@opengeni/core 1.4.0 → 1.4.4

package/dist/index.js

@@ -845,7 +845,11 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { isDeepStrictEqual } from "util";
 import { withLockedCapabilityInstallation } from "@opengeni/db/capability-reconciliation";
-import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import {
+  environmentsEncryptionKeyBytes,
+  findIntegrationsOauthClient,
+  parseIntegrationsOauthClientsJson
+} from "@opengeni/config";
 import { pinnedFetch } from "@opengeni/network";
 import {
   CapabilityCatalogItem,
@@ -2027,6 +2031,7 @@ async function buildCapabilityCatalog(input) {
     listEnabledMcpCapabilityServers(input.db, input.workspaceId)
   ]);
   const runnableCapabilityIds = new Set(runnableMcpServers.map((server) => server.capabilityId));
+  const operatorOAuthClientConfigured = operatorOAuthClientResolver(input.settings);
   const catalogInstallations = capabilityInstallations.filter(
     (installation) => installation.kind === "mcp"
   );
@@ -2064,13 +2069,33 @@ async function buildCapabilityCatalog(input) {
         notes: "This installed connection is unavailable. Review its connection settings."
       }
     } : projected;
-    return applyCapabilityLifecycle(runtimeProjected);
+    return applyCapabilityLifecycle(
+      applyOperatorOAuthClientRequirement(runtimeProjected, operatorOAuthClientConfigured)
+    );
   }).sort(compareCatalogItems);
   return {
     items,
     installations: catalogInstallations
   };
 }
+function operatorOAuthClientResolver(settings) {
+  let configured = {};
+  try {
+    configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
+  } catch {
+  }
+  return (issuer) => findIntegrationsOauthClient(configured, [issuer]) !== null;
+}
+function applyOperatorOAuthClientRequirement(item, configured) {
+  if (item.kind !== "mcp") return item;
+  const requirement = item.metadata.oauthClientRequirement;
+  const issuer = requirement && typeof requirement === "object" && !Array.isArray(requirement) ? requirement.issuer : void 0;
+  if (typeof issuer !== "string" || !issuer) return item;
+  return {
+    ...item,
+    runtime: { ...item.runtime, operatorOAuthClient: { configured: configured(issuer) } }
+  };
+}
 async function createCatalogItem(input) {
   const id = input.payload.id?.trim() || generatedCapabilityId(input.payload);
   if (id.startsWith("skill:")) {
@@ -6707,15 +6732,13 @@ import {
 import {
   listConnectionsMetadata as listConnectionsMetadata3,
   getDeploymentModelCatalog,
-  listWorkspaceProviderCustomModels,
+  listWorkspaceProviderCustomModelsByKind,
   getWorkspaceProviderCustomModelForExecution,
   lockActiveWorkspaceProviderCustomModelForAdmission,
   getWorkspaceGatewayCustomModelForExecution,
   getWorkspaceOpenRouterCustomModelForExecution,
   getOrganizationModelProviderCustomModelForExecution,
-  listWorkspaceGatewayCustomModels,
-  listWorkspaceOpenRouterCustomModels,
-  listOrganizationModelProviderCustomModelsForWorkspace,
+  getOrganizationModelProviderCatalogForWorkspace,
   lockActiveOrganizationModelProviderCustomModelForAdmission
 } from "@opengeni/db";
 function isWorkspaceGatewayCustomModelId(settings, modelId) {
@@ -6830,26 +6853,28 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
   const retainedOrganizationOpenRouterUpstreamModelIds = retainedProductModelIds.flatMap(
     (productModelId) => productModelId?.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX) ? [productModelId.slice(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX.length)] : []
   );
+  const workspaceCustomModelKinds = [
+    "vercel_gateway",
+    "openrouter",
+    ...supportsOrganizationProviderReads ? CLAUDE_CONNECTION_KINDS.filter(
+      (kind) => kind !== "claude_subscription" || envSettings.claudeSubscriptionEnabled
+    ) : []
+  ];
   const [
     resolved,
-    activeGatewayCustomModels,
-    activeOpenRouterCustomModels,
+    workspaceCustomModels,
     retainedGatewayCustomModels,
     retainedOpenRouterCustomModels,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels,
+    organizationProviders,
     retainedOrganizationGatewayCustomModels,
     retainedOrganizationOpenRouterCustomModels,
     directConnections
   ] = await Promise.all([
     resolveCatalogSettings(db, envSettings),
-    listWorkspaceGatewayCustomModels(db, {
+    listWorkspaceProviderCustomModelsByKind(db, {
       accountId: input.accountId,
-      workspaceId: input.workspaceId
-    }),
-    listWorkspaceOpenRouterCustomModels(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId
+      workspaceId: input.workspaceId,
+      providerKinds: workspaceCustomModelKinds
     }),
     Promise.all(
       [...new Set(retainedGatewayUpstreamModelIds)].map(
@@ -6869,16 +6894,11 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
         })
       )
     ),
-    supportsOrganizationProviderReads ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      providerKind: "vercel_gateway"
-    }) : Promise.resolve([]),
-    supportsOrganizationProviderReads ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
+    supportsOrganizationProviderReads ? getOrganizationModelProviderCatalogForWorkspace(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
-      providerKind: "openrouter"
-    }) : Promise.resolve([]),
+      providerKinds: ["vercel_gateway", "openrouter", ...CLAUDE_CONNECTION_KINDS]
+    }) : null,
     supportsOrganizationProviderReads ? Promise.all(
       [...new Set(retainedOrganizationGatewayUpstreamModelIds)].map(
         async (upstreamModelId) => await getOrganizationModelProviderCustomModelForExecution(db, {
@@ -6913,29 +6933,25 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
     return customModels;
   };
   const gatewayCustomModels = includeRetainedModels(
-    activeGatewayCustomModels,
+    workspaceCustomModels.vercel_gateway,
     retainedGatewayCustomModels
   );
   const openRouterCustomModels = includeRetainedModels(
-    activeOpenRouterCustomModels,
+    workspaceCustomModels.openrouter,
     retainedOpenRouterCustomModels
   );
   const organizationGatewayModels = includeRetainedModels(
-    organizationGatewayCustomModels,
+    organizationProviders?.vercel_gateway.models ?? [],
     retainedOrganizationGatewayCustomModels
   );
   const organizationOpenRouterModels = includeRetainedModels(
-    organizationOpenRouterCustomModels,
+    organizationProviders?.openrouter.models ?? [],
     retainedOrganizationOpenRouterCustomModels
   );
   const claudeConnections = {};
-  if (supportsOrganizationProviderReads)
+  if (organizationProviders)
     for (const kind of CLAUDE_CONNECTION_KINDS) {
-      const models = await listOrganizationModelProviderCustomModelsForWorkspace(db, {
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        providerKind: kind
-      });
+      const models = [...organizationProviders[kind].models];
       const prefix = claudeProviderId(kind) + "/";
       for (const productId of retainedProductModelIds)
         if (productId?.startsWith(prefix)) {
@@ -6953,11 +6969,7 @@ async function resolveWorkspaceCatalogSettings(db, envSettings, input) {
   if (supportsOrganizationProviderReads)
     for (const kind of CLAUDE_CONNECTION_KINDS) {
       if (kind === "claude_subscription" && !resolved.settings.claudeSubscriptionEnabled) continue;
-      const models = await listWorkspaceProviderCustomModels(db, {
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        providerKind: kind
-      });
+      const models = [...workspaceCustomModels[kind]];
       const prefix = claudeProviderId(kind, "workspace") + "/";
       for (const productId of retainedProductModelIds) {
         if (!productId?.startsWith(prefix)) continue;
@@ -7267,15 +7279,11 @@ import {
   getWorkspace as getWorkspace2,
   getWorkspaceConnectionModelRestrictions,
   getWorkspaceModelPolicy,
-  getWorkspaceProviderApiKeyConnectionMetadata,
-  listWorkspaceProviderCustomModels as listWorkspaceProviderCustomModels2,
-  listOrganizationModelProviderCustomModelsForWorkspace as listOrganizationModelProviderCustomModelsForWorkspace2,
-  listWorkspaceGatewayCustomModels as listWorkspaceGatewayCustomModels2,
-  listWorkspaceOpenRouterCustomModels as listWorkspaceOpenRouterCustomModels2,
-  organizationModelProviderConnectionActiveForWorkspace,
+  getOrganizationModelProviderCatalogForWorkspace as getOrganizationModelProviderCatalogForWorkspace2,
+  listConnectionsMetadata as listConnectionsMetadata4,
+  listWorkspaceProviderCustomModelsByKind as listWorkspaceProviderCustomModelsByKind2,
   workspaceCodexSubscriptionActive,
-  workspaceOpenRouterConnectionActive,
-  workspaceVercelAiGatewayConnectionActive,
+  workspaceProviderApiKeyConnectionMetadataFromConnections,
   getBillingBalance,
   spendableCreditMicros,
   workspaceXaiSubscriptionActive,
@@ -7592,84 +7600,55 @@ async function loadWorkspaceClaudeSubscriptionReadiness(db, settings, context) {
 }
 async function loadWorkspaceModelSelectionInput(db, settings, context, options = {}) {
   const { accountId, workspaceId } = context;
-  const restrictionsRead = (async () => connectionRestrictionsAndXaiReadiness(db, settings, context))();
-  const claudePoolRead = (async () => loadWorkspaceClaudeSubscriptionReadiness(db, settings, context))();
+  const providerKinds = [
+    "vercel_gateway",
+    "openrouter",
+    ...CLAUDE_CONNECTION_KINDS2.filter(
+      (kind) => kind !== "claude_subscription" || settings.claudeSubscriptionEnabled
+    )
+  ];
   const inputRead = (async () => Promise.all([
-    restrictionsRead,
-    claudePoolRead,
+    connectionRestrictionsAndXaiReadiness(db, settings, context),
+    loadWorkspaceClaudeSubscriptionReadiness(db, settings, context),
     getWorkspaceModelPolicy(db, workspaceId),
     workspaceCodexSubscriptionActive(db, settings, workspaceId),
-    options.observeAvailability === false ? Promise.resolve({}) : loadWorkspaceCodexModelAvailability(db, settings, workspaceId),
-    workspaceVercelAiGatewayConnectionActive(db, workspaceId),
-    listWorkspaceGatewayCustomModels2(db, { accountId, workspaceId }),
-    workspaceOpenRouterConnectionActive(db, workspaceId),
-    listWorkspaceOpenRouterCustomModels2(db, { accountId, workspaceId }),
-    organizationModelProviderConnectionActiveForWorkspace(db, {
-      accountId,
-      workspaceId,
-      providerKind: "vercel_gateway"
-    }),
-    organizationModelProviderConnectionActiveForWorkspace(db, {
-      accountId,
-      workspaceId,
-      providerKind: "openrouter"
-    }),
-    listOrganizationModelProviderCustomModelsForWorkspace2(db, {
-      accountId,
-      workspaceId,
-      providerKind: "vercel_gateway"
-    }),
-    listOrganizationModelProviderCustomModelsForWorkspace2(db, {
+    options.observeAvailability === false ? Promise.resolve({}) : loadWorkspaceCodexModelAvailability(db, settings, workspaceId)
+  ]))();
+  if (typeof db.rollback === "function") await inputRead;
+  const catalogRead = (async () => Promise.all([
+    listConnectionsMetadata4(db, workspaceId, null),
+    listWorkspaceProviderCustomModelsByKind2(db, { accountId, workspaceId, providerKinds }),
+    getOrganizationModelProviderCatalogForWorkspace2(db, {
       accountId,
       workspaceId,
-      providerKind: "openrouter"
+      providerKinds
     })
   ]))();
-  const claudeConnections = {};
-  const workspaceClaudeConnections = {};
-  if (typeof db.rollback === "function") await inputRead;
-  const catalogRead = (async () => Promise.all(
-    CLAUDE_CONNECTION_KINDS2.map(async (kind) => {
-      if (kind === "claude_subscription" && !settings.claudeSubscriptionEnabled) return;
-      const [active, models, metadata, workspaceModels] = await Promise.all([
-        kind === "claude_subscription" ? claudePoolRead.then((pool) => pool.organization) : organizationModelProviderConnectionActiveForWorkspace(db, {
-          accountId,
-          workspaceId,
-          providerKind: kind
-        }),
-        listOrganizationModelProviderCustomModelsForWorkspace2(db, {
-          accountId,
-          workspaceId,
-          providerKind: kind
-        }),
-        kind === "claude_subscription" ? Promise.resolve(null) : getWorkspaceProviderApiKeyConnectionMetadata(db, workspaceId, kind),
-        listWorkspaceProviderCustomModels2(db, { accountId, workspaceId, providerKind: kind })
-      ]);
-      claudeConnections[kind] = { active, models };
-      workspaceClaudeConnections[kind] = {
-        active: kind === "claude_subscription" ? (await claudePoolRead).workspace : metadata !== null,
-        models: workspaceModels
-      };
-    })
-  ))();
   const [inputResult, catalogResult] = await Promise.allSettled([inputRead, catalogRead]);
   if (inputResult.status === "rejected") throw inputResult.reason;
   if (catalogResult.status === "rejected") throw catalogResult.reason;
   const [
     { restrictions: connectionModelRestrictions, xaiSubscriptionActive },
-    _claudePool,
+    claudePool,
     policy,
     codexSubscriptionActive,
-    observations,
-    workspaceGatewayConnectionActive,
-    workspaceGatewayCustomModels,
-    openRouterConnectionActive,
-    workspaceOpenRouterCustomModels,
-    organizationGatewayConnectionActive,
-    organizationOpenRouterConnectionActive,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels
+    observations
   ] = inputResult.value;
+  const [workspaceConnections, workspaceCustomModels, organizationProviders] = catalogResult.value;
+  const workspaceConnectionActive = (kind) => workspaceProviderApiKeyConnectionMetadataFromConnections(workspaceConnections, kind) !== null;
+  const claudeConnections = {};
+  const workspaceClaudeConnections = {};
+  for (const kind of CLAUDE_CONNECTION_KINDS2) {
+    if (kind === "claude_subscription" && !settings.claudeSubscriptionEnabled) continue;
+    claudeConnections[kind] = {
+      active: kind === "claude_subscription" ? claudePool.organization : organizationProviders[kind].active,
+      models: organizationProviders[kind].models
+    };
+    workspaceClaudeConnections[kind] = {
+      active: kind === "claude_subscription" ? claudePool.workspace : workspaceConnectionActive(kind),
+      models: workspaceCustomModels[kind]
+    };
+  }
   return {
     claudeConnections,
     workspaceClaudeConnections,
@@ -7679,14 +7658,14 @@ async function loadWorkspaceModelSelectionInput(db, settings, context, options =
     codexSubscriptionActive,
     observations,
     xaiSubscriptionActive,
-    workspaceGatewayConnectionActive,
-    workspaceGatewayCustomModels,
-    workspaceOpenRouterConnectionActive: openRouterConnectionActive,
-    workspaceOpenRouterCustomModels,
-    organizationGatewayConnectionActive,
-    organizationOpenRouterConnectionActive,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels
+    workspaceGatewayConnectionActive: workspaceConnectionActive("vercel_gateway"),
+    workspaceGatewayCustomModels: workspaceCustomModels.vercel_gateway,
+    workspaceOpenRouterConnectionActive: workspaceConnectionActive("openrouter"),
+    workspaceOpenRouterCustomModels: workspaceCustomModels.openrouter,
+    organizationGatewayConnectionActive: organizationProviders.vercel_gateway.active,
+    organizationOpenRouterConnectionActive: organizationProviders.openrouter.active,
+    organizationGatewayCustomModels: organizationProviders.vercel_gateway.models,
+    organizationOpenRouterCustomModels: organizationProviders.openrouter.models
   };
 }
 async function resolveCallerWorkspaceModelSelections(db, settings, context, options = {}) {
@@ -7969,12 +7948,12 @@ function resolveTurnToolPolicy(input) {
     defaultMcpServerIds: scheduledIds ?? input.defaultMcpServerIds ?? []
   });
 }
-async function workspaceSessionToolPolicyContext(db, workspaceId, settings, subjectId) {
+async function workspaceSessionToolPolicyContext(db, workspaceId, settings, subjectId, workspaceRead) {
   const [runtimeSettings, workspace] = await Promise.all([
     settingsWithEnabledCapabilityMcpServers(db, workspaceId, settings, {
       ...subjectId ? { subjectId } : {}
     }),
-    requireWorkspace3(db, workspaceId)
+    workspaceRead ?? requireWorkspace3(db, workspaceId)
   ]);
   return {
     workspaceServerIds: sortedIds(runtimeSettings.mcpServers.map((server) => server.id)),
@@ -8010,7 +7989,7 @@ function workspaceSessionToolPolicyDefaultServerIdsFor(runtimeMcpServers, worksp
     ...configured.inheritConnectedMcpServers ? availableDefaults.filter((id) => !["opengeni", "files", "docs"].includes(id)) : []
   ]);
 }
-async function workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectId, sessions) {
+async function workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectId, sessions, workspaceRead) {
   const configured = sessions.filter((session) => session.agent != null);
   const baseline = {
     settings: deps.settings,
@@ -8020,7 +7999,7 @@ async function workspaceSessionEffectiveToolsContext(deps, workspaceId, subjectI
   };
   if (configured.length === 0) return baseline;
   const [workspace, catalog, descriptors, sandboxes, routerHistory] = await Promise.all([
-    requireWorkspace3(deps.db, workspaceId),
+    workspaceRead ?? requireWorkspace3(deps.db, workspaceId),
     resolveWorkspaceCatalogSettings(deps.db, deps.settings, {
       accountId: configured[0].accountId,
       workspaceId,
@@ -9952,7 +9931,12 @@ async function postUserMessageTurn(input) {
             }
           } : {},
           controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs()
-        })
+        }),
+        void 0,
+        "shared",
+        // Linked-actor capture reauthorizes under the organization-membership
+        // lock; take it before the tenancy fence and the canonical prefix.
+        Boolean(input.captureTurnAuthority)
       )
     );
   } catch (error) {
@@ -10342,24 +10326,29 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   let retainedKeyedShellModel = null;
   let retainedKeyedShellReasoningEffort = null;
   if (payload.idempotencyKey && (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)) {
+    const createIdempotencyKey = payload.idempotencyKey;
     try {
-      const initializedReplay = await getInitializedSessionCreateReplay(db, {
-        bundledSkillIds,
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
-        ...replayManagedHumanSubjectId ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId } : {},
-        createIdempotencyKey: payload.idempotencyKey,
-        selectedInstalledSkillIds: payload.installedSkillIds ?? [],
-        initialAgentLearning: payload.agentLearning,
-        ...sessionScope,
-        ...payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {},
-        visibility: effectiveVisibility,
-        variableSetIds: payload.variableSetIds ?? [],
-        initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
-        deferInitialTurn: payload.startMode === "realtime",
-        agentConfig
-      });
+      const initializedReplay = await measureSessionStartPhase(
+        unresolvedDeps.observability,
+        "idempotent_replay",
+        () => getInitializedSessionCreateReplay(db, {
+          bundledSkillIds,
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
+          ...replayManagedHumanSubjectId ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId } : {},
+          createIdempotencyKey,
+          selectedInstalledSkillIds: payload.installedSkillIds ?? [],
+          initialAgentLearning: payload.agentLearning,
+          ...sessionScope,
+          ...payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {},
+          visibility: effectiveVisibility,
+          variableSetIds: payload.variableSetIds ?? [],
+          initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+          deferInitialTurn: payload.startMode === "realtime",
+          agentConfig
+        })
+      );
       if (initializedReplay) {
         if (initializedReplay.outcome === "denied") {
           throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(initializedReplay.denial));
@@ -10668,40 +10657,50 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   }
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
   const captureLinkedAuthority = prepareExternalLinkTurnAdmission(authorization);
-  await validateGitHubRepositorySelection(db, workspaceId, resources);
-  if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException17(503, {
-      message: "object storage is not configured"
-    });
-  }
-  const attachmentOwnerContext = authorization ? await fileOwnerContextForAccess({ db }, authorization, "sessions:create") : grant.principalKind === "agent_attempt" ? await fileOwnerContextForAgent({ db }, grant, "sessions:create") : void 0;
-  const attachmentOwner = attachmentOwnerContext?.privateFileOwnerSubjectId === grant.subjectId ? grant.subjectId : null;
-  await validateFileResources(
-    db,
-    grant.accountId,
-    workspaceId,
-    personalResourceSubjectId ?? grant.subjectId,
-    resources,
-    attachmentOwnerContext
-  );
-  const variableSets = [];
-  for (const variableSetId of payload.variableSetIds ?? []) {
-    variableSets.push(
-      await validateVariableSetAttachment({ settings, db }, grant, workspaceId, variableSetId)
-    );
-  }
-  const requestedRigId = payload.rigId === void 0 ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;
-  let frozenRigId = null;
-  let frozenRigVersionId = null;
-  if (requestedRigId) {
-    const rig = await getRig2(db, grant, requestedRigId);
-    if (!rig || !rig.activeVersion) {
-      if (payload.rigId) {
-        throw new HTTPException17(422, {
-          message: rig ? `sandbox environment ${payload.rigId} has no active version to bind` : `unknown rigId: ${payload.rigId}`
+  const { attachmentOwnerContext, variableSets } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "resource_validation",
+    async () => {
+      await validateGitHubRepositorySelection(db, workspaceId, resources);
+      if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
+        throw new HTTPException17(503, {
+          message: "object storage is not configured"
         });
       }
-    } else {
+      const ownerContext = authorization ? await fileOwnerContextForAccess({ db }, authorization, "sessions:create") : grant.principalKind === "agent_attempt" ? await fileOwnerContextForAgent({ db }, grant, "sessions:create") : void 0;
+      await validateFileResources(
+        db,
+        grant.accountId,
+        workspaceId,
+        personalResourceSubjectId ?? grant.subjectId,
+        resources,
+        ownerContext
+      );
+      const validatedVariableSets = [];
+      for (const variableSetId of payload.variableSetIds ?? []) {
+        validatedVariableSets.push(
+          await validateVariableSetAttachment({ settings, db }, grant, workspaceId, variableSetId)
+        );
+      }
+      return { attachmentOwnerContext: ownerContext, variableSets: validatedVariableSets };
+    }
+  );
+  const attachmentOwner = attachmentOwnerContext?.privateFileOwnerSubjectId === grant.subjectId ? grant.subjectId : null;
+  const { frozenRigId, frozenRigVersionId } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "rig_binding",
+    async () => {
+      const requestedRigId = payload.rigId === void 0 ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;
+      if (!requestedRigId) return { frozenRigId: null, frozenRigVersionId: null };
+      const rig = await getRig2(db, grant, requestedRigId);
+      if (!rig || !rig.activeVersion) {
+        if (payload.rigId) {
+          throw new HTTPException17(422, {
+            message: rig ? `sandbox environment ${payload.rigId} has no active version to bind` : `unknown rigId: ${payload.rigId}`
+          });
+        }
+        return { frozenRigId: null, frozenRigVersionId: null };
+      }
       for (const defaultVariableSetId of new Set(rig.activeVersion.defaultVariableSetIds)) {
         await validateVariableSetAttachment(
           { settings, db },
@@ -10710,10 +10709,12 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
           defaultVariableSetId
         );
       }
-      frozenRigId = rig.id;
-      frozenRigVersionId = rig.activeVersion.id;
+      return {
+        frozenRigId: rig.id,
+        frozenRigVersionId: rig.activeVersion.id
+      };
     }
-  }
+  );
   let channelId = null;
   if (payload.channelId) {
     const channel = await getChannel(db, workspaceId, payload.channelId);
@@ -10728,19 +10729,21 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
   if (model === null || model === void 0) {
     throw new Error("effective session model unexpectedly resolved to null");
   }
-  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
-  if (retainedKeyedShellModel === null && !parentSession) {
-    const selections = await resolveCallerWorkspaceModelSelections(db, settings, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: personalResourceSubjectId ?? grant.subjectId,
-      ...xaiProviderAccountAuthoritySnapshot ? { xaiAuthoritySnapshot: xaiProviderAccountAuthoritySnapshot } : {},
-      ...claudeProviderAccountAuthoritySnapshot ? { claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot } : {}
-    });
-    if (!admissibleWorkspaceModel(selections, model)) {
-      throw new HTTPException17(422, { message: `model is not selectable: ${model}` });
+  await measureSessionStartPhase(unresolvedDeps.observability, "model_admission", async () => {
+    await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+    if (retainedKeyedShellModel === null && !parentSession) {
+      const selections = await resolveCallerWorkspaceModelSelections(db, settings, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: personalResourceSubjectId ?? grant.subjectId,
+        ...xaiProviderAccountAuthoritySnapshot ? { xaiAuthoritySnapshot: xaiProviderAccountAuthoritySnapshot } : {},
+        ...claudeProviderAccountAuthoritySnapshot ? { claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot } : {}
+      });
+      if (!admissibleWorkspaceModel(selections, model)) {
+        throw new HTTPException17(422, { message: `model is not selectable: ${model}` });
+      }
     }
-  }
+  });
   const inheritedReasoningEffort = parentCallingTurn?.reasoningEffort ?? parentSession?.reasoningEffort ?? resolvedDefault?.reasoningEffort ?? settings.openaiReasoningEffort;
   const reasoningEffort = payload.reasoningEffort ?? inheritedReasoningEffort;
   const latencyMode = payload.latencyMode ?? "standard";
@@ -10859,18 +10862,22 @@ async function createSessionForRequestInFileScope(unresolvedDeps, grant, workspa
       workspace.settings
     )
   });
-  const { personalConnectionDelegations, mcpAccountBindings } = await freezeConnectionAccounts({
-    db,
-    accountId: grant.accountId,
-    workspaceId,
-    settings: runtimeSettings,
-    tools: connectionAccountTools,
-    resources,
-    source: connectionDelegationSource,
-    authoritySelections: payload.connectionAccounts,
-    googleDrivePublicationEnabled,
-    atlassianEnabled
-  });
+  const { personalConnectionDelegations, mcpAccountBindings } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "connection_freeze",
+    () => freezeConnectionAccounts({
+      db,
+      accountId: grant.accountId,
+      workspaceId,
+      settings: runtimeSettings,
+      tools: connectionAccountTools,
+      resources,
+      source: connectionDelegationSource,
+      authoritySelections: payload.connectionAccounts,
+      googleDrivePublicationEnabled,
+      atlassianEnabled
+    })
+  );
   if (effectiveGoal) {
     const missingGoalTools = ["goal_update", "goal_progress", "goal_complete", "goal_pause"].filter(
       (name) => !firstPartyMcpTools.includes(name)
@@ -12658,21 +12665,22 @@ async function searchKnowledgeEntries(db, context, input, embedder, settings) {
 // src/domain/voice-input-billing.ts
 import {
   calculateVoiceInputCost,
-  configuredStaticUsageLimits as configuredStaticUsageLimits2,
-  voiceInputCreditBillingActive,
+  configuredStaticUsageLimits as configuredStaticUsageLimits3,
+  voiceInputCreditBillingActive as voiceInputCreditBillingActive2,
   voiceInputPricingHasTokenRates
 } from "@opengeni/config";
 import {
-  applyCreditDebitAfterUse as applyCreditDebitAfterUse2,
-  checkWorkspaceAllowance as checkWorkspaceAllowance3,
-  creditDebitAttributionMetadata,
-  getSpendableCreditBalance as getSpendableCreditBalance3,
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse3,
+  checkWorkspaceAllowance as checkWorkspaceAllowance4,
+  creditDebitAttributionMetadata as creditDebitAttributionMetadata2,
+  getSpendableCreditBalance as getSpendableCreditBalance4,
   listUnsettledVoiceTranscriptionCharges,
-  recordUsageEvent as recordUsageEvent3,
-  sumUsageQuantity as sumUsageQuantity3,
+  recordUsageEvent as recordUsageEvent4,
+  sumUsageQuantity as sumUsageQuantity4,
   VOICE_TRANSCRIPTION_DEBIT_TYPE,
   VOICE_TRANSCRIPTION_SOURCE_TYPE,
-  voiceTranscriptionSettlementKeys
+  voiceTranscriptionSettlementKeys,
+  VOICE_CREDIT_USAGE as VOICE_CREDIT_USAGE2
 } from "@opengeni/db";
 
 // src/transcription.ts
@@ -12764,73 +12772,347 @@ function filenameForMimeType(mimeType) {
   }
 }
 
-// src/domain/voice-input-billing.ts
-var VOICE_INPUT_DEBIT_TYPE = VOICE_TRANSCRIPTION_DEBIT_TYPE;
-var VOICE_INPUT_SOURCE_TYPE = VOICE_TRANSCRIPTION_SOURCE_TYPE;
-function voiceInputBillableUsage(input) {
-  if (input.usage?.kind === "tokens" && voiceInputPricingHasTokenRates(input.pricing)) {
-    return { usage: input.usage, basis: "provider_tokens" };
+// src/domain/realtime-voice-billing.ts
+import {
+  AI_GATEWAY_REALTIME_MODELS,
+  AZURE_LIVE_REALTIME_MODEL_ID,
+  configuredStaticUsageLimits as configuredStaticUsageLimits2,
+  parseRealtimeVoicePricingJson,
+  parseRealtimeVoicePricingTableJson,
+  realtimeVoiceMinuteCreditMicros,
+  realtimeVoiceStartedMinutes,
+  voiceInputCreditBillingActive
+} from "@opengeni/config";
+import {
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse2,
+  checkWorkspaceAllowance as checkWorkspaceAllowance3,
+  creditDebitAttributionMetadata,
+  existingUsageEventIdempotencyKeys,
+  getSpendableCreditBalance as getSpendableCreditBalance3,
+  loadSessionRealtimeBillingFacts,
+  recordUsageEvent as recordUsageEvent3,
+  sumUsageQuantity as sumUsageQuantity3,
+  VOICE_CREDIT_USAGE,
+  withRlsContext
+} from "@opengeni/db";
+var REALTIME_VOICE_DEBIT_TYPE = "voice_realtime_debit";
+var REALTIME_VOICE_SOURCE_TYPE = "voice_realtime";
+var reportedPricingErrors = /* @__PURE__ */ new Set();
+function tolerantPricing(parse, fallback) {
+  try {
+    return parse();
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!reportedPricingErrors.has(message)) {
+      reportedPricingErrors.add(message);
+      console.error(`Live voice pricing ignored: ${message}`);
+    }
+    return fallback;
   }
-  if (input.usage?.kind === "duration") {
-    return { usage: input.usage, basis: "provider_duration" };
+}
+function deploymentRealtimeVoice(settings, model) {
+  const azureConfigured = Boolean(settings.azureLiveEndpoint && settings.azureLiveApiKey?.trim());
+  if (model === AZURE_LIVE_REALTIME_MODEL_ID) {
+    return {
+      provider: "azure-live",
+      configured: azureConfigured,
+      pricing: tolerantPricing(
+        () => parseRealtimeVoicePricingJson(
+          settings.azureLivePricingJson,
+          "OPENGENI_AZURE_LIVE_PRICING_JSON"
+        ),
+        null
+      )
+    };
   }
-  if (input.trustedDurationSeconds !== void 0 && Number.isFinite(input.trustedDurationSeconds) && input.trustedDurationSeconds >= 0) {
+  for (const gateway of Object.values(AI_GATEWAY_REALTIME_MODELS)) {
+    if (gateway.managedModelId !== model) continue;
     return {
-      usage: { kind: "duration", seconds: input.trustedDurationSeconds },
-      basis: "server_duration"
+      provider: "ai-gateway",
+      configured: Boolean(settings.vercelAiGatewayApiKey),
+      pricing: tolerantPricing(
+        () => parseRealtimeVoicePricingTableJson(
+          settings.aiGatewayRealtimePricingJson,
+          "OPENGENI_AI_GATEWAY_REALTIME_PRICING_JSON"
+        ),
+        {}
+      )[gateway.upstreamModelId] ?? null
     };
   }
-  throw new TranscriptionServiceError({
-    code: "provider",
-    message: "Transcription usage was not reported."
-  });
+  return null;
 }
-function initiatingHuman(attribution) {
-  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
+var RealtimeVoiceUnavailableError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  name = "RealtimeVoiceUnavailableError";
+};
+function realtimeVoiceOfferProblem(settings, voice) {
+  if (!voice.configured) {
+    return new RealtimeVoiceUnavailableError(
+      "not_configured",
+      "Opengeni live voice is not configured on this deployment."
+    );
+  }
+  if (voiceInputCreditBillingActive(settings) && !voice.pricing) {
+    return new RealtimeVoiceUnavailableError(
+      "pricing_unconfigured",
+      "Opengeni live voice is not available on this deployment yet."
+    );
+  }
+  return null;
 }
-function startOfUtcMonth2() {
-  const now = /* @__PURE__ */ new Date();
+var REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE = "Live voice needs Opengeni credits. Add credits to continue.";
+function voiceCreditStanding(balance) {
+  if (balance.balanceMicros > 0) return "spendable";
+  return (balance.promotionalCredits ?? []).some((grant) => grant.remainingMicros > 0) ? "promotional_only" : "none";
+}
+function voiceInsufficientCreditsMessage(feature, standing) {
+  return standing === "promotional_only" ? `Promotional credits don't cover ${feature.toLowerCase()}. Add credits to use it.` : `${feature} needs Opengeni credits. Add credits to continue.`;
+}
+function startOfUtcMonth2(now) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
 }
-function createVoiceInputBilling(deps) {
-  const reconcileInterval = deps.reconcileIntervalMilliseconds ?? 5 * 6e4;
-  const lastReconciled = /* @__PURE__ */ new Map();
-  const reconcileDue = (key) => {
-    const now = Date.now();
-    const last = lastReconciled.get(key);
-    if (last !== void 0 && now - last < reconcileInterval) return false;
-    if (lastReconciled.size >= 1e4) lastReconciled.clear();
-    lastReconciled.set(key, now);
-    return true;
-  };
-  return {
-    async admit({ accountId, workspaceId, attribution }) {
-      if (!voiceInputCreditBillingActive(deps.settings)) return;
-      if (attribution.kind === "unknown") {
-        throw new TranscriptionServiceError({
-          code: "policy_blocked",
-          status: 403,
-          message: "Voice input payer could not be verified."
-        });
-      }
-      if (reconcileDue(`${accountId}:${workspaceId}`)) {
-        await reconcileUnsettledVoiceInputCharges(deps.db, { accountId, workspaceId }).catch(
-          (error) => {
-            deps.onReconcileError?.(error, { accountId, workspaceId });
-          }
-        );
-      }
-      const balance = await getSpendableCreditBalance3(deps.db, accountId);
-      if (balance.balanceMicros <= 0) {
-        throw new TranscriptionBillingRefusedError({
-          code: "insufficient_credits",
-          message: "Voice input needs Opengeni credits. Add credits to continue."
-        });
-      }
-      const refusal = await checkWorkspaceAllowance3(deps.db, {
-        accountId,
-        workspaceId,
-        subjectId: initiatingHuman(attribution)
+function initiatingHuman(attribution) {
+  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
+}
+function createRealtimeVoiceBilling(deps) {
+  const billingActive = () => voiceInputCreditBillingActive(deps.settings);
+  async function refusal(input) {
+    const balance = await getSpendableCreditBalance3(deps.db, input.accountId, VOICE_CREDIT_USAGE);
+    if (balance.balanceMicros <= 0) {
+      return new TranscriptionBillingRefusedError({
+        code: "insufficient_credits",
+        message: voiceInsufficientCreditsMessage("Live voice", voiceCreditStanding(balance))
+      });
+    }
+    const allowance = await checkWorkspaceAllowance3(deps.db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: initiatingHuman(input.attribution)
+    });
+    if (allowance) {
+      return new TranscriptionBillingRefusedError({
+        code: allowance.code,
+        message: allowance.message,
+        details: {
+          scope: allowance.scope,
+          resetsAt: allowance.resetsAt,
+          ...allowance.subjectId ? { subjectId: allowance.subjectId } : {}
+        }
+      });
+    }
+    if (deps.settings.usageLimitsMode === "static" || deps.settings.usageLimitsMode === "managed") {
+      const cap = configuredStaticUsageLimits2(deps.settings).maxMonthlyCostMicrosPerAccount;
+      if (cap) {
+        const used = await sumUsageQuantity3(deps.db, {
+          accountId: input.accountId,
+          eventType: "model.cost",
+          since: startOfUtcMonth2(input.now)
+        });
+        if (used >= cap) {
+          return new TranscriptionBillingRefusedError({
+            code: "monthly_model_cost_limit",
+            message: "The monthly model cost limit has been reached."
+          });
+        }
+      }
+    }
+    return null;
+  }
+  return {
+    /**
+     * Throws RealtimeVoiceUnavailableError when the deployment cannot offer
+     * the model and TranscriptionBillingRefusedError for a credit refusal.
+     * Workspace-funded models are always admitted here.
+     */
+    async admit(input) {
+      const voice = deploymentRealtimeVoice(deps.settings, input.model);
+      if (!voice) return;
+      const problem = realtimeVoiceOfferProblem(deps.settings, voice);
+      if (problem) throw problem;
+      if (!billingActive()) return;
+      const refused = await refusal({ ...input, now: input.now ?? /* @__PURE__ */ new Date() });
+      if (refused) throw refused;
+    },
+    /** Spendable credits are positive (always true when credits are not enforced). */
+    async hasSpendableCredits(accountId) {
+      return await this.creditStanding(accountId) === "spendable";
+    },
+    /** Credit standing for live voice ("spendable" when credits are not enforced). */
+    async creditStanding(accountId) {
+      if (!billingActive()) return "spendable";
+      return voiceCreditStanding(
+        await getSpendableCreditBalance3(deps.db, accountId, VOICE_CREDIT_USAGE)
+      );
+    },
+    /**
+     * Settle every started minute observed so far for one live-voice mode and
+     * report whether the call must stop. Safe to call repeatedly and
+     * concurrently: receipts and debits are idempotent per (connection, minute).
+     */
+    async settle(input) {
+      const now = input.now ?? /* @__PURE__ */ new Date();
+      if (!billingActive()) return { debitedMicros: 0, stop: null };
+      const facts = await loadSessionRealtimeBillingFacts(deps.db, { ...input, now });
+      if (!facts) return { debitedMicros: 0, stop: null };
+      const voice = deploymentRealtimeVoice(deps.settings, facts.model);
+      if (!voice) return { debitedMicros: 0, stop: null };
+      if (!voice.pricing) {
+        return {
+          debitedMicros: 0,
+          stop: new RealtimeVoiceUnavailableError(
+            "pricing_unconfigured",
+            "Opengeni live voice is no longer available on this deployment."
+          )
+        };
+      }
+      const attribution = input.callerSubjectId === facts.ownerSubjectId ? input.attribution : { kind: "unknown" };
+      const cost = realtimeVoiceMinuteCreditMicros(voice.pricing);
+      const minutes = facts.connections.flatMap(
+        (connection) => Array.from(
+          { length: realtimeVoiceStartedMinutes(connection.startedAt, connection.observedUntil) },
+          (_, index) => ({
+            connectionId: connection.id,
+            minute: index + 1,
+            startsAt: new Date(connection.startedAt.getTime() + index * 6e4),
+            key: `voice.realtime_cost:${connection.id}:${index + 1}`
+          })
+        )
+      );
+      const recorded = await existingUsageEventIdempotencyKeys(deps.db, {
+        accountId: facts.accountId,
+        workspaceId: facts.workspaceId,
+        keys: minutes.map((minute) => minute.key)
+      });
+      let debitedMicros = 0;
+      for (const minute of minutes) {
+        if (recorded.has(minute.key)) continue;
+        debitedMicros += await withRlsContext(
+          deps.db,
+          { accountId: facts.accountId, workspaceId: facts.workspaceId },
+          async (tx) => {
+            const sourceId = `${minute.connectionId}:${minute.minute}`;
+            const receipt2 = await recordUsageEvent3(tx, {
+              accountId: facts.accountId,
+              workspaceId: facts.workspaceId,
+              sessionId: facts.sessionId,
+              eventType: "model.cost",
+              quantity: cost.creditCostMicros,
+              unit: "usd_micros",
+              sourceResourceType: REALTIME_VOICE_SOURCE_TYPE,
+              sourceResourceId: sourceId,
+              idempotencyKey: minute.key,
+              occurredAt: minute.startsAt,
+              initiator: { kind: "service", subjectId: "api:voice-realtime" },
+              initiatorContext: { creditDebitAttribution: attribution }
+            });
+            const amount = Number(receipt2.quantity);
+            if (amount <= 0) return 0;
+            const debit = await applyCreditDebitAfterUse2(tx, {
+              accountId: facts.accountId,
+              workspaceId: facts.workspaceId,
+              type: REALTIME_VOICE_DEBIT_TYPE,
+              amountMicros: amount,
+              sourceType: REALTIME_VOICE_SOURCE_TYPE,
+              sourceId,
+              idempotencyKey: `credit:${REALTIME_VOICE_DEBIT_TYPE}:${sourceId}`,
+              occurredAt: minute.startsAt,
+              usage: VOICE_CREDIT_USAGE,
+              metadata: {
+                provider: voice.provider,
+                model: facts.model,
+                realtimeId: facts.realtimeId,
+                connectionId: minute.connectionId,
+                minute: minute.minute,
+                basis: "server_observed_started_minute",
+                providerCostMicros: cost.providerCostMicros,
+                ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata(attribution)
+              }
+            });
+            return debit.debitedMicros;
+          }
+        );
+      }
+      const stop = facts.state === "active" ? await refusal({
+        accountId: facts.accountId,
+        workspaceId: facts.workspaceId,
+        attribution,
+        now
+      }) : null;
+      return { debitedMicros, stop };
+    }
+  };
+}
+
+// src/domain/voice-input-billing.ts
+var VOICE_INPUT_DEBIT_TYPE = VOICE_TRANSCRIPTION_DEBIT_TYPE;
+var VOICE_INPUT_SOURCE_TYPE = VOICE_TRANSCRIPTION_SOURCE_TYPE;
+function voiceInputBillableUsage(input) {
+  if (input.usage?.kind === "tokens" && voiceInputPricingHasTokenRates(input.pricing)) {
+    return { usage: input.usage, basis: "provider_tokens" };
+  }
+  if (input.usage?.kind === "duration") {
+    return { usage: input.usage, basis: "provider_duration" };
+  }
+  if (input.trustedDurationSeconds !== void 0 && Number.isFinite(input.trustedDurationSeconds) && input.trustedDurationSeconds >= 0) {
+    return {
+      usage: { kind: "duration", seconds: input.trustedDurationSeconds },
+      basis: "server_duration"
+    };
+  }
+  throw new TranscriptionServiceError({
+    code: "provider",
+    message: "Transcription usage was not reported."
+  });
+}
+function initiatingHuman2(attribution) {
+  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
+}
+function startOfUtcMonth3() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+function createVoiceInputBilling(deps) {
+  const reconcileInterval = deps.reconcileIntervalMilliseconds ?? 5 * 6e4;
+  const lastReconciled = /* @__PURE__ */ new Map();
+  const reconcileDue = (key) => {
+    const now = Date.now();
+    const last = lastReconciled.get(key);
+    if (last !== void 0 && now - last < reconcileInterval) return false;
+    if (lastReconciled.size >= 1e4) lastReconciled.clear();
+    lastReconciled.set(key, now);
+    return true;
+  };
+  return {
+    async admit({ accountId, workspaceId, attribution }) {
+      if (!voiceInputCreditBillingActive2(deps.settings)) return;
+      if (attribution.kind === "unknown") {
+        throw new TranscriptionServiceError({
+          code: "policy_blocked",
+          status: 403,
+          message: "Voice input payer could not be verified."
+        });
+      }
+      if (reconcileDue(`${accountId}:${workspaceId}`)) {
+        await reconcileUnsettledVoiceInputCharges(deps.db, { accountId, workspaceId }).catch(
+          (error) => {
+            deps.onReconcileError?.(error, { accountId, workspaceId });
+          }
+        );
+      }
+      const balance = await getSpendableCreditBalance4(deps.db, accountId, VOICE_CREDIT_USAGE2);
+      if (balance.balanceMicros <= 0) {
+        throw new TranscriptionBillingRefusedError({
+          code: "insufficient_credits",
+          message: voiceInsufficientCreditsMessage("Voice input", voiceCreditStanding(balance))
+        });
+      }
+      const refusal = await checkWorkspaceAllowance4(deps.db, {
+        accountId,
+        workspaceId,
+        subjectId: initiatingHuman2(attribution)
       });
       if (refusal) {
         throw new TranscriptionBillingRefusedError({
@@ -12844,12 +13126,12 @@ function createVoiceInputBilling(deps) {
         });
       }
       if (deps.settings.usageLimitsMode === "static" || deps.settings.usageLimitsMode === "managed") {
-        const cap = configuredStaticUsageLimits2(deps.settings).maxMonthlyCostMicrosPerAccount;
+        const cap = configuredStaticUsageLimits3(deps.settings).maxMonthlyCostMicrosPerAccount;
         if (cap) {
-          const used = await sumUsageQuantity3(deps.db, {
+          const used = await sumUsageQuantity4(deps.db, {
             accountId,
             eventType: "model.cost",
-            since: startOfUtcMonth2()
+            since: startOfUtcMonth3()
           });
           if (used >= cap) {
             throw new TranscriptionBillingRefusedError({
@@ -12861,7 +13143,7 @@ function createVoiceInputBilling(deps) {
       }
     },
     async settle(input) {
-      if (!voiceInputCreditBillingActive(deps.settings)) return { creditCostMicros: 0 };
+      if (!voiceInputCreditBillingActive2(deps.settings)) return { creditCostMicros: 0 };
       const { usage, basis } = voiceInputBillableUsage({
         pricing: input.pricing,
         usage: input.usage,
@@ -12888,7 +13170,7 @@ async function settleVoiceInputUsage(db, input) {
     workspaceId: input.workspaceId,
     sourceId: input.billing.sourceId
   });
-  const receipt2 = await recordUsageEvent3(db, {
+  const receipt2 = await recordUsageEvent4(db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     eventType: "model.cost",
@@ -12903,7 +13185,7 @@ async function settleVoiceInputUsage(db, input) {
   });
   const amount = Number(receipt2.quantity);
   if (amount > 0) {
-    await applyCreditDebitAfterUse2(db, {
+    await applyCreditDebitAfterUse3(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       type: VOICE_TRANSCRIPTION_DEBIT_TYPE,
@@ -12911,6 +13193,7 @@ async function settleVoiceInputUsage(db, input) {
       sourceType: VOICE_TRANSCRIPTION_SOURCE_TYPE,
       sourceId: input.billing.sourceId,
       idempotencyKey: keys.debitIdempotencyKey,
+      usage: VOICE_CREDIT_USAGE2,
       metadata: {
         providerId: input.providerId,
         model: input.model,
@@ -12922,7 +13205,7 @@ async function settleVoiceInputUsage(db, input) {
           textInputTokens: input.usage.textInputTokens,
           outputTokens: input.usage.outputTokens
         } : { audioMilliseconds: Math.ceil(input.usage.seconds * 1e3) },
-        ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata(attribution)
+        ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata2(attribution)
       }
     });
   }
@@ -12935,7 +13218,7 @@ async function reconcileUnsettledVoiceInputCharges(db, input) {
     ...input.minAgeMilliseconds !== void 0 ? { minAgeMilliseconds: input.minAgeMilliseconds } : {}
   });
   for (const charge of pending) {
-    await applyCreditDebitAfterUse2(db, {
+    await applyCreditDebitAfterUse3(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       type: VOICE_TRANSCRIPTION_DEBIT_TYPE,
@@ -12946,9 +13229,10 @@ async function reconcileUnsettledVoiceInputCharges(db, input) {
         workspaceId: input.workspaceId,
         sourceId: charge.sourceId
       }).debitIdempotencyKey,
+      usage: VOICE_CREDIT_USAGE2,
       metadata: {
         basis: "reconciled_receipt",
-        ...charge.attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata(charge.attribution)
+        ...charge.attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata2(charge.attribution)
       }
     });
   }
@@ -12957,13 +13241,13 @@ async function reconcileUnsettledVoiceInputCharges(db, input) {
 
 // src/domain/web-search-billing.ts
 import {
-  applyCreditDebitAfterUse as applyCreditDebitAfterUse3,
-  checkWorkspaceAllowance as checkWorkspaceAllowance4,
+  applyCreditDebitAfterUse as applyCreditDebitAfterUse4,
+  checkWorkspaceAllowance as checkWorkspaceAllowance5,
   creditDebitAttributionForTurn as creditDebitAttributionForTurn2,
-  creditDebitAttributionMetadata as creditDebitAttributionMetadata2,
-  getSpendableCreditBalance as getSpendableCreditBalance4,
-  recordUsageEvent as recordUsageEvent4,
-  withRlsContext
+  creditDebitAttributionMetadata as creditDebitAttributionMetadata3,
+  getSpendableCreditBalance as getSpendableCreditBalance5,
+  recordUsageEvent as recordUsageEvent5,
+  withRlsContext as withRlsContext2
 } from "@opengeni/db";
 var WEB_SEARCH_DEBIT_TYPE = "web_search_debit";
 var WEB_SEARCH_SOURCE_TYPE = "web_search";
@@ -12995,14 +13279,14 @@ function createWebSearchBilling(deps) {
     async admit(scope, expectedProviderMicros) {
       if (!active || expectedProviderMicros <= 0) return;
       const attribution = await attributionFor(scope);
-      const balance = await getSpendableCreditBalance4(deps.db, scope.accountId);
+      const balance = await getSpendableCreditBalance5(deps.db, scope.accountId);
       if (balance.balanceMicros <= 0) {
         throw new WebSearchBillingRefusedError(
           "insufficient_credits",
           "Web search needs Opengeni credits, and this account has none left."
         );
       }
-      const refusal = await checkWorkspaceAllowance4(deps.db, {
+      const refusal = await checkWorkspaceAllowance5(deps.db, {
         accountId: scope.accountId,
         workspaceId: scope.workspaceId,
         subjectId: attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null
@@ -13019,7 +13303,7 @@ function createWebSearchBilling(deps) {
         sourceResourceType: WEB_SEARCH_SOURCE_TYPE,
         sourceResourceId: `${scope.attemptId}:${cost.operationId}`
       };
-      await recordUsageEvent4(deps.db, {
+      await recordUsageEvent5(deps.db, {
         ...shared,
         eventType: `web_search.${cost.operation}_requests`,
         quantity: 1,
@@ -13028,11 +13312,11 @@ function createWebSearchBilling(deps) {
       });
       if (!active || cost.creditMicros <= 0) return;
       const attribution = await attributionFor(scope);
-      await withRlsContext(
+      await withRlsContext2(
         deps.db,
         { accountId: scope.accountId, workspaceId: scope.workspaceId },
         async (tx) => {
-          await recordUsageEvent4(tx, {
+          await recordUsageEvent5(tx, {
             ...shared,
             eventType: "web_search.cost",
             quantity: cost.creditMicros,
@@ -13041,7 +13325,7 @@ function createWebSearchBilling(deps) {
             initiator: { kind: "service", subjectId: WEB_SEARCH_BILLING_INITIATOR },
             initiatorContext: { creditDebitAttribution: attribution }
           });
-          await applyCreditDebitAfterUse3(tx, {
+          await applyCreditDebitAfterUse4(tx, {
             accountId: scope.accountId,
             workspaceId: scope.workspaceId,
             type: WEB_SEARCH_DEBIT_TYPE,
@@ -13052,7 +13336,7 @@ function createWebSearchBilling(deps) {
             metadata: {
               // turnId lets the allowance trigger resolve the causal human
               // from the immutable turn receipt.
-              ...creditDebitAttributionMetadata2(attribution),
+              ...creditDebitAttributionMetadata3(attribution),
               provider: cost.provider,
               operation: cost.operation,
               providerCostMicros: cost.providerMicros,
@@ -13066,241 +13350,6 @@ function createWebSearchBilling(deps) {
   };
 }
 
-// src/domain/realtime-voice-billing.ts
-import {
-  AI_GATEWAY_REALTIME_MODELS,
-  AZURE_LIVE_REALTIME_MODEL_ID,
-  configuredStaticUsageLimits as configuredStaticUsageLimits3,
-  parseRealtimeVoicePricingJson,
-  parseRealtimeVoicePricingTableJson,
-  realtimeVoiceMinuteCreditMicros,
-  realtimeVoiceStartedMinutes,
-  voiceInputCreditBillingActive as voiceInputCreditBillingActive2
-} from "@opengeni/config";
-import {
-  applyCreditDebitAfterUse as applyCreditDebitAfterUse4,
-  checkWorkspaceAllowance as checkWorkspaceAllowance5,
-  creditDebitAttributionMetadata as creditDebitAttributionMetadata3,
-  existingUsageEventIdempotencyKeys,
-  getSpendableCreditBalance as getSpendableCreditBalance5,
-  loadSessionRealtimeBillingFacts,
-  recordUsageEvent as recordUsageEvent5,
-  sumUsageQuantity as sumUsageQuantity4,
-  withRlsContext as withRlsContext2
-} from "@opengeni/db";
-var REALTIME_VOICE_DEBIT_TYPE = "voice_realtime_debit";
-var REALTIME_VOICE_SOURCE_TYPE = "voice_realtime";
-function deploymentRealtimeVoice(settings, model) {
-  const azureConfigured = Boolean(settings.azureLiveEndpoint && settings.azureLiveApiKey?.trim());
-  if (model === AZURE_LIVE_REALTIME_MODEL_ID) {
-    return {
-      provider: "azure-live",
-      configured: azureConfigured,
-      pricing: parseRealtimeVoicePricingJson(settings.azureLivePricingJson)
-    };
-  }
-  for (const gateway of Object.values(AI_GATEWAY_REALTIME_MODELS)) {
-    if (gateway.managedModelId !== model) continue;
-    return {
-      provider: "ai-gateway",
-      configured: Boolean(settings.vercelAiGatewayApiKey),
-      pricing: parseRealtimeVoicePricingTableJson(settings.aiGatewayRealtimePricingJson)[gateway.upstreamModelId] ?? null
-    };
-  }
-  return null;
-}
-var RealtimeVoiceUnavailableError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-  name = "RealtimeVoiceUnavailableError";
-};
-function realtimeVoiceOfferProblem(settings, voice) {
-  if (!voice.configured) {
-    return new RealtimeVoiceUnavailableError(
-      "not_configured",
-      "Opengeni live voice is not configured on this deployment."
-    );
-  }
-  if (voiceInputCreditBillingActive2(settings) && !voice.pricing) {
-    return new RealtimeVoiceUnavailableError(
-      "pricing_unconfigured",
-      "Opengeni live voice is not available on this deployment yet."
-    );
-  }
-  return null;
-}
-var REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE = "Live voice needs Opengeni credits. Add credits to continue.";
-function startOfUtcMonth3(now) {
-  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
-}
-function initiatingHuman2(attribution) {
-  return attribution.kind === "human" || attribution.kind === "turn" ? attribution.initiatingHumanSubjectId : null;
-}
-function createRealtimeVoiceBilling(deps) {
-  const billingActive = () => voiceInputCreditBillingActive2(deps.settings);
-  async function refusal(input) {
-    const balance = await getSpendableCreditBalance5(deps.db, input.accountId);
-    if (balance.balanceMicros <= 0) {
-      return new TranscriptionBillingRefusedError({
-        code: "insufficient_credits",
-        message: REALTIME_VOICE_INSUFFICIENT_CREDITS_MESSAGE
-      });
-    }
-    const allowance = await checkWorkspaceAllowance5(deps.db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      subjectId: initiatingHuman2(input.attribution)
-    });
-    if (allowance) {
-      return new TranscriptionBillingRefusedError({
-        code: allowance.code,
-        message: allowance.message,
-        details: {
-          scope: allowance.scope,
-          resetsAt: allowance.resetsAt,
-          ...allowance.subjectId ? { subjectId: allowance.subjectId } : {}
-        }
-      });
-    }
-    if (deps.settings.usageLimitsMode === "static" || deps.settings.usageLimitsMode === "managed") {
-      const cap = configuredStaticUsageLimits3(deps.settings).maxMonthlyCostMicrosPerAccount;
-      if (cap) {
-        const used = await sumUsageQuantity4(deps.db, {
-          accountId: input.accountId,
-          eventType: "model.cost",
-          since: startOfUtcMonth3(input.now)
-        });
-        if (used >= cap) {
-          return new TranscriptionBillingRefusedError({
-            code: "monthly_model_cost_limit",
-            message: "The monthly model cost limit has been reached."
-          });
-        }
-      }
-    }
-    return null;
-  }
-  return {
-    /**
-     * Throws RealtimeVoiceUnavailableError when the deployment cannot offer
-     * the model and TranscriptionBillingRefusedError for a credit refusal.
-     * Workspace-funded models are always admitted here.
-     */
-    async admit(input) {
-      const voice = deploymentRealtimeVoice(deps.settings, input.model);
-      if (!voice) return;
-      const problem = realtimeVoiceOfferProblem(deps.settings, voice);
-      if (problem) throw problem;
-      if (!billingActive()) return;
-      const refused = await refusal({ ...input, now: input.now ?? /* @__PURE__ */ new Date() });
-      if (refused) throw refused;
-    },
-    /** Spendable credits are positive (always true when credits are not enforced). */
-    async hasSpendableCredits(accountId) {
-      if (!billingActive()) return true;
-      const balance = await getSpendableCreditBalance5(deps.db, accountId);
-      return balance.balanceMicros > 0;
-    },
-    /**
-     * Settle every started minute observed so far for one live-voice mode and
-     * report whether the call must stop. Safe to call repeatedly and
-     * concurrently: receipts and debits are idempotent per (connection, minute).
-     */
-    async settle(input) {
-      const now = input.now ?? /* @__PURE__ */ new Date();
-      if (!billingActive()) return { debitedMicros: 0, stop: null };
-      const facts = await loadSessionRealtimeBillingFacts(deps.db, { ...input, now });
-      if (!facts) return { debitedMicros: 0, stop: null };
-      const voice = deploymentRealtimeVoice(deps.settings, facts.model);
-      if (!voice) return { debitedMicros: 0, stop: null };
-      if (!voice.pricing) {
-        return {
-          debitedMicros: 0,
-          stop: new RealtimeVoiceUnavailableError(
-            "pricing_unconfigured",
-            "Opengeni live voice is no longer available on this deployment."
-          )
-        };
-      }
-      const attribution = input.callerSubjectId === facts.ownerSubjectId ? input.attribution : { kind: "unknown" };
-      const cost = realtimeVoiceMinuteCreditMicros(voice.pricing);
-      const minutes = facts.connections.flatMap(
-        (connection) => Array.from(
-          { length: realtimeVoiceStartedMinutes(connection.startedAt, connection.observedUntil) },
-          (_, index) => ({
-            connectionId: connection.id,
-            minute: index + 1,
-            startsAt: new Date(connection.startedAt.getTime() + index * 6e4),
-            key: `voice.realtime_cost:${connection.id}:${index + 1}`
-          })
-        )
-      );
-      const recorded = await existingUsageEventIdempotencyKeys(deps.db, {
-        accountId: facts.accountId,
-        workspaceId: facts.workspaceId,
-        keys: minutes.map((minute) => minute.key)
-      });
-      let debitedMicros = 0;
-      for (const minute of minutes) {
-        if (recorded.has(minute.key)) continue;
-        debitedMicros += await withRlsContext2(
-          deps.db,
-          { accountId: facts.accountId, workspaceId: facts.workspaceId },
-          async (tx) => {
-            const sourceId = `${minute.connectionId}:${minute.minute}`;
-            const receipt2 = await recordUsageEvent5(tx, {
-              accountId: facts.accountId,
-              workspaceId: facts.workspaceId,
-              sessionId: facts.sessionId,
-              eventType: "model.cost",
-              quantity: cost.creditCostMicros,
-              unit: "usd_micros",
-              sourceResourceType: REALTIME_VOICE_SOURCE_TYPE,
-              sourceResourceId: sourceId,
-              idempotencyKey: minute.key,
-              occurredAt: minute.startsAt,
-              initiator: { kind: "service", subjectId: "api:voice-realtime" },
-              initiatorContext: { creditDebitAttribution: attribution }
-            });
-            const amount = Number(receipt2.quantity);
-            if (amount <= 0) return 0;
-            const debit = await applyCreditDebitAfterUse4(tx, {
-              accountId: facts.accountId,
-              workspaceId: facts.workspaceId,
-              type: REALTIME_VOICE_DEBIT_TYPE,
-              amountMicros: amount,
-              sourceType: REALTIME_VOICE_SOURCE_TYPE,
-              sourceId,
-              idempotencyKey: `credit:${REALTIME_VOICE_DEBIT_TYPE}:${sourceId}`,
-              occurredAt: minute.startsAt,
-              metadata: {
-                provider: voice.provider,
-                model: facts.model,
-                realtimeId: facts.realtimeId,
-                connectionId: minute.connectionId,
-                minute: minute.minute,
-                basis: "server_observed_started_minute",
-                providerCostMicros: cost.providerCostMicros,
-                ...attribution.kind === "unknown" ? {} : creditDebitAttributionMetadata3(attribution)
-              }
-            });
-            return debit.debitedMicros;
-          }
-        );
-      }
-      const stop = facts.state === "active" ? await refusal({
-        accountId: facts.accountId,
-        workspaceId: facts.workspaceId,
-        attribution,
-        now
-      }) : null;
-      return { debitedMicros, stop };
-    }
-  };
-}
-
 // src/workflow-wake-contract.ts
 var SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID = "opengeni-session-workflow-wake-dispatcher";
 var SESSION_WORKFLOW_WAKE_DISPATCHER_WORKFLOW_TYPE = "sessionWorkflowWakeDispatcherWorkflow";
@@ -23243,6 +23292,7 @@ export {
   appendRigSetupCommand,
   applyCapabilityEnablement,
   applyGitHubRepositoryBindings,
+  applyOperatorOAuthClientRequirement,
   applySessionAgentConfigWriteThrough,
   approveSkill,
   assertAllowedEnvironmentVariableName,
@@ -23759,7 +23809,9 @@ export {
   videoGenerationProviderIdempotencyKey,
   videoGenerationRequestDigest,
   visibleMcpAccountConnections,
+  voiceCreditStanding,
   voiceInputBillableUsage,
+  voiceInsufficientCreditsMessage,
   webSearchCreditBillingActive,
   withAgentConfigHttpErrors,
   withDefaultEnabledCapabilityMcpTools,