaceGatewayCustomModelId(settings, modelId) {
@@ -6800,26 +6853,28 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
   const retainedOrganizationOpenRouterUpstreamModelIds = retainedProductModelIds.flatMap(
     (productModelId) => productModelId?.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX) ? [productModelId.slice(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX.length)] : []
   );
+  const workspaceCustomModelKinds = [
+    "vercel_gateway",
+    "openrouter",
+    ...supportsOrganizationProviderReads ? CLAUDE_CONNECTION_KINDS.filter(
+      (kind) => kind !== "claude_subscription" || envSettings.claudeSubscriptionEnabled
+    ) : []
+  ];
   const [
     resolved,
-    activeGatewayCustomModels,
-    activeOpenRouterCustomModels,
+    workspaceCustomModels,
     retainedGatewayCustomModels,
     retainedOpenRouterCustomModels,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels,
+    organizationProviders,
     retainedOrganizationGatewayCustomModels,
     retainedOrganizationOpenRouterCustomModels,
     directConnections
   ] = await Promise.all([
     resolveCatalogSettings(db, envSettings),
-    listWorkspaceGatewayCustomModels(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId
-    }),
-    listWorkspaceOpenRouterCustomModels(db, {
+    listWorkspaceProviderCustomModelsByKind(db, {
       accountId: input.accountId,
-      workspaceId: input.workspaceId
+      workspaceId: input.workspaceId,
+      providerKinds: workspaceCustomModelKinds
     }),
     Promise.all(
       [...new Set(retainedGatewayUpstreamModelIds)].map(
@@ -6839,16 +6894,11 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
         })
       )
     ),
-    supportsOrganizationProviderReads ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      providerKind: "vercel_gateway"
-    }) : Promise.resolve([]),
-    supportsOrganizationProviderReads ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
+    supportsOrganizationProviderReads ? getOrganizationModelProviderCatalogForWorkspace(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
-      providerKind: "openrouter"
-    }) : Promise.resolve([]),
+      providerKinds: ["vercel_gateway", "openrouter", ...CLAUDE_CONNECTION_KINDS]
+    }) : null,
     supportsOrganizationProviderReads ? Promise.all(
       [...new Set(retainedOrganizationGatewayUpstreamModelIds)].map(
         async (upstreamModelId) => await getOrganizationModelProviderCustomModelForExecution(db, {
@@ -6883,29 +6933,25 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
     return customModels;
   };
   const gatewayCustomModels = includeRetainedModels(
-    activeGatewayCustomModels,
+    workspaceCustomModels.vercel_gateway,
     retainedGatewayCustomModels
   );
   const openRouterCustomModels = includeRetainedModels(
-    activeOpenRouterCustomModels,
+    workspaceCustomModels.openrouter,
     retainedOpenRouterCustomModels
   );
   const organizationGatewayModels = includeRetainedModels(
-    organizationGatewayCustomModels,
+    organizationProviders?.vercel_gateway.models ?? [],
     retainedOrganizationGatewayCustomModels
   );
   const organizationOpenRouterModels = includeRetainedModels(
-    organizationOpenRouterCustomModels,
+    organizationProviders?.openrouter.models ?? [],
     retainedOrganizationOpenRouterCustomModels
   );
   const claudeConnections = {};
-  if (supportsOrganizationProviderReads)
+  if (organizationProviders)
     for (const kind of CLAUDE_CONNECTION_KINDS) {
-      const models = await listOrganizationModelProviderCustomModelsForWorkspace(db, {
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        providerKind: kind
-      });
+      const models = [...organizationProviders[kind].models];
       const prefix = claudeProviderId(kind) + "/";
       for (const productId of retainedProductModelIds)
         if (productId?.startsWith(prefix)) {
@@ -6923,11 +6969,7 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
   if (supportsOrganizationProviderReads)
     for (const kind of CLAUDE_CONNECTION_KINDS) {
       if (kind === "claude_subscription" && !resolved.settings.claudeSubscriptionEnabled) continue;
-      const models = await listWorkspaceProviderCustomModels(db, {
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        providerKind: kind
-      });
+      const models = [...workspaceCustomModels[kind]];
       const prefix = claudeProviderId(kind, "workspace") + "/";
       for (const productId of retainedProductModelIds) {
         if (!productId?.startsWith(prefix)) continue;
@@ -7237,15 +7279,11 @@ import {
   getWorkspace as getWorkspace2,
   getWorkspaceConnectionModelRestrictions,
   getWorkspaceModelPolicy,
-  getWorkspaceProviderApiKeyConnectionMetadata,
-  listWorkspaceProviderCustomModels as listWorkspaceProviderCustomModels2,
-  listOrganizationModelProviderCustomModelsForWorkspace as listOrganizationModelProviderCustomModelsForWorkspace2,
-  listWorkspaceGatewayCustomModels as listWorkspaceGatewayCustomModels2,
-  listWorkspaceOpenRouterCustomModels as listWorkspaceOpenRouterCustomModels2,
-  organizationModelProviderConnectionActiveForWorkspace,
+  getOrganizationModelProviderCatalogForWorkspace as getOrganizationModelProviderCatalogForWorkspace2,
+  listConnectionsMetadata as listConnectionsMetadata4,
+  listWorkspaceProviderCustomModelsByKind as listWorkspaceProviderCustomModelsByKind2,
   workspaceCodexSubscriptionActive,
-  workspaceOpenRouterConnectionActive,
-  workspaceVercelAiGatewayConnectionActive,
+  workspaceProviderApiKeyConnectionMetadataFromConnections,
   getBillingBalance,
   spendableCreditMicros,
   workspaceXaiSubscriptionActive,
@@ -7562,84 +7600,55 @@ async function loadWorkspaceClaudeSubscriptionReadiness(db, settings, context) {
 }
 async function loadWorkspaceModelSelectionInput(db, settings, context, options = {}) {
   const { accountId, workspaceId } = context;
-  const restrictionsRead = (async () => connectionRestrictionsAndXaiReadiness(db, settings, context))();
-  const claudePoolRead = (async () => loadWorkspaceClaudeSubscriptionReadiness(db, settings, context))();
+  const providerKinds = [
+    "vercel_gateway",
+    "openrouter",
+    ...CLAUDE_CONNECTION_KINDS2.filter(
+      (kind) => kind !== "claude_subscription" || settings.claudeSubscriptionEnabled
+    )
+  ];
   const inputRead = (async () => Promise.all([
-    restrictionsRead,
-    claudePoolRead,
+    connectionRestrictionsAndXaiReadiness(db, settings, context),
+    loadWorkspaceClaudeSubscriptionReadiness(db, settings, context),
     getWorkspaceModelPolicy(db, workspaceId),
     workspaceCodexSubscriptionActive(db, settings, workspaceId),
-    options.observeAvailability === false ? Promise.resolve({}) : loadWorkspaceCodexModelAvailability(db, settings, workspaceId),
-    workspaceVercelAiGatewayConnectionActive(db, workspaceId),
-    listWorkspaceGatewayCustomModels2(db, { accountId, workspaceId }),
-    workspaceOpenRouterConnectionActive(db, workspaceId),
-    listWorkspaceOpenRouterCustomModels2(db, { accountId, workspaceId }),
-    organizationModelProviderConnectionActiveForWorkspace(db, {
-      accountId,
-      workspaceId,
-      providerKind: "vercel_gateway"
-    }),
-    organizationModelProviderConnectionActiveForWorkspace(db, {
-      accountId,
-      workspaceId,
-      providerKind: "openrouter"
-    }),
-    listOrganizationModelProviderCustomModelsForWorkspace2(db, {
-      accountId,
-      workspaceId,
-      providerKind: "vercel_gateway"
-    }),
-    listOrganizationModelProviderCustomModelsForWorkspace2(db, {
+    options.observeAvailability === false ? Promise.resolve({}) : loadWorkspaceCodexModelAvailability(db, settings, workspaceId)
+  ]))();
+  if (typeof db.rollback === "function") await inputRead;
+  const catalogRead = (async () => Promise.all([
+    listConnectionsMetadata4(db, workspaceId, null),
+    listWorkspaceProviderCustomModelsByKind2(db, { accountId, workspaceId, providerKinds }),
+    getOrganizationModelProviderCatalogForWorkspace2(db, {
       accountId,
       workspaceId,
-      providerKind: "openrouter"
+      providerKinds
     })
   ]))();
-  const claudeConnections = {};
-  const workspaceClaudeConnections = {};
-  if (typeof db.rollback === "function") await inputRead;
-  const catalogRead = (async () => Promise.all(
-    CLAUDE_CONNECTION_KINDS2.map(async (kind) => {
-      if (kind === "claude_subscription" && !settings.claudeSubscriptionEnabled) return;
-      const [active, models, metadata, workspaceModels] = await Promise.all([
-        kind === "claude_subscription" ? claudePoolRead.then((pool) => pool.organization) : organizationModelProviderConnectionActiveForWorkspace(db, {
-          accountId,
-          workspaceId,
-          providerKind: kind
-        }),
-        listOrganizationModelProviderCustomModelsForWorkspace2(db, {
-          accountId,
-          workspaceId,
-          providerKind: kind
-        }),
-        kind === "claude_subscription" ? Promise.resolve(null) : getWorkspaceProviderApiKeyConnectionMetadata(db, workspaceId, kind),
-        listWorkspaceProviderCustomModels2(db, { accountId, workspaceId, providerKind: kind })
-      ]);
-      claudeConnections[kind] = { active, models };
-      workspaceClaudeConnections[kind] = {
-        active: kind === "claude_subscription" ? (await claudePoolRead).workspace : metadata !== null,
-        models: workspaceModels
-      };
-    })
-  ))();
   const [inputResult, catalogResult] = await Promise.allSettled([inputRead, catalogRead]);
   if (inputResult.status === "rejected") throw inputResult.reason;
   if (catalogResult.status === "rejected") throw catalogResult.reason;
   const [
     { restrictions: connectionModelRestrictions, xaiSubscriptionActive },
-    _claudePool,
+    claudePool,
     policy,
     codexSubscriptionActive,
-    observations,
-    workspaceGatewayConnectionActive,
-    workspaceGatewayCustomModels,
-    openRouterConnectionActive,
-    workspaceOpenRouterCustomModels,
-    organizationGatewayConnectionActive,
-    organizationOpenRouterConnectionActive,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels
+    observations
   ] = inputResult.value;
+  const [workspaceConnections, workspaceCustomModels, organizationProviders] = catalogResult.value;
+  const workspaceConnectionActive = (kind) => workspaceProviderApiKeyConnectionMetadataFromConnections(workspaceConnections, kind) !== null;
+  const claudeConnections = {};
+  const workspaceClaudeConnections = {};
+  for (const kind of CLAUDE_CONNECTION_KINDS2) {
+    if (kind === "claude_subscription" && !settings.claudeSubscriptionEnabled) continue;
+    claudeConnections[kind] = {
+      active: kind === "claude_subscription" ? claudePool.organization : organizationProviders[kind].active,
+      models: organizationProviders[kind].models
+    };
+    workspaceClaudeConnections[kind] = {
+      active: kind === "claude_subscription" ? claudePool.workspace : workspaceConnectionActive(kind),
+      models: workspaceCustomModels[kind]
+    };
+  }
   return {
     claudeConnections,
     workspaceClaudeConnections,
@@ -7649,14 +7658,14 @@ async function loadWorkspaceModelSelectionInput(db, settings, context, options =
     codexSubscriptionActive,
     observations,
     xaiSubscriptionActive,
-    workspaceGatewayConnectionActive,
-    workspaceGatewayCustomModels,
-    workspaceOpenRouterConnectionActive: openRouterConnectionActive,
-    workspaceOpenRouterCustomModels,
-    organizationGatewayConnectionActive,
-    organizationOpenRouterConnectionActive,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels
+    workspaceGatewayConnectionActive: workspaceConnectionActive("vercel_gateway"),
+    workspaceGatewayCustomModels: workspaceCustomModels.vercel_gateway,
+    workspaceOpenRouterConnectionActive: workspaceConnectionActive("openrouter"),
+    workspaceOpenRouterCustomModels: workspaceCustomModels.openrouter,
+    organizationGatewayConnectionActive: organizationProviders.vercel_gateway.active,
+    organizationOpenRouterConnectionActive: organizationProviders.openrouter.active,
+    organizationGatewayCustomModels: organizationProviders.vercel_gateway.models,
+    organizationOpenRouterCustomModels: organizationProviders.openrouter.models
   };
 }
 async function resolveCallerWorkspaceModelSelections(db, settings, context, options = {}) {
@@ -7802,7 +7811,8 @@ import {
   allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession2,
   codeSearchDeploymentPolicy,
   resolveModelProviderForTurn as resolveModelProviderForTurn2,
-  resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret2
+  resolveFirstPartyDelegationSecret as resolveFirstPartyDelegationSecret2,
+  webSearchToolPlan
 } from "@opengeni/config";
 import {
   AGENT_SKILL_MANAGE_TOOL_NAMES,
@@ -7938,12 +7948,12 @@ function resolveTurnToolPolicy(input) {
     defaultMcpServerIds: scheduledIds ?? input.defaultMcpServerIds ?? []
   });
 }
-async function workspaceSessionToolPolicyContext(db, workspaceId, settings, subjectId) {
+async function workspaceSessionToolPolicyContext(db, workspaceId, settings, subjectId, workspaceRead) {
   const [runtimeSettings, workspace] = await Promise.all([
     settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
       ...subjectId ? { subjectId } : {}
     }),
-    requireWorkspace3(db, workspaceId)
+    workspaceRead ?? requireWorkspace3(db, workspaceId)
   ]);
   return {
     workspaceServerIds: sortedIds(runtimeSettings.mcpServers.map((server) => server.id)),
@@ -7979,7 +7989,7 @@ function workspaceSessionToolPolicyDefaultServerIdsFor(runtimeMcpServers, worksp
     ...configured.inheritConnectedMcpServers ? availableDefaults.filter((id) => !["opengeni", "files", "docs"].includes(id)) : []
   ]);
 }
-async function workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectId, sessions) {
+async function workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectId, sessions, workspaceRead) {
   const configured = sessions.filter((session) => session.agent != null);
   const baseline = {
     settings: deps.settings,
@@ -7989,7 +7999,7 @@ async function workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectI
   };
   if (configured.length === 0) return baseline;
   const [workspace, catalog, descriptors, sandboxes, routerHistory] = await Promise.all([
-    requireWorkspace3(deps.db, workspaceId),
+    workspaceRead ?? requireWorkspace3(deps.db, workspaceId),
     resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
       accountId: configured[0].accountId,
       workspaceId,
@@ -8076,9 +8086,14 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
   const sandboxAvailable = context !== void 0 && sandboxBackend !== "none";
   const supportsImages = model?.model.api === "responses" && model.model.capabilities.inputModalities.includes("image");
   const hostedToolNames = [];
+  const webSearchPlan = context ? webSearchToolPlan(context.settings, {
+    hostedWebSearch: model?.model.hostedWebSearch ?? context.settings.webSearchEnabled,
+    transportHostedSearch: model?.provider.kind === "xai-subscription"
+  }) : { hostedWebSearch: false, providerTools: [] };
   if (model?.provider.kind === "xai-subscription") {
     if (context?.settings.webSearchEnabled) hostedToolNames.push("web_search", "x_search");
-  } else if (model?.model.hostedWebSearch) hostedToolNames.push("web_search");
+  } else if (model?.model.hostedWebSearch && webSearchPlan.hostedWebSearch)
+    hostedToolNames.push("web_search");
   const mediaAttachment = context?.mediaAttachments?.get(session.id) ?? (context?.objectStorageAvailable === false ? { image: null, video: false } : void 0);
   const media = resolveAgentMediaToolSurface(session.agent, mediaAttachment);
   hostedToolNames.push(...media.hosted);
@@ -8087,7 +8102,8 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
     "list_models",
     "skill_read",
     ...AGENT_SKILL_MANAGE_TOOL_NAMES,
-    ...media.runtime
+    ...media.runtime,
+    ...webSearchPlan.providerTools
   ] : [];
   const sandboxToolNames = sandboxAvailable ? [
     "exec_command",
@@ -8146,6 +8162,7 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
     "skill_read",
     "request_human_input",
     "list_models",
+    ...webSearchPlan.providerTools,
     ...toolRefs.some((ref) => ref.id === "opengeni" && ref.eager === true) || !progressiveDisclosure ? firstPartyMcpTools.filter((name) => !interactionNames.has(name) || !progressiveDisclosure) : [],
     ...!progressiveDisclosure ? runtimeToolNames : []
   ]);
@@ -8155,7 +8172,7 @@ function sessionEffectiveToolProjectionInput(session, toolRefs, context) {
       ...session.toolPolicy.mode !== "workspace_default" ? session.tools.map((tool) => tool.id) : []
     ]),
     hasSkills: context ? sessionHasSkills(session, context) : false,
-    webSearch: hostedToolNames.includes("web_search"),
+    webSearch: hostedToolNames.includes("web_search") || webSearchPlan.providerTools.length > 0,
     humanInput: context?.humanInputEnabled ?? false,
     media: media.toolsKnown ? media.hosted.length + media.runtime.length > 0 : void 0,
     routerInHistory: context?.routerInHistory === true || context?.routerHistorySessionIds?.has(session.id) === true,
@@ -9914,7 +9931,12 @@ async function postUserMessageTurn(input) {
             }
           } : {},
           controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
-        })
+        }),
+        void 0,
+        "shared",
+        // Linked-actor capture reauthorizes under the organization-membership
+        // lock; take it before the tenancy fence and the canonical prefix.
+        Boolean(input.captureTurnAuthority)
       )
     );
   } catch (error) {
@@ -10167,6 +10189,12 @@ async function withSessionCreateUsageRecording(input) {
 }
 async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspaceId, rawPayload, authorization, agentChildPresentation, requestOptions = {}) {
   const payload = CreateSessionRequest.parse(rawPayload);
+  if (payload.firstPartyMcpTools) {
+    const unavailable = deploymentUnavailableFirstPartyMcpTools(unresolvedDeps.settings);
+    payload.firstPartyMcpTools = payload.firstPartyMcpTools.filter(
+      (tool) => !unavailable.has(tool)
+    );
+  }
   const surface = resolveTurnSurface({
     grant,
     authorization,
@@ -10298,24 +10326,29 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   let retainedKeyedShellModel = null;
   let retainedKeyedShellReasoningEffort = null;
   if (payload.idempotencyKey && (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)) {
+    const createIdempotencyKey = payload.idempotencyKey;
     try {
-      const initializedReplay = await getInitializedSessionCreateReplay(db, {
-        bundledSkillIds,
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
-        ...replayManagedHumanSubjectId ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId } : {},
-        createIdempotencyKey: payload.idempotencyKey,
-        selectedInstalledSkillIds: payload.installedSkillIds ?? [],
-        initialAgentLearning: payload.agentLearning,
-        ...sessionScope,
-        ...payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {},
-        visibility: effectiveVisibility,
-        variableSetIds: payload.variableSetIds ?? [],
-        initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
-        deferInitialTurn: payload.startMode === "realtime",
-        agentConfig
-      });
+      const initializedReplay = await measureSessionStartPhase(
+        unresolvedDeps.observability,
+        "idempotent_replay",
+        () => getInitializedSessionCreateReplay(db, {
+          bundledSkillIds,
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
+          ...replayManagedHumanSubjectId ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId } : {},
+          createIdempotencyKey,
+          selectedInstalledSkillIds: payload.installedSkillIds ?? [],
+          initialAgentLearning: payload.agentLearning,
+          ...sessionScope,
+          ...payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {},
+          visibility: effectiveVisibility,
+          variableSetIds: payload.variableSetIds ?? [],
+          initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+          deferInitialTurn: payload.startMode === "realtime",
+          agentConfig
+        })
+      );
       if (initializedReplay) {
         if (initializedReplay.outcome === "denied") {
           throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(initializedReplay.denial));
@@ -10624,40 +10657,50 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   }
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
   const captureLinkedAuthority = prepareExternalLinkTurnAdmission(authorization);
-  await validateGitHubRepositorySelection(db, workspaceId, resources);
-  if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException17(503, {
-      message: "object storage is not configured"
-    });
-  }
-  const attachmentOwnerContext = authorization ? await fileOwnerContextForAccess({ db }, authorization, "sessions:create") : grant.principalKind === "agent_attempt" ? await fileOwnerContextForAgent({ db }, grant, "sessions:create") : void 0;
-  const attachmentOwner = attachmentOwnerContext?.privateFileOwnerSubjectId === grant.subjectId ? grant.subjectId : null;
-  await validateFileResources(
-    db,
-    grant.accountId,
-    workspaceId,
-    personalResourceSubjectId ?? grant.subjectId,
-    resources,
-    attachmentOwnerContext
-  );
-  const variableSets = [];
-  for (const variableSetId of payload.variableSetIds ?? []) {
-    variableSets.push(
-      await validateVariableSetAttachment({ settings, db }, grant, workspaceId, variableSetId)
-    );
-  }
-  const requestedRigId = payload.rigId === void 0 ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;
-  let frozenRigId = null;
-  let frozenRigVersionId = null;
-  if (requestedRigId) {
-    const rig = await getRig2(db, grant, requestedRigId);
-    if (!rig || !rig.activeVersion) {
-      if (payload.rigId) {
-        throw new HTTPException17(422, {
-          message: rig ? `sandbox environment ${payload.rigId} has no active version to bind` : `unknown rigId: ${payload.rigId}`
+  const { attachmentOwnerContext, variableSets } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "resource_validation",
+    async () => {
+      await validateGitHubRepositorySelection(db, workspaceId, resources);
+      if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
+        throw new HTTPException17(503, {
+          message: "object storage is not configured"
         });
       }
-    } else {
+      const ownerContext = authorization ? await fileOwnerContextForAccess({ db }, authorization, "sessions:create") : grant.principalKind === "agent_attempt" ? await fileOwnerContextForAgent({ db }, grant, "sessions:create") : void 0;
+      await validateFileResources(
+        db,
+        grant.accountId,
+        workspaceId,
+        personalResourceSubjectId ?? grant.subjectId,
+        resources,
+        ownerContext
+      );
+      const validatedVariableSets = [];
+      for (const variableSetId of payload.variableSetIds ?? []) {
+        validatedVariableSets.push(
+          await validateVariableSetAttachment({ settings, db }, grant, workspaceId, variableSetId)
+        );
+      }
+      return { attachmentOwnerContext: ownerContext, variableSets: validatedVariableSets };
+    }
+  );
+  const attachmentOwner = attachmentOwnerContext?.privateFileOwnerSubjectId === grant.subjectId ? grant.subjectId : null;
+  const { frozenRigId, frozenRigVersionId } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "rig_binding",
+    async () => {
+      const requestedRigId = payload.rigId === void 0 ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;
+      if (!requestedRigId) return { frozenRigId: null, frozenRigVersionId: null };
+      const rig = await getRig2(db, grant, requestedRigId);
+      if (!rig || !rig.activeVersion) {
+        if (payload.rigId) {
+          throw new HTTPException17(422, {
+            message: rig ? `sandbox environment ${payload.rigId} has no active version to bind` : `unknown rigId: ${payload.rigId}`
+          });
+        }
+        return { frozenRigId: null, frozenRigVersionId: null };
+      }
       for (const defaultVariableSetId of new Set(rig.activeVersion.defaultVariableSetIds)) {
         await validateVariableSetAttachment(
           { settings, db },
@@ -10666,10 +10709,12 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
           defaultVariableSetId
         );
       }
-      frozenRigId = rig.id;
-      frozenRigVersionId = rig.activeVersion.id;
+      return {
+        frozenRigId: rig.id,
+        frozenRigVersionId: rig.activeVersion.id
+      };
     }
-  }
+  );
   let channelId = null;
   if (payload.channelId) {
     const channel = await getChannel(db, workspaceId, payload.channelId);
@@ -10684,19 +10729,21 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   if (model === null || model === void 0) {
     throw new Error("effective session model unexpectedly resolved to null");
   }
-  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
-  if (retainedKeyedShellModel === null && !parentSession) {
-    const selections = await resolveCallerWorkspaceModelSelections(db, settings, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: personalResourceSubjectId ?? grant.subjectId,
-      ...xaiProviderAccountAuthoritySnapshot ? { xaiAuthoritySnapshot: xaiProviderAccountAuthoritySnapshot } : {},
-      ...claudeProviderAccountAuthoritySnapshot ? { claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot } : {}
-    });
-    if (!admissibleWorkspaceModel(selections, model)) {
-      throw new HTTPException17(422, { message: `model is not selectable: ${model}` });
+  await measureSessionStartPhase(unresolvedDeps.observability, "model_admission", async () => {
+    await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+    if (retainedKeyedShellModel === null && !parentSession) {
+      const selections = await resolveCallerWorkspaceModelSelections(db, settings, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: personalResourceSubjectId ?? grant.subjectId,
+        ...xaiProviderAccountAuthoritySnapshot ? { xaiAuthoritySnapshot: xaiProviderAccountAuthoritySnapshot } : {},
+        ...claudeProviderAccountAuthoritySnapshot ? { claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot } : {}
+      });
+      if (!admissibleWorkspaceModel(selections, model)) {
+        throw new HTTPException17(422, { message: `model is not selectable: ${model}` });
+      }
     }
-  }
+  });
   const inheritedReasoningEffort = parentCallingTurn?.reasoningEffort ?? parentSession?.reasoningEffort ?? resolvedDefault?.reasoningEffort ?? settings.openaiReasoningEffort;
   const reasoningEffort = payload.reasoningEffort ?? inheritedReasoningEffort;
   const latencyMode = payload.latencyMode ?? "standard";
@@ -10815,18 +10862,22 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
       workspace.settings
     )
   });
-  const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
-    db,
-    accountId: grant.accountId,
-    workspaceId,
-    settings: runtimeSettings,
-    tools: connectionAccountTools,
-    resources,
-    source: connectionDelegationSource,
-    authoritySelections: payload.connectionAccounts,
-    googleDrivePublicationEnabled,
-    atlassianEnabled
-  });
+  const { personalConnectionDelegations, mcpAccountBindings } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "connection_freeze",
+    () => freezeConnectionAccounts({
+      db,
+      accountId: grant.accountId,
+      workspaceId,
+      settings: runtimeSettings,
+      tools: connectionAccountTools,
+      resources,
+      source: connectionDelegationSource,
+      authoritySelections: payload.connectionAccounts,
+      googleDrivePublicationEnabled,
+      atlassianEnabled
+    })
+  );
   if (effectiveGoal) {
     const missingGoalTools = ["goal_update", "goal_progress", "goal_complete", "goal_pause"].filter(
       (name) => !firstPartyMcpTools.includes(name)
@@ -11464,6 +11515,10 @@ async function acceptSessionUserMessageInFileScope(deps, grant, workspaceId, ses
         (await requireWorkspace5(db, workspaceId)).settings
       )
     });
+    const existingEffectiveFirstPartyTools = allowedFirstPartyMcpToolsForSession3(
+      settings,
+      existingSession.firstPartyMcpTools
+    );
     const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
       db,
       accountId: grant.accountId,
@@ -11473,7 +11528,7 @@ async function acceptSessionUserMessageInFileScope(deps, grant, workspaceId, ses
       resources: [...existingSession.resources, ...requestedResources],
       source: connectionDelegationSource,
       targetSessionId: sessionId,
-      googleDrivePublicationEnabled: existingSession.firstPartyMcpTools.includes("editable_artifact_export") && existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("artifacts:read") && existingSession.firstPartyMcpPermissions.includes("artifacts:publish")),
+      googleDrivePublicationEnabled: existingEffectiveFirstPartyTools.includes("editable_artifact_export") && existingEffectiveFirstPartyTools.includes("editable_artifact_export_status") && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("artifacts:read") && existingSession.firstPartyMcpPermissions.includes("artifacts:publish")),
       atlassianEnabled: existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) && (!existingSession.firstPartyMcpPermissions?.length || existingSession.firstPartyMcpPermissions.includes("connections:read")),
       ...input.connectionAccounts ? { authoritySelections: input.connectionAccounts } : {}
     });
@@ -12329,6 +12384,10 @@ async function freezeSessionRealtimeConnectionAccounts(input) {
       (await requireWorkspace6(db, workspaceId)).settings
     )
   });
+  const effectiveFirstPartyTools = allowedFirstPartyMcpToolsForSession4(
+    settings,
+    session.firstPartyMcpTools
+  );
   return await freezeConnectionAccounts({
     db,
     settings: runtimeSettings,
@@ -12338,7 +12397,7 @@ async function freezeSessionRealtimeConnectionAccounts(input) {
     resources: session.resources,
     source: personalConnectionDelegationSourceForGrant(grant),
     targetSessionId: sessionId,
-    googleDrivePublicationEnabled: session.firstPartyMcpTools.includes("editable_artifact_export") && session.firstPartyMcpTools.includes("editable_artifact_export_status") && (!session.firstPartyMcpPermissions?.length || session.firstPartyMcpPermissions.includes("artifacts:read") && session.firstPartyMcpPermissions.includes("artifacts:publish")),
+    googleDrivePublicationEnabled: effectiveFirstPartyTools.includes("editable_artifact_export") && effectiveFirstPartyTools.includes("editable_artifact_export_status") && (!session.firstPartyMcpPermissions?.length || session.firstPartyMcpPermissions.includes("artifacts:read") && session.firstPartyMcpPermissions.includes("artifacts:publish")),
     atlassianEnabled: session.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) && (!session.firstPartyMcpPermissions?.length || session.firstPartyMcpPermissions.includes("connections:read"))
   });
 }
@@ -12603,109 +12662,41 @@ async function searchKnowledgeEntries(db, context, input, embedder, settings) {
   );
 }
 
-// src/workflow-wake-contract.ts
-var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
-var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
-var SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 1e4;
-var TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS = 500;
+// src/domain/voice-input-billing.ts
+import {
+  calculateVoiceInputCost,
+  configuredStaticUsageLimits as configuredStaticUsageLimits3,
+  voiceInputCreditBillingActive as voiceInputCreditBillingActive2,
+  voiceInputPricingHasTokenRates
+} from "@opengeni/config";
+import {
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse3,
+  checkWorkspaceAllowance as checkWorkspaceAllowance4,
+  creditDebitAttributionMetadata as creditDebitAttributionMetadata2,
+  getSpendableCreditBalance as getSpendableCreditBalance4,
+  listUnsettledVoiceTranscriptionCharges,
+  recordUsageEvent as recordUsageEvent4,
+  sumUsageQuantity as sumUsageQuantity4,
+  VOICE_TRANSCRIPTION_DEBIT_TYPE,
+  VOICE_TRANSCRIPTION_SOURCE_TYPE,
+  voiceTranscriptionSettlementKeys,
+  VOICE_CREDIT_USAGE as VOICE_CREDIT_USAGE2
+} from "@opengeni/db";
 
-// src/user-presence.ts
-import { recordUserActivityPresence } from "@opengeni/db";
-var USER_PRESENCE_THROTTLE_MS = 6e4;
-var USER_PRESENCE_FLUSH_DELAY_MS = 5e3;
-var USER_PRESENCE_MAX_TRACKED = 5e4;
-var USER_PRESENCE_SUBJECT = /^user:[A-Za-z0-9_-]{8,128}$/;
-var PRESENCE_FLUSH_METRIC = {
-  name: "opengeni_user_presence_flushes_total",
-  help: "Batched user presence writes from this API process by outcome."
+// src/transcription.ts
+var TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS = 10 * 60 * 1e3;
+var TranscriptionBillingRefusedError = class extends Error {
+  status;
+  code;
+  details;
+  constructor(input) {
+    super(input.message);
+    this.name = "TranscriptionBillingRefusedError";
+    this.code = input.code;
+    this.status = input.code === "monthly_model_cost_limit" ? 429 : 402;
+    this.details = input.details ?? {};
+  }
 };
-function createUserPresenceRecorder(options) {
-  const throttleMs = options.throttleMs ?? USER_PRESENCE_THROTTLE_MS;
-  const flushDelayMs = options.flushDelayMs ?? USER_PRESENCE_FLUSH_DELAY_MS;
-  const maxTracked = options.maxTracked ?? USER_PRESENCE_MAX_TRACKED;
-  const now = options.now ?? Date.now;
-  const record3 = options.record ?? recordUserActivityPresence;
-  const lastQueuedAt = /* @__PURE__ */ new Map();
-  const pending = /* @__PURE__ */ new Set();
-  let timer = null;
-  let closed = false;
-  let lastWarningAt = 0;
-  let tail = Promise.resolve();
-  const count = (outcome) => {
-    try {
-      options.observability?.incrementCounter({ ...PRESENCE_FLUSH_METRIC, labels: { outcome } });
-    } catch {
-    }
-  };
-  const prune = (at) => {
-    for (const [subject, queuedAt] of lastQueuedAt) {
-      if (at - queuedAt >= throttleMs && !pending.has(subject)) lastQueuedAt.delete(subject);
-    }
-    if (lastQueuedAt.size > maxTracked) {
-      const excess = lastQueuedAt.size - maxTracked;
-      let removed = 0;
-      for (const subject of lastQueuedAt.keys()) {
-        if (removed >= excess) break;
-        if (pending.has(subject)) continue;
-        lastQueuedAt.delete(subject);
-        removed += 1;
-      }
-    }
-  };
-  const writeBatch = async () => {
-    if (pending.size === 0) return;
-    const batch = [...pending];
-    pending.clear();
-    try {
-      await record3(options.db, batch);
-      count("ok");
-    } catch (error) {
-      for (const subject of batch) lastQueuedAt.delete(subject);
-      count("failed");
-      const at = now();
-      if (at - lastWarningAt >= throttleMs) {
-        lastWarningAt = at;
-        options.observability?.warn("user presence write failed", {
-          errorClass: error instanceof Error ? error.name : "UnknownError"
-        });
-      }
-    }
-  };
-  const flush = () => {
-    if (timer) {
-      clearTimeout(timer);
-      timer = null;
-    }
-    tail = tail.then(writeBatch, writeBatch);
-    return tail;
-  };
-  return {
-    touch(subjectId) {
-      if (closed || !USER_PRESENCE_SUBJECT.test(subjectId)) return;
-      const at = now();
-      const previous = lastQueuedAt.get(subjectId);
-      if (previous !== void 0 && at - previous < throttleMs) return;
-      lastQueuedAt.set(subjectId, at);
-      pending.add(subjectId);
-      if (lastQueuedAt.size > maxTracked) prune(at);
-      if (!timer) {
-        timer = setTimeout(() => {
-          timer = null;
-          void flush();
-        }, flushDelayMs);
-        timer.unref?.();
-      }
-    },
-    flush,
-    async close() {
-      closed = true;
-      await flush();
-    }
-  };
-}
-
-// src/transcription.ts
-var TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS = 10 * 60 * 1e3;
 var TranscriptionServiceError = class extends Error {
   code;
   status;
@@ -12781,6 +12772,685 @@ function filenameForMimeType(mimeType) {
   }
 }
 
+// src/domain/realtime-voice-billing.ts
+import {
+  AI_GATEWAY_REALTIME_MODELS,
+  AZURE_LIVE_REALTIME_MODEL_ID,
+  configuredStaticUsageLimits as configuredStaticUsageLimits2,
+  parseRealtimeVoicePricingJson,
+  parseRealtimeVoicePricingTableJson,
+  realtimeVoiceMinuteCreditMicros,
+  realtimeVoiceStartedMinutes,
+  voiceInputCreditBillingActive
+} from "@opengeni/config";
+import {
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse2,
+  checkWorkspaceAllowance as checkWorkspaceAllowance3,
+  creditDebitAttributionMetadata,
+  existingUsageEventIdempotencyKeys,
+  getSpendableCreditBalance as getSpendableCreditBalance3,
+  loadSessionRealtimeBillingFacts,
+  recordUsageEvent as recordUsageEvent3,
+  sumUsageQuantity as sumUsageQuantity3,
+  VOICE_CREDIT_USAGE,
+  withRlsContext
+} from "@opengeni/db";
+var REALTIME_VOICE_DEBIT_TYPE = "voice_realtime_debit";
+var REALTIME_VOICE_SOURCE_TYPE = "voice_realtime";
+var reportedPricingErrors = /* @__PURE__ */ new Set();
+function tolerantPricing(parse, fallback) {
+  try {
+    return parse();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!reportedPricingErrors.has(message)) {
+      reportedPricingErrors.add(message);
+      console.error(`Live voice pricing ignored: ${message}`);
+    }
+    return fallback;
+  }
+}
+function deploymentRealtimeVoice(settings, model) {
+  const azureConfigured = Boolean(settings.azureLiveEndpoint && settings.azureLiveApiKey?.trim());
+  if (model === AZURE_LIVE_REALTIME_MODEL_ID) {
+    return {
+      provider: "azure-live",
+      configured: azureConfigured,
+      pricing: tolerantPricing(
+        () => parseRealtimeVoicePricingJson(
+          settings.azureLivePricingJson,
+          "OPENGENI_AZURE_LIVE_PRICING_JSON"
+        ),
+        null
+      )
+    };
+  }
+  for (const gateway of Object.values(AI_GATEWAY_REALTIME_MODELS)) {
+    if (gateway.managedModelId !== model) continue;
+    return {
+      provider: "ai-gateway",
+      configured: Boolean(settings.vercelAiGatewayApiKey),
+      pricing: tolerantPricing(
+        () => parseRealtimeVoicePricingTableJson(
+          settings.aiGatewayRealtimePricingJson,
+          "OPENGENI_AI_GATEWAY_REALTIME_PRICING_JSON"
+        ),
+        {}
+      )[gateway.upstreamModelId] ?? null
+    };
+  }
+  return null;
+}
+var RealtimeVoiceUnavailableError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  name = "RealtimeVoiceUnavailableError";
+};
+function realtimeVoiceOfferProblem(settings, voice) {
+  if (!voice.configured) {
+    return new RealtimeVoiceUnavailableError(
+      "not_configured",
+      "Opengeni live voice is not configured on this deployment."
+    );
+  }
+  if (voiceInputCreditBillingActive(settings) && !voice.pricing) {
+    return new RealtimeVoiceUnavailableError(
+      "pricing_unconfigured",
+      "Opengeni live voice is not available on this deployment yet."
+    );
+  }
+  return null;
+}
+var REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE = "Live voice needs Opengeni credits. Add credits to continue.";
+function voiceCreditStanding(balance) {
+  if (balance.balanceMicros > 0) return "spendable";
+  return (balance.promotionalCredits ?? []).some((grant) => grant.remainingMicros > 0) ? "promotional_only" : "none";
+}
+function voiceInsufficientCreditsMessage(feature, standing) {
+  return standing === "promotional_only" ? `Promotional credits don't cover ${feature.toLowerCase()}. Add credits to use it.` : `${feature} needs Opengeni credits. Add credits to continue.`;
+}
+function startOfUtcMonth2(now) {
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+function initiatingHuman(attribution) {
+  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
+}
+function createRealtimeVoiceBilling(deps) {
+  const billingActive = () => voiceInputCreditBillingActive(deps.settings);
+  async function refusal(input) {
+    const balance = await getSpendableCreditBalance3(deps.db, input.accountId, VOICE_CREDIT_USAGE);
+    if (balance.balanceMicros <= 0) {
+      return new TranscriptionBillingRefusedError({
+        code: "insufficient_credits",
+        message: voiceInsufficientCreditsMessage("Live voice", voiceCreditStanding(balance))
+      });
+    }
+    const allowance = await checkWorkspaceAllowance3(deps.db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: initiatingHuman(input.attribution)
+    });
+    if (allowance) {
+      return new TranscriptionBillingRefusedError({
+        code: allowance.code,
+        message: allowance.message,
+        details: {
+          scope: allowance.scope,
+          resetsAt: allowance.resetsAt,
+          ...allowance.subjectId ? { subjectId: allowance.subjectId } : {}
+        }
+      });
+    }
+    if (deps.settings.usageLimitsMode === "static" || deps.settings.usageLimitsMode === "managed") {
+      const cap = configuredStaticUsageLimits2(deps.settings).maxMonthlyCostMicrosPerAccount;
+      if (cap) {
+        const used = await sumUsageQuantity3(deps.db, {
+          accountId: input.accountId,
+          eventType: "model.cost",
+          since: startOfUtcMonth2(input.now)
+        });
+        if (used >= cap) {
+          return new TranscriptionBillingRefusedError({
+            code: "monthly_model_cost_limit",
+            message: "The monthly model cost limit has been reached."
+          });
+        }
+      }
+    }
+    return null;
+  }
+  return {
+    /**
+     * Throws RealtimeVoiceUnavailableError when the deployment cannot offer
+     * the model and TranscriptionBillingRefusedError for a credit refusal.
+     * Workspace-funded models are always admitted here.
+     */
+    async admit(input) {
+      const voice = deploymentRealtimeVoice(deps.settings, input.model);
+      if (!voice) return;
+      const problem = realtimeVoiceOfferProblem(deps.settings, voice);
+      if (problem) throw problem;
+      if (!billingActive()) return;
+      const refused = await refusal({ ...input, now: input.now ?? /* @__PURE__ */ new Date() });
+      if (refused) throw refused;
+    },
+    /** Spendable credits are positive (always true when credits are not enforced). */
+    async hasSpendableCredits(accountId) {
+      return await this.creditStanding(accountId) === "spendable";
+    },
+    /** Credit standing for live voice ("spendable" when credits are not enforced). */
+    async creditStanding(accountId) {
+      if (!billingActive()) return "spendable";
+      return voiceCreditStanding(
+        await getSpendableCreditBalance3(deps.db, accountId, VOICE_CREDIT_USAGE)
+      );
+    },
+    /**
+     * Settle every started minute observed so far for one live-voice mode and
+     * report whether the call must stop. Safe to call repeatedly and
+     * concurrently: receipts and debits are idempotent per (connection, minute).
+     */
+    async settle(input) {
+      const now = input.now ?? /* @__PURE__ */ new Date();
+      if (!billingActive()) return { debitedMicros: 0, stop: null };
+      const facts = await loadSessionRealtimeBillingFacts(deps.db, { ...input, now });
+      if (!facts) return { debitedMicros: 0, stop: null };
+      const voice = deploymentRealtimeVoice(deps.settings, facts.model);
+      if (!voice) return { debitedMicros: 0, stop: null };
+      if (!voice.pricing) {
+        return {
+          debitedMicros: 0,
+          stop: new RealtimeVoiceUnavailableError(
+            "pricing_unconfigured",
+            "Opengeni live voice is no longer available on this deployment."
+          )
+        };
+      }
+      const attribution = input.callerSubjectId === facts.ownerSubjectId ? input.attribution : { kind: "unknown" };
+      const cost = realtimeVoiceMinuteCreditMicros(voice.pricing);
+      const minutes = facts.connections.flatMap(
+        (connection) => Array.from(
+          { length: realtimeVoiceStartedMinutes(connection.startedAt, connection.observedUntil) },
+          (_, index) => ({
+            connectionId: connection.id,
+            minute: index + 1,
+            startsAt: new Date(connection.startedAt.getTime() + index * 6e4),
+            key: `voice.realtime_cost:${connection.id}:${index + 1}`
+          })
+        )
+      );
+      const recorded = await existingUsageEventIdempotencyKeys(deps.db, {
+        accountId: facts.accountId,
+        workspaceId: facts.workspaceId,
+        keys: minutes.map((minute) => minute.key)
+      });
+      let debitedMicros = 0;
+      for (const minute of minutes) {
+        if (recorded.has(minute.key)) continue;
+        debitedMicros += await withRlsContext(
+          deps.db,
+          { accountId: facts.accountId, workspaceId: facts.workspaceId },
+          async (tx) => {
+            const sourceId = `${minute.connectionId}:${minute.minute}`;
+            const receipt2 = await recordUsageEvent3(tx, {
+              accountId: facts.accountId,
+              workspaceId: facts.workspaceId,
+              sessionId: facts.sessionId,
+              eventType: "model.cost",
+              quantity: cost.creditCostMicros,
+              unit: "usd_micros",
+              sourceResourceType: REALTIME_VOICE_SOURCE_TYPE,
+              sourceResourceId: sourceId,
+              idempotencyKey: minute.key,
+              occurredAt: minute.startsAt,
+              initiator: { kind: "service", subjectId: "api:voice-realtime" },
+              initiatorContext: { creditDebitAttribution: attribution }
+            });
+            const amount = Number(receipt2.quantity);
+            if (amount <= 0) return 0;
+            const debit = await applyCreditDebitAfterUse2(tx, {
+              accountId: facts.accountId,
+              workspaceId: facts.workspaceId,
+              type: REALTIME_VOICE_DEBIT_TYPE,
+              amountMicros: amount,
+              sourceType: REALTIME_VOICE_SOURCE_TYPE,
+              sourceId,
+              idempotencyKey: `credit:${REALTIME_VOICE_DEBIT_TYPE}:${sourceId}`,
+              occurredAt: minute.startsAt,
+              usage: VOICE_CREDIT_USAGE,
+              metadata: {
+                provider: voice.provider,
+                model: facts.model,
+                realtimeId: facts.realtimeId,
+                connectionId: minute.connectionId,
+                minute: minute.minute,
+                basis: "server_observed_started_minute",
+                providerCostMicros: cost.providerCostMicros,
+                ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata(attribution)
+              }
+            });
+            return debit.debitedMicros;
+          }
+        );
+      }
+      const stop = facts.state === "active" ? await refusal({
+        accountId: facts.accountId,
+        workspaceId: facts.workspaceId,
+        attribution,
+        now
+      }) : null;
+      return { debitedMicros, stop };
+    }
+  };
+}
+
+// src/domain/voice-input-billing.ts
+var VOICE_INPUT_DEBIT_TYPE = VOICE_TRANSCRIPTION_DEBIT_TYPE;
+var VOICE_INPUT_SOURCE_TYPE = VOICE_TRANSCRIPTION_SOURCE_TYPE;
+function voiceInputBillableUsage(input) {
+  if (input.usage?.kind === "tokens" && voiceInputPricingHasTokenRates(input.pricing)) {
+    return { usage: input.usage, basis: "provider_tokens" };
+  }
+  if (input.usage?.kind === "duration") {
+    return { usage: input.usage, basis: "provider_duration" };
+  }
+  if (input.trustedDurationSeconds !== void 0 && Number.isFinite(input.trustedDurationSeconds) && input.trustedDurationSeconds >= 0) {
+    return {
+      usage: { kind: "duration", seconds: input.trustedDurationSeconds },
+      basis: "server_duration"
+    };
+  }
+  throw new TranscriptionServiceError({
+    code: "provider",
+    message: "Transcription usage was not reported."
+  });
+}
+function initiatingHuman2(attribution) {
+  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
+}
+function startOfUtcMonth3() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+function createVoiceInputBilling(deps) {
+  const reconcileInterval = deps.reconcileIntervalMilliseconds ?? 5 * 6e4;
+  const lastReconciled = /* @__PURE__ */ new Map();
+  const reconcileDue = (key) => {
+    const now = Date.now();
+    const last = lastReconciled.get(key);
+    if (last !== void 0 && now - last < reconcileInterval) return false;
+    if (lastReconciled.size >= 1e4) lastReconciled.clear();
+    lastReconciled.set(key, now);
+    return true;
+  };
+  return {
+    async admit({ accountId, workspaceId, attribution }) {
+      if (!voiceInputCreditBillingActive2(deps.settings)) return;
+      if (attribution.kind === "unknown") {
+        throw new TranscriptionServiceError({
+          code: "policy_blocked",
+          status: 403,
+          message: "Voice input payer could not be verified."
+        });
+      }
+      if (reconcileDue(`${accountId}:${workspaceId}`)) {
+        await reconcileUnsettledVoiceInputCharges(deps.db, { accountId, workspaceId }).catch(
+          (error) => {
+            deps.onReconcileError?.(error, { accountId, workspaceId });
+          }
+        );
+      }
+      const balance = await getSpendableCreditBalance4(deps.db, accountId, VOICE_CREDIT_USAGE2);
+      if (balance.balanceMicros <= 0) {
+        throw new TranscriptionBillingRefusedError({
+          code: "insufficient_credits",
+          message: voiceInsufficientCreditsMessage("Voice input", voiceCreditStanding(balance))
+        });
+      }
+      const refusal = await checkWorkspaceAllowance4(deps.db, {
+        accountId,
+        workspaceId,
+        subjectId: initiatingHuman2(attribution)
+      });
+      if (refusal) {
+        throw new TranscriptionBillingRefusedError({
+          code: refusal.code,
+          message: refusal.message,
+          details: {
+            scope: refusal.scope,
+            resetsAt: refusal.resetsAt,
+            ...refusal.subjectId ? { subjectId: refusal.subjectId } : {}
+          }
+        });
+      }
+      if (deps.settings.usageLimitsMode === "static" || deps.settings.usageLimitsMode === "managed") {
+        const cap = configuredStaticUsageLimits3(deps.settings).maxMonthlyCostMicrosPerAccount;
+        if (cap) {
+          const used = await sumUsageQuantity4(deps.db, {
+            accountId,
+            eventType: "model.cost",
+            since: startOfUtcMonth3()
+          });
+          if (used >= cap) {
+            throw new TranscriptionBillingRefusedError({
+              code: "monthly_model_cost_limit",
+              message: "The monthly model cost limit has been reached."
+            });
+          }
+        }
+      }
+    },
+    async settle(input) {
+      if (!voiceInputCreditBillingActive2(deps.settings)) return { creditCostMicros: 0 };
+      const { usage, basis } = voiceInputBillableUsage({
+        pricing: input.pricing,
+        usage: input.usage,
+        trustedDurationSeconds: input.billing.trustedDurationSeconds
+      });
+      const cost = calculateVoiceInputCost(input.pricing, usage);
+      return await settleVoiceInputUsage(deps.db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        providerId: input.providerId,
+        model: input.model,
+        billing: input.billing,
+        usage,
+        basis,
+        providerCostMicros: cost.providerCostMicros,
+        creditCostMicros: cost.creditCostMicros
+      });
+    }
+  };
+}
+async function settleVoiceInputUsage(db, input) {
+  const attribution = input.billing.attribution;
+  const keys = voiceTranscriptionSettlementKeys({
+    workspaceId: input.workspaceId,
+    sourceId: input.billing.sourceId
+  });
+  const receipt2 = await recordUsageEvent4(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    eventType: "model.cost",
+    quantity: input.creditCostMicros,
+    unit: "usd_micros",
+    sourceResourceType: VOICE_TRANSCRIPTION_SOURCE_TYPE,
+    sourceResourceId: input.billing.sourceId,
+    idempotencyKey: keys.usageIdempotencyKey,
+    // The API is the writer; the payer is the trusted attribution snapshot.
+    initiator: { kind: "service", subjectId: "api:voice-input" },
+    initiatorContext: { creditDebitAttribution: attribution }
+  });
+  const amount = Number(receipt2.quantity);
+  if (amount > 0) {
+    await applyCreditDebitAfterUse3(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      type: VOICE_TRANSCRIPTION_DEBIT_TYPE,
+      amountMicros: amount,
+      sourceType: VOICE_TRANSCRIPTION_SOURCE_TYPE,
+      sourceId: input.billing.sourceId,
+      idempotencyKey: keys.debitIdempotencyKey,
+      usage: VOICE_CREDIT_USAGE2,
+      metadata: {
+        providerId: input.providerId,
+        model: input.model,
+        basis: input.basis,
+        providerCostMicros: input.providerCostMicros,
+        ...input.usage.kind === "tokens" ? {
+          inputTokens: input.usage.inputTokens,
+          audioInputTokens: input.usage.audioInputTokens,
+          textInputTokens: input.usage.textInputTokens,
+          outputTokens: input.usage.outputTokens
+        } : { audioMilliseconds: Math.ceil(input.usage.seconds * 1e3) },
+        ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata2(attribution)
+      }
+    });
+  }
+  return { creditCostMicros: amount };
+}
+async function reconcileUnsettledVoiceInputCharges(db, input) {
+  const pending = await listUnsettledVoiceTranscriptionCharges(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    ...input.minAgeMilliseconds !== void 0 ? { minAgeMilliseconds: input.minAgeMilliseconds } : {}
+  });
+  for (const charge of pending) {
+    await applyCreditDebitAfterUse3(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      type: VOICE_TRANSCRIPTION_DEBIT_TYPE,
+      amountMicros: charge.amountMicros,
+      sourceType: VOICE_TRANSCRIPTION_SOURCE_TYPE,
+      sourceId: charge.sourceId,
+      idempotencyKey: voiceTranscriptionSettlementKeys({
+        workspaceId: input.workspaceId,
+        sourceId: charge.sourceId
+      }).debitIdempotencyKey,
+      usage: VOICE_CREDIT_USAGE2,
+      metadata: {
+        basis: "reconciled_receipt",
+        ...charge.attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata2(charge.attribution)
+      }
+    });
+  }
+  return { reconciled: pending.length };
+}
+
+// src/domain/web-search-billing.ts
+import {
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse4,
+  checkWorkspaceAllowance as checkWorkspaceAllowance5,
+  creditDebitAttributionForTurn as creditDebitAttributionForTurn2,
+  creditDebitAttributionMetadata as creditDebitAttributionMetadata3,
+  getSpendableCreditBalance as getSpendableCreditBalance5,
+  recordUsageEvent as recordUsageEvent5,
+  withRlsContext as withRlsContext2
+} from "@opengeni/db";
+var WEB_SEARCH_DEBIT_TYPE = "web_search_debit";
+var WEB_SEARCH_SOURCE_TYPE = "web_search";
+var WEB_SEARCH_BILLING_INITIATOR = "worker:web-search";
+function webSearchCreditBillingActive(settings) {
+  return settings.billingMode === "stripe" || settings.usageLimitsMode === "managed";
+}
+var WebSearchBillingRefusedError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "WebSearchBillingRefusedError";
+  }
+};
+function createWebSearchBilling(deps) {
+  const active = webSearchCreditBillingActive(deps.settings);
+  const attributionByTurn = /* @__PURE__ */ new Map();
+  const attributionFor = (scope) => {
+    let attribution = attributionByTurn.get(scope.turnId);
+    if (!attribution) {
+      attribution = creditDebitAttributionForTurn2(deps.db, scope);
+      attributionByTurn.set(scope.turnId, attribution);
+      attribution.catch(() => attributionByTurn.delete(scope.turnId));
+    }
+    return attribution;
+  };
+  return {
+    active,
+    async admit(scope, expectedProviderMicros) {
+      if (!active || expectedProviderMicros <= 0) return;
+      const attribution = await attributionFor(scope);
+      const balance = await getSpendableCreditBalance5(deps.db, scope.accountId);
+      if (balance.balanceMicros <= 0) {
+        throw new WebSearchBillingRefusedError(
+          "insufficient_credits",
+          "Web search needs Opengeni credits, and this account has none left."
+        );
+      }
+      const refusal = await checkWorkspaceAllowance5(deps.db, {
+        accountId: scope.accountId,
+        workspaceId: scope.workspaceId,
+        subjectId: attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null
+      });
+      if (refusal) throw new WebSearchBillingRefusedError("allowance_exhausted", refusal.message);
+    },
+    async settle(scope, cost) {
+      const shared = {
+        accountId: scope.accountId,
+        workspaceId: scope.workspaceId,
+        sessionId: scope.sessionId,
+        turnId: scope.turnId,
+        turnAttemptId: scope.attemptId,
+        sourceResourceType: WEB_SEARCH_SOURCE_TYPE,
+        sourceResourceId: `${scope.attemptId}:${cost.operationId}`
+      };
+      await recordUsageEvent5(deps.db, {
+        ...shared,
+        eventType: `web_search.${cost.operation}_requests`,
+        quantity: 1,
+        unit: "request",
+        idempotencyKey: `usage:web_search.${cost.operation}_requests:${shared.sourceResourceId}`
+      });
+      if (!active || cost.creditMicros <= 0) return;
+      const attribution = await attributionFor(scope);
+      await withRlsContext2(
+        deps.db,
+        { accountId: scope.accountId, workspaceId: scope.workspaceId },
+        async (tx) => {
+          await recordUsageEvent5(tx, {
+            ...shared,
+            eventType: "web_search.cost",
+            quantity: cost.creditMicros,
+            unit: "usd_micros",
+            idempotencyKey: `usage:web_search.cost:${shared.sourceResourceId}`,
+            initiator: { kind: "service", subjectId: WEB_SEARCH_BILLING_INITIATOR },
+            initiatorContext: { creditDebitAttribution: attribution }
+          });
+          await applyCreditDebitAfterUse4(tx, {
+            accountId: scope.accountId,
+            workspaceId: scope.workspaceId,
+            type: WEB_SEARCH_DEBIT_TYPE,
+            amountMicros: cost.creditMicros,
+            sourceType: WEB_SEARCH_SOURCE_TYPE,
+            sourceId: shared.sourceResourceId,
+            idempotencyKey: `credit:${WEB_SEARCH_DEBIT_TYPE}:${shared.sourceResourceId}`,
+            metadata: {
+              // turnId lets the allowance trigger resolve the causal human
+              // from the immutable turn receipt.
+              ...creditDebitAttributionMetadata3(attribution),
+              provider: cost.provider,
+              operation: cost.operation,
+              providerCostMicros: cost.providerMicros,
+              marginBps: cost.marginBps,
+              basis: cost.basis
+            }
+          });
+        }
+      );
+    }
+  };
+}
+
+// src/workflow-wake-contract.ts
+var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
+var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
+var SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS = 1e4;
+var TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS = 500;
+
+// src/user-presence.ts
+import { recordUserActivityPresence } from "@opengeni/db";
+var USER_PRESENCE_THROTTLE_MS = 6e4;
+var USER_PRESENCE_FLUSH_DELAY_MS = 5e3;
+var USER_PRESENCE_MAX_TRACKED = 5e4;
+var USER_PRESENCE_SUBJECT = /^user:[A-Za-z0-9_-]{8,128}$/;
+var PRESENCE_FLUSH_METRIC = {
+  name: "opengeni_user_presence_flushes_total",
+  help: "Batched user presence writes from this API process by outcome."
+};
+function createUserPresenceRecorder(options) {
+  const throttleMs = options.throttleMs ?? USER_PRESENCE_THROTTLE_MS;
+  const flushDelayMs = options.flushDelayMs ?? USER_PRESENCE_FLUSH_DELAY_MS;
+  const maxTracked = options.maxTracked ?? USER_PRESENCE_MAX_TRACKED;
+  const now = options.now ?? Date.now;
+  const record3 = options.record ?? recordUserActivityPresence;
+  const lastQueuedAt = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Set();
+  let timer = null;
+  let closed = false;
+  let lastWarningAt = 0;
+  let tail = Promise.resolve();
+  const count = (outcome) => {
+    try {
+      options.observability?.incrementCounter({ ...PRESENCE_FLUSH_METRIC, labels: { outcome } });
+    } catch {
+    }
+  };
+  const prune = (at) => {
+    for (const [subject, queuedAt] of lastQueuedAt) {
+      if (at - queuedAt >= throttleMs && !pending.has(subject)) lastQueuedAt.delete(subject);
+    }
+    if (lastQueuedAt.size > maxTracked) {
+      const excess = lastQueuedAt.size - maxTracked;
+      let removed = 0;
+      for (const subject of lastQueuedAt.keys()) {
+        if (removed >= excess) break;
+        if (pending.has(subject)) continue;
+        lastQueuedAt.delete(subject);
+        removed += 1;
+      }
+    }
+  };
+  const writeBatch = async () => {
+    if (pending.size === 0) return;
+    const batch = [...pending];
+    pending.clear();
+    try {
+      await record3(options.db, batch);
+      count("ok");
+    } catch (error) {
+      for (const subject of batch) lastQueuedAt.delete(subject);
+      count("failed");
+      const at = now();
+      if (at - lastWarningAt >= throttleMs) {
+        lastWarningAt = at;
+        options.observability?.warn("user presence write failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError"
+        });
+      }
+    }
+  };
+  const flush = () => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+    tail = tail.then(writeBatch, writeBatch);
+    return tail;
+  };
+  return {
+    touch(subjectId) {
+      if (closed || !USER_PRESENCE_SUBJECT.test(subjectId)) return;
+      const at = now();
+      const previous = lastQueuedAt.get(subjectId);
+      if (previous !== void 0 && at - previous < throttleMs) return;
+      lastQueuedAt.set(subjectId, at);
+      pending.add(subjectId);
+      if (lastQueuedAt.size > maxTracked) prune(at);
+      if (!timer) {
+        timer = setTimeout(() => {
+          timer = null;
+          void flush();
+        }, flushDelayMs);
+        timer.unref?.();
+      }
+    },
+    flush,
+    async close() {
+      closed = true;
+      await flush();
+    }
+  };
+}
+
 // src/goal-admission.ts
 import {
   isModelAvailableForNewSelection as isModelAvailableForNewSelection2,
@@ -12799,13 +13469,13 @@ import { getWorkspaceModelPolicy as getWorkspaceModelPolicy3 } from "@opengeni/d
 // src/billing/agent-run-admission.ts
 import {
   canonicalizeConfiguredModelId as canonicalizeConfiguredModelId4,
-  configuredStaticUsageLimits as configuredStaticUsageLimits2
+  configuredStaticUsageLimits as configuredStaticUsageLimits4
 } from "@opengeni/config";
 import {
-  checkWorkspaceAllowance as checkWorkspaceAllowance3,
-  getSpendableCreditBalance as getSpendableCreditBalance3,
+  checkWorkspaceAllowance as checkWorkspaceAllowance6,
+  getSpendableCreditBalance as getSpendableCreditBalance6,
   isCodexBilledTurn as isCodexBilledTurn2,
-  sumUsageQuantity as sumUsageQuantity3
+  sumUsageQuantity as sumUsageQuantity5
 } from "@opengeni/db";
 async function agentRunAdmissionDenial(services, input) {
   const codexBilled = await isCodexBilledTurn2({
@@ -12829,7 +13499,7 @@ async function agentRunAdmissionDenial(services, input) {
       });
       if (!decision.allowed) return "insufficient_credits";
     } else {
-      const balance = await getSpendableCreditBalance3(
+      const balance = await getSpendableCreditBalance6(
         services.db,
         input.accountId,
         canonicalizeConfiguredModelId4(services.settings, input.model)
@@ -12838,7 +13508,7 @@ async function agentRunAdmissionDenial(services, input) {
     }
   }
   if (!externallyBilled) {
-    const refusal = await checkWorkspaceAllowance3(services.db, {
+    const refusal = await checkWorkspaceAllowance6(services.db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       subjectId: input.initiatingHumanSubjectId ?? null
@@ -12848,22 +13518,22 @@ async function agentRunAdmissionDenial(services, input) {
   if (services.settings.usageLimitsMode !== "static" && services.settings.usageLimitsMode !== "managed") {
     return null;
   }
-  const limits = configuredStaticUsageLimits2(services.settings);
+  const limits = configuredStaticUsageLimits4(services.settings);
   if (!externallyBilled && limits.maxMonthlyCostMicrosPerAccount) {
-    const used = await sumUsageQuantity3(services.db, {
+    const used = await sumUsageQuantity5(services.db, {
       accountId: input.accountId,
       eventType: "model.cost",
-      since: startOfUtcMonth2()
+      since: startOfUtcMonth4()
     });
     if (used >= limits.maxMonthlyCostMicrosPerAccount) {
       return "monthly_model_cost_limit";
     }
   }
   if (limits.maxMonthlyAgentRunsPerWorkspace) {
-    const used = await sumUsageQuantity3(services.db, {
+    const used = await sumUsageQuantity5(services.db, {
       workspaceId: input.workspaceId,
       eventType: "agent_run.created",
-      since: startOfUtcMonth2()
+      since: startOfUtcMonth4()
     });
     if (used + input.requestedAgentRuns > limits.maxMonthlyAgentRunsPerWorkspace) {
       return "monthly_agent_run_limit";
@@ -12871,7 +13541,7 @@ async function agentRunAdmissionDenial(services, input) {
   }
   return null;
 }
-function startOfUtcMonth2() {
+function startOfUtcMonth4() {
   const now = /* @__PURE__ */ new Date();
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
 }
@@ -15581,7 +16251,7 @@ import {
   SCHEDULED_TASK_OCCURRENCE_PAYLOAD_INGRESS_HEADROOM_BYTES
 } from "@opengeni/contracts";
 import {
-  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession4,
+  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession5,
   resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy2
 } from "@opengeni/config";
 import {
@@ -15689,7 +16359,7 @@ async function scheduledConnectionTools(db, workspaceId, settings, target, taskT
   }).toolRefs;
 }
 function scheduledConnectionSurfaceEligibility(settings, target) {
-  const tools = target?.firstPartyMcpTools ?? resolveFirstPartyMcpToolPolicy2(settings).default;
+  const tools = allowedFirstPartyMcpToolsForSession5(settings, target?.firstPartyMcpTools);
   const permissions = target?.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS3;
   return {
     googleDrivePublicationEnabled: tools.includes("editable_artifact_export") && tools.includes("editable_artifact_export_status") && permissions.includes("artifacts:read") && permissions.includes("artifacts:publish"),
@@ -16014,7 +16684,7 @@ async function frozenScheduledTaskCreatorPolicy(input) {
   restricted ||= Boolean(
     turnPolicy.kind === "valid" && turnPolicy.policy.credentialRestriction === "developer_setup" || sessionPolicy.kind === "valid" && sessionPolicy.policy.credentialRestriction === "developer_setup"
   );
-  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession4(
+  const firstPartyMcpTools = allowedFirstPartyMcpToolsForSession5(
     input.settings,
     session.firstPartyMcpTools
   );
@@ -17315,7 +17985,7 @@ function trimmedScheduledTaskName(name) {
 
 // src/domain/scheduled-task-access.ts
 import {
-  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession5,
+  allowedFirstPartyMcpToolsForSession as allowedFirstPartyMcpToolsForSession6,
   resolveFirstPartyMcpToolPolicy as resolveFirstPartyMcpToolPolicy3
 } from "@opengeni/config";
 import {
@@ -17420,7 +18090,7 @@ function sameMembers(left, right) {
 function planScheduledTaskOpenGeniTools(input) {
   const stored = input.creatorPolicy?.firstPartyMcpTools;
   if (!stored) return { missing: [], policy: null };
-  const effective = new Set(allowedFirstPartyMcpToolsForSession5(input.settings, stored));
+  const effective = new Set(allowedFirstPartyMcpToolsForSession6(input.settings, stored));
   const missing = resolveFirstPartyMcpToolPolicy3(input.settings).default.filter(
     (tool) => !effective.has(tool) && !input.leaveOut?.has(tool)
   );
@@ -17939,7 +18609,7 @@ function orderScheduledTaskAccessAttention(items) {
 }
 
 // src/domain/insights.ts
-import { configuredStaticUsageLimits as configuredStaticUsageLimits3 } from "@opengeni/config";
+import { configuredStaticUsageLimits as configuredStaticUsageLimits5 } from "@opengeni/config";
 import {
   WorkspaceInsightsSnapshot
 } from "@opengeni/contracts";
@@ -18070,7 +18740,7 @@ function cacheHitPct(cached2, input) {
 function startOfUtcDay(date) {
   return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
 }
-function startOfUtcMonth3(date) {
+function startOfUtcMonth5(date) {
   return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));
 }
 function startOfUtcYear(date) {
@@ -18099,7 +18769,7 @@ function resolveRangeWindow(range, now) {
       cacheSeriesLabel = "Cache hit % / UTC day";
       break;
     case "month":
-      since = startOfUtcMonth3(now);
+      since = startOfUtcMonth5(now);
       rangeLabel = "This month (UTC)";
       priorLabel = "Prior equal window";
       seriesLabel = "Credit $ / UTC day";
@@ -18230,7 +18900,7 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
         until: window.until,
         priorSince: window.priorSince,
         priorUntil: window.priorUntil,
-        monthSince: startOfUtcMonth3(now),
+        monthSince: startOfUtcMonth5(now),
         granularity: input.range === "today" ? "hour" : "day",
         warmGroupLimit: 24
       })
@@ -18473,7 +19143,7 @@ async function getWorkspaceInsights(db, settings, input, observePhase) {
       billing: fact ? billingPathOf(fact.billingPath) : null
     };
   });
-  const limits = configuredStaticUsageLimits3(settings);
+  const limits = configuredStaticUsageLimits5(settings);
   const floor = floorRows.filter((row) => {
     if (!model) return true;
     return row.model === model;
@@ -20721,7 +21391,7 @@ async function submitComposerDraftForRequest(deps, grant, workspaceId, sessionId
 import { DraftTimelineAnnotations as DraftTimelineAnnotations3 } from "@opengeni/contracts";
 import { HTTPException as HTTPException30 } from "hono/http-exception";
 import {
-  checkWorkspaceAllowance as checkWorkspaceAllowance4,
+  checkWorkspaceAllowance as checkWorkspaceAllowance7,
   deleteSessionQueueItemInTransaction,
   editQueuedTurnInTransaction,
   getComposerDraftInTransaction as getComposerDraftInTransaction2,
@@ -20819,7 +21489,7 @@ async function assertFreshAgentCommandAllowance(tx, deps, context, targetSession
     }
   }
   const frozen = await frozenInitiatorForCommandActor2(tx, context.workspaceId, agentActor(context));
-  const refusal = await checkWorkspaceAllowance4(tx, {
+  const refusal = await checkWorkspaceAllowance7(tx, {
     accountId: target.accountId,
     workspaceId: context.workspaceId,
     subjectId: initiatingHumanForAllowance(frozen)
@@ -22142,7 +22812,6 @@ import { createPinnedIntegrationTransport as createPinnedIntegrationTransport2 }
 import {
   buildConnectionTokenResolver,
   getConnectionMetadata as getConnectionMetadata5,
-  listConnectionsMetadata as listConnectionsMetadata4,
   listEnabledMcpCapabilityServers as listEnabledMcpCapabilityServers3,
   listConnectorToolPermissionPolicies,
   listChangedConnectorToolPermissions,
@@ -22155,6 +22824,7 @@ import {
 import { HTTPException as HTTPException32 } from "hono/http-exception";
 import {
   GMAIL_REST_MCP_TOOLS,
+  gmailToolAvailableOnDeployment,
   gmailToolSupportsScopes,
   isOfficialGmailMcpConfig,
   isOfficialSlackMcpConfig
@@ -22240,11 +22910,12 @@ async function resolveTarget2(input) {
     throw new HTTPException32(403, {
       message: "Only the authenticated connection owner may manage personal tool permissions"
     });
-  const visible = ref ? await listConnectionsMetadata4(
-    input.db,
-    input.workspaceId,
-    input.personalOwnerVerified ? input.grant.subjectId : null
-  ) : [];
+  const source = personalConnectionDelegationSourceForGrant(input.grant);
+  const visible = ref ? await visibleMcpAccountConnections(input.db, {
+    accountId: input.grant.accountId,
+    workspaceId: input.workspaceId,
+    source: input.personalOwnerVerified && source.kind === "subject" ? source : { kind: "none" }
+  }) : [];
   const bindings = mcpAccountBindingsFromVisibleConnections({
     accountId: input.grant.accountId,
     workspaceId: input.workspaceId,
@@ -22286,15 +22957,20 @@ async function resolveTarget2(input) {
     listedTools: null
   };
 }
-function reviewedConnectorToolCatalog(server, grantedScopes) {
-  const tools = isOfficialGmailMcpConfig(server.url, server.connectionRef) ? GMAIL_REST_MCP_TOOLS.filter((tool) => gmailToolSupportsScopes(tool.name, grantedScopes)) : isOfficialSlackMcpConfig(server.url, server.connectionRef) ? slackRestMcpToolsForScopes(grantedScopes) : null;
+function reviewedConnectorToolCatalog(server, grantedScopes, deployment) {
+  const tools = isOfficialGmailMcpConfig(server.url, server.connectionRef) ? GMAIL_REST_MCP_TOOLS.filter(
+    (tool) => gmailToolSupportsScopes(tool.name, grantedScopes) && gmailToolAvailableOnDeployment(tool.name, {
+      watchTopicName: deployment.gmailWatchTopicName
+    })
+  ) : isOfficialSlackMcpConfig(server.url, server.connectionRef) ? slackRestMcpToolsForScopes(grantedScopes) : null;
   return tools?.filter((tool) => !server.allowedTools || server.allowedTools.includes(tool.name)) ?? null;
 }
 async function listTools(input, target) {
   if (target.listedTools !== null) return target.listedTools;
   const reviewed = reviewedConnectorToolCatalog(
     target.server,
-    target.connection?.grantedScopes ?? []
+    target.connection?.grantedScopes ?? [],
+    input.settings
   );
   if (reviewed !== null) return reviewed;
   let headers = { ...target.server.headers };
@@ -22303,7 +22979,9 @@ async function listTools(input, target) {
       input.db,
       input.settings
     )({
-      workspaceId: input.workspaceId,
+      // The selected account's credentials remain in its origin workspace;
+      // approval preferences remain scoped to the workspace being configured.
+      workspaceId: target.connection?.workspaceId ?? input.workspaceId,
       ...target.connection?.subjectId ? { subjectId: input.grant.subjectId } : {},
       serverId: target.server.id,
       toolName: "tools/list",
@@ -22560,7 +23238,11 @@ export {
   PR_REVIEW_AUTOMATION_SETUP,
   ProductionEditableArtifactSnapshotVerifier,
   PublicSkillSearchError,
+  REALTIME_VOICE_DEBIT_TYPE,
+  REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE,
+  REALTIME_VOICE_SOURCE_TYPE,
   RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY,
+  RealtimeVoiceUnavailableError,
   SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS,
   SESSION_CREATED_BY_KINDS,
   SESSION_WORKFLOW_WAKE_DISPATCHER_PERIOD_MS,
@@ -22579,14 +23261,20 @@ export {
   SystemEditableArtifactLiveScheduler,
   TRANSCRIPTION_PROVIDER_REQUEST_TIMEOUT_MILLISECONDS,
   TURN_ACTIVITY_CANCELLATION_HEARTBEAT_INTERVAL_MS,
+  TranscriptionBillingRefusedError,
   TranscriptionServiceError,
   USER_PRESENCE_FLUSH_DELAY_MS,
   USER_PRESENCE_THROTTLE_MS,
   VIDEO_GENERATION_ADAPTER_VERSION,
   VIDEO_GENERATION_MODEL_CATALOG,
+  VOICE_INPUT_DEBIT_TYPE,
+  VOICE_INPUT_SOURCE_TYPE,
+  WEB_SEARCH_DEBIT_TYPE,
+  WEB_SEARCH_SOURCE_TYPE,
   WORKSPACE_INSIGHTS_MODEL_FILTER_MAX_UTF8_BYTES,
   WORKSPACE_INSIGHTS_PROVIDER_FILTER_MAX_UTF8_BYTES,
   WebCryptoEditableArtifactLiveTokens,
+  WebSearchBillingRefusedError,
   WorkspaceInsightsFilterValidationError,
   acceptSessionUserMessage,
   acceptSessionUserMessageWithOutcome,
@@ -22604,6 +23292,7 @@ export {
   appendRigSetupCommand,
   applyCapabilityEnablement,
   applyGitHubRepositoryBindings,
+  applyOperatorOAuthClientRequirement,
   applySessionAgentConfigWriteThrough,
   approveSkill,
   assertAllowedEnvironmentVariableName,
@@ -22679,12 +23368,15 @@ export {
   createCompanyProfileDurableLearningAdapter,
   createGitHubSkillSourceClient,
   createPublicSkillSearchClient,
+  createRealtimeVoiceBilling,
   createRigForApi,
   createRigVersionForApi,
   createSessionForRequest,
   createSessionForRequestWithOutcome,
   createUserPresenceRecorder,
   createValidatedScheduledTask,
+  createVoiceInputBilling,
+  createWebSearchBilling,
   creationInitiatorForGrant,
   creditsDefaultSessionModel,
   decodeEditableArtifactBrokerHint,
@@ -22697,6 +23389,7 @@ export {
   deleteHumanQueuePrompt,
   deleteRigForApi,
   deleteScheduledTaskLifecycle,
+  deploymentRealtimeVoice,
   describeConfiguredExportFormats,
   describeEditableArtifactExportFormats,
   directPersonalConnectionSubjectId,
@@ -22920,6 +23613,8 @@ export {
   readSessionAttachmentFiles,
   readSessionLineage,
   readSkill,
+  realtimeVoiceOfferProblem,
+  reconcileUnsettledVoiceInputCharges,
   recordManagedAuthLoggedFailure,
   recordRigAuditEvent,
   recordSessionCreated,
@@ -23056,6 +23751,7 @@ export {
   settingsWithRigProviderImage,
   settingsWithSessionMcpServerMetadata,
   settingsWithWorkspaceSandboxImage,
+  settleVoiceInputUsage,
   signedJsonAutomationAdapter,
   skillBundleHash,
   stableJson,
@@ -23113,6 +23809,10 @@ export {
   videoGenerationProviderIdempotencyKey,
   videoGenerationRequestDigest,
   visibleMcpAccountConnections,
+  voiceCreditStanding,
+  voiceInputBillableUsage,
+  voiceInsufficientCreditsMessage,
+  webSearchCreditBillingActive,
   withAgentConfigHttpErrors,
   withDefaultEnabledCapabilityMcpTools,
   withFrozenPersonalConnectionDelegations,